linux-kernel - [PATCH 0/2] kprobes/x86: Allow "boost" for 10- and 11-byte instructions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon,  1 Jun 2015 19:32:09 +0300
From:	Eugene Shatokhin <eugene.shatokhin@...alab.ru>
To:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Ingo Molnar <mingo@...nel.org>
Cc:	Andy Lutomirski <luto@...capital.net>,
	Ingo Molnar <mingo@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: [PATCH 0/2] kprobes/x86: Allow "boost" for 10- and 11-byte instructions

Kprobes' "boost" feature allows to avoid single-stepping in some cases, along with its overhead. It is useful for the Kprobes that cannot be optimized for some reason.

Currently, "boost" cannot be applied to the instructions of 10 and 11 bytes in size, including some rather commonly used kinds of MOV.

The first of the two patches in this series fixes the code that checks if the jump needed for the boost fits in the insn slot (the conditional is too strict). This allows to apply "boost" to 10-byte instructions.

As a side effect of commit 91e5ed49fca0 ("x86/asm/decoder: Fix and enforce max instruction size in the insn decoder"), the size of the instruction slot became 1 byte smaller, 15 bytes VS 16 bytes before that change. The second patch makes the size of each insn slot 16 bytes again (while keeping MAX_INSN_SIZE as 15). This allows to apply "boost" to 11-byte instructions as well.

I have checked that "boost" does happen for at least "movq $0x1,0x100(%rbx)" (48 c7 83 00 01 00 00 01 00 00 00) in the kernel 4.1-rc6 after these changes.

arch/x86/include/asm/kprobes.h | 1 +
arch/x86/kernel/kprobes/core.c | 2 +-
kernel/kprobes.c               | 8 ++++++--
3 files changed, 8 insertions(+), 3 deletions(-)

Regards,

Eugene

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/