linux-kernel - RE: perf probe -L sys_select or sys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 12 Aug 2015 00:49:04 +0000
From:	平松雅巳 / HIRAMATU，MASAMI 
	<masami.hiramatsu.pt@...achi.com>
To:	"'Arnaldo Carvalho de Melo'" <acme@...nel.org>
CC:	David Ahern <dsahern@...il.com>, Jiri Olsa <jolsa@...hat.com>,
	"Namhyung Kim" <namhyung@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: RE: perf probe -L sys_select or sys_poll

> From: Arnaldo Carvalho de Melo [mailto:acme@...nel.org]
> 
> Hi Masami,
> 
> 	Have you noticed that sys_select or sys_poll stops after the
> first few lines? Please let me know if you need more info than is below.
> 
>   [root@zoo ~]# perf probe -L sys_select
>   <SyS_select@...me/git/linux/fs/select.c:0>
>       0  SYSCALL_DEFINE5(select, int, n, fd_set __user *, inp, fd_set __user *, outp,
>                         fd_set __user *, exp, struct timeval __user *, tvp)
>          {
>                 struct timespec end_time, *to = NULL;
> 
>   [root@zoo ~]# perf probe -L sys_poll
>   <SyS_poll@...me/git/linux/fs/select.c:0>
>       0  SYSCALL_DEFINE3(poll, struct pollfd __user *, ufds, unsigned int, nfds,
>                         int, timeout_msecs)
>          {
>                 struct timespec end_time, *to = NULL;
> 
>   [root@zoo ~]#
> 
> I haven't investigated it too much, if there is some trouble that makes
> 'perf probe -L' to stop like that maybe we should warn the user somehow?
> 
> Using -v didn't helped that much:
> 
>   [root@zoo ~]# perf probe -v -L sys_poll
>   Using /root/.debug/.build-id/a8/26726b5ddacfab1f0bade868f1a7924f6b20c4 for symbols
>   Open Debuginfo file: /root/.debug/.build-id/a8/26726b5ddacfab1f0bade868f1a7924f6b20c4
>   path: (null)
>   Symbol sys_poll address found : ffffffff812297e0
>   fname: /home/git/linux/fs/select.c, lineno:957
>   New line range: 957 to 2147483647
>   path: /home/git/linux/fs/select.c
>   <SyS_poll@...me/git/linux/fs/select.c:0>
>       0  SYSCALL_DEFINE3(poll, struct pollfd __user *, ufds, unsigned int, nfds,
>                         int, timeout_msecs)
>          {
>                 struct timespec end_time, *to = NULL;
> 
>   [root@zoo ~]#

OK, I got what was wrong.
I've ingestigated and found that SYSCALL_DEFINE macro is doing 

SYSCALL_DEFINE*(foo,...)
{
  body;
}

is expanded as below (on debuginfo)

static inline int SYSC_foo(...)
{
  body;
}
int SyS_foo(...) <- is an alias of sys_foo.
{
  return SYSC_foo(...);
}

"perf probe -L sys_foo" decodes SyS_foo function and it also
skips inlined functions inside the target function because
those functions are usually defined somewhere else.
Thus, it shows only the first line of sys_foo.
BTW, since SYSC_foo doesn't have no instance, "perf probe -L SYSC_foo"
doesn't show anything.

I think we can avoid this problem by checking whether the inlined function
is defined at the same point of the target function definition.

Thank you,

-- 
Masami HIRAMATSU
Linux Technology Research Center, System Productivity Research Dept.
Center for Technology Innovation - Systems Engineering
Hitachi, Ltd., Research & Development Group
E-mail: masami.hiramatsu.pt@...achi.com

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/