linux-kernel - Re: [RFC][PATCH -tip 3/5 V2] tracing: kprobe-tracer plugin supports arguments

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 21 Mar 2009 16:57:24 -0400
From:	Masami Hiramatsu <mhiramat@...hat.com>
To:	Frederic Weisbecker <fweisbec@...il.com>
CC:	Ingo Molnar <mingo@...e.hu>, Steven Rostedt <rostedt@...dmis.org>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	systemtap-ml <systemtap@...rces.redhat.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [RFC][PATCH -tip 3/5 V2] tracing: kprobe-tracer plugin	supports
 arguments

Frederic Weisbecker wrote:
>> +
>> +#if defined(__i386__)
>> +#define REGPARMS 3
>> +static unsigned long fetch_argument(struct pt_regs *regs, void *data)
>> +{
>> +	unsigned long n = (unsigned long)data;
>> +	if (n > REGPARMS) {
>> +		/*
>> +		 * The typical case: arg n is on the stack.
>> +		 * stack[0] = return address
>> +		 */
>> +		return fetch_stack(regs, (void *)(n - REGPARMS));
> 
> 
> I wonder if it wouldn't be better to make this tracer depend on
> CONFIG_FRAME_POINTER. So that wherever we probe inside a function,
> the argument asked keeps being reliable. esp will move, ebp will not until
> we quit the frame.

Hm, AFAIK, CONFIG_FRAME_POINTER is for unwinding stacks, but I doubt
it is useful for getting function arguments, because first nth parameters
are passed by registers which will easily be broken and compilers may
change register assignment in the function body.

I guess that most of debugging users will disassemble kernel binary
when setting a probe (I recommend it, at least with this version.)
So they can find what they want by analyzing assemble code.

Anyway, I think it is possible to get a stack entry referred from
ebp(stack frame register) by implementing below item.
> - Support indirect memory fetch from registers etc.

This will allow us to access memory indirectly like as;
 p sys_open+10 r5[8]

This will mean "record *(ulong)(pt_regs->bp+8) at sys_open+10"
(syntax is not fixed yet.)

Thank you,

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: mhiramat@...hat.com


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/