linux-kernel - Question about enabling trave

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 28 Feb 2020 20:16:54 +0100
From:   Cezary Rojewski <cezary.rojewski@...el.com>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Question about enabling trave_events on module load

Hello Steven,

I bet that is not the first time said question is asked - that's for 
sure - but I failed to find a method for solving the issue, that is: not 
missing a single trace from the moment given module is loaded. Maybe I'm 
missing something or documentation wasn't clear enough and that's why 
I'm here.

If I am, please point to towards the right direction. Then you can slap 
me for not reading the documentation carefully.

"trace_event=" cmdline option seems to target built-in tracepoints 
_only_ so ain't much of a help to me. After digging the past for some 
time, I've found a very promising thread:
	tracing: Enable tracepoints via module parameters
	https://lore.kernel.org/patchwork/patch/240185/

Sadly, I wasn't able to find _that_ solution (or anything similar for 
that matter) implemented into the kernel.

So far, the only option I came with was separating traces into a 
built-in piece that declares all events upfront so "trace_event=" option 
has something to hook into. Said piece is of course made of a standard 
trace header file filled with macro usage and a .c file with handful of 
EXPORT_TRACEPOINT_SYMBOL(s).

While that solution could suffice, localization is the problem here - if 
a tree my module is built in is configured via -m, the built-in piece 
won't expose symbols at all and 'make' will leave me with bunch of 
"ERROR: <symbol> undefined" for every module my traces were used in. To 
fix the problem, I've relocated my trace .c file to /kernel/trace/. 
Finally it compiles and works as intended..

Not really satisfying, though. While there are some examples of 
subsystems keeping their trace .c in /kernel/trace (e.g.: 
power-traces.c), I don't believe that place is open for _every single 
driver_ to dump their trace sources into.

If indeed traces cannot be enabled on module load, then this is a gap.
While not everyone looked satisfied in the 9year old thread, I believe 
having the gap closed is important - and userspace can always be 
improved upon as time passes.

Thank you in advance for your input and time.

Czarek