linux-kernel - Re: [PATCH 1/3] perf probe: Set retprobe flag when probe in address-based alternative mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150413204251.GA14885@kernel.org>
Date:	Mon, 13 Apr 2015 17:42:51 -0300
From:	Arnaldo Carvalho de Melo <acme@...nel.org>
To:	He Kuang <hekuang@...o.com>
Cc:	He Kuang <hekuang@...wei.com>, masami.hiramatsu.pt@...achi.com,
	a.p.zijlstra@...llo.nl, mingo@...hat.com, namhyung@...nel.org,
	wangnan0@...wei.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/3] perf probe: Set retprobe flag when probe in
 address-based alternative mode

Em Mon, Apr 13, 2015 at 11:38:19PM +0800, He Kuang escreveu:
> Hi, Arnaldo
> 
> On 04/13/2015 10:42 PM, Arnaldo Carvalho de Melo wrote:
> >Em Mon, Apr 13, 2015 at 11:39:03AM -0300, Arnaldo Carvalho de Melo escreveu:
> >>Em Mon, Apr 13, 2015 at 07:41:28PM +0800, He Kuang escreveu:
> >>>Perf probe misses to set retprobe flag back when falling back to
> >>>address-based alternative mode.
> >
> >>Humm, noticed one other problem, but not with your patch, about this message:
> >
> >>"Could not open debuginfo. Try to use symbols."
> >
> >>That is really not clear, specially that "try to use symbols" :-)
> >
> >>[root@...andy ~]# ls -la /root/.debug/.build-id/dd/32e51921ede0fd46f034091b7f6a0f2e01ebda
> >>lrwxrwxrwx. 1 root root 86 Apr 10 18:02 /root/.debug/.build-id/dd/32e51921ede0fd46f034091b7f6a0f2e01ebda -> ../../home/acme/git/build/v4.0.0-rc6+/vmlinux/dd32e51921ede0fd46f034091b7f6a0f2e01ebda
> >>[root@...andy ~]# ls -la /root/.debug/.build-id/dd/../../home/acme/git/build/v4.0.0-rc6+/vmlinux/dd32e51921ede0fd46f034091b7f6a0f2e01ebda
> >>-rwxr-xr-x. 1 root root 22698661 Apr 10 18:02 /root/.debug/.build-id/dd/../../home/acme/git/build/v4.0.0-rc6+/vmlinux/dd32e51921ede0fd46f034091b7f6a0f2e01ebda
> >>[root@...andy ~]# ls -la /root/.debug/.build-id/dd/../../home/acme/git/build/v4.0.0-rc6+/vmlinux/dd32e51921ede0fd46f034091b7f6a0f2e01ebda
> >
> >>I.e. it managed to read the debuginfo, its just that it has no symbols in it :-)
> >
> >>Anyway, digression ended.
> >
> >Interesting is that when testing your next patch I see:
> >
> >   [root@...andy linux]#  perf probe -s ./kernel_src/ --add='fs/super.c;s->s_count=1;'
> >   The /root/.debug/.build-id/dd/32e51921ede0fd46f034091b7f6a0f2e01ebda file has no debug information.
> >   Rebuild with CONFIG_DEBUG_INFO=y, or install an appropriate debuginfo package.
> >     Error: Failed to add events.
> >   [root@...andy linux]#
> >
> >Much, much clear message about that debuginfo file :-)
> >
> >But then, to test your [2/3] patch I'll have to figure out how to setup the
> >environment so that I can match your results, shouldn't be hard, but would
> >save reviewing time if you stated it in the commit log message.
> 
> Sorry for not providing enough information.
> 
> -s ./kernel_src/
> 
> The kernel_src dir is a kernel source tree path, it can be
> anywhere, for test you can only put fs/super.c in it:
> 
> kernel_src/
>   -- fs
>      -- super.c
> 
> -k vmlinux
> 
> This is necessary and should be matched to your running kernel.

Normally I don't use this, as 'make install' will set it to a place that
the perf symbol code will look, check its build id, see that it matches
the what is running, i.e. this will hold true:

[root@...andy ~]# perf buildid-list --hell 2>&1 | grep -- --kernel
    -k, --kernel          Show current kernel build id
[root@...andy ~]# perf buildid-list --kernel
cd1d2cf9f473d0cac668e3afee32866da4540bd4
[root@...andy ~]#
[root@...andy ~]# perf buildid-list -i
/lib/modules/4.0.0-rc6+/build/vmlinux
cd1d2cf9f473d0cac668e3afee32866da4540bd4

I.e. no need to explicitely pass '-k vmlinux':

[root@...andy ~]# perf probe -v --add='sys_write%return'
probe-definition(0): sys_write%return
symbol:sys_write file:(null) line:0 offset:0 return:1 lazy:(null)
0 arguments
Looking at the vmlinux_path (7 entries long)
Using /lib/modules/4.0.0-rc6+/build/vmlinux for symbols
Open Debuginfo file: /lib/modules/4.0.0-rc6+/build/vmlinux
Try to find probe point from debuginfo.
Symbol sys_write address found : ffffffff811e5f10
Probe point found: SyS_write+0
Found 1 probe_trace_events.
Opening /sys/kernel/debug/tracing/kprobe_events write=1
Added new event:
Writing event: r:probe/sys_write SyS_write+0
  probe:sys_write      (on sys_write%return)

You can now use it in all perf tools, such as:

	perf record -e probe:sys_write -aR sleep 1

[root@...andy ~]#

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/