linux-kernel - Re: tracing/kprobes: [Bug] Identical timestamps on two kprobes that are few instructions apart

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sun, 9 Jul 2017 21:51:54 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Arun Kalyanasundaram <arunkaly@...gle.com>
Cc:     rostedt@...dmis.org, linux-kernel@...r.kernel.org,
        mingo@...nel.org, David Carrillo-Cisneros <davidcc@...gle.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        mingo@...nel.org
Subject: Re: tracing/kprobes: [Bug] Identical timestamps on two kprobes that
 are few instructions apart

On Fri, 7 Jul 2017 10:34:48 -0700
Arun Kalyanasundaram <arunkaly@...gle.com> wrote:

> Hi,
> 
> I am trying to use kprobes to time a few kernel functions. However, when I
> add two kprobes on a function that are a few instructions apart, I
> sometimes get the same timestamp (measured in nano seconds) on the two
> probes.
> 
> For example, if I add the two probes as follows,
> 1) perf probe -a "kprobe1=__schedule"
> 2) perf probe -a "kprobe2=__schedule+12"
> 
> I then use "perf record" on a multi-threaded benchmark (e.g. stream:
> https://www.cs.virginia.edu/stream/) to collect samples. I then see the
> same timestamp on kprobe1 and kprobe2 for the same thread running on the
> same CPU. Following is an example of the output showing the same timestamp
> on the two probes.
> 
> comm,tid,cpu,time,event,ip,sym
> stream,62182,[064],3020935.384132080,probe:kprobe1,ffffffffb36399f1,__schedule
> stream,62182,[064],3020935.384132080,probe:kprobe2,ffffffffb36399fd,__schedule

Could you tell me on what architecture are you running the benchmark?
(It seems that your machine has more than 64 core(or SMT))

And would you see same issue when you are using ftrace debugfs
(or tracefs) interface too?

Actually, if you use "perf" to trace events, those are recorded in
different buffers and different way to be read. So we have to
investigate perf side too. 

Peter, Arnaldo, if there are 2 perf events occurs in very short
period, is it possible to indicate same timestamp for those?

Thank you,

> 
> Since it happens intermittently, I am wondering if there is some sort of
> race condition here. Please let me know if this is an expected behavior or
> is there something wrong in the way I use kprobes.
> 
> Thank you,
> - Arun


-- 
Masami Hiramatsu <mhiramat@...nel.org>