linux-kernel - Re: [PATCH 2/4] perf probe: Fix failure to probe online module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 01 Jul 2015 20:14:20 +0900
From:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
To:	He Kuang <hekuang@...wei.com>, acme@...nel.org,
	a.p.zijlstra@...llo.nl, mingo@...hat.com, namhyung@...nel.org,
	jolsa@...nel.org
CC:	wangnan0@...wei.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/4] perf probe: Fix failure to probe online module

On 2015/07/01 18:05, He Kuang wrote:
> Kernel module has the type DSO_TYPE_USER, the check on dso type in
> kernel_get_module_dso() disable openning debuginfo of online kernel
> modules.
> 
> Problem can be reproduced as:
> 
>   $ insmod test_bpf.ko
> 
>   $ perf probe -v -m test_bpf --add='skb_is_nonlinear'
> 
>   probe-definition(0): skb_is_nonlinear
>   symbol:skb_is_nonlinear file:(null) line:0 offset:0 return:0 lazy:(null)
>   0 arguments
>   Failed to find module test_bpf.
>   Could not open debuginfo. Try to use symbols.
>   Failed to find symbol skb_is_nonlinear in test_bpf
>     Error: Failed to add events. Reason: No such file or directory (Code: -2)
> 
> Infact kernel_get_module_dso() function is called in perf-probe, in this
> condition, machine->dsos list contains only dsos which is either kmod or
> kernel loaded by machine__create_kernel_maps(), so there's no need to
> pick away the non-kmod user type dsos.
> 
> This patch removes the check.
> 
> After this patch:
> 
>   $ perf probe -v -m test_bpf --add='skb_is_nonlinear'
> 
>   probe-definition(0): skb_is_nonlinear
>   symbol:skb_is_nonlinear file:(null) line:0 offset:0 return:0 lazy:(null)
>   0 arguments
>   Open Debuginfo file: /lib/modules/4.1.0+/test_bpf.ko
>   Try to find probe point from debuginfo.
>   Matched function: skb_is_nonlinear
>   found inline addr: 0x10ab3
>   Probe point found: test_bpf_init+585
>   Found 1 probe_trace_events.
>   Opening /sys/kernel/debug/tracing/kprobe_events write=1
>   Added new event:
>   Writing event: p:probe/skb_is_nonlinear test_bpf:test_bpf_init+585
>     probe:skb_is_nonlinear (on skb_is_nonlinear in test_bpf)
> 
>   You can now use it in all perf tools, such as:
> 
>       perf record -e probe:skb_is_nonlinear -aR sleep 1

Oops, OK. Without debuginfo, that always fails. I've tested on my machine.

Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>

Thank you!

> 
> Signed-off-by: He Kuang <hekuang@...wei.com>
> ---
>  tools/perf/util/probe-event.c | 2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
> index 381f23a..8ad2743 100644
> --- a/tools/perf/util/probe-event.c
> +++ b/tools/perf/util/probe-event.c
> @@ -275,8 +275,6 @@ static int kernel_get_module_dso(const char *module, struct dso **pdso)
>  
>  	if (module) {
>  		list_for_each_entry(dso, &host_machine->dsos.head, node) {
> -			if (!dso->kernel)
> -				continue;
>  			if (strncmp(dso->short_name + 1, module,
>  				    dso->short_name_len - 2) == 0)
>  				goto found;
> 


-- 
Masami HIRAMATSU
Linux Technology Research Center, System Productivity Research Dept.
Center for Technology Innovation - Systems Engineering
Hitachi, Ltd., Research & Development Group
E-mail: masami.hiramatsu.pt@...achi.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/