linux-kernel - Re: Any tracing mechanism can track the executed instructions of a user process in the kernel?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 18 Oct 2021 10:08:32 +0300
From:   Pavel Skripkin <paskripkin@...il.com>
To:     Dongliang Mu <mudongliangabcd@...il.com>,
        kernelnewbies <kernelnewbies@...nelnewbies.org>,
        linux-kernel <linux-kernel@...r.kernel.org>
Cc:     Greg KH <gregkh@...uxfoundation.org>,
        Dan Carpenter <dan.carpenter@...cle.com>
Subject: Re: Any tracing mechanism can track the executed instructions of a
 user process in the kernel?

On 10/18/21 05:45, Dongliang Mu wrote:
> Hi all,
> 
> I am writing to kindly ask one question: is there any tracing
> mechanism in Linux kernel that can trace all the executed instructions
> of a user process? If this user process is run on different
> processors, traces of this process on different processors should be
> also recorded.
> 
>

I think, kernel is not supposed to do that kind of things. I mean, there 
is no such wrapper in the kernel to do this task, AFAIK.

You have an access to all system calls, so you can implement your own 
gdb in the kernel via ptrace() :)


If you need only report about instructions, you can call `perf record` + 
`perf report` via call_usermodehelper() and somehow parse the output of 
these helpers.


> Any comment is welcome.
> 


With regards,
Pavel Skripkin