linux-kernel - tracing child threads with address filtering using intel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <8fc78808-db61-2f41-180a-9713178e22f6@gatech.edu>
Date:   Wed, 3 Oct 2018 00:23:33 +0000
From:   Mansour Alharthi <malharthi9@...ech.edu>
To:     "peterz@...radead.org" <peterz@...radead.org>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "acme@...nel.org" <acme@...nel.org>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: tracing child threads with address filtering using intel_pt

Hello all,

I am having trouble tracing child threads when using address filtering
with intel_pt ..

Assume this test code:

thread_start(){
...
test();
...
}

test(){
printf("test");
}

main(){
...
pthread_create(......, thread_start,....);
}

Tracing the above program with the following command:
perf record -v -m 512,10000 -e intel_pt//u -T --switch-events --filter
'filter * @ ./test' -- ./test

Returns zero trace for code executed by child thread, i.e.
thread_start() and test() functions..
While tracing without the filter does include the threads trace:
perf record -v -m 512,10000 -e intel_pt//u -T --switch-events -- ./test

Is this intended? or is it a bug?

Thanks!
Mansour.