linux-kernel - Re: [PATCH v3 net-next 2/5] net: tracepoint: replace tcp_set_state tracepoint with inet_sock_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 3 Jan 2018 09:48:55 +0800
From:   Yafang Shao <laoar.shao@...il.com>
To:     Brendan Gregg <brendan.d.gregg@...il.com>
Cc:     Song Liu <songliubraving@...com>,
        "David S. Miller" <davem@...emloft.net>,
        Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
        Steven Rostedt <rostedt@...dmis.org>,
        Brendan Gregg <bgregg@...flix.com>, netdev@...r.kernel.org,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v3 net-next 2/5] net: tracepoint: replace tcp_set_state
 tracepoint with inet_sock_set_state tracepoint

On Wed, Jan 3, 2018 at 3:46 AM, Brendan Gregg <brendan.d.gregg@...il.com> wrote:
> On Sat, Dec 30, 2017 at 7:06 PM, Yafang Shao <laoar.shao@...il.com> wrote:
>> On Sun, Dec 31, 2017 at 6:33 AM, Brendan Gregg
>> <brendan.d.gregg@...il.com> wrote:
>>> On Tue, Dec 19, 2017 at 7:12 PM, Yafang Shao <laoar.shao@...il.com> wrote:
>>>> As sk_state is a common field for struct sock, so the state
>>>> transition tracepoint should not be a TCP specific feature.
>>>> Currently it traces all AF_INET state transition, so I rename this
>>>> tracepoint to inet_sock_set_state tracepoint with some minor changes and move it
>>>> into trace/events/sock.h.
>>>
>>> The tcp:tcp_set_state probe is tcp_set_state(), so it's only going to
>>> fire for TCP sessions. It's not broken, and we could add a
>>> sctp:sctp_set_state as well. Replacing tcp:tcp_set_state with
>>> inet_sk_set_state is feeling like we might be baking too much
>>> implementation detail into the tracepoint API.
>>>
>>> If we must have inet_sk_set_state, then must we also delete tcp:tcp_set_state?
>>>
>>
>> Hi Brendan,
>>
>> The reason we have to make this change could be got from this mail
>> thread, https://patchwork.kernel.org/patch/10099243/ .
>>
>> The original tcp:tcp_set_state probe doesn't traced all TCP state transitions.
>> There're some state transitions in inet_connection_sock.c and
>> inet_hashtables.c are missed.
>> So we have to place this probe into these two files to fix the issue.
>> But as inet_connection_sock.c and inet_hashtables.c are common files
>> for all IPv4 protocols, not only for TCP, so it is not proper to place
>> a tcp_ function in these two files.
>> That's why we decide to rename tcp:tcp_set_state probe to
>> sock:inet_sock_set_state.
>
> It kinda feels like we are fixing one exposing-implementation problem
> (the missing state changes, which I'm happy to see fixed), by exposing
> another (there's no tcp:tcp_set_state because we don't want to put tcp
> functions in inet*.c files). Anyway...
>
> If I'm to use sock:inet_sock_set_state for TCP tracing, I'd like
> sk->sk_protocol exposed as a tracepoint argument so I can match on
> IPPROTO_TCP. Otherwise I'll have to keep digging it out of (void
> *)skaddr. (And if we're adding arguments, maybe consider sk_family as
> well, to make it easier to see which address arguments to use).
>

I will improve it as your suggestion.

Thanks
Yafang