linux-kernel - Re: [PATCH] trace-cmd: add helper to read kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 24 Sep 2014 12:49:48 -0400
From:	Josef Bacik <jbacik@...com>
To:	Steven Rostedt <rostedt@...dmis.org>
CC:	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] trace-cmd: add helper to read kernel_stack functions

On 09/24/2014 12:12 PM, Steven Rostedt wrote:
> On Wed, 24 Sep 2014 12:03:29 -0400
> Josef Bacik <jbacik@...com> wrote:
>
>> The way the ftrace kernel_stack event is handled doesn't work right with the
>> normal event reading stuff in python.  The raw buffer read stuff expects the
>> size of the event to be non-zero, but in the case of kernel_stack the caller
>> array is 0 and we are given a size field
>>
>> 	field:int size;	offset:8;	size:4;	signed:1;
>> 	field:unsigned long caller;	offset:16;	size:0;	signed:0;
>>
>> This screws up python becuase it uses the size field to indicate how much of the
>> memory buffer is there to read, which in this case is 0.  This makes it
>> impossible to actually read the caller array from python.  So add a new c
>> binding to specially read the addr array and go ahead and look up the function
>> names for the addr and return those strings.  With this I can now pull the
>> function names for a kernel_stack event from the python library.  Thanks,
>
> No need to add "Thanks" to a change log ;-)

git log --author="Josef Bacik" --author="Josef Whiter" \
	| grep "Thanks," | wc -l
540
git log --author="Josef Bacik" --author="Josef Whiter" --oneline \
	| wc -l
688

Old habits ;).

>
> Will this still work if we convert the kernel_stack to be the same as
> the other dynamic_arrays?
>
> I'm assuming so, as there doesn't seem to be anything here that looks
> specific to the kernel_stack event, and we wouldn't want to break the
> other events.
>
> I just want to make sure you are testing both formats.
>

It should work which is why I went ahead and sent it, but I'm fixing to 
do the kernel side now and I'll test with that and if it doesn't work 
I'll send a v2.  Thanks,

Josef

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/