linux-kernel - Re: [RFC PATCH v2] trace: Add trace any kernel object

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEr6+EBROjKJ0LqTb1q5OMNJW61bKxUXTDTUrv0XdoJcEqpXvQ@mail.gmail.com>
Date:   Wed, 27 Oct 2021 00:58:59 +0800
From:   Huan Xie <xiehuan09@...il.com>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     Masami Hiramatsu <mhiramat@...nel.org>, mingo@...hat.com,
        chenhuacai@...nel.org, linux-kernel@...r.kernel.org,
        Tom Zanussi <zanussi@...nel.org>
Subject: Re: [RFC PATCH v2] trace: Add trace any kernel object

Hi steven,

On Wed, Oct 27, 2021 at 12:11 AM Huan Xie <xiehuan09@...il.com> wrote:
>
> On Tue, Oct 26, 2021 at 11:44 PM Steven Rostedt <rostedt@...dmis.org> wrote:
> >
> > On Tue, 26 Oct 2021 23:40:03 +0800
> > Huan Xie <xiehuan09@...il.com> wrote:
> >
> > > > > static void trace_object_trigger(struct event_trigger_data *data,
> > > > > struct trace_buffer *buffer,  void *rec,
> > > > >                    struct ring_buffer_event *event)
> > > >
> > > >
> > > > OK, so let me ask this question. What is it that you want to see?
> > >
> > > Thanks, I got your point now,  my original idea was to just track the
> > > flow of objects.
> >
> > Well, the current patch set doesn't really show any flow of objects, as it
> > only records a value that never changes until the next kprobe is hit, and
> > we get that from the kprobe itself.
>
> My original purpose was to track which functions the (struct bio)
> passed through for the linux block subsystem.
> and which functions the (struct page) passed through for the linux
> memory subsystem.  ;-)
> and I feel this help will be great for learning and developing the linux kernel.

I doubt you may have misunderstood my first patch ;-)

1. Get the argN from the kprobe and record it (call it object).
2. The function trace_object_events_call() scanning every function args,
 If any of the args match the above record(object), output the ip and
parent ip to the ring buffer, so that we
can know which function the object has passed through.

> >
> > > >
> > > > And let's say I want to monitor that __bi_cnt while functions are being
> > > > traced. What would be *really cool*, is to mark that value!
> > >
> > > This is really cool to  get the change of the value. And is a good
> > > feature enhancement.
> > >
> >
> > Right, and this is what I thought the purpose of your patch was! :-)
> >
> > And why I got really excited about it. So I don't see this as a feature
> > enhancement to your patch, but the feature enhancement that your patch can
> > give us.
> >
> > -- Steve
>
> --
> JeffXie
--
JeffXie