linux-kernel - Re: 'perf probe' and symbols from .text.<something>

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210223001201.c478d4cb6481385d31b3f09b@kernel.org>
Date:   Tue, 23 Feb 2021 00:12:01 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Evgenii Shatokhin <eshatokhin@...tuozzo.com>,
        Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Evgenii Shatokhin <eshatokhin@...tuozzo.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Kristen Carlson Accardi <kristen@...ux.intel.com>,
        live-patching@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>, linux-kernel@...r.kernel.org,
        Konstantin Khorenko <khorenko@...tuozzo.com>
Subject: Re: 'perf probe' and symbols from .text.<something>

On Tue, 23 Feb 2021 00:05:08 +0900
Masami Hiramatsu <mhiramat@...nel.org> wrote:

> Hi Evgenii,
> 
> On Thu, 18 Feb 2021 20:09:17 +0300
> Evgenii Shatokhin <eshatokhin@...tuozzo.com> wrote:
> 
> > Hi,
> > 
> > It seems, 'perf probe' can only see functions from .text section in the 
> > kernel modules, but not from .text.unlikely or other .text.* sections.
> > 
> > For example, with kernel 5.11 and nf_conntrack.ko with debug info, 'perf 
> > probe' succeeds for nf_conntrack_attach() from .text and fails for 
> > nf_ct_resolve_clash() from .text.unlikely:
> 
> Thanks for reporting it!
> 
> > 
> > ------------
> > # perf probe -v -m nf_conntrack nf_ct_resolve_clash
> > probe-definition(0): nf_ct_resolve_clash
> > symbol:nf_ct_resolve_clash file:(null) line:0 offset:0 return:0 lazy:(null)
> > 0 arguments
> > Failed to get build-id from nf_conntrack.
> > Cache open error: -1
> > Open Debuginfo file: 
> > /lib/modules/5.11.0-test01/kernel/net/netfilter/nf_conntrack.ko
> > Try to find probe point from debuginfo.
> > Matched function: nf_ct_resolve_clash [33616]
> > Probe point found: nf_ct_resolve_clash+0
> > Found 1 probe_trace_events.
> > Post processing failed or all events are skipped. (-2)
> > Probe point 'nf_ct_resolve_clash' not found.
> >    Error: Failed to add events. Reason: No such file or directory (Code: -2)
> 
[...]

> > Is there a way to allow probing of functions in .text.<something> ?

BTW, just for putting a probe on nf_ct_resolve_clash, please give the module *path*
instead of the module *name*. For example,

perf probe -v -m /lib/modules/5.11.0-test01/kernel/net/netfilter/nf_conntrack.ko nf_ct_resolve_clash

This should work (at least works for me), because it directly loads the symbols from the .ko file.

Thank you,

-- 
Masami Hiramatsu <mhiramat@...nel.org>