linux-kernel - Re: [RFC patch 19/21] LTTng Linux Kernel Trace Thread Flag x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sun, 15 Mar 2009 16:08:46 -0400
From:	Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>
To:	Frederic Weisbecker <fweisbec@...il.com>
Cc:	Ingo Molnar <mingo@...e.hu>, akpm@...ux-foundation.org,
	Steven Rostedt <rostedt@...dmis.org>,
	LKML <linux-kernel@...r.kernel.org>, Andi Kleen <ak@....de>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>
Subject: Re: [RFC patch 19/21] LTTng Linux Kernel Trace Thread Flag x86

* Frederic Weisbecker (fweisbec@...il.com) wrote:
> On Sun, Mar 15, 2009 at 03:03:59PM -0400, Mathieu Desnoyers wrote:
> > Add a thread flag to activate system-wide syscall tracing.
> > 
> > Make x86_64 support TIF_SYSCALL_TRACE async flag set in entry.S
> 
> 
> x86-32 :-)
> 
>  
> > When the flag is inactive upon syscall entry and concurrently activated before
> > exit, we seem to reach a state where the top of stack is incorrect upon return
> > to user space.
> > 
> > Fix this by fixing the top of stack and jumping to int_ret_from_sys_call if we
> > detect that thread flags has been modified.
> 
> 
> I don't see where you do that. May be you forgot some parts that match your changelog?
> 

Oh, I see. I moved the *.S modifications to the LTTng instrumentation
patches. Maybe those belong more to the kernel trace thread flags
patches. I'll move them and repost.

Thanks,

Mathieu

> > 
> > We make sure that the thread flag read is coherent between our new test and the ALLWORK_MASK test by first saving it in a register used for both comparisons.
> 
> Ditto.
> 
> Thanks,
> Frederic.
> 
> > 
> > Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>
> > CC: Andi Kleen <ak@....de>
> > CC: Thomas Gleixner <tglx@...utronix.de>
> > CC: Ingo Molnar <mingo@...hat.com>
> > CC: H. Peter Anvin <hpa@...or.com>
> > ---
> >  arch/x86/include/asm/thread_info.h |    9 ++++++---
> >  arch/x86/kernel/entry_32.S         |    3 ++-
> >  2 files changed, 8 insertions(+), 4 deletions(-)
> > 
> > Index: linux-2.6-lttng/arch/x86/include/asm/thread_info.h
> > ===================================================================
> > --- linux-2.6-lttng.orig/arch/x86/include/asm/thread_info.h	2009-01-14 22:10:38.000000000 -0500
> > +++ linux-2.6-lttng/arch/x86/include/asm/thread_info.h	2009-01-14 22:25:08.000000000 -0500
> > @@ -79,6 +79,7 @@ struct thread_info {
> >  #define TIF_SYSCALL_EMU		6	/* syscall emulation active */
> >  #define TIF_SYSCALL_AUDIT	7	/* syscall auditing active */
> >  #define TIF_SECCOMP		8	/* secure computing */
> > +#define TIF_KERNEL_TRACE	9	/* kernel trace active */
> >  #define TIF_MCE_NOTIFY		10	/* notify userspace of an MCE */
> >  #define TIF_NOTSC		16	/* TSC is not accessible in userland */
> >  #define TIF_IA32		17	/* 32bit process */
> > @@ -102,6 +103,7 @@ struct thread_info {
> >  #define _TIF_SYSCALL_EMU	(1 << TIF_SYSCALL_EMU)
> >  #define _TIF_SYSCALL_AUDIT	(1 << TIF_SYSCALL_AUDIT)
> >  #define _TIF_SECCOMP		(1 << TIF_SECCOMP)
> > +#define _TIF_KERNEL_TRACE	(1 << TIF_KERNEL_TRACE)
> >  #define _TIF_MCE_NOTIFY		(1 << TIF_MCE_NOTIFY)
> >  #define _TIF_NOTSC		(1 << TIF_NOTSC)
> >  #define _TIF_IA32		(1 << TIF_IA32)
> > @@ -117,17 +119,18 @@ struct thread_info {
> >  
> >  /* work to do in syscall_trace_enter() */
> >  #define _TIF_WORK_SYSCALL_ENTRY	\
> > -	(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU | \
> > +	(_TIF_SYSCALL_TRACE | _TIF_KERNEL_TRACE | _TIF_SYSCALL_EMU | \
> >  	 _TIF_SYSCALL_AUDIT | _TIF_SECCOMP | _TIF_SINGLESTEP)
> >  
> >  /* work to do in syscall_trace_leave() */
> >  #define _TIF_WORK_SYSCALL_EXIT	\
> > -	(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SINGLESTEP)
> > +	(_TIF_SYSCALL_TRACE | _TIF_KERNEL_TRACE | _TIF_SYSCALL_AUDIT | \
> > +	 _TIF_SINGLESTEP)
> >  
> >  /* work to do on interrupt/exception return */
> >  #define _TIF_WORK_MASK							\
> >  	(0x0000FFFF &							\
> > -	 ~(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|			\
> > +	 ~(_TIF_SYSCALL_TRACE|_TIF_KERNEL_TRACE|_TIF_SYSCALL_AUDIT|	\
> >  	   _TIF_SINGLESTEP|_TIF_SECCOMP|_TIF_SYSCALL_EMU))
> >  
> >  /* work to do on any return to user space */
> > Index: linux-2.6-lttng/arch/x86/kernel/entry_32.S
> > ===================================================================
> > --- linux-2.6-lttng.orig/arch/x86/kernel/entry_32.S	2009-01-14 22:22:40.000000000 -0500
> > +++ linux-2.6-lttng/arch/x86/kernel/entry_32.S	2009-01-14 22:25:44.000000000 -0500
> > @@ -571,7 +571,8 @@ END(syscall_trace_entry)
> >  	# perform syscall exit tracing
> >  	ALIGN
> >  syscall_exit_work:
> > -	testb $_TIF_WORK_SYSCALL_EXIT, %cl
> > +	/* Note, _TIF_KERNEL_TRACE is bit number 9, and so it needs testw and not testb */
> > +	testw $_TIF_WORK_SYSCALL_EXIT, %cx
> >  	jz work_pending
> >  	TRACE_IRQS_ON
> >  	ENABLE_INTERRUPTS(CLBR_ANY)	# could let syscall_trace_leave() call
> > 
> > -- 
> > Mathieu Desnoyers
> > OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F  BA06 3F25 A8FE 3BAE 9A68
> 

-- 
Mathieu Desnoyers
OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F  BA06 3F25 A8FE 3BAE 9A68
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/