linux-kernel - [PATCH] perf probe: Fix module probing with shortname

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1442892872-33708-1-git-send-email-wangnan0@huawei.com>
Date:	Tue, 22 Sep 2015 03:34:32 +0000
From:	Wang Nan <wangnan0@...wei.com>
To:	<acme@...hat.com>
CC:	<linux-kernel@...r.kernel.org>, <lizefan@...wei.com>,
	<pi3orama@....com>, Wang Nan <wangnan0@...wei.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Jiri Olsa <jolsa@...hat.com>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
Subject: [PATCH] perf probe: Fix module probing with shortname

After commit 3d39ac538629e4f00a6e1c38d46346f1b8e69505 ("perf machine:
No need to have two DSOs lists"), perf probe with module short name doesn't
work again. For example:

 # lsmod | grep e1000e
 e1000e                233472  0

 # cat /proc/modules | grep e1000e
 e1000e 233472 0 - Live 0xffffffffa0073000

 # cat /proc/kallsyms | grep '\<e1000e_up\>'
 ffffffffa0093860 t e1000e_up[e1000e]

 # perf probe -v -m e1000e --add e1000e_up
 probe-definition(0): e1000e_up
 symbol:e1000e_up file:(null) line:0 offset:0 return:0 lazy:(null)
 0 arguments
 Failed to find module e1000e.
 Could not open debuginfo. Try to use symbols.
 Looking at the vmlinux_path (7 entries long)
 Using /lib/modules/4.2.0-rc7+/build/vmlinux for symbols
 e1000e_up is out of .text, skip it.
   Error: Failed to add events. Reason: No such file or directory (Code: -2)

This is caused by a misunderstood of dso->kernel in kernel_get_module_dso()
that, for kernel module, dso->kernel is DSO_TYPE_USER. dso->kernel is DSO_TYPE_KERNEL
iff dso is vmlinux.

This patch fix 'perf probe -m' with an ad-hoc way.

After this patch:

 # perf probe -v -m e1000e --add e1000e_up
 probe-definition(0): e1000e_up
 symbol:e1000e_up file:(null) line:0 offset:0 return:0 lazy:(null)
 0 arguments
 Open Debuginfo file: /lib/modules/4.2.0-rc7+/kernel/drivers/net/ethernet/intel/e1000e/e1000e.ko
 Try to find probe point from debuginfo.
 Matched function: e1000e_up
 Probe point found: e1000e_up+0
 Found 1 probe_trace_events.
 Opening /sys/kernel/debug/tracing//kprobe_events write=1
 Writing event: p:probe/e1000e_up e1000e:e1000e_up+0
 Added new event:
   probe:e1000e_up      (on e1000e_up in e1000e)

 You can now use it in all perf tools, such as:

 	perf record -e probe:e1000e_up -aR sleep 1

 # perf probe -l
 Failed to find debug information for address ffffffffa0093860
   probe:e1000e_up      (on e1000e_up in e1000e)

Signed-off-by: Wang Nan <wangnan0@...wei.com>
Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
Cc: Namhyung Kim <namhyung@...nel.org>
Cc: Jiri Olsa <jolsa@...hat.com>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
---

I think there may be other places where dso->kernel is misused.
machine__process_kernel_mmap_event() may be one of them. If I understand
correctly, 'dso->kernel && is_kernel_module(dso->long_name)' should always
false theoretically. However, I don't have enough time to check whether that
code really cause problem.

---
 tools/perf/util/probe-event.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 2b78e8f..c7d6d3d 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -270,7 +270,7 @@ static int kernel_get_module_dso(const char *module, struct dso **pdso)

 	if (module) {
 		list_for_each_entry(dso, &host_machine->dsos.head, node) {
-			if (!dso->kernel)
+			if (dso->kernel)
 				continue;
 			if (strncmp(dso->short_name + 1, module,
 				    dso->short_name_len - 2) == 0)
-- 
1.8.3.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/