linux-kernel - Re: [PATCH 1/5] [PATCH 1/5] function-graph/x86: replace unbalanced ret with jmp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1255468366.7113.2403.camel@gandalf.stny.rr.com>
Date:	Tue, 13 Oct 2009 17:12:46 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Frederic Weisbecker <fweisbec@...il.com>
Cc:	linux-kernel@...r.kernel.org, Ingo Molnar <mingo@...e.hu>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>
Subject: Re: [PATCH 1/5] [PATCH 1/5] function-graph/x86: replace unbalanced
 ret with jmp

On Tue, 2009-10-13 at 23:02 +0200, Frederic Weisbecker wrote:
> On Tue, Oct 13, 2009 at 04:33:50PM -0400, Steven Rostedt wrote:
> > From: Steven Rostedt <srostedt@...hat.com>
> > 
> > The function graph tracer replaces the return address with a hook to
> > trace the exit of the function call. This hook will finish by returning
> > to the real location the function should return to.
> > 
> > But the current implementation uses a ret to jump to the real return
> > location. This causes a imbalance between calls and ret. That is
> > the original function does a call, the ret goes to the handler
> > and then the handler does a ret without a matching call.
> > 
> > Although the function graph tracer itself still breaks the branch
> > predictor by replacing the original ret, by using a second ret and
> > causing an imbalance, it breaks the predictor even more.
> 
> 
> 
> I have troubles to understand by it breaks the predictor, especially
> since there is not conditional branch in return_to_handler.
> But still I don't understand why a ret would break more the branch
> prediction than a jmp.

Calls are branch prediction jumps. Which associates the "ret" with the
call. As it approaches the ret, it starts to receive the code after the
call.

But this is stack order. Every call should hit one ret. But with the
original code, we break this stack. We have one call and two rets. Which
means that the branch prediction will also get messed up with the
previous stored call.

-- Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/