linux-kernel - Re: [PATCH 11/20 v2] tracing: Add symbol type to function based events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20180210000337.c2efb5438d281892e83caaba@kernel.org>
Date:   Sat, 10 Feb 2018 00:03:37 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Jiri Olsa <jolsa@...hat.com>
Cc:     Steven Rostedt <rostedt@...dmis.org>, linux-kernel@...r.kernel.org,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Peter Zijlstra <peterz@...radead.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Tom Zanussi <tom.zanussi@...ux.intel.com>,
        linux-rt-users@...r.kernel.org, linux-trace-users@...r.kernel.org,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Clark Williams <williams@...hat.com>,
        Daniel Bristot de Oliveira <bristot@...hat.com>,
        Juri Lelli <juri.lelli@...hat.com>
Subject: Re: [PATCH 11/20 v2] tracing: Add symbol type to function based
 events

On Thu, 8 Feb 2018 12:20:31 +0100
Jiri Olsa <jolsa@...hat.com> wrote:

> On Wed, Feb 07, 2018 at 03:24:13PM -0500, Steven Rostedt wrote:
> > From: "Steven Rostedt (VMware)" <rostedt@...dmis.org>
> > 
> > Add a special type "symbol" that will use %pS to display the field of a
> > function based event.
> > 
> > Signed-off-by: Steven Rostedt (VMware) <rostedt@...dmis.org>
> > ---
> >  Documentation/trace/function-based-events.rst | 26 +++++++++++++++++++++++++-
> >  kernel/trace/trace_event_ftrace.c             | 13 ++++++++++---
> >  2 files changed, 35 insertions(+), 4 deletions(-)
> > 
> > diff --git a/Documentation/trace/function-based-events.rst b/Documentation/trace/function-based-events.rst
> > index bdb28f433bfb..f18c8f3ef330 100644
> > --- a/Documentation/trace/function-based-events.rst
> > +++ b/Documentation/trace/function-based-events.rst
> > @@ -98,7 +98,8 @@ as follows:
> >   ATOM := 'u8' | 'u16' | 'u32' | 'u64' |
> >           's8' | 's16' | 's32' | 's64' |
> >           'x8' | 'x16' | 'x32' | 'x64' |
> > -         'char' | 'short' | 'int' | 'long' | 'size_t'
> > +         'char' | 'short' | 'int' | 'long' | 'size_t' |
> > +	 'symbol'
> >  
> >   FIELD := <name> | <name> INDEX | <name> OFFSET | <name> OFFSET INDEX
> >  
> > @@ -243,3 +244,26 @@ The above will take the parameter value, add it by 4, then index it by two
> >  8 byte words. It's the same in C as: (u64 *)((void *)param + 4)[2]
> >  
> >   Note: "int skb[32]" is the same as "int skb+4[31]".
> > +
> > +
> > +Symbols (function names)
> > +========================
> > +
> > +To display kallsyms "%pS" type of output, use the special type "symbol".
> > +
> > +Again, using gdb to find the offset of the "func" field of struct work_struct
> > +
> > +(gdb) printf "%d\n", &((struct work_struct *)0)->func
> > +24
> 
> you could also use Arnaldo's pahole for this, seems like less typing:
> 
>   $ pahole ./vmlinux -C work_struct
>   die__process_function: tag not supported (INVALID)!
>   struct work_struct {
>           atomic_long_t              data;                 /*     0     8 */
>           struct list_head           entry;                /*     8    16 */
>           work_func_t                func;                 /*    24     8 */
> 
> it's in 'dwarves' package
> 

Just FYI, perf probe gives you the offset too :)

# perf probe -D "work_busy work->func"
p:probe/work_busy _text+591936 func=+24(%di):x64

Anyway, this "symbol" type is also interesting. I'll pick it.

Thanks,

-- 
Masami Hiramatsu <mhiramat@...nel.org>