linux-kernel - Re: [tip:perf/core] perf/x86: Fix USER/KERNEL tagging of samples

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 06 Jul 2012 22:48:33 +0200
From:	Peter Zijlstra <a.p.zijlstra@...llo.nl>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	mingo@...nel.org, hpa@...or.com, eranian@...gle.com,
	linux-kernel@...r.kernel.org, fweisbec@...il.com,
	akpm@...ux-foundation.org, tglx@...utronix.de,
	linux-tip-commits@...r.kernel.org,
	Robert Richter <robert.richter@....com>
Subject: Re: [tip:perf/core] perf/x86: Fix USER/KERNEL tagging of samples

On Fri, 2012-07-06 at 11:34 -0700, Linus Torvalds wrote:
> On Fri, Jul 6, 2012 at 11:16 AM, Linus Torvalds
> <torvalds@...ux-foundation.org> wrote:
> >
> > If some code then changes the values in the pt_regs, it is *that* code
> > that needs to think twice about what it does. Where is that code?
> 
> From a quick grep it looks like it is __intel_pmu_pebs_event() that does this.

Correct, as well as perf_ibs_handle_irq() and I'll have to have a good
look at the BTS stuff.

> THAT is where you would possibly have a huge honking big comment about
> how you have to fake the CS register contents because the PEBS
> information is incomplete. But make it clear that it is a total hack.

OK.

> Also, somebody should check. Is the PEBS information *actually* the
> instruction pointer (address within the code segment), or is it the
> "linear address" (segment base + rip)? I hope it is the latter,
> because in the absense of CS, the segment-based address is very
> unclear indeed.

I _think_ it is just the RIP since its part of a more general register
dump (which does not include the segment registers).

I can't find anything in the SDM clarifying it one way or the other.
Stephane do you know?

> And if it *is* the linear address, then at that point you could do
> 
>    regs->cs = kernel_ip(ip) ? __KERNEL_CS : __USER_CS;
>    regs->eflags &= ~X86_EFLAGS_VM;
> 
> and document this as a "we fake the CS and vm86 mode, using the known
> zero-based code segments". At that point it would be technically
> correct.

OK, thanks.. At least the AMB IBS case provides the Linear address of
the instruction so the IBS code should do it this way. We'll need to
check with Intel to see what PEBS does.

Supposing the worst case and Intel simply provides the RIP as is, what
should we do then?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/