linux-kernel - Re: [PATCH 1/3] perf probe: Set retprobe flag when probe in address-based alternative mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150413162344.GL3200@kernel.org>
Date:	Mon, 13 Apr 2015 13:23:44 -0300
From:	Arnaldo Carvalho de Melo <acme@...nel.org>
To:	He Kuang <hekuang@...o.com>
Cc:	He Kuang <hekuang@...wei.com>, masami.hiramatsu.pt@...achi.com,
	a.p.zijlstra@...llo.nl, mingo@...hat.com, namhyung@...nel.org,
	wangnan0@...wei.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/3] perf probe: Set retprobe flag when probe in
 address-based alternative mode

Em Mon, Apr 13, 2015 at 11:23:12PM +0800, He Kuang escreveu:
> 
> 
> On 04/13/2015 10:39 PM, Arnaldo Carvalho de Melo wrote:
> >Em Mon, Apr 13, 2015 at 07:41:28PM +0800, He Kuang escreveu:
> >>Perf probe misses to set retprobe flag back when falling back to
> >>address-based alternative mode.
> >
> >And when is that happens, can you explain? Because I tried to follow your
> >instructions, but in my case it worked in the same way before and after your
> >patch.
> >
> >Can you please provide more context for reviewing your patch?
> >
> 
> More details:
> 
>   [root]# perf probe -v -k vmlinux --add='sys_write%return'
>   probe-definition(0): sys_write%return
>   symbol:sys_write file:(null) line:0 offset:0 return:1 lazy:(null)
>   0 arguments
>   Use vmlinux: vmlinux
>   map_groups__set_modules_path_dir: cannot open /lib/modules/4.0.0-rc6+ dir
>   Problems setting modules path maps, continuing anyway...
>   Using vmlinux for symbols
> 
>   Open Debuginfo file: vmlinux
>   >>>==========================
> 
>   Try to find probe point from debuginfo.
>   Symbol sys_write address found : ffffffff811a8cf0
>   Probe point found: SyS_write+0
>   Found 1 probe_trace_events.
>   Opening /sys/kernel/debug/tracing/kprobe_events write=1
>   Added new event:
>   Writing event: p:probe/sys_write _stext+1739560
>     probe:sys_write      (on sys_write%return)
> 
>   You can now use it in all perf tools, such as:
> 
>           perf record -e probe:sys_write -aR sleep 1
> 
>   [root@...ldroot tmp]# cat /sys/kernel/debug/tracing/kprobe_events
>   p:probe/sys_write _stext+1739560
> 
> 
> The line I marked is different from your result, which is:
>   """Could not open debuginfo. Try to use symbols."""
> 
> 
> When perf probe searched in debuginfo and failed, it tried with alternative,
> in function get_alternative_probe_event():
> 
>         memcpy(tmp, &pev->point, sizeof(*tmp));
> 	memset(&pev->point, 0, sizeof(pev->point));
> 
> In this case, it drops the retprobe flag and forgets to set it back in
> find_alternative_probe_point(), so the problem occurred.

Thanks for the additional information! I will add it to the commit log.

I'm still not being able to reproduce your results, but this time was
because I tried using those separate .dwo debuginfo files, to check if
'perf' would support it already because elfutils would somehow hide that
from us, but that doesn't seem to be the case:

[root@...andy ~]# perf probe -v --add='sys_write%return'
probe-definition(0): sys_write%return
symbol:sys_write file:(null) line:0 offset:0 return:1 lazy:(null)
0 arguments
Looking at the vmlinux_path (7 entries long)
Using /lib/modules/4.0.0-rc6+/build/vmlinux for symbols
Open Debuginfo file: /lib/modules/4.0.0-rc6+/build/vmlinux
Try to find probe point from debuginfo.
Symbol sys_write address found : ffffffff811e5f10
Failed to find scope of probe point.
An error occurred in debuginfo analysis (-2).
  Error: Failed to add events. Reason: No such file or directory (Code: -2)
[root@...andy ~]# cat /sys/kernel/debug/tracing/kprobe_events
[root@...andy ~]#

[root@...andy linux]# grep CONFIG_DEBUG_INFO ../build/v4.0.0-rc6+/.config
CONFIG_DEBUG_INFO=y
# CONFIG_DEBUG_INFO_REDUCED is not set
CONFIG_DEBUG_INFO_SPLIT=y
# CONFIG_DEBUG_INFO_DWARF4 is not set
[root@...andy linux]# 

Masami, this is about using CONFIG_DEBUG_INFO_SPLIT=y, that eventually we
should support, for now I will disable it and test again,

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/