linux-kernel - Re: Any tracing mechanism can track the executed instructions of a user process in the kernel?

Open Source and information security mailing list archives

Message-ID: <CAD-N9QW0NEi6Jzh-bu0Bb=RFB6405G28t_jtctk_t8Kw+HUpVQ@mail.gmail.com>
Date:   Mon, 18 Oct 2021 16:41:14 +0800
From:   Dongliang Mu <mudongliangabcd@...il.com>
To:     FMDF <fmdefrancesco@...il.com>
Cc:     kernelnewbies <kernelnewbies@...nelnewbies.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Greg KH <gregkh@...uxfoundation.org>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        Pavel Skripkin <paskripkin@...il.com>
Subject: Re: Any tracing mechanism can track the executed instructions of a
 user process in the kernel?

On Mon, Oct 18, 2021 at 4:07 PM FMDF <fmdefrancesco@...il.com> wrote:
>
> On Mon, 18 Oct 2021, 04:46 Dongliang Mu, <mudongliangabcd@...il.com> wrote:
>>
>> Hi all,
>>
>> I am writing to kindly ask one question: is there any tracing
>> mechanism in Linux kernel that can trace all the executed instructions
>> of a user process? If this user process is run on different
>> processors, traces of this process on different processors should be
>> also recorded.
>
>
> You've not explained in detail what is the purpose of the tracing that you want to do. Missing this information I can only provide you a list of links to various tools and methods. Take a look by yourself and try to figure out what is better suited for your needs...

I want to log all the executed instructions of a user process (e.g.,
poc.c in syzkaller) in the kernel mode and then would like to leverage
backward analysis to capture the root cause of kernel panic/crash.

Therefore, I need the instruction-level tracing mechanisms or tools.

>
> https://lwn.net/Kernel/Index/#Development_tools-Kernel_tracing
> trace-cmd: https://trace-cmd.org

Ftrace is working at the function level. Therefore, ftrace and tracers
based on ftrace are not suitable for my scenario.

> perf ftrace: <Linux source>/tools/perf/Documentation/perf-trace.txt
> perf-tools: https://github.com/brendangregg/perf-tools

I am not familiar with the perf tool and cannot verify if it works for
my scenario.

>
> In particular, the "function_graph" tracer of ftrace seems to be suited for your purposes:
>
> https://man7.org/linux/man-pages/man1/trace-cmd.1.html
> https://man7.org/linux/man-pages/man1/trace-cmd-record.1.html
> https://man7.org/linux/man-pages/man1/trace-cmd-report.1.html
>
> Obviously, gdb (and friends) is still invaluable (but it may be difficult to use, depending on your knowledge and experience, so use it if you really know that  you need it):
>
> https://www.kernel.org/doc/html/latest/dev-tools/gdb-kernel-debugging.html
> https://www.kernel.org/doc/html/latest/dev-tools/kgdb.html
>
> Regards,
>
> Fabio M. De Francesco
>
>>
>> Any comment is welcome.
>>
>> --
>> My best regards to you.
>>
>>      No System Is Safe!
>>      Dongliang Mu
>>
>> _______________________________________________
>> Kernelnewbies mailing list
>> Kernelnewbies@...nelnewbies.org
>> https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives