linux-kernel - Re: [tip:perf/kprobes] kprobes: Introduce NOKPROBE_SYMBOL() macro to maintain kprobes blacklist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 06 May 2014 19:03:55 +0900
From:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
To:	Tony Luck <tony.luck@...il.com>
Cc:	Ingo Molnar <mingo@...nel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Rusty Russell <rusty@...tcorp.com.au>, rdunlap@...radead.org,
	Jeremy Fitzhardinge <jeremy@...p.org>,
	Arnd Bergmann <arnd@...db.de>, dl9pf@....de,
	Andrew Morton <akpm@...ux-foundation.org>, sparse@...isli.org,
	Thomas Gleixner <tglx@...utronix.de>,
	"H. Peter Anvin" <hpa@...or.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	anil.s.keshavamurthy@...el.com,
	"David S. Miller" <davem@...emloft.net>,
	"ananth@...ibm.com" <ananth@...ibm.com>,
	Chris Wright <chrisw@...s-sol.org>, akataria@...are.com,
	linux-tip-commits@...r.kernel.org,
	"yrl.pp-manager.tt@...achi.com" <yrl.pp-manager.tt@...achi.com>
Subject: Re: [tip:perf/kprobes] kprobes: Introduce NOKPROBE_SYMBOL() macro
 to maintain kprobes blacklist

(2014/05/06 5:48), Tony Luck wrote:
> This patch is in linux-next ("next-20140505") and I see a
> bunch of "Failed to find blacklist" messages when booting
> on ia64:
> 
> Failed to find blacklist 0001013168300000
> Failed to find blacklist 0001013000f0a000
> Failed to find blacklist 000101315f70a000
> Failed to find blacklist 000101324c80a000
> Failed to find blacklist 0001013063f0a000
> Failed to find blacklist 000101327800a000
> Failed to find blacklist 0001013277f0a000
> Failed to find blacklist 000101315a70a000
> Failed to find blacklist 0001013277e0a000
> Failed to find blacklist 000101305a20a000
> Failed to find blacklist 0001013277d0a000
> Failed to find blacklist 00010130bdc0a000
> Failed to find blacklist 00010130dc20a000
> Failed to find blacklist 000101309a00a000
> Failed to find blacklist 0001013277c0a000
> Failed to find blacklist 0001013277b0a000
> Failed to find blacklist 0001013277a0a000
> Failed to find blacklist 000101327790a000
> Failed to find blacklist 000101303140a000
> Failed to find blacklist 0001013a3280a000
> 
> What do these mean?

Ah, I forgot that ia64 has function descriptor :(
That means kprobes initial code has failed to get correct
entry address of the blacklisted functions.

In include/linux/kprobes.h, I defined NOKPROBE_SYMBOL to store
the addresses of blacklisted functions as below,

#define __NOKPROBE_SYMBOL(fname)                        \
static unsigned long __used                             \
        __attribute__((section("_kprobe_blacklist")))   \
        _kbl_addr_##fname = (unsigned long)fname;
#define NOKPROBE_SYMBOL(fname)  __NOKPROBE_SYMBOL(fname)

_kbl_addr_XX stores the address of the function, but on IA64,
it stores the address of function descriptor.

Since those addresses are only used with kallsyms to lookup
function size, I think I should use a macro to store correct
function address instead of the address of function descriptor
on ia64 (and similar arch).
But I'm not sure which macro I should use... Is there any good way
to get the address of function, instead of function descriptor?

Thank you,

-- 
Masami HIRAMATSU
Software Platform Research Dept. Linux Technology Research Center
Hitachi, Ltd., Yokohama Research Laboratory
E-mail: masami.hiramatsu.pt@...achi.com


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/