linux-kernel - Re: [RFC patch 19/21] LTTng Linux Kernel Trace Thread Flag x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 15 Mar 2009 20:56:50 +0100
From:	Frederic Weisbecker <fweisbec@...il.com>
To:	Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>
Cc:	Ingo Molnar <mingo@...e.hu>, akpm@...ux-foundation.org,
	Steven Rostedt <rostedt@...dmis.org>,
	LKML <linux-kernel@...r.kernel.org>, Andi Kleen <ak@....de>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>
Subject: Re: [RFC patch 19/21] LTTng Linux Kernel Trace Thread Flag x86

On Sun, Mar 15, 2009 at 03:03:59PM -0400, Mathieu Desnoyers wrote:
> Add a thread flag to activate system-wide syscall tracing.
> 
> Make x86_64 support TIF_SYSCALL_TRACE async flag set in entry.S


x86-32 :-)

 
> When the flag is inactive upon syscall entry and concurrently activated before
> exit, we seem to reach a state where the top of stack is incorrect upon return
> to user space.
> 
> Fix this by fixing the top of stack and jumping to int_ret_from_sys_call if we
> detect that thread flags has been modified.


I don't see where you do that. May be you forgot some parts that match your changelog?

> 
> We make sure that the thread flag read is coherent between our new test and the ALLWORK_MASK test by first saving it in a register used for both comparisons.

Ditto.

Thanks,
Frederic.

> 
> Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>
> CC: Andi Kleen <ak@....de>
> CC: Thomas Gleixner <tglx@...utronix.de>
> CC: Ingo Molnar <mingo@...hat.com>
> CC: H. Peter Anvin <hpa@...or.com>
> ---
>  arch/x86/include/asm/thread_info.h |    9 ++++++---
>  arch/x86/kernel/entry_32.S         |    3 ++-
>  2 files changed, 8 insertions(+), 4 deletions(-)
> 
> Index: linux-2.6-lttng/arch/x86/include/asm/thread_info.h
> ===================================================================
> --- linux-2.6-lttng.orig/arch/x86/include/asm/thread_info.h	2009-01-14 22:10:38.000000000 -0500
> +++ linux-2.6-lttng/arch/x86/include/asm/thread_info.h	2009-01-14 22:25:08.000000000 -0500
> @@ -79,6 +79,7 @@ struct thread_info {
>  #define TIF_SYSCALL_EMU		6	/* syscall emulation active */
>  #define TIF_SYSCALL_AUDIT	7	/* syscall auditing active */
>  #define TIF_SECCOMP		8	/* secure computing */
> +#define TIF_KERNEL_TRACE	9	/* kernel trace active */
>  #define TIF_MCE_NOTIFY		10	/* notify userspace of an MCE */
>  #define TIF_NOTSC		16	/* TSC is not accessible in userland */
>  #define TIF_IA32		17	/* 32bit process */
> @@ -102,6 +103,7 @@ struct thread_info {
>  #define _TIF_SYSCALL_EMU	(1 << TIF_SYSCALL_EMU)
>  #define _TIF_SYSCALL_AUDIT	(1 << TIF_SYSCALL_AUDIT)
>  #define _TIF_SECCOMP		(1 << TIF_SECCOMP)
> +#define _TIF_KERNEL_TRACE	(1 << TIF_KERNEL_TRACE)
>  #define _TIF_MCE_NOTIFY		(1 << TIF_MCE_NOTIFY)
>  #define _TIF_NOTSC		(1 << TIF_NOTSC)
>  #define _TIF_IA32		(1 << TIF_IA32)
> @@ -117,17 +119,18 @@ struct thread_info {
>  
>  /* work to do in syscall_trace_enter() */
>  #define _TIF_WORK_SYSCALL_ENTRY	\
> -	(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU | \
> +	(_TIF_SYSCALL_TRACE | _TIF_KERNEL_TRACE | _TIF_SYSCALL_EMU | \
>  	 _TIF_SYSCALL_AUDIT | _TIF_SECCOMP | _TIF_SINGLESTEP)
>  
>  /* work to do in syscall_trace_leave() */
>  #define _TIF_WORK_SYSCALL_EXIT	\
> -	(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SINGLESTEP)
> +	(_TIF_SYSCALL_TRACE | _TIF_KERNEL_TRACE | _TIF_SYSCALL_AUDIT | \
> +	 _TIF_SINGLESTEP)
>  
>  /* work to do on interrupt/exception return */
>  #define _TIF_WORK_MASK							\
>  	(0x0000FFFF &							\
> -	 ~(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|			\
> +	 ~(_TIF_SYSCALL_TRACE|_TIF_KERNEL_TRACE|_TIF_SYSCALL_AUDIT|	\
>  	   _TIF_SINGLESTEP|_TIF_SECCOMP|_TIF_SYSCALL_EMU))
>  
>  /* work to do on any return to user space */
> Index: linux-2.6-lttng/arch/x86/kernel/entry_32.S
> ===================================================================
> --- linux-2.6-lttng.orig/arch/x86/kernel/entry_32.S	2009-01-14 22:22:40.000000000 -0500
> +++ linux-2.6-lttng/arch/x86/kernel/entry_32.S	2009-01-14 22:25:44.000000000 -0500
> @@ -571,7 +571,8 @@ END(syscall_trace_entry)
>  	# perform syscall exit tracing
>  	ALIGN
>  syscall_exit_work:
> -	testb $_TIF_WORK_SYSCALL_EXIT, %cl
> +	/* Note, _TIF_KERNEL_TRACE is bit number 9, and so it needs testw and not testb */
> +	testw $_TIF_WORK_SYSCALL_EXIT, %cx
>  	jz work_pending
>  	TRACE_IRQS_ON
>  	ENABLE_INTERRUPTS(CLBR_ANY)	# could let syscall_trace_leave() call
> 
> -- 
> Mathieu Desnoyers
> OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F  BA06 3F25 A8FE 3BAE 9A68

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/