lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 13 Jun 2017 22:13:16 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Will Hawkins <whh8b@...ginia.edu>
Cc:     LKML <linux-kernel@...r.kernel.org>
Subject: Re: Ftrace vs perf user page fault statistics differences

On Tue, 13 Jun 2017 21:27:20 -0400
Will Hawkins <whh8b@...ginia.edu> wrote:

> But, while I have your ear, I was wondering if you could direct me to
> where the page_fault_user gathers its information (when tracing) and
> where that information is formatted for printing (in trace-cmd). I'd
> really like to investigate modifying that code so that it provides
> "better" information than
> 
> address=__per_cpu_end ip=__per_cpu_end
> 
> Now that I'm into this, I want to really dig in. If you can give me a
> pointer, that would really help me get started. After that I can
> attempt to make some patches and see where it leads.
> 
> For the x86 architecture, the relevant files seem to be
> 
> mm/fault.c (with the trace_page_fault_entries function)
> 
> and
> 
> include/asm/trace/exceptions.h (where the exception class is built)

Correct.

> 
> What seems odd there is that the exception *should* be responding with
> "better" information -- address is set to the value of the cr2
> register which should contain the address of the faulting instruction.
> Perhaps I just don't understand what the symbol __per_cpu_end means.
> 
> Any information you can shed on this would be really great.

hmm, actually that looks to be translating the ip address into
functions. It shouldn't be doing that, and it doesn't do it for me with
the latest kernel and trace-cmd.

What does it give you in trace-cmd report -R ? The -R will not parse
the printk-fmt of the event format files, and just show raw numbers.

Can you give me the contents of:

 cat /sys/kernel/debug/tracing/exceptions/page_fault_user/format

?

That's how trace-cmd parses it.



> 
> Thanks again for your patience with me! I think that I now understand
> what is going on.


No problem, it's good to be curious.

-- Steve

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ