linux-kernel - Re: [PATCH] kvm: log directly from the guest to the host kvm buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 17 May 2011 11:50:34 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Dhaval Giani <dhaval.giani@...il.com>
Cc:	Avi Kivity <avi@...hat.com>, kvm@...r.kernel.org, joro@...tes.org,
	agraf@...e.de, linux-kernel@...r.kernel.org,
	Fabio Checconi <fchecconi@...il.com>,
	Tommaso Cucinotta <tommaso.cucinotta@...up.it>
Subject: Re: [PATCH] kvm: log directly from the guest to the host kvm buffer

On Thu, 2011-05-12 at 17:39 +0200, Dhaval Giani wrote:

> >>
> >> +int kvm_pv_ftrace(struct kvm_vcpu *vcpu, unsigned long ip, gpa_t addr)
> >> +{
> >> +       int ret;
> >> +       char *fmt = (char *) kzalloc(PAGE_SIZE, GFP_KERNEL);
> >> +
> >> +       ret = kvm_read_guest(vcpu->kvm, addr, fmt, PAGE_SIZE);
> >> +
> >> +       trace_printk("KVM instance %p: VCPU %d, IP %lu: %s",
> >> +                               vcpu->kvm, vcpu->vcpu_id, ip, fmt);
> >> +
> >> +       kfree(fmt);
> >> +
> >> +       return 0;
> >> +}
> >
> > A kmalloc and printf seem expensive here.  I'd prefer to log the arguments
> > and format descriptor instead.  Similarly the guest should pass unformatted
> > parameters.+int kvm_ftrace_printk(unsigned long ip, const char *fmt, ...)
> >>
> 
> the trace_printk is actually quite cheap (IIRC), but I guess Steve is
> the best person to let us know about that. We can avoid the kzalloc
> overhead though.

You could replace the kzalloc with a static page. Perhaps, one page per
CPU. Then you just need to disable interrupts (unless this is never
called by an interrupt) to get the information into the page, without
any allocation.

trace_printk() does basically the same thing, but uses a single page
with locks. I've thought about replacing that with per cpu pages too,
but haven't gotten around to it.

I also agree that you should just write to some buffer and when it
overflows, flush it.

-- Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/