linux-kernel - Re: [PATCH] Add support for disabling Intel PT trace in ftrace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20161123165740.GB26852@two.firstfloor.org>
Date:   Wed, 23 Nov 2016 08:57:41 -0800
From:   Andi Kleen <andi@...stfloor.org>
To:     Alexander Shishkin <alexander.shishkin@...el.com>
Cc:     Andi Kleen <andi@...stfloor.org>, linux-kernel@...r.kernel.org,
        Andi Kleen <ak@...ux.intel.com>, tom.zanussi@...ux.intel.com,
        rostedt@...dmis.org, peterz@...radead.org,
        alexander.shishkin@...ux.intel.com
Subject: Re: [PATCH] Add support for disabling Intel PT trace in ftrace

> This will create unexplainable gaps in the trace, at least we should
> output RECORD_AUX when this happens, maybe add a flag for "had to stop
> the trace for reasons external to perf".

I don't think it's unexplainable. After all the user set it up this way.
It's the same as with an address filter for example.

If we started messing with the perf state then we have all the
locking/recursion problems between ftrace and perf.
kprobe can be set on near all kernel functions. I tried to do only
the minimum safe thing. Otherwise it would need a special
black list and likely other things for correctness.

Just disabling is much simpler and avoids all that.

> 
> Also, I can't tell if this is called from an atomic context.

It's not, but it doesn't matter if you just change the MSR. It can
be done in any context.

> 
> But I'd suggest something more generic like perf_pmu_off($pmu):
>  - we already have the code to stop the output;
>  - this won't be a driver-specific api then;
>  - this will be reflected in the event hw state;
>  - it will also go through the driver's callbacks, so its internal
>  states will actually match the reality;

See above.

>  - will work equally well for intel_bts or the ARM/Coresight tracers.

BTS could be handled like PT, but frankly noone should be using that, so I
don't think it's worth it.

-Andi