lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:	Wed, 13 Apr 2016 10:06:57 +0900
From:	Namhyung Kim <namhyung@...nel.org>
To:	Arnaldo Carvalho de Melo <acme@...nel.org>
Cc:	Jiri Olsa <jolsa@...nel.org>, David Ahern <dsahern@...il.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Milian Wolff <milian.wolff@...b.com>,
	Wang Nan <wangnan0@...wei.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: zeros in frame pointer callchains

Hi Arnaldo,

On Tue, Apr 12, 2016 at 10:38:47AM -0300, Arnaldo Carvalho de Melo wrote:
> Hi,
> 
> 	Namhyung, while working on supporting callchains in 'perf trace' I
> noticed something I think we discussed at some point, zeros in frame pointer
> callchains...
> 
> 	Oh well figured it out, its probably userspace not having frame
> pointers, grrr anyway, keeping the rest of the message, for reference,
> but now I think we need to have some expressiveness to say that for that
> particular event we want to use perf_event_attr.exclude_callchain_user... 
> 
> First add a special probe point that 'perf trace' uses, if present:
> 
>   # perf probe 'vfs_getname=getname_flags:72 pathname=filename:string'
> 
> 	Then lets ask to see just when this thing hits, no syscall
> printing whatsoever ('trace' == 'perf trace'), sometimes just a few
> zeros at the top, sometimes a long series, need to investigate how to
> chop those off in the kernel, not to use the ring buffer needlessly,
> will start chopping these in userspace (in perf trace):

My solution was to look at /proc/sys/vm/mmap_min_addr [1].  For kernel
it'd be simply discarding callchains after seeing an address below the
mmap_min_addr.  For userspace, it requires to carry the mmap_min_addr
via feature bit or something.  Or Maybe we can just discard addresses
under 4096 for simplicity?


[1] https://lkml.org/lkml/2015/11/26/40

Thanks,
Namhyung


> 
>   # trace --no-sys --ev probe:vfs_getname/call-graph=fp/
>   
>  34033.533 probe:vfs_getname:(ffffffff8124c06c) pathname="/usr/share/pixmaps")
>                                        getname_flags+0xfe20009d ([kernel.kallsyms])
>                                        user_path_at_empty+0xfe200023 ([kernel.kallsyms])
>                                        vfs_fstatat+0xfe200066 ([kernel.kallsyms])
>                                        SYSC_newstat+0xfe20002e ([kernel.kallsyms])
>                                        sys_newstat+0xfe20000e ([kernel.kallsyms])
>                                        entry_SYSCALL_64_fastpath+0xfe20001a ([kernel.kallsyms])
>                                        __xstat64+0xffff011e90b98015 (/usr/lib64/libc-2.22.so)
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>  36001.681 probe:vfs_getname:(ffffffff8124c06c) pathname="/var/tmp")
>                                        getname_flags+0xfe20009d ([kernel.kallsyms])
>                                        user_path_at_empty+0xfe200023 ([kernel.kallsyms])
>                                        vfs_fstatat+0xfe200066 ([kernel.kallsyms])
>                                        SYSC_newstat+0xfe20002e ([kernel.kallsyms])
>                                        sys_newstat+0xfe20000e ([kernel.kallsyms])
>                                        entry_SYSCALL_64_fastpath+0xfe20001a ([kernel.kallsyms])
>                                        __xstat64+0xffff00b816a28015 (/usr/lib64/libc-2.22.so)
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>  36001.696 probe:vfs_getname:(ffffffff8124c06c) pathname="/var/tmp")
>                                        getname_flags+0xfe20009d ([kernel.kallsyms])
>                                        user_path_at_empty+0xfe200023 ([kernel.kallsyms])
>                                        sys_access+0xfe2000b4 ([kernel.kallsyms])
>                                        entry_SYSCALL_64_fastpath+0xfe20001a ([kernel.kallsyms])
>                                        __GI___access+0xffff00b816a28007 (/usr/lib64/libc-2.22.so)
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>   8254.597 probe:vfs_getname:(ffffffff8124c06c) pathname="/etc/localtime")
>                                        getname_flags+0xfe20009d ([kernel.kallsyms])
>                                        user_path_at_empty+0xfe200023 ([kernel.kallsyms])
>                                        vfs_fstatat+0xfe200066 ([kernel.kallsyms])
>                                        SYSC_newstat+0xfe20002e ([kernel.kallsyms])
>                                        sys_newstat+0xfe20000e ([kernel.kallsyms])
>                                        entry_SYSCALL_64_fastpath+0xfe20001a ([kernel.kallsyms])
>                                        __xstat64+0xffff0104f5696015 (/usr/lib64/libc-2.22.so)
>                                        [0] ([unknown])
>                                        [0] ([unknown])
>   9001.567 probe:vfs_getname:(ffffffff8124c06c) pathname="/etc/firewalld/ipsets")
>                                        getname_flags+0xfe20009d ([kernel.kallsyms])
>                                        user_path_at_empty+0xfe200023 ([kernel.kallsyms])
>                                        sys_inotify_add_watch+0xfe200098 ([kernel.kallsyms])
>                                        entry_SYSCALL_64_fastpath+0xfe20001a ([kernel.kallsyms])
>                                        inotify_add_watch+0xffff008bb9432007 (/usr/lib64/libc-2.22.so)
>   9450.181 probe:vfs_getname:(ffffffff8124c06c) pathname="/root")
>                                        getname_flags+0xfe20009d ([kernel.kallsyms])
>                                        user_path_at_empty+0xfe200023 ([kernel.kallsyms])
>                                        sys_inotify_add_watch+0xfe200098 ([kernel.kallsyms])
>                                        entry_SYSCALL_64_fastpath+0xfe20001a ([kernel.kallsyms])
>                                        inotify_add_watch+0xffff01b7aa4f2007 (/usr/lib64/libc-2.22.so)

Powered by blists - more mailing lists