linux-kernel - Re: [PATCH v3] Allow user probes on versioned symbols

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <a0c9ba7b-5f79-a73d-3237-7ec8a0cbb7bd@us.ibm.com>
Date:   Wed, 5 Apr 2017 22:45:29 -0500
From:   Paul Clarke <pc@...ibm.com>
To:     Arnaldo Carvalho de Melo <acme@...nel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        David Ahern <dsahern@...il.com>,
        linux-perf-users <linux-perf-users@...r.kernel.org>
Subject: Re: [PATCH v3] Allow user probes on versioned symbols

On 04/04/2017 09:26 AM, Arnaldo Carvalho de Melo wrote:
> Em Tue, Apr 04, 2017 at 11:18:02PM +0900, Masami Hiramatsu escreveu:
>> On Mon, 3 Apr 2017 11:46:58 -0300
>> Arnaldo Carvalho de Melo <acme@...nel.org> wrote:
>> > > > But apart from those problems, I think that one should be able to ask
>> > > > for a versioned symbol, to probe just apps using that specific version,
>> >
>> > > I agree, but wasn't trying to tackle that at the moment.  I can look into it, though.
>> >
>> > > > for instance, we should consider the whole name as two functions, which
>> > > > in fact, they are, no?
>> >
>> > > I'm not sure I understand what you mean here.  Do you mean we should set a probe at every version of a given symbol name?  For example, if there are symbols:
>> > > a@@V2
>> > > a@...1
>> > > a@V1
>> >
>> > > ...for a request to set a probe at "a", we'd actually set a probe at all 3?
>> >
>> > I think that we should just probe the default for that symbol and have a
>> > way to probe all of them, perhaps using the wildcard, i.e.:
>> >
>> > [root@...et linux]# nm /lib64/libpthread-2.24.so  | grep ' pthread_cond_timedwait'
>> > 000000000000dd90 T pthread_cond_timedwait@...BC_2.2.5
>> > 000000000000d6e0 T pthread_cond_timedwait@@GLIBC_2.3.2
>> > [root@...et linux]#
>> >
>> >   # perf probe -x /lib64/libpthread-2.24.so pthread_cond_timedwait
>> >
>> > should be equivalent to:
>> >
>> >   # perf probe -x /lib64/libpthread-2.24.so pthread_cond_timedwait@@GLIBC_2.3.2
>> >
>> > Which matches how these versioned symbols are resolved by the linker,
>> > no?
>> >
>> > I.e. when 'pthread_cond_timedwait' is specified and the symbol table
>> > lookup fails, I think we should re-lookup for
>> > 'pthread_cond_timedwait@@*', i.e. we should have a
>> > symbol__find_default_by_name(), which will take the
>> > "pthread_cond_timedwait" and use a symbol comparison using
>> > strncmp(strlen(key)), matching, should then look at right after the
>> > common part looking for the double @@.
>
>> Hm, this 'fallback'process sounds good idea to me.

I just sent a patch that does what you suggest, above.  To avoid duplicating the code in symbols_find_by_name, I added a parameter to tell it whether to ignore default symbol tags or not.

> This is just trying to keep the semantics used by the original user of
> this syntax, i.e. the linker.
>
>> BTW, how would we support other SYMBOL@...SION, since we already
>> use '@' for specifying source code?
>> One possible way is to support it directly in perf-probe. If it
>> failed to find probe point from dwarf, try to find from symbol
>> map by using '@...SION' suffix.
>
> Right, we would be overloading that @ symbol, since version numbers
> usually are very different of file source names :-)

There's not a lot of syntactic difference between "file" and "tag".  I don't think there is any standard for what either can be.  One might expect a "file" to be name.extension, where extension is a finite set (possibly fairly large).  A tag can be almost anything, I think.  One might expect it to end with a number.  I don't think there's a guarantee of either case, though.

It would seem one way to determine whether it's a file or a tag is to try to find it in the symbol tables.  If it's not there, assume it's a file.  (Or vice-versa.)

PC