From: Adrian Hunter <adrian.hunter@intel.com>
To: Peter Zijlstra <peterz@infradead.org>
Cc: Nadav Amit <nadav.amit@gmail.com>,
Andi Kleen <ak@linux.intel.com>, Ingo Molnar <mingo@redhat.com>,
Andy Lutomirski <luto@kernel.org>,
Josh Poimboeuf <jpoimboe@redhat.com>,
Edward Cree <ecree@solarflare.com>,
"H . Peter Anvin" <hpa@zytor.com>,
Thomas Gleixner <tglx@linutronix.de>,
LKML <linux-kernel@vger.kernel.org>, X86 ML <x86@kernel.org>,
Paolo Abeni <pabeni@redhat.com>, Borislav Petkov <bp@alien8.de>,
David Woodhouse <dwmw@amazon.co.uk>,
Alexander Shishkin <alexander.shishkin@linux.intel.com>,
songliubraving@fb.com
Subject: Re: Tracing text poke / kernel self-modifying code (Was: Re: [RFC v2 0/6] x86: dynamic indirect branch promotion)
Date: Thu, 29 Aug 2019 12:40:56 +0300 [thread overview]
Message-ID: <d37f678f-cf1d-5c98-228f-05bed99f2112@intel.com> (raw)
In-Reply-To: <20190829085339.GN2369@hirez.programming.kicks-ass.net>
On 29/08/19 11:53 AM, Peter Zijlstra wrote:
> On Thu, Aug 29, 2019 at 11:23:52AM +0300, Adrian Hunter wrote:
>> On 9/01/19 12:35 PM, Peter Zijlstra wrote:
>>> On Tue, Jan 08, 2019 at 12:47:42PM -0800, Nadav Amit wrote:
>>>
>>>> A general solution is more complicated, however, due to the racy nature of
>>>> cross-modifying code. There would need to be TSC recording of the time
>>>> before the modifications start and after they are done.
>>>>
>>>> BTW: I am not sure that static-keys are much better. Their change also
>>>> affects the control flow, and they do affect the control flow.
>>>
>>> Any text_poke() user is a problem; which is why I suggested a
>>> PERF_RECORD_TEXT_POKE that emits the new instruction. Such records are
>>> timestamped and can be correlated to the trace.
>>>
>>> As to the racy nature of text_poke, yes, this is a wee bit tricky and
>>> might need some care. I _think_ we can make it work, but I'm not 100%
>>> sure on exactly how PT works, but something like:
>>>
>>> - write INT3 byte
>>> - IPI-SYNC
>>>
>>> and ensure the poke_handler preserves the existing control flow (which
>>> it currently does not, but should be possible).
>>>
>>> - emit RECORD_TEXT_POKE with the new instruction
>>>
>>> at this point the actual control flow will be through the INT3 and
>>> handler and not hit the actual instruction, so the actual state is
>>> irrelevant.
>>>
>>> - write instruction tail
>>> - IPI-SYNC
>>> - write first byte
>>> - IPI-SYNC
>>>
>>> And at this point we start using the new instruction, but this is after
>>> the timestamp from the RECORD_TEXT_POKE event and decoding should work
>>> just fine.
>>>
>>
>> Presumably the IPI-SYNC does not guarantee that other CPUs will not already
>> have seen the change. In that case, it is not possible to provide a
>> timestamp before which all CPUs executed the old code, and after which all
>> CPUs execute the new code.
>
> 'the change' is an INT3 poke, so either you see the old code flow, or
> you see an INT3 emulate the old flow in your trace.
>
> That should be unambiguous.
>
> Then you emit the RECORD_TEXT_POKE with the new instruction on. This
> prepares the decoder to accept a new reality.
>
> Then we finish the instruction poke.
>
> And then when the trace no longer shows INT3 exceptions, you know the
> new code is in effect.
>
> How is this ambiguous?
It's not. I didn't get that from the first read, sorry.
Can you expand on "and ensure the poke_handler preserves the existing
control flow"? Whatever the INT3-handler does will be traced normally so
long as it does not itself execute self-modified code.
next prev parent reply other threads:[~2019-08-29 9:42 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-31 7:21 [RFC v2 0/6] x86: dynamic indirect branch promotion Nadav Amit
2018-12-31 7:21 ` [RFC v2 1/6] x86: introduce kernel restartable sequence Nadav Amit
2018-12-31 20:08 ` Andy Lutomirski
2018-12-31 21:12 ` Nadav Amit
2019-01-03 22:21 ` Andi Kleen
2019-01-03 22:29 ` Nadav Amit
2019-01-03 22:48 ` Andi Kleen
2019-01-03 22:52 ` Nadav Amit
2019-01-03 23:40 ` Andi Kleen
2019-01-03 23:56 ` Nadav Amit
2019-01-04 0:34 ` hpa
2018-12-31 7:21 ` [RFC v2 2/6] objtool: ignore instructions Nadav Amit
2018-12-31 7:21 ` [RFC v2 3/6] x86: patch indirect branch promotion Nadav Amit
2018-12-31 7:21 ` [RFC v2 4/6] x86: interface for accessing indirect branch locations Nadav Amit
2018-12-31 7:21 ` [RFC v2 5/6] x86: learning and patching indirect branch targets Nadav Amit
2018-12-31 20:05 ` Andy Lutomirski
2018-12-31 21:07 ` Nadav Amit
2018-12-31 7:21 ` [RFC v2 6/6] x86: outline optpoline Nadav Amit
2018-12-31 19:51 ` [RFC v2 0/6] x86: dynamic indirect branch promotion Andy Lutomirski
2018-12-31 19:53 ` Nadav Amit
2019-01-03 18:10 ` Josh Poimboeuf
2019-01-03 18:30 ` Nadav Amit
2019-01-03 20:31 ` Josh Poimboeuf
2019-01-03 22:18 ` Andi Kleen
2019-01-07 16:32 ` Peter Zijlstra
2019-01-08 7:47 ` Adrian Hunter
2019-01-08 9:25 ` Peter Zijlstra
2019-01-08 10:01 ` Adrian Hunter
2019-01-08 10:10 ` Peter Zijlstra
2019-01-08 17:27 ` Andi Kleen
2019-01-08 18:28 ` Nadav Amit
2019-01-08 19:01 ` Peter Zijlstra
2019-01-08 20:47 ` Nadav Amit
2019-01-08 20:53 ` Andi Kleen
2019-01-09 10:35 ` Peter Zijlstra
2019-08-29 8:23 ` Tracing text poke / kernel self-modifying code (Was: Re: [RFC v2 0/6] x86: dynamic indirect branch promotion) Adrian Hunter
2019-08-29 8:53 ` Peter Zijlstra
2019-08-29 9:40 ` Adrian Hunter [this message]
2019-08-29 11:46 ` Peter Zijlstra
2019-09-12 7:00 ` Adrian Hunter
2019-09-12 12:17 ` hpa
2019-01-08 18:57 ` [RFC v2 0/6] x86: dynamic indirect branch promotion Peter Zijlstra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d37f678f-cf1d-5c98-228f-05bed99f2112@intel.com \
--to=adrian.hunter@intel.com \
--cc=ak@linux.intel.com \
--cc=alexander.shishkin@linux.intel.com \
--cc=bp@alien8.de \
--cc=dwmw@amazon.co.uk \
--cc=ecree@solarflare.com \
--cc=hpa@zytor.com \
--cc=jpoimboe@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=nadav.amit@gmail.com \
--cc=pabeni@redhat.com \
--cc=peterz@infradead.org \
--cc=songliubraving@fb.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).