linux-kernel - tracing child threads with address filtering using intel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 3 Oct 2018 00:19:39 +0000
From:   Mansour Alharthi <malharthi9@...ech.edu>
To:     "\"peterz@...radead.org; mingo@...hat.com; acme\"@kernel.org" 
        <"peterz@...radead.org; mingo@...hat.com; acme"@kernel.org>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: tracing child threads with address filtering using intel_pt pmu

Hello all,

I am having trouble tracing child threads when using address filtering 
with intel_pt ..

Assume this test code:

thread_start(){
...
test();
...
}

test(){
printf("test");
}

main(){
...
pthread_create(......, thread_start,....);
}

Tracing the above program with the following command:
perf record -v -m 512,10000 -e intel_pt//u -T --switch-events --filter 
'filter * @ ./test' -- ./test

Returns zero trace for code executed by child thread, i.e. 
thread_start() and test() functions..
While tracing without the filter does include the threads trace:
perf record -v -m 512,10000 -e intel_pt//u -T --switch-events -- ./test

Is this intended? or is it a bug?

Thanks!
Mansour.