linux-kernel - perf trace: substruct BTF based pretty printing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZuH8qhuZB6mr9JvR@x1>
Date: Wed, 11 Sep 2024 17:25:14 -0300
From: Arnaldo Carvalho de Melo <acme@...nel.org>
To: Howard Chu <howardchu95@...il.com>
Cc: Adrian Hunter <adrian.hunter@...el.com>,
	Alan Maguire <alan.maguire@...cle.com>,
	Jiri Olsa <jolsa@...nel.org>, Kan Liang <kan.liang@...ux.intel.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	linux-perf-users@...r.kernel.org
Subject: perf trace: substruct BTF based pretty printing

Hi Howard,

	Not really a requirement on you to do work, just a some notes to
add to our discussion/experiment on using BTF to pretty print syscall
(and tracepoints/whatever) arguments:

root@...ber:~# perf trace -e setitimer -p 5444 |& head -5
     0.000 ( 0.017 ms): Xwayland/5444 setitimer(value: (struct __kernel_old_itimerval){})                   = 0
     0.050 ( 0.004 ms): Xwayland/5444 setitimer(value: (struct __kernel_old_itimerval){})                   = 0
     0.142 ( 0.005 ms): Xwayland/5444 setitimer(value: (struct __kernel_old_itimerval){})                   = 0
     0.174 ( 0.004 ms): Xwayland/5444 setitimer(value: (struct __kernel_old_itimerval){})                   = 0
     0.293 ( 0.004 ms): Xwayland/5444 setitimer(value: (struct __kernel_old_itimerval){})                   = 0
root@...ber:~# strace -e setitimer -p 5444 |& head -5
strace: Process 5444 attached
setitimer(ITIMER_REAL, {it_interval={tv_sec=0, tv_usec=5000}, it_value={tv_sec=0, tv_usec=5000}}, NULL) = 0
setitimer(ITIMER_REAL, {it_interval={tv_sec=0, tv_usec=0}, it_value={tv_sec=0, tv_usec=0}}, NULL) = 0
setitimer(ITIMER_REAL, {it_interval={tv_sec=0, tv_usec=5000}, it_value={tv_sec=0, tv_usec=5000}}, NULL) = 0
setitimer(ITIMER_REAL, {it_interval={tv_sec=0, tv_usec=0}, it_value={tv_sec=0, tv_usec=0}}, NULL) = 0
root@...ber:~# 
root@...ber:~# 
root@...ber:~# grep -w value /sys/kernel/tracing/events/syscalls/sys_enter_rseq/format 
root@...ber:~# grep -w value /sys/kernel/tracing/events/syscalls/sys_enter_setitimer/format 
	field:struct __kernel_old_itimerval * value;	offset:24;	size:8;	signed:0;
print fmt: "which: 0x%08lx, value: 0x%08lx, ovalue: 0x%08lx", ((unsigned long)(REC->which)), ((unsigned long)(REC->value)), ((unsigned long)(REC->ovalue))
root@...ber:~# pahole __kernel_old_itimerval
struct __kernel_old_itimerval {
	struct __kernel_old_timeval it_interval;         /*     0    16 */
	struct __kernel_old_timeval it_value;            /*    16    16 */

	/* size: 32, cachelines: 1, members: 2 */
	/* last cacheline: 32 bytes */
};

root@...ber:~# pahole -E __kernel_old_itimerval
struct __kernel_old_itimerval {
	struct __kernel_old_timeval {
		/* typedef __kernel_long_t */ long int           tv_sec;                 /*     0     8 */
		/* typedef __kernel_long_t */ long int           tv_usec;                /*     8     8 */
	} it_interval; /*     0    16 */
	struct __kernel_old_timeval {
		/* typedef __kernel_long_t */ long int           tv_sec;                 /*    16     8 */
		/* typedef __kernel_long_t */ long int           tv_usec;                /*    24     8 */
	} it_value; /*    16    16 */

	/* size: 32, cachelines: 1, members: 2 */
	/* last cacheline: 32 bytes */
};

root@...ber:~#