linux-kernel - Re: [RFC PATCH] perf report: add sort by file lines

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1301580117.4859.286.camel@twins>
Date:	Thu, 31 Mar 2011 16:01:57 +0200
From:	Peter Zijlstra <peterz@...radead.org>
To:	Lin Ming <ming.m.lin@...el.com>
Cc:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Arnaldo Carvalho de Melo <acme@...radead.org>,
	Frederic Weisbecker <fweisbec@...il.com>,
	LKML <linux-kernel@...r.kernel.org>,
	"2nddept-manager@....hitachi.co.jp" 
	<2nddept-manager@....hitachi.co.jp>
Subject: Re: [RFC PATCH] perf report: add sort by file lines

On Thu, 2011-03-31 at 16:45 +0800, Lin Ming wrote:
> I am considering if it is possible to do "instruction unwind" to get a
> map from (temporarily used) register to a specific member of a data
> structure pointed by a pointer.
> 
> 4004a0:         movq    -8(%rbp), %rax    /* load foo arg from stack
> */
> 4004a4:         movq    24(%rax), %rax    /* load foo->bar */
> 4004a8:         movq    -16(%rbp), %rdx   /* load tmp arg from stack
> */
> 4004ac:         movl    32(%rdx), %edx    /* load tmp->blah */
> 4004af:         movl    %edx, 20(%rax)    /* store bar->fubar */ 
> 
> foo: -8(%rbp)
> tmp: -16(%rbp)
> 
> Assume we are now at ip 4004af, from the instruction decoder, we know
> it's a store operation, and we want to find out what %rax is.
> 
> 1. unwind to 4004ac
>    Ignore this, because it does not touch %rax
> 
> 2. unwind to 4004a8
>    Ignore this, because it does not touch %rax
> 
> 3. unwind to 4004a4
>    20(%rax) => 20(24(%rax)), continue to unwind because we still
>    have no idea what %rax is
> 
> 4. unwind to 4004a0
>    20(24(%rax)) => 20(24(-8(%rbp))), stop unwind, because we now know
>    -8(%rbp) is foo.
> 
> So the original 20(%rax) is replace as 20(24(-8(%rbp))), and it means
> foo->bar->fubar
> 
> Does this make sense? 

Yes and no, the problem is that you cannot unwind an x86 instruction
stream. Therefore its easier to start at the beginning of a function
where DWARF should be able to tell you everything you need and then do a
single fwd scan to propagate the information until you reach the point
of interest.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/