linux-kernel - Re: [PATCH RFC] tracing: Call triggers only if event passes filter checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 15 Jun 2018 12:16:03 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Joel Fernandes <joelaf@...gle.com>
Cc:     "BarclaycardUS" 
        <1eaff0972layfivcia3p5kbiaaaaabtyzcthzutkdtiyaaaaa@...ers.BarclaycardUS.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH RFC] tracing: Call triggers only if event passes filter
 checks

On Thu, 14 Jun 2018 18:01:13 -0700
Joel Fernandes <joelaf@...gle.com> wrote:

> From: "Joel Fernandes (Google)" <joel@...lfernandes.org>
> 
> Currently, trace event triggers are called regardless of if the event
> filter checks pass or fail. Thus if one were to enable event triggers
> and filters at the same time, then the triggers will always be called
> even if the filter checks didn't pass.
> 
> This is a problem for a usecase I was experimenting with: measuring the
> time preemption is disabled using synthetic events and dump the stack
> using the stacktrace trigger if the total preempt off time was greater
> than a threshold. Following are the commands for the same:
> 
> Create synthetic event:
> 
> echo 'preemptdisable u64 lat' >> \
> 	      /sys/kernel/debug/tracing/synthetic_events
> 
> echo 'hist:keys=cpu:ts0=common_timestamp.usecs:scpu=cpu' >> \
> 	      /sys/kernel/debug/tracing/events/preemptirq/preempt_disable/trigger
> 
> echo 'hist:keys=cpu:wakeup_lat=common_timestamp.usecs-$ts0:\
> onmatch(preemptirq.preempt_disable).preemptdisable($wakeup_lat)' >> \
> 	        /sys/kernel/debug/tracing/events/preemptirq/preempt_enable/trigger
> 
> Enable synthetic event:
> 
> echo stacktrace > /sys/kernel/debug/tracing/events/synthetic/preemptdisable/trigger
> echo 'lat > 400' > /sys/kernel/debug/tracing/events/synthetic/preemptdisable/filter
> echo 1 > /sys/kernel/debug/tracing/events/synthetic/preemptdisable/enable
> 
> With the patch, the stacktrace is triggered only if the filter checks
> passed. It also seems sensible to call triggers only if filter checks
> pass so lets do that.

No, it worked as expected. The filter is only to be used it the event
should be recorded or not. What you wanted to do is:

 echo 'stacktrace if lat > 400' > events/synthetic/preemptdisable/trigger

-- Steve