linux-kernel - Re: Ftrace vs perf user page fault statistics differences

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170613221316.64d46ea5@gandalf.local.home>
Date:   Tue, 13 Jun 2017 22:13:16 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Will Hawkins <whh8b@...ginia.edu>
Cc:     LKML <linux-kernel@...r.kernel.org>
Subject: Re: Ftrace vs perf user page fault statistics differences

On Tue, 13 Jun 2017 21:27:20 -0400
Will Hawkins <whh8b@...ginia.edu> wrote:

> But, while I have your ear, I was wondering if you could direct me to
> where the page_fault_user gathers its information (when tracing) and
> where that information is formatted for printing (in trace-cmd). I'd
> really like to investigate modifying that code so that it provides
> "better" information than
> 
> address=__per_cpu_end ip=__per_cpu_end
> 
> Now that I'm into this, I want to really dig in. If you can give me a
> pointer, that would really help me get started. After that I can
> attempt to make some patches and see where it leads.
> 
> For the x86 architecture, the relevant files seem to be
> 
> mm/fault.c (with the trace_page_fault_entries function)
> 
> and
> 
> include/asm/trace/exceptions.h (where the exception class is built)

Correct.

> 
> What seems odd there is that the exception *should* be responding with
> "better" information -- address is set to the value of the cr2
> register which should contain the address of the faulting instruction.
> Perhaps I just don't understand what the symbol __per_cpu_end means.
> 
> Any information you can shed on this would be really great.

hmm, actually that looks to be translating the ip address into
functions. It shouldn't be doing that, and it doesn't do it for me with
the latest kernel and trace-cmd.

What does it give you in trace-cmd report -R ? The -R will not parse
the printk-fmt of the event format files, and just show raw numbers.

Can you give me the contents of:

 cat /sys/kernel/debug/tracing/exceptions/page_fault_user/format

?

That's how trace-cmd parses it.



> 
> Thanks again for your patience with me! I think that I now understand
> what is going on.


No problem, it's good to be curious.

-- Steve