linux-kernel - Re: [PATCH 2/2] perf probe: Allow user to specify address within executable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <529C9DDF.1080401@gmail.com>
Date:	Mon, 02 Dec 2013 07:49:03 -0700
From:	David Ahern <dsahern@...il.com>
To:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
CC:	acme@...stprotocols.net, linux-kernel@...r.kernel.org,
	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>,
	Oleg Nesterov <oleg@...hat.com>, namhyung@...nel.org,
	"yrl.pp-manager.tt@...achi.com" <yrl.pp-manager.tt@...achi.com>
Subject: Re: [PATCH 2/2] perf probe: Allow user to specify address within
 executable

On 12/1/13, 11:15 PM, Masami Hiramatsu wrote:
> (2013/12/02 9:07), David Ahern wrote:
>> Allow user to specify an address within an executable. This is useful, for
>> example, in probing local functions. If the function name begins with 0x
>> then try to convert the supplied name to an address. If succuessful then
>> treat the function name as the address within the executable to be probed.
> 
> Hmm, IMHO, this kind of functionality is only good for debugging.

Why? perf-probe takes the function name, looks up the address in the
executable, adds an offset and then pushes that address to the kernel.
Why can't I have an option to jump straight to the desired address?

A few use cases that come to mind:

1. Allows manual creation of return probes in kernels which do not have
that support.

2. probing static functions

3. probing versioned addresses in libc -- something the current syntax
does not allow because '@' is used as a field separator:

$ nm /lib64/libc-2.14.90.so | grep pthread_cond_timedwait
00000000000fe6c0 t __pthread_cond_timedwait
000000000012d920 t __pthread_cond_timedwait_2_0
00000000000fe6c0 T pthread_cond_timedwait@@GLIBC_2.3.2
000000000012d920 T pthread_cond_timedwait@...BC_2.2.5

$ perf probe -x /lib64/libc-2.14.90.so -a
'cond_timewait=pthread_cond_timedwait'
no symbols found in /lib64/libc-2.14.90.so, maybe install a debug package?
Failed to load map.
  Error: Failed to add events. (-22)

$ perf probe -x /lib64/libc-2.14.90.so -a
'cond_timewait=pthread_cond_timedwait@@GLIBC_2.3.2'
Semantic error :SRC@SRC is not allowed.

4. A workaround for any other shortcomings in the interface that require
patches to fix and backports to be done. backports which take time if
even possible.

> In that case, you should use uprobe_events interface directly.

How do I do that within the context of perf?

> 
> I recommend you to try enabing dwarf support in user space.
> Perf probe is a user-friendly interface of dynamic events.

I do have dwarf support enabled in perf. Are you referring to other
components of userspace (like system libraries)?

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/