linux-kernel - Re: [PATCH v12 08/11] perf tools: Minimal CALLCHAIN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250702122837.4bb6f259@batman.local.home>
Date: Wed, 2 Jul 2025 12:28:37 -0400
From: Steven Rostedt <rostedt@...dmis.org>
To: Jens Remus <jremus@...ux.ibm.com>
Cc: linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org,
 bpf@...r.kernel.org, x86@...nel.org, Masami Hiramatsu
 <mhiramat@...nel.org>, Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
 Josh Poimboeuf <jpoimboe@...nel.org>, Peter Zijlstra
 <peterz@...radead.org>, Ingo Molnar <mingo@...nel.org>, Jiri Olsa
 <jolsa@...nel.org>, Namhyung Kim <namhyung@...nel.org>, Thomas Gleixner
 <tglx@...utronix.de>, Andrii Nakryiko <andrii@...nel.org>, Indu Bhagat
 <indu.bhagat@...cle.com>, "Jose E. Marchesi" <jemarch@....org>, Beau
 Belgrave <beaub@...ux.microsoft.com>, Linus Torvalds
 <torvalds@...ux-foundation.org>, Andrew Morton <akpm@...ux-foundation.org>,
 Jens Axboe <axboe@...nel.dk>, Florian Weimer <fweimer@...hat.com>, Heiko
 Carstens <hca@...ux.ibm.com>, Vasily Gorbik <gor@...ux.ibm.com>
Subject: Re: [PATCH v12 08/11] perf tools: Minimal CALLCHAIN_DEFERRED
 support

On Wed, 2 Jul 2025 14:23:24 +0200
Jens Remus <jremus@...ux.ibm.com> wrote:

> > +struct perf_record_callchain_deferred {
> > +	struct perf_event_header header;  
> 
> At minimum the timestamp field added to perf with "[PATCH v12 07/11]
> perf: Support deferred user callchains for per CPU events" needs to be
> added here as well:

Thanks for the review.

> 
> 	__u64			 timestamp;
> 
> Otherwise this and any subsequent enhancements of the perf tools do no
> longer work at all.  But probably the timestamp field also needs to be
> used for some purpose?

OK, so this may be part of the discussion about using this as a
timestamp. The timestamp is the timestamp given by the deferred trace
infrastructure. It holds the time that this stack trace is valid for.
But that's assuming that the timestamp is the same as what perf is
using.

In case of dropped events, we could have the case of:

  system_call() {
    <nmi> {
      take kernel stack trace
      ask for deferred trace.

   [EVENTS START DROPPING HERE]
    }
    Call deferred callback to record trace [ BUT IS DROPPED ]
  }

  system_call() {
    <nmi> {
      take kernel stack trace
      ask for deferred trace [ STILL DROPPING ]
    }
    [ READER CATCHES UP AND STARTS READING EVENTS AGAIN]

    Call deferred callback to record trace
  }

The user space tool will see that kernel stack traces of the first
system call, then it will see events dropped, and then it will see the
deferred user space stack trace of the second call.

If the timestamps are in sync with perf and what is passed in, then the
tool will see that the kernel stack traces from the first system call
are older than the timestamp of the user stack trace and know that they
are not related.

Without either saving the timestamp along with the kernel stack traces,
or having the timestamps in sync, user space will not know whether or
not if the user space stack trace of the second system call belongs to
the kernel stack traces that were recorded in the first system call.

I guess the question is, do we just not associate stack traces beyond
where events are dropped? If so, we don't even need to save the
timestamp.

-- Steve

> 
> > +	__u64			 nr;
> > +	__u64			 ips[];
> > +};