linux-kernel - Re: [patch] kprobes: optimize branch placement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 18 Sep 2006 19:22:08 +0530
From:	Ananth N Mavinakayanahalli <ananth@...ibm.com>
To:	Ingo Molnar <mingo@...e.hu>
Cc:	Andrew Morton <akpm@...l.org>,
	Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>,
	Jes Sorensen <jes@....com>,
	Roman Zippel <zippel@...ux-m68k.org>, tglx@...utronix.de,
	karim@...rsys.com, Paul Mundt <lethal@...ux-sh.org>,
	linux-kernel@...r.kernel.org,
	Christoph Hellwig <hch@...radead.org>,
	Ingo Molnar <mingo@...hat.com>,
	Greg Kroah-Hartman <gregkh@...e.de>,
	Tom Zanussi <zanussi@...ibm.com>, ltt-dev@...fik.org,
	Michel Dagenais <michel.dagenais@...ymtl.ca>, fche@...hat.com
Subject: Re: [patch] kprobes: optimize branch placement

On Sun, Sep 17, 2006 at 01:30:38AM +0200, Ingo Molnar wrote:
> 
> * Andrew Morton <akpm@...l.org> wrote:
> 
> > On Sat, 16 Sep 2006 22:43:42 +0200
> > Ingo Molnar <mingo@...e.hu> wrote:
> > 
> > > --- linux.orig/arch/i386/kernel/kprobes.c
> > > +++ linux/arch/i386/kernel/kprobes.c
> > > @@ -354,9 +354,8 @@ no_kprobe:
> > >   */
> > >  fastcall void *__kprobes trampoline_handler(struct pt_regs *regs)
> > >  {
> > > -        struct kretprobe_instance *ri = NULL;
> > > -        struct hlist_head *head;
> > > -        struct hlist_node *node, *tmp;
> > > +        struct kretprobe_instance *ri = NULL, *tmp;
> > > +        struct list_head *head;
> > >  	unsigned long flags, orig_ret_address = 0;
> > >  	unsigned long trampoline_address =(unsigned long)&kretprobe_trampoline;
> > 
> > Wanna fix the whitespace wreckage while you're there??
>
> will do. If you consider this for -mm then there's some djprobes noise 
> in the patch [djprobes isnt upstream yet] - it's not completely 
> sanitized yet. (but it should actually work if applied to upstream - 
> kprobes and djprobes are disjunct.) Also, i havent tested with 
> CONFIG_KPROBES turned off, etc. I'll do a clean queue.

Also, the hlist->list changes need to be taken care of for the other
archs too.

> > i386's kprobe_handler() appears to forget to reenable preemption in 
> > the if (p->pre_handler && p->pre_handler(p, regs)) case?
> 
> that portion seems a bit tricky - i think what happens is that the 
> pre_handler() sets stuff up for single-stepping, and then we do this 
> recursive single-stepping (during which preemption remains disabled), 
> and _then_ do we re-enable preemption.

Well, that is the jprobes and return probes case. In the case of normal
kprobes, p->pre_handler() should always return 0.

In the case of a jprobe, the setjmp_pre_handler() resets the instruction
pointer to the instrumented routine (same signature as the routine being
jprobed), which later does a jprobe_return(), a placeholder for the
arch-specific trap instruction. We re-enter the kprobe_handler here and
then re-enable preemption via the longjmp_break_handler. As for the
return probe case, since the underlying instruction originally was a nop
(kretprobe_trampoline), we don't need to single-step.

Yes, its a bit convoluted, but we are currently covered for all cases.

Ananth
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/