linux-kernel - Re: Question: perf dso support for /proc/kallsyms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181102134649.GB3983@leoy-ThinkPad-X240s>
Date:   Fri, 2 Nov 2018 21:46:49 +0800
From:   leo.yan@...aro.org
To:     Al Grant <Al.Grant@....com>
Cc:     "acme@...hat.com" <acme@...hat.com>, Jiri Olsa <jolsa@...nel.org>,
        Mathieu Poirier <mathieu.poirier@...aro.org>,
        Coresight ML <coresight@...ts.linaro.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: Question: perf dso support for /proc/kallsyms

Hi Al,

On Fri, Nov 02, 2018 at 12:08:04PM +0000, Al Grant wrote:
> > Now I still don't understand how the dso/map support "/proc/kallsyms" and
> > have no idea to fix this issue, though I spent some time to look into it.
> 
> The way this is supported is that at record time, pseudo mmap records
> are created for the kernel. But depending on permissions these might
> not get created. This isn't just an ETM issue, it can happen on Intel too.

Agree, I also think this is not a specific issue only for Arm platform,
this should be one common issue for how to parse kernel symbols with
kallsyms file.

> What do you see in "perf report -D", do you see a PERF_RECORD_MMAP
> record for "[kernel.kallsyms]_text" and possibly some others for loadable
> kernel modules in /lib/modules?

Yes, I can see PERF_RECORD_MMAP for "[kernel.kallsyms]_text".

0x350 [0x50]: event: 1
.
. ... raw event: size 80 bytes
.  0000:  01 00 00 00 01 00 50 00 ff ff ff ff 00 00 00 00  ......P.........
.  0010:  00 00 08 08 00 00 ff ff ff ff f7 f7 ff ff 00 00  ................
.  0020:  00 00 08 08 00 00 ff ff 5b 6b 65 72 6e 65 6c 2e  ........[kernel.
.  0030:  6b 61 6c 6c 73 79 6d 73 5d 5f 74 65 78 74 00 00  kallsyms]_text..
.  0040:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

0x350 [0x50]: PERF_RECORD_MMAP -1/0: [0xffff000008080000(0xfffff7f7ffff) @ 0xffff000008080000]: x [kernel.kallsyms]_text

Below is the infor for checking buildid:

root@...ian:~/coresight_test# perf buildid-list
0242d9154c78df1d8fe1d0512c36a236d0861a18 [kernel.kallsyms]
b8c89e8ba41a2ea486c66a50c29c60d38c34a759 /root/coresight_test/main
26b12a9d1a54ed2b0478cb0203435b76aabab3fb /usr/lib/aarch64-linux-gnu/ld-2.27.so
8fca7ed524c9469b065af83bc8a529fe72858f53 [vdso]
25829a59e21012cfde7850b30a310cd3a58f531c /root/coresight_test/libcstest.so
70512527439ef76c8802a7a2a546bde6a5a6e967 /usr/lib/aarch64-linux-gnu/libc-2.27.so
root@...ian:~/coresight_test# ls ~/.debug/\[kernel.kallsyms\]/0242d9154c78df1d8fe1d0512c36a236d0861a18/
kallsyms

> Does it all work if you run perf record as sudo? Or if you do
> 
>    sudo sysctl kernel.kptr_restrict=0
> 
> before you run perf record?

Yes, tested this on Juno board with Debian rootFS and logined in
with 'root' user.  I suspected the pointer permission issue so
checked with below command:

root@...ian:~/coresight_test# cat /proc/sys/kernel/kptr_restrict 
0

Thanks,
Leo Yan