dannas

#include <sys/auxv.h>
#include <stdio.h>

/* Write vdso segment to a file for post inspection by objdump. */
int main(int argc, char* argv[], char** envp) {
  FILE* fp = fopen("foo.vdso", "w+");
 
 /* Fetch pointer to start of vdso section. */
  void* p = (void*)getauxval(AT_SYSINFO_EHDR);

dannas

How determine which element in a pipeline, stops the pipeline?

• Trying to play mp4 files on a ARM imx53 board.
• End of life, no support from vendor.
• Linux 3.9 with patches for VPU.
• Custom gstreamer plugins developed by Pengutronix.

Video stops ~1.5s before end, independent of file size, but plays smoothly up until then.

What I've tried

dannas

// When will the destructor of class C get called?
// 1. If we call exit?
// 2. If we call abort?
// 3. If we throw an exception?
// 4. If we throw an exception that won't be caught (comment out the try-catch statement) 
//    and thus invokes the terminate() handler?

#include <cstdlib>
#include <iostream>

dannas

QUESTIONS ===
Which counters should be guest only and which should run in hypervisor as well?
    Vmware
        guest only
            instructions retired
            branches retired
        guest + hypervisor
            all other events

dannas

Enabling debug output for v4l2 drivers

To change your current console loglevel to debug

echo 8 > /proc/sys/kernel/printk

First, you can enable v4l2 core debug logs. Check what driver is associated with which device file:

ls /dev/video/by-name/ -l

lrwxrwxrwx 1 root root 12 Jan 1 03:00 coda -> ../../video2

dannas

#include <stdint.h>

// Program for experimenting with C code generation of x86-64 mov instructions.
// https://godbolt.org/z/7UPcax
//
// The x86-64 has grown from the original x86 16-bit arch. A word in Intel terminology is still 16-bits (2 bytes).
// A list of instruction size suffixes
//    b    Byte
//    w    Word
//    l    Double-Word

dannas

#include <stddef.h>

// Demonstrate how nested array accesses are lowered by the C
// compiler. https://godbolt.org/z/Nj4uYn
// 
// A nested array T a[nrows][ncols]. The expression a[i][j] is lowered as:
//
//      a[i][j]
// =>
//      a[i * ncols + j]

dannas

Background

For a speculative attack, 3 conditions are needed

• a cache for holding the dependent load
• a timer with sufficient resolution
• some branches that the hw can speculate over
• If we disable out-of-order execution the problem goes away but we pay a 5-20x slowdown tax
• Remove caches: 50-100x slowdown

RIDL attack

• victim makes a load/store

dannas

#include <vector>
#include <numeric>
using namespace std;

// Compare lowering of loops for -Og, -O2 and -O3
// https://godbolt.org/z/mNtLqi

int f1(const vector<int> &v) {
    int sum = 0;
    for (int val : v) {

dannas

// Example of unwanted reordering gcc 9.3
// https://godbolt.org/z/5AL_wh
// 
// The flag |ready| should be set after the load to the message.
//
// If I use size_t as type for |i| then all three functions give
// the correct ordering, so the compiler needs "something to chew on",
// in this case the sign extension to a 64 bit type, for it to emit 
// the stores in the wrong order.