linux-kernel - Re: [BUG REPORT] perf tools: x86_64: Broken calllchain when sampling taken at 'callq' instruction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 19 Nov 2015 11:23:00 +0100
From:	Ingo Molnar <mingo@...nel.org>
To:	"Wangnan (F)" <wangnan0@...wei.com>
Cc:	Jiri Olsa <jolsa@...nel.org>,
	Arnaldo Carvalho de Melo <acme@...nel.org>,
	David Ahern <dsahern@...il.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Milian Wolff <milian.wolff@...b.com>,
	linux-kernel@...r.kernel.org, pi3orama <pi3orama@....com>,
	lizefan 00213767 <lizefan@...wei.com>
Subject: Re: [BUG REPORT] perf tools: x86_64: Broken calllchain when sampling
 taken at 'callq' instruction


* Wangnan (F) <wangnan0@...wei.com> wrote:

> 
> 
> On 2015/11/19 14:37, Ingo Molnar wrote:
> >* Wangnan (F) <wangnan0@...wei.com> wrote:
> >
> >>>perf cmdline is
> >>>
> >>># ./pref record  -g -F 9 --call-graph dwarf ./test_dwarf_unwind
> >>>
> >>>Use default events, precise_ip == 2 so uses PEBS.
> >>>
> >>Testetd 'cycles', 'cycles:p' and 'cycles:pp'. Only 'cycles:pp' captures
> >>sample at callq. So maybe a PEBS problem?
> >Well, that's how our PEBS sampling works: we roll back the instruction pointer to
> >point at the instruction generating the sample. The state itself is
> >post-instruction.
> 
> Just for curiosity:
> 
> how the interrupted process continue to execute, when the PC
> saved in pt_regs still pointed to 'callq' but SP and stack has
> already changes? Do we fix it in kernel, or by hardware?

PEBS is an asynchronous hardware tracing mechanism, when batched PEBS is used it 
might not even result in any interruption of execution. The 'pt_regs' does not 
necessarily correspond to an interrupted, restartable context - we take the RIP 
from the PEBS machinery and also use LBR and disassembly to determine the previous 
instruction, before reporting it to user-space.

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/