linux-kernel - Re: [PATCH 0/3] perf: script: Intro capstone disasm engine to show instruction trace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87il3tl6zf.fsf@linux.intel.com>
Date: Tue, 16 Jan 2024 05:53:40 -0800
From: Andi Kleen <ak@...ux.intel.com>
To: Changbin Du <changbin.du@...wei.com>
Cc: Peter Zijlstra <peterz@...radead.org>,  Ingo Molnar <mingo@...hat.com>,
  Arnaldo Carvalho de Melo <acme@...nel.org>,  Mark Rutland
 <mark.rutland@....com>,  Alexander Shishkin
 <alexander.shishkin@...ux.intel.com>,  Jiri Olsa <jolsa@...nel.org>,
  Namhyung Kim <namhyung@...nel.org>,  Ian Rogers <irogers@...gle.com>,
  Adrian Hunter <adrian.hunter@...el.com>,  <linux-kernel@...r.kernel.org>,
  <linux-perf-users@...r.kernel.org>
Subject: Re: [PATCH 0/3] perf: script: Intro capstone disasm engine to show
 instruction trace

Changbin Du <changbin.du@...wei.com> writes:

> This series introduces capstone disassembler engine to print instructions of
> Intel PT trace, which was printed via the XED tool.

FWIW at least on x86 in my experience capstone isn't that great an
disassembler. I used it in another project and ran into many decoding bugs.
They're mostly in obscure corners, but can be fairly annoying.

My other concern with your patchkit is that you change the default
output formats. Since perf script is often used with scripts
(as the name implies) there is a certain expectation that the output
remains stable and parse-able. There are actually use cases where
the raw bytes "insn" output is needed.

I would rather define new perf script output types for the new decoded output,
but keep the old alone.

-Andi