linux-kernel - Re: [PATCH V4 03/13] kprobes: Add symbols for kprobe insn pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 24 Mar 2020 14:54:05 +0200
From:   Adrian Hunter <adrian.hunter@...el.com>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     Ingo Molnar <mingo@...hat.com>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Borislav Petkov <bp@...en8.de>,
        "H . Peter Anvin" <hpa@...or.com>, x86@...nel.org,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Mathieu Poirier <mathieu.poirier@...aro.org>,
        Leo Yan <leo.yan@...aro.org>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Jiri Olsa <jolsa@...hat.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH V4 03/13] kprobes: Add symbols for kprobe insn pages

On 24/03/20 2:31 pm, Peter Zijlstra wrote:
> On Wed, Mar 04, 2020 at 11:06:23AM +0200, Adrian Hunter wrote:
>> Symbols are needed for tools to describe instruction addresses. Pages
>> allocated for kprobe's purposes need symbols to be created for them.
>> Add such symbols to be visible via /proc/kallsyms.
>>
>> Note: kprobe insn pages are not used if ftrace is configured. To see the
>> effect of this patch, the kernel must be configured with:
>>
>> 	# CONFIG_FUNCTION_TRACER is not set
>> 	CONFIG_KPROBES=y
>>
>> and for optimised kprobes:
>>
>> 	CONFIG_OPTPROBES=y
>>
>> Example on x86:
>>
>> 	# perf probe __schedule
>> 	Added new event:
>> 	  probe:__schedule     (on __schedule)
>> 	# cat /proc/kallsyms | grep '\[__builtin__kprobes\]'
>> 	ffffffffc00d4000 t kprobe_insn_page     [__builtin__kprobes]
>> 	ffffffffc00d6000 t kprobe_optinsn_page  [__builtin__kprobes]
>>
> 
> I'm confused; why are you iterating pages and not slots? A 'page' is not
> a symbol, they contain text, sometimes.

A symbol for each slot is not necessary, and it doesn't look like the slots
can be walked without taking a mutex, which is a problem for kallsyms.

> 
> If you iterate slots you can even get them a proper name; something
> like:
> 
> 	optinsn-sym+xxx [__builtin__kprobes]
> 
> 	insn-sym+xxx [__builtin__kprobes]
> 

Addresses resolve to the previous symbol plus an offset, so it seems to me
that the only difference in what you are proposing is the symbol name, which
can be changed if you like.