linux-kernel - Re: [PATCH 1/2] perf intel-pt-decoder: Report instruction bytes and length in sample

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 30 Sep 2016 13:07:17 +0300
From:   Adrian Hunter <adrian.hunter@...el.com>
To:     Andi Kleen <andi@...stfloor.org>, acme@...nel.org
Cc:     linux-kernel@...r.kernel.org, Andi Kleen <ak@...ux.intel.com>
Subject: Re: [PATCH 1/2] perf intel-pt-decoder: Report instruction bytes and
 length in sample

On 30/09/16 06:49, Andi Kleen wrote:
> From: Andi Kleen <ak@...ux.intel.com>
> 
> Change the Intel PT decoder to pass up the length and the instruction
> bytes of the decoded or sampled instruction in the perf sample.
> 
> The decoder already knows this information, we just need to pass it
> up. Since it is only a couple of movs it is not very expensive.

The decoder doesn't always fill the instruction buffer because it caches the
results from walking basic blocks.  That means the bytes from the last
instruction in the basic block would need to be added to the cache.

I wonder if we shouldn't look at something more sophisticated e.g. a python
script that can do full disassembly.