* Duplicate events for 32-bit compatible syscall probes
@ 2013-04-24 9:48 Aryeh Weinreb
2013-04-25 13:12 ` David Smith
0 siblings, 1 reply; 6+ messages in thread
From: Aryeh Weinreb @ 2013-04-24 9:48 UTC (permalink / raw)
To: systemtap
Hi,
While using some syscall.mq_* probes on 32bit on x86_64 I am getting
duplicate events.
Looking into ipc/compat_mq.c it seems that the compat_sys_mq calls are
just wrappers for the sys_mq ones.
Although, sometimes the compat calls can return EFAULT without calling
the non-compat versions.
It would be nice to only get one event for each system call without
missing any calls.
I am using an RHEL 6 build of systemtap version 1.8.
Thanks,
Aryeh
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Duplicate events for 32-bit compatible syscall probes
2013-04-24 9:48 Duplicate events for 32-bit compatible syscall probes Aryeh Weinreb
@ 2013-04-25 13:12 ` David Smith
2013-04-25 13:18 ` David Smith
0 siblings, 1 reply; 6+ messages in thread
From: David Smith @ 2013-04-25 13:12 UTC (permalink / raw)
To: Aryeh Weinreb; +Cc: systemtap
On 04/24/2013 04:47 AM, Aryeh Weinreb wrote:
> Hi,
>
> While using some syscall.mq_* probes on 32bit on x86_64 I am getting
> duplicate events.
>
> Looking into ipc/compat_mq.c it seems that the compat_sys_mq calls are
> just wrappers for the sys_mq ones.
> Although, sometimes the compat calls can return EFAULT without calling
> the non-compat versions.
>
> It would be nice to only get one event for each system call without
> missing any calls.
>
> I am using an RHEL 6 build of systemtap version 1.8.
If you just want to trace the "real" 64-bit syscalls, I'd do something
like the following to reject the 32-bit-on-64-bit syscalls. Note that
this is untested, but should work.
=====
function is_compat_task:long () %{
STAP_RETVALUE = _stp_is_compat_task();
%}
probe syscall.mq_getsetattr
{
if { is_compat_task() } next;
# ... your real code here
}
=====
--
David Smith
dsmith@redhat.com
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Duplicate events for 32-bit compatible syscall probes
2013-04-25 13:12 ` David Smith
@ 2013-04-25 13:18 ` David Smith
2013-04-25 14:39 ` David Smith
0 siblings, 1 reply; 6+ messages in thread
From: David Smith @ 2013-04-25 13:18 UTC (permalink / raw)
To: Aryeh Weinreb; +Cc: systemtap
On 04/25/2013 08:12 AM, David Smith wrote:
> On 04/24/2013 04:47 AM, Aryeh Weinreb wrote:
>> Hi,
>>
>> While using some syscall.mq_* probes on 32bit on x86_64 I am getting
>> duplicate events.
>>
>> Looking into ipc/compat_mq.c it seems that the compat_sys_mq calls are
>> just wrappers for the sys_mq ones.
>> Although, sometimes the compat calls can return EFAULT without calling
>> the non-compat versions.
>>
>> It would be nice to only get one event for each system call without
>> missing any calls.
>>
>> I am using an RHEL 6 build of systemtap version 1.8.
>
> If you just want to trace the "real" 64-bit syscalls, I'd do something
> like the following to reject the 32-bit-on-64-bit syscalls. Note that
> this is untested, but should work.
>
> =====
> function is_compat_task:long () %{
> STAP_RETVALUE = _stp_is_compat_task();
> %}
>
> probe syscall.mq_getsetattr
> {
> if { is_compat_task() } next;
> # ... your real code here
> }
> =====
>
And of course as soon as I send this I realize it won't work. That will
most likely reject all 32-on-64 processes.
I'll keep thinking here.
--
David Smith
dsmith@redhat.com
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Duplicate events for 32-bit compatible syscall probes
2013-04-25 13:18 ` David Smith
@ 2013-04-25 14:39 ` David Smith
2013-04-26 13:41 ` Aryeh Weinreb
0 siblings, 1 reply; 6+ messages in thread
From: David Smith @ 2013-04-25 14:39 UTC (permalink / raw)
To: Aryeh Weinreb; +Cc: systemtap
On 04/25/2013 08:18 AM, David Smith wrote:
> On 04/25/2013 08:12 AM, David Smith wrote:
>> On 04/24/2013 04:47 AM, Aryeh Weinreb wrote:
>>> Hi,
>>>
>>> While using some syscall.mq_* probes on 32bit on x86_64 I am getting
>>> duplicate events.
>>>
>>> Looking into ipc/compat_mq.c it seems that the compat_sys_mq calls are
>>> just wrappers for the sys_mq ones.
>>> Although, sometimes the compat calls can return EFAULT without calling
>>> the non-compat versions.
>>>
>>> It would be nice to only get one event for each system call without
>>> missing any calls.
>>>
>>> I am using an RHEL 6 build of systemtap version 1.8.
>>
>> If you just want to trace the "real" 64-bit syscalls, I'd do something
>> like the following to reject the 32-bit-on-64-bit syscalls. Note that
>> this is untested, but should work.
>>
>> =====
>> function is_compat_task:long () %{
>> STAP_RETVALUE = _stp_is_compat_task();
>> %}
>>
>> probe syscall.mq_getsetattr
>> {
>> if { is_compat_task() } next;
>> # ... your real code here
>> }
>> =====
>>
>
> And of course as soon as I send this I realize it won't work. That will
> most likely reject all 32-on-64 processes.
>
> I'll keep thinking here.
>
OK, here's a solution that I actually tested with syscall.open.
Basically if the function name we're probing has 'compat_' in it, skip it.
====
probe syscall.open
{
if (isinstr(ppfunc(), "compat_")) {
next
}
# ... your real code here
}
====
--
David Smith
dsmith@redhat.com
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Duplicate events for 32-bit compatible syscall probes
2013-04-25 14:39 ` David Smith
@ 2013-04-26 13:41 ` Aryeh Weinreb
2013-04-26 14:45 ` David Smith
0 siblings, 1 reply; 6+ messages in thread
From: Aryeh Weinreb @ 2013-04-26 13:41 UTC (permalink / raw)
To: David Smith; +Cc: systemtap
> OK, here's a solution that I actually tested with syscall.open.
> Basically if the function name we're probing has 'compat_' in it, skip it.
>
> ====
> probe syscall.open
> {
> if (isinstr(ppfunc(), "compat_")) {
> next
> }
> # ... your real code here
Thanks.
Unfortunately I don't have ppfunc since I'm only on 1.8, but I guess
if we are ignoring EFAULT I could also just:
probe kernel.function("sys_mq_*)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Duplicate events for 32-bit compatible syscall probes
2013-04-26 13:41 ` Aryeh Weinreb
@ 2013-04-26 14:45 ` David Smith
0 siblings, 0 replies; 6+ messages in thread
From: David Smith @ 2013-04-26 14:45 UTC (permalink / raw)
To: Aryeh Weinreb; +Cc: systemtap
On 04/26/2013 08:41 AM, Aryeh Weinreb wrote:
>> OK, here's a solution that I actually tested with syscall.open.
>> Basically if the function name we're probing has 'compat_' in it, skip it.
>>
>> ====
>> probe syscall.open
>> {
>> if (isinstr(ppfunc(), "compat_")) {
>> next
>> }
>> # ... your real code here
>
> Thanks.
>
> Unfortunately I don't have ppfunc since I'm only on 1.8, but I guess
> if we are ignoring EFAULT I could also just:
> probe kernel.function("sys_mq_*)
>
ppfunc() is just a cut down pp() (with just the function part of the
probe point name). You should be able to use pp() instead of ppfunc().
--
David Smith
dsmith@redhat.com
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-04-26 14:45 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-04-24 9:48 Duplicate events for 32-bit compatible syscall probes Aryeh Weinreb
2013-04-25 13:12 ` David Smith
2013-04-25 13:18 ` David Smith
2013-04-25 14:39 ` David Smith
2013-04-26 13:41 ` Aryeh Weinreb
2013-04-26 14:45 ` David Smith
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).