linux-kernel - perf probe and structs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 12 Jun 2015 16:27:16 -0300
From:	Arnaldo Carvalho de Melo <acme@...nel.org>
To:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Alexei Starovoitov <ast@...mgrid.com>
Cc:	David Ahern <dsahern@...il.com>, Jiri Olsa <jolsa@...hat.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Ingo Molnar <mingo@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: perf probe and structs

Hi Masami,

	I tried somethig with perf probe today, namely to ask for a
variable that is a struct perf_event_attr to be collected after
the perf_event_open syscall copies it from userspace, and got this
message:

[root@zoo ~]# perf probe SYSC_perf_event_open:23 args
Failed to find 'args' in this function.
  Error: Failed to add events.
[root@zoo ~]#

Ok, I guess it should be instead:

[root@zoo ~]# perf probe SYSC_perf_event_open:23 args
The 'args' variable is a struct, this is not supported yet.
  Error: Failed to add events.
[root@zoo ~]#

:-)

That said, can't we just go ahead and collect sizeof(args) into the
buffer and let userspace cast the result to the right type, etc, i.e.
kinda like what is done now for a string.

Alexei, is this already possible with eBPF?

This is all in the context of:

  [root@zoo ~]# perf trace -e perf_event_open &
  [1] 20775
  [root@zoo ~]# perf stat -e cycles usleep 1
    7304.425 ( 0.519 ms): perf/20776 perf_event_open(attr_uptr: 0x222b220, pid: 20777, cpu: -1, group_fd: -1, flags: FD_CLOEXEC) = 3

   Performance counter stats for 'usleep 1':

         2,024,026      cycles                                                      

       0.005277428 seconds time elapsed

  [root@zoo ~]#

I want to decode that attr_uptr thing :-)

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/