linux-kernel - Re: [PATCH v2 0/5] tracepoints: Add warnings for unused tracepoints and trace events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250613102834.539bd849@batman.local.home>
Date: Fri, 13 Jun 2025 10:28:34 -0400
From: Steven Rostedt <rostedt@...dmis.org>
To: linux-arch@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-trace-kernel@...r.kernel.org, linux-kbuild@...r.kernel.org,
 llvm@...ts.linux.dev
Cc: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>, Masami Hiramatsu
 <mhiramat@...nel.org>, Arnd Bergmann <arnd@...db.de>, Masahiro Yamada
 <masahiroy@...nel.org>, Nathan Chancellor <nathan@...nel.org>, Nicolas
 Schier <nicolas.schier@...ux.dev>, Nick Desaulniers
 <nick.desaulniers+lkml@...il.com>, Catalin Marinas
 <catalin.marinas@....com>, Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH v2 0/5] tracepoints: Add warnings for unused tracepoints
 and trace events

On Thu, 12 Jun 2025 19:58:27 -0400
Steven Rostedt <rostedt@...dmis.org> wrote:

> Every trace event can take up to 5K of memory in text and meta data regardless
> if they are used or not. Trace events should not be created if they are not
> used.  Currently there's over a hundred events in the kernel that are defined
> but unused, either because their callers were removed without removing the
> trace event with it, or a config hides the trace event caller but not the
> trace event itself. And in some cases, trace events were simply added but were
> never called for whatever reason. The number of unused trace events continues
> to grow.

Now it's been a while since I looked at the actual sizes, so I decided
to see what they are again.

So I created a trace header with 10 events (attached file), that had this:

TRACE_EVENT(size_event_1,
        TP_PROTO(struct size_event_struct *A, struct size_event_struct *B),
        TP_ARGS(A, B),
        TP_STRUCT__entry(
                __field(        unsigned long,  Aa)
                __field(        unsigned long,  Ab)
                __field(        unsigned long,  Ba)
                __field(        unsigned long,  Bb)
        ),
        TP_fast_assign(
                __entry->Aa = A->a;
                __entry->Ab = A->b;
                __entry->Ba = B->a;
                __entry->Bb = B->b;
        ),
        TP_printk("Aa=%ld Ab=%ld Ba=%ld Bb=%ld",
                __entry->Aa, __entry->Ab, __entry->Ba, __entry->Bb)
);

And I created 9 more by just renaming the event name (size_event_2, etc).

I also looked at how well DEFINE_EVENT() works (note a TRACE_EVENT()
macro is just a DECLARE_EVENT_CLASS() followed by a DEFINE_EVENT() with
the same name as the class, so I could use the first TRACE_EVENT as a
class and the first event).

DEFINE_EVENT(size_event_1, size_event_2,
        TP_PROTO(struct size_event_struct *A, struct size_event_struct *B),
        TP_ARGS(A, B));

The module is simply:

echo '#include <linux/module.h>

#define CREATE_TRACE_POINTS
#include "size_events.h"

static __init int size_init(void)
{
        return 0;
}

static __exit void size_exit(void)
{
}

module_init(size_init);
module_exit(size_exit);

MODULE_AUTHOR("Steven Rostedt");
MODULE_DESCRIPTION("Test the size of trace event");
MODULE_LICENSE("GPL");' > event-mod.c

The results are (renaming the module to what they did):

   text    data     bss     dec     hex filename
    629    1440       0    2069     815 no-events.ko
  44837   15424       0   60261    eb65 trace-events.ko
  11495    8064       0   19559    4c67 define-events.ko

With no events, the size is 2069.
With full trace events it jumped to 60261
With One DECLARE_EVENT_CLASS() and 9 DEFINE_EVENT(), it changed to 19559

That means each TRACE_EVENT() is approximately 5819 bytes.
  (60261 - 2069) / 10

And each DEFINE_EVENT() is approximately 1296 bytes.
  ((19559 - 2069) - 5819) / 9

Now I do have a bit of debugging options enabled which could cause this
to bloat even more. But yeah, trace events do take up a bit of memory.

-- Steve

View attachment "size_events.h" of type "text/x-chdr" (6598 bytes)