linux-kernel - Re: [PATCH 1/1] perf symbols: Use the buildids if present

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091105120118.GB3494@ghostprotocols.net>
Date:	Thu, 5 Nov 2009 10:01:18 -0200
From:	Arnaldo Carvalho de Melo <acme@...radead.org>
To:	Ingo Molnar <mingo@...e.hu>
Cc:	Masami Hiramatsu <mhiramat@...hat.com>,
	linux-kernel@...r.kernel.org,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	Christoph Hellwig <hch@...radead.org>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	Frédéric Weisbecker <fweisbec@...il.com>,
	"H. Peter Anvin" <hpa@...or.com>, Jason Baron <jbaron@...hat.com>,
	Jim Keniston <jkenisto@...ibm.com>,
	"K. Prasad" <prasad@...ux.vnet.ibm.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Roland McGrath <roland@...hat.com>,
	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>,
	Steven Rostedt <rostedt@...dmis.org>
Subject: Re: [PATCH 1/1] perf symbols: Use the buildids if present

Em Thu, Nov 05, 2009 at 09:27:33AM +0100, Ingo Molnar escreveu:
> 
> * Masami Hiramatsu <mhiramat@...hat.com> wrote:
> 
> > Arnaldo Carvalho de Melo wrote:
> >> From: Arnaldo Carvalho de Melo<acme@...hat.com>
> >>
> >> Now 'perf record' will intercept PERF_RECORD_MMAP calls, creating a
> >> linked list of DSOs, then when the session finishes, it will traverse
> >> this list and read the buildids, stashing them at the end of the file
> >> and will set up a new feature bit in the header bitmask.
> >>
> >> 'perf report' will then notice this feature and populate the 'dsos' list
> >> and set the build ids.
> >>
> >> When reading the symtabs it will refuse to load from a file that doesn't
> >> have the same build id.
> >>
> >> Example:
> >>
> >>   [root@...pio ~]# perf report | head
> >>   /home/acme/bin/perf with build id b1ea544ac3746e7538972548a09aadecc5753868 not found, continuing without symbols
> >>    # Samples: 2621434559
> >>    #
> >>    # Overhead          Command                  Shared Object  Symbol
> >>    # ........  ...............  .............................  ......
> >>    #
> >>         7.91%             init  [kernel]        [k] read_hpet
> >>         7.64%             init  [kernel]        [k] mwait_idle_with_hints
> >>         7.60%          swapper  [kernel]        [k] read_hpet
> >>         7.60%          swapper  [kernel]        [k] mwait_idle_with_hints
> >>         3.65%             init  [kernel]        [k] 0xffffffffa02339d9
> >> [root@...pio ~]#
> >>
> >> In this case the 'perf' binary was an older one, vanished, so it the symbols
> >> probably wouldn't match.
> >>
> >> Next patches will support the kernel as well, reading the build id notes for it
> >> and the modules from /sys.
> >
> > Great! then I can use it on 'perf probe' to check the dwarf binary is
> > same as running kernel.

Yes, at perf record I'll always get the build id from /sys/kernel/notes
and insert it in the buildid table, then at 'perf report' it will match
it against the file from where it is getting the symbols, be it
/proc/kallsyms or the vmlinux file, be it one specified in the command
line, found on some standard location (/sys/kernel/`uname
-r`/build/vmlinux) or from some new /sys file, as Ingo suggests.

The resulting infrastructure can then be used in perf probe to match
running kernel buildid against the vmlinux used.

> >> Another patch should also introduce a new plumbing command:
> >>
> >> 'perf list-buildids'
> >>
> >> that will then be used in porcelain that is distro specific to
> >> fetch -debuginfo packages where such buildids are present. This will in turn
> >> allow for one to run 'perf record' in one machine and 'perf report' in another.
> >
> > Hmm, so, will this command list up all debuginfo files with buildids?
> > If so, can it also find a kernel binary built locally?
> 
> Arnaldo, how about adding the kernel binary's build path to 
> /sys/kernel/notes, during the kernel build? (With perhaps a .config 
> override as well, for package builds.)
> 
> That object might or might not exist, and if it does not exist, or if 
> there is a buildid mismatch, we can fall back to 'well known' places for 
> kernel/module binaries.

Yeah, I'll do that. I haven't touched much of the kernel because I'm
trying to use what is already there to the fullest extent.

But there are things to do in the kernel (and wiki), yeah:

1. atomically generate mmap events, keeping the synthesize mmap/comm
events that traverses /proc/ pidspace just for older kernels

2. insert the buildid in the PERF_RECORD_MMAP events

3. kernel binary build path

4. write such entries in the perf wiki TODO page

:-)

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/