linux-kernel - Re: [PATCH v7 02/13] user_events: Add minimal support for trace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20211213090915.58034cd6c74782a4f58aacc2@kernel.org>
Date:   Mon, 13 Dec 2021 09:09:15 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     Beau Belgrave <beaub@...ux.microsoft.com>,
        linux-trace-devel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v7 02/13] user_events: Add minimal support for
 trace_event into ftrace

On Fri, 10 Dec 2021 12:43:05 -0500
Steven Rostedt <rostedt@...dmis.org> wrote:

> On Fri, 10 Dec 2021 19:43:58 +0900
> Masami Hiramatsu <mhiramat@...nel.org> wrote:
> 
> > > +/* Limit how long of an event name plus args within the subsystem. */
> > > +#define MAX_EVENT_DESC 512
> > > +#define EVENT_NAME(user_event) ((user_event)->tracepoint.name)
> > > +#define MAX_FIELD_ARRAY_SIZE (2 * PAGE_SIZE)  
> > 
> > I don't recommend to record the event which size is more than a page size...
> > Maybe 256 entries?
> > It is also better to limit the total size of the event and the number
> > of fields (arguments).
> > 
> > Steve, can we write such a big event data on the trace buffer?
> 
> In the future yes!
> 
>   https://lore.kernel.org/all/20211125175253.186422-1-tz.stoyanov@gmail.com/

Ah, nice!

> 
> But it will still require some configuration changes from user space. But
> that said, if the user wants to add a larger size, then they can do so (in
> the future).

Hmm, so, at this moment I recommend to pick the max size of the event
smaller than page size but enough large (e.g. 1024, that is finally Beau
has chosen).
And after that new ring buffer introduced, expand it.
What would you think?

Thank you,


-- 
Masami Hiramatsu <mhiramat@...nel.org>