linux-kernel - Re: Process-wide watchpoints

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+Z34tz4k09Ei+BDzrM1XmftTzTRBG7nkJLReN+ZTUXhPw@mail.gmail.com>
Date:   Thu, 4 Feb 2021 09:10:52 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Namhyung Kim <namhyung@...nel.org>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Jiri Olsa <jolsa@...hat.com>, Will Deacon <will@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Matt Morehouse <mascasa@...gle.com>
Subject: Re: Process-wide watchpoints

On Wed, Feb 3, 2021 at 6:38 AM Namhyung Kim <namhyung@...nel.org> wrote:
>
> Hello,
>
> On Sun, Jan 31, 2021 at 7:28 PM Dmitry Vyukov <dvyukov@...gle.com> wrote:
> > Not directly related to the above question, but related to my use case.
> > Could we extend bpf_perf_event_data with some more data re breakpoint events?
> >
> > struct bpf_perf_event_data {
> >     bpf_user_pt_regs_t regs;
> >     __u64 sample_period;
> >     __u64 addr;
> > };
> >
> > Ideally, I would like to have an actual access address, size and
> > read/write type (may not match bp addr/size). Is that info easily
> > available at the point of bpf hook call?
> > Or, if that's not available at least breakpoint bp_type/bp_size.
> >
> > Is it correct that we can materialize in bpf_perf_event_data anything
> > that's available in bpf_perf_event_data_kern (if it makes sense in the
> > public interface of course)?
> >
> > struct bpf_perf_event_data_kern {
> >     bpf_user_pt_regs_t *regs;
> >     struct perf_sample_data *data;
> >     struct perf_event *event;
> > };
> >
> > Unfortunately I don't see perf_event_attr.bp_type/bp_size
> > stored/accessible anywhere in bpf_perf_event_data_kern. What would be
> > the right way to expose them in bpf_perf_event_data?
>
> I think you can access it via event->attr.bp_type/size in the struct
> bpf_perf_event_data_kern.


Hi Namhyung,

Right, that's I need. Thanks.