linux-kernel - Re: [PATCH] tracing/fgraph: support recording function return values

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190716112433.5936c60f@gandalf.local.home>
Date:   Tue, 16 Jul 2019 11:24:33 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     Changbin Du <changbin.du@...il.com>, Will Deacon <will@...nel.org>,
        mingo@...hat.com, corbet@....net, linux@...linux.org.uk,
        catalin.marinas@....com, tglx@...utronix.de, bp@...en8.de,
        hpa@...or.com, x86@...nel.org, linux-doc@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH] tracing/fgraph: support recording function return
 values

On Tue, 16 Jul 2019 16:20:05 +0200
Peter Zijlstra <peterz@...radead.org> wrote:

> On Tue, Jul 16, 2019 at 10:08:18PM +0800, Changbin Du wrote:
> > On Mon, Jul 15, 2019 at 12:12:31PM +0200, Peter Zijlstra wrote:  
> 
> > > Alternatively, we can have recordmcount (or objtool) mark all functions
> > > with a return value when the build has DEBUG_INFO on. The dwarves know
> > > the function signature.
> > >  
> > We can extend the recordmcount tool to search 'subprogram' tag in the DIE tree.
> > In below example, the 'DW_AT_type' is the type of function pidfd_create().
> > 
> > $ readelf -w kernel/pid.o
> >  [...]
> >  <1><1b914>: Abbrev Number: 232 (DW_TAG_subprogram)
> >     <1b916>   DW_AT_name        : (indirect string, offset: 0x415e): pidfd_create
> >     <1b91a>   DW_AT_decl_file   : 1
> >     <1b91b>   DW_AT_decl_line   : 471
> >     <1b91d>   DW_AT_decl_column : 12
> >     <1b91e>   DW_AT_prototyped  : 1
> >     <1b91e>   DW_AT_type        : <0xcc>
> >     <1b922>   DW_AT_low_pc      : 0x450
> >     <1b92a>   DW_AT_high_pc     : 0x50
> >     <1b932>   DW_AT_frame_base  : 1 byte block: 9c 	(DW_OP_call_frame_cfa)
> >     <1b934>   DW_AT_GNU_all_call_sites: 1
> >     <1b934>   DW_AT_sibling     : <0x1b9d9>
> >  [...]
> > 
> > To that end, we need to introduce libdw library for recordmcount. I will have a
> > try this week.  
> 
> Right; but only when this config option is set.

Sure, and we can have fgraph support of return values depend on that
option ;-)

> 
> > And probably, we can also record the parameters?  
> 
> The 'fun' part is where to store all this information in the kernel and
> how fast you can find it while tracing.

This has been on my TODO list for a long time (I'm really happy if
someone else would do it!). My thought is that this information would
need to be able to be a module and loaded (like config.gz can be). And
then you can load the info, do the tracing, and then unload it.

For the speed part, we can add a way to hook the function with the
parameters, which shouldn't be an issue, as we already do that when
filtering for function graph. There's a function hash table that fgraph
users have that is tested to see if it should trace the function or
not. And the functions themselves are recorded in a mostly binary array
that can be looked up via a binary search from the ip address.

-- Steve