linux-kernel - [RFC][PATCH 0/3] kprobes/ftrace/x86: Function graph trace jprobes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20150128043036.429390502@goodmis.org>
Date:	Tue, 27 Jan 2015 23:30:36 -0500
From:	Steven Rostedt <rostedt@...dmis.org>
To:	linux-kernel@...r.kernel.org
Cc:	Ingo Molnar <mingo@...nel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	"H. Peter Anvin" <hpa@...or.com>
Subject: [RFC][PATCH 0/3] kprobes/ftrace/x86: Function graph trace jprobes

I had these patches sitting in my repo for a while, thinking I already
posted them. I never did, so here I go  (a little late :-/)

Basically, what I had before was fixes for jprobes and function graph
tracing that were stepping on each other. When enabling both jprobes
and graph tracer, it could crash the system. The fix was just to ignore
function graph tracing while handling a jprobe. This was fine for stable
and fixing a bug that would usually crash, but it still messes with
function graph trace. It is still required if fentry is not used, but
when fentry is (which is now the majority of cases - gcc > 4.6 and x86_64),
we can trace jprobes with a little trickery.

The way this solves the issue is that on the return from the jprobe,
we can detect if function graph tracing happened because the stack
frame would have changed. When this is detected
 (saved_sp == return_to_handler), the ip is changed once again to
go preform a "fixup". The real ip is saved in r10 (callee clobber)
and will be put back by the fixup trampoline.

The second patch will move ip to r10 always, and will call either
the fixup (if it was modified) or will jump to ftrace_trace_addr.
The ftrace_trace_addr will call the function graph code, if the
ip address is set to be traced. Otherwise the function graph code
ignores it (which is why it's called by all jprobe returns).

The final patch fixes the name of a variable that Masami suggesed.

Steven Rostedt (Red Hat) (3):
      ftrace/jprobes/x86: Allow jprobes to be graph traced if using fentry
      ftrace/jprobes/x86: Have function being probed be graph traced
      ftrace: Rename variable from old_hash_ops to old_ops_hash

----
 arch/x86/include/asm/ftrace.h    |  4 +++
 arch/x86/include/asm/kprobes.h   |  9 +++++
 arch/x86/kernel/kprobes/core.c   | 72 +++++++++++++++++++++++++++++++++++++++-
 arch/x86/kernel/kprobes/ftrace.c | 14 ++++++++
 arch/x86/kernel/mcount_64.S      | 36 +++++++++++++++++++-
 kernel/trace/ftrace.c            | 24 +++++++-------
 6 files changed, 145 insertions(+), 14 deletions(-)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/