linux-kernel - Re: [PATCH 6/9][RFC] kprobes: Allow probe on ftrace reserved text (but move it)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4FAA32B3.3070806@hitachi.com>
Date:	Wed, 09 May 2012 18:02:43 +0900
From:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
To:	Steven Rostedt <rostedt@...dmis.org>
Cc:	"Frank Ch. Eigler" <fche@...hat.com>, linux-kernel@...r.kernel.org,
	Ingo Molnar <mingo@...e.hu>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Frederic Weisbecker <fweisbec@...il.com>,
	"H. Peter Anvin" <hpa@...or.com>, yrl.pp-manager.tt@...achi.com
Subject: Re: [PATCH 6/9][RFC] kprobes: Allow probe on ftrace reserved text
 (but move it)

(2012/05/09 17:12), Masami Hiramatsu wrote:
> (2012/05/09 14:53), Masami Hiramatsu wrote:
>> (2012/05/08 22:04), Steven Rostedt wrote:
>>> Note, the big difference with using ftrace optimization and normal
>>> kprobe jump optimization is that the ftrace one can be used on a preempt
>>> kernel. But this code is still under development. I want to get a
>>> solution for the current code (this patch set) now. It would be nice if
>>> it was ready for 3.5.
>>
>> I doubt that we can really do this. If this is possible, I can make
>> jump optimization work with preemptive kernel.
> 
> Now I'm clear that it can be done only with ftrace-nop.
> What I concerned with is out-of-line execution buffer releasing
> timing. but with the ftrace-nop, we don't need to do that.
> 
> Theoretically, that will be done in following steps;
> 
> 1. call mcount (w/ push call-site address+5)
> 2. mcount calls ftrace handlers
> 3. mcount makes pt_regs on the stack
>  - on x86-32, regs->cs should be the call-site address+5, since
>    regs->sp must be the top of original stack.

Oops, no, %flags is stored on regs->cs and regs->flags is
call-site address. So we have to fix it up in optprobe handler.

>  - on x86-64, it is enough that regs->sp points the top of original
>    stack.
> 4. mcount store call-site address+5 to %ax
> 5. mcount calls new-optprobe handler (which returns call-site address+5)
> 6. mcount restores registers
> 7. mcount returns to the call-site address+5.
> 
> Between 6 and 7, original opt-probe has to do out-of-line execution,
> but this ftrace-based one doesn't need to do that. In that case,
> we don't need to allocate nor to release out-of-line execution buffer
> for this probe.

And I got an concrete idea of kprobes call-optimization which
uses call instead of jump. That will make ftrace-based optimization
very easy. :)

Thank you,

-- 
Masami HIRAMATSU
Software Platform Research Dept. Linux Technology Center
Hitachi, Ltd., Yokohama Research Laboratory
E-mail: masami.hiramatsu.pt@...achi.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/