linux-kernel - Re: [for-next][PATCH 02/11] tracing: Add __cpumask to denote a trace event field that is a cpumask

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221213144408.0b78d2c3@gandalf.local.home>
Date:   Tue, 13 Dec 2022 14:44:08 -0500
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Douglas Raillard <douglas.raillard@....com>
Cc:     linux-kernel@...r.kernel.org,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Valentin Schneider <vschneid@...hat.com>
Subject: Re: [for-next][PATCH 02/11] tracing: Add __cpumask to denote a
 trace event field that is a cpumask_t

On Tue, 13 Dec 2022 17:40:06 +0000
Douglas Raillard <douglas.raillard@....com> wrote:

> > I prefer not to have "quick&dirty" ;-)  
> 
> I'm not saying that I would like to see such quick and dirty events upstream, but the reality around me is
> that ftrace events is the only sane way of having an idea what the scheduler does. This means people need
> to create experiments all the time with ad-hoc trace events, on top of the trace events that we attach to
> tracepoints via a module. Currently, people use trace_printk() for that, which comes with some significant
> amount of work and pain (mostly regex speed).

Have you seen custom events?

  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/samples/trace_events/trace_custom_sched.h


> 
> That said having just looked at bprint, I could probably support trace_printk() format strings with simple
> struct member access (i.e. no __printflags shenanigans etc) as normal events relatively easily. It's even
> possible to use the fmt string pointer as an "event ID". Still a shame that all the event field format infra
> basically gets duplicated in a printf format string ...

It's the easiest thing to do in the kernel. The below is probably too much
work for people to use. The fact that it's just a string and does not have
any type information is one of the main reasons I force it not to be in
mainline (hence the nasty banner when it is added).

> 
> >   
> >>
> >> 	#define SIMPLE_TRACE_EVENT(type, fields) \
> >> 	struct type fields;	
> >> 	TRACE_EVENT(type, \
> >> 		TP_PROTO(struct type *data), \
> >> 		TP_ARGS(data), \
> >> 		TP_STRUCT__entry(__field(struct type, data)), \
> >> 		TP_fast_assign(__entry->data = *data;), \
> >> 		TP_printk("print in raw mode to display the data"), \
> >> 	);
> >> 	#define SIMPLE_TRACE(type, fields) trace_struct_##type(&(struct type)fields)
> >>
> >>
> >> 	SIMPLE_TRACE_EVENT(myevent, {
> >> 		char name[11];
> >> 		int foobar;
> >> 	});
> >> 	
> >> 	SIMPLE_TRACE(myevent, {.name = "hello", .foobar = 42});  
> > 
> >   
> >>
> >> The format string could be either kernel-generated based on BTF or userspace could be expected
> >> to make its own use of BTF.  
> > 
> > What's the use case for the above?  
> 
> An equivalent to trace_printk() that exposes its fields in the "normal" way rather than having to parse
> the format string and a comma-separated list of C expressions. Life is too short to write C interpreters.
> Parsing BTF is at least a finite amount of work. But I guess it would be easy to handle only "REC->field"
> expressions.

But the above isn't that much simpler than writing a trace event. When I
use trace_printk(), I seldom use it with tooling. And for the few times I
have written tools to parse printk, the printk formats are very easily
parsed, as I control them. Heck, I'd just do colon delimited string.

-- Steve