linux-kernel - Re: [PATCH v10 2/4] trace/objtrace: Get the value of the object

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEr6+EAU_FUvCqZqqpp_hC5ichV9WJ+Up+N6ya5KW_CbqbRGFA@mail.gmail.com>
Date:   Tue, 31 May 2022 15:13:24 +0800
From:   Jeff Xie <xiehuan09@...il.com>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Steven Rostedt <rostedt@...dmis.org>, mingo@...hat.com,
        Tom Zanussi <zanussi@...nel.org>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v10 2/4] trace/objtrace: Get the value of the object

Hi Masami and steve,

On Sun, May 22, 2022 at 10:22 PM Masami Hiramatsu <mhiramat@...nel.org> wrote:
>
> Hi Jeff,
>
> On Fri, 13 May 2022 01:00:06 +0800
> Jeff Xie <xiehuan09@...il.com> wrote:
>
> [...]
> > @@ -175,9 +271,27 @@ trace_object_trigger(struct event_trigger_data *data,
> >
> >       field = obj_data->field;
> >       memcpy(&obj, rec + field->offset, sizeof(obj));
> > -     set_trace_object(obj, tr);
> > +     /* set the offset from the special object and the type size of the value*/
> > +     set_trace_object(obj, obj_data->obj_offset,
> > +                     obj_data->obj_value_type_size, tr);
> >  }
> >
> > +static const struct objtrace_fetch_type objtrace_fetch_types[] = {
> > +     {"u8", 1},
> > +     {"s8", 1},
> > +     {"x8", 1},
> > +     {"u16", 2},
> > +     {"s16", 2},
> > +     {"x16", 2},
> > +     {"u32", 4},
> > +     {"s32", 4},
> > +     {"x32", 4},
> > +     {"u64", 8},
> > +     {"s64", 8},
> > +     {"x64", 8},
>
> Hmm, as far as I can see, you don't distinguish the prefix 'u','s','x'.
> If so, please support only 'x' at this moment. kprobe events supports
> those types, and it distinguishes the types when printing the logged
> data. E.g. 's16' shows '-1' for 0xffff, but 'x16' shows '0xffff'.
> You can add another patch to support such different types afterwards.

I feel to let the objtrace trigger to distinguish the prefix 'u', 's',
'x', It seems a very challenging work ;-)
I spent a lot of time thinking, I would like to add a callback
function(print function) in the struct trace_object_entry  for each
data type.
Not sure if this is possible or allowed, as I haven't seen any example
like this to add function in the  struct *_entry  ;-)

The following is part of the code I have prepared. I don't know if you
can give any suggestions or wait until I submit the next version to
discuss.

<snip>
diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h
index 2407c45a568c..5f8289e26f91 100644
--- a/kernel/trace/trace_entries.h
+++ b/kernel/trace/trace_entries.h
@@ -414,6 +414,7 @@ FTRACE_ENTRY(object, trace_object_entry,
                __field(        unsigned long,          parent_ip       )
                __field(        unsigned long,          object          )
                __field(        unsigned long,          value           )
+               __field(        unsigned long,          print           )
        ),

+/* get the type size for the special object */
+struct objtrace_fetch_type {
+       char *name;
+       int type_size;
+       int is_signed;
+       print_type_func_t       print;
+};
+

 static const struct objtrace_fetch_type objtrace_fetch_types[] = {
-       {"x8", 1},
-       {"x16", 2},
-       {"x32", 4},
-       {"x64", 8},
-       {NULL, 0}
+       {"u8", 1, 0, PRINT_TYPE_FUNC_NAME(u8)},
+       {"s8", 1, 1, PRINT_TYPE_FUNC_NAME(s8)},
+       {"x8", 1, 0, PRINT_TYPE_FUNC_NAME(x8)},
+       {"u16", 2, 0, PRINT_TYPE_FUNC_NAME(u16)},
+       {"s16", 2, 1, PRINT_TYPE_FUNC_NAME(s16)},
+       {"x16", 2, 0, PRINT_TYPE_FUNC_NAME(x16)},
+       {"u32", 4, 0, PRINT_TYPE_FUNC_NAME(u32)},
+       {"s32", 4, 1, PRINT_TYPE_FUNC_NAME(s32)},
+       {"x32", 4, 0, PRINT_TYPE_FUNC_NAME(x32)},
+       {"u64", 8, 0, PRINT_TYPE_FUNC_NAME(u64)},
+       {"s64", 8, 1, PRINT_TYPE_FUNC_NAME(s64)},
+       {"x64", 8, 1, PRINT_TYPE_FUNC_NAME(x64)},
+       {NULL, 0, 0, NULL}
 };
</snip>

> > +     {}
>
> If this array is null terminated, please explictly do that, like
>
>         {NULL, 0},
>
> for readability.
>
> Thank you,
>
> --
> Masami Hiramatsu (Google) <mhiramat@...nel.org>

Thanks,
JeffXie