linux-kernel - Re: x86_64 Compiler Output Kernel Bloat v4.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 19 Jan 2016 08:39:30 +0100
From:	Jiri Olsa <jolsa@...hat.com>
To:	Jeff Merkey <linux.mdb@...il.com>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Andy Lutomirski <luto@...capital.net>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>, X86 ML <x86@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Andy Lutomirski <luto@...nel.org>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Borislav Petkov <bp@...en8.de>, Jiri Olsa <jolsa@...nel.org>
Subject: Re: x86_64 Compiler Output Kernel Bloat v4.4

On Mon, Jan 18, 2016 at 02:45:14PM -0700, Jeff Merkey wrote:

SNIP

> > 0xffffffffa073e019 E8C2579FE0      call   touch_softlockup_watchdog_sync
> > 0xffffffffa073e01e E87D2B9BE0      call   clocksource_touch_watchdog
> > 0xffffffffa073e023 E8F8099AE0      call   rcu_cpu_stall_reset
> > 0xffffffffa073e028 E893579FE0      call   touch_nmi_watchdog
> > 0xffffffffa073e02d 5D              pop    rbp
> > 0xffffffffa073e02e 6690            data16
> > 0xffffffffa073e030 C3              ret
> > 0xffffffffa073e031 6666666666662E0F1F840000000000  nop    cs:WORD PTR
> > [rax+rax]=0x0000
> > mdb|mdb:
> > 0xffffffffa073e040 0F1F440000      nop    DWORD PTR [rax+rax]=0x0  <<
> > 0xffffffffa073e045 55              push   rbp
> > 0xffffffffa073e046 4889E5          mov    rbp,rsp
> > 0xffffffffa073e049 4157            push   r15
> > 0xffffffffa073e04b 4156            push   r14
> > 0xffffffffa073e04d 4989FE          mov    r14,rdi
> > 0xffffffffa073e050 4155            push   r13
> > (0)> g
> >
> > Jeff
> >
> 
> I think xor eax,eax is a lot shorter and fewer bytes.

that 5 byte nop gets replaced by call instruction once the
function trace is enabled

explained in CONFIG_FUNCTION_TRACER option doc:


config FUNCTION_TRACER
        bool "Kernel Function Tracer"
        depends on HAVE_FUNCTION_TRACER
        select KALLSYMS
        select GENERIC_TRACER
        select CONTEXT_SWITCH_TRACER
        help
          Enable the kernel to trace every kernel function. This is done
          by using a compiler feature to insert a small, 5-byte No-Operation
          instruction at the beginning of every kernel function, which NOP
          sequence is then dynamically patched into a tracer call when
          tracing is enabled by the administrator. If it's runtime disabled
          (the bootup default), then the overhead of the instructions is very
          small and not measurable even in micro-benchmarks.

jirka