linux-kernel - Re: [PATCH v2 1/4] perf probe: Generate event name with line number

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 13 Nov 2019 08:01:57 +0700
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Arnaldo Carvalho de Melo <acme@...nel.org>,
        Ingo Molnar <mingo@...hat.com>,
        Steven Rostedt <rostedt@...dmis.org>,
        linux-kernel@...r.kernel.org,
        Tom Zanussi <tom.zanussi@...ux.intel.com>,
        Ravi Bangoria <ravi.bangoria@...ux.ibm.com>,
        Namhyung Kim <namhyung@...nel.org>
Subject: Re: [PATCH v2 1/4] perf probe: Generate event name with line number

Hi Arnaldo,

On Tue, 12 Nov 2019 17:31:31 +0700
Masami Hiramatsu <mhiramat@...nel.org> wrote:
> > > > # perf probe --list
> > > >   probe:kernel_read_l1 (on kernel_read@...read_write.c)
> > > >   probe:kernel_read_l2 (on kernel_read:1@...read_write.c)
> > > 
> > > 
> > > Also look above at the listing, I would expect this instead:
> > > 
> > > # perf probe --list
> > >   probe:kernel_read_l1 (on kernel_read:1@...read_write.c)
> > >   probe:kernel_read_l2 (on kernel_read:2@...read_write.c)
> > > 
> > > Right?
> 
> Yes, it should be so.

Hmm, this looks the limiation of debuginfo generated by gcc.
Let me explain what happens. So, here is the decoded Line info in
debuginfo for kernel_read (is defined in fs/read_write.c:423)

---
$ readelf -wL /usr/lib/debug/boot/vmlinux-5.0.0-32-generic 
...
read_write.c                                 444  0xffffffff812b435d        
read_write.c                                 424  0xffffffff812b4370               x
read_write.c                                 425  0xffffffff812b4375               x
read_write.c                                 426  0xffffffff812b4375       1       x
read_write.c                                 428  0xffffffff812b4375       2       x

---
This shows the line number info points the kernel_read entry address is
on #424, this means we can not distinguish kernel_read:0 and kernel_read:1
from only the address information. (maybe huristically we can distinguish
it by the "_L1" suffix. But if user gives another event name, it doesn't
work.)
---

/build/linux-pvZVvI/linux-5.0.0/arch/x86/include/asm/current.h:
current.h                                     13  0xffffffff812b4375       3       x
current.h                                     15  0xffffffff812b4375       4       x
current.h                                     15  0xffffffff812b4375       5       x
current.h                                     15  0xffffffff812b4375       6       x
current.h                                     15  0xffffffff812b4375       7       x

/build/linux-pvZVvI/linux-5.0.0/fs/read_write.c:
read_write.c                                 424  0xffffffff812b4375       8

---
And it seems that the dwarf_getsrc_die() returns the last line info
correspoinding to given address (0xffffffff812b4375) even if it is
not a stetement line. This is why probe:kernel_read_l2 is 
on kernel_read:1. I will fix that.

However, again, as long as the different lines are encoded in same
address, we can not distinguish them except for checking "_L*"
suffix.

Possible solutions are
 - Do not allow user to put probes on lines which shares the address
   with other lines (user can put a probe only on the earliest line)
 - Warn user that the line shares address with other lines and put
   the probe with the earliest line number suffix.
 - Just warn user. 

THank you,

-- 
Masami Hiramatsu <mhiramat@...nel.org>