linux-kernel - Re: Bad kernel mmap in perf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20100118142414.GA9423@ghostprotocols.net>
Date:	Mon, 18 Jan 2010 12:24:14 -0200
From:	Arnaldo Carvalho de Melo <acme@...radead.org>
To:	Frederic Weisbecker <fweisbec@...il.com>
Cc:	Ingo Molnar <mingo@...e.hu>, Mike Galbraith <efault@....de>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Paul Mackerras <paulus@...ba.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	linux-perf-users@...r.kernel.org
Subject: Re: Bad kernel mmap in perf

Em Mon, Jan 18, 2010 at 12:13:46AM +0100, Frederic Weisbecker escreveu:
> Hi!
> 
> That doesn't look related to my previous problem,
> but I get another trouble:
> 
> $ sudo ./perf sched record
> Couldn't record kernel reference relocation symbol.
> 
> After investigating a bit, it looks like we ask
> event__synthesize_kernel_mmap() to find the kernel text
> mapping boudaries starting from the _text symbol.

Its not exactly to get the kernel boundaries, it could be any symbol that is
present everywhere, we'll just look at where it was at 'perf record' time and
then at 'perf report' time, when we may be using a vmlinux file, where the
values may not be the same due to relocation performed by things like kexec.

Look at:

        dso__load_sym() 
                perf_session__reloc_vmlinux_maps()

> But I don't have _text in /proc/kallsyms, instead I
> have _stext.
> 
> I'm not sure what's the difference between both, looks like
> between _text and _stext I'm supposed to have boot code? (which
> is then unlikely to be used by perf).
> 
> That said the following patch fixes the issue, does that look
> sane to you?

yes, read more below

> diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
> index 7bb9ca1..49492f4 100644
> --- a/tools/perf/builtin-record.c
> +++ b/tools/perf/builtin-record.c
> @@ -569,7 +569,7 @@ static int __cmd_record(int argc, const char **argv)
>  	}
>  
>  	err = event__synthesize_kernel_mmap(process_synthesized_event,
> -					    session, "_text");
> +					    session, "_stext");

Its a good thing we encode the symbol name in the kernel MMAP fake event :-)

We need to find one symbol that is present in all arches, or use a fallback
mechanism to pick one present at 'perf record' time.

Checking here I have "_text" and "_stext" on two 32-bit machines:

[root@...o ~]# uname -a
Linux filo.ghostprotocols.net 2.6.30.10-105.fc11.i586 #1 SMP Thu Dec 24 16:26:26 UTC 2009 i686 athlon i386 GNU/Linux
[root@...o ~]# grep -w _text /proc/kallsyms 
c0400000 T _text
[root@...o ~]# grep -w _stext /proc/kallsyms 
c04010f0 T _stext
[root@...o ~]#

[acme@ana Downloads]$ uname -a
Linux ana.ghostprotocols.net 2.6.31.9-174.fc12.i686 #1 SMP Mon Dec 21 06:24:20 UTC 2009 i686 i686 i386 GNU/Linux
[acme@ana Downloads]$ grep -w _text /proc/kallsyms 
c0400000 T _text
[acme@ana Downloads]$ grep -w _stext /proc/kallsyms 
c04010e8 T _stext
[acme@ana Downloads]$

Also on ppc64:

[acme@...badil ~]$ cat /etc/fedora-release 
Fedora release 11 (Leonidas)
[acme@...badil ~]$ uname -a
Linux bombadil.infradead.org 2.6.30.9-90.fc11.ppc64 #1 SMP Sat Oct 17 11:12:20 EDT 2009 ppc64 ppc64 ppc64 GNU/Linux
[acme@...badil ~]$ grep -w _text /proc/kallsyms 
c000000000000000 T _text
[acme@...badil ~]$ grep -w _stext /proc/kallsyms 
c000000000000000 T _stext
[acme@...badil ~]$

And on parisc64:

acme@...isc:~$ cat /etc/debian_version 
squeeze/sid
acme@...isc:~$ uname -a
Linux parisc 2.6.33-rc4-tip+ #3 SMP Sat Jan 16 15:26:28 BRST 2010 parisc64 GNU/Linux
acme@...isc:~$ grep -w _text /proc/kallsyms 
0000000040100000 A _text
acme@...isc:~$ grep -w _stext /proc/kallsyms 
0000000040100000 T _stext
acme@...isc:~$

And x86-64:

[acme@...pio linux-2.6-tip]$ cat /etc/fedora-release 
Fedora release 11 (Leonidas)
[acme@...pio linux-2.6-tip]$ uname -a
Linux doppio.ghostprotocols.net 2.6.33-rc4-tip+ #3 SMP Wed Jan 13 11:58:15 BRST 2010 x86_64 x86_64 x86_64 GNU/Linux
[acme@...pio linux-2.6-tip]$ grep -w _stext /proc/kallsyms 
ffffffff81000190 T _stext
[acme@...pio linux-2.6-tip]$ grep -w _text /proc/kallsyms 
ffffffff81000000 T _text
[acme@...pio linux-2.6-tip]$


	So changing to "_stext" seems ok and perf.data files collected with it
as the "relocation reference symbol" will work with older perf binaries because
we encode the symbol name in the fake kernel MMAP event.

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/