linux-kernel - Re: [PATCH] perf-probe: dso: Add symbols in .text.* subsections to text symbol map in kenrel modules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 23 Feb 2021 18:02:58 +0300
From:   Evgenii Shatokhin <eshatokhin@...tuozzo.com>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Arnaldo Carvalho de Melo <acme@...nel.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Kristen Carlson Accardi <kristen@...ux.intel.com>,
        live-patching@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>, linux-kernel@...r.kernel.org,
        Konstantin Khorenko <khorenko@...tuozzo.com>
Subject: Re: [PATCH] perf-probe: dso: Add symbols in .text.* subsections to
 text symbol map in kenrel modules

On 23.02.2021 10:37, Masami Hiramatsu wrote:
> The kernel modules have .text.* subsections such as .text.unlikely.
> Since dso__process_kernel_symbol() only identify the symbols in the ".text"
> section as the text symbols and inserts it in the default dso in the map,
> the symbols in such subsections can not be found by map__find_symbol().
> 
> This adds the symbols in those subsections to the default dso in the map so
> that map__find_symbol() can find them. This solves the perf-probe issue on
> probing online module.
> 
> Without this fix, probing on a symbol in .text.unlikely fails.
>    ----
>    # perf probe -m nf_conntrack nf_l4proto_log_invalid
>    Probe point 'nf_l4proto_log_invalid' not found.
>      Error: Failed to add events.
>    ----
> 
> With this fix, it works because map__find_symbol() can find the symbol
> correctly.
>    ----
>    # perf probe -m nf_conntrack nf_l4proto_log_invalid
>    Added new event:
>      probe:nf_l4proto_log_invalid (on nf_l4proto_log_invalid in nf_conntrack)
> 
>    You can now use it in all perf tools, such as:
> 
>    	perf record -e probe:nf_l4proto_log_invalid -aR sleep 1
> 
>    ----
> 
> Reported-by: Evgenii Shatokhin <eshatokhin@...tuozzo.com>
> Signed-off-by: Masami Hiramatsu <mhiramat@...nel.org>

Thanks for the fix!

It looks like it helps, at least with nf_conntrack in kernel 5.11:
---------------------
# ./perf probe -v -m nf_conntrack nf_ct_resolve_clash
probe-definition(0): nf_ct_resolve_clash
symbol:nf_ct_resolve_clash file:(null) line:0 offset:0 return:0 lazy:(null)
0 arguments
Failed to get build-id from nf_conntrack.
Cache open error: -1
Open Debuginfo file: 
/lib/modules/5.11.0-test01/kernel/net/netfilter/nf_conntrack.ko
Try to find probe point from debuginfo.
Matched function: nf_ct_resolve_clash [33616]
Probe point found: nf_ct_resolve_clash+0
Found 1 probe_trace_events.
Opening /sys/kernel/tracing//kprobe_events write=1
Opening /sys/kernel/tracing//README write=0
Writing event: p:probe/nf_ct_resolve_clash 
nf_conntrack:nf_ct_resolve_clash+0
Added new event:
   probe:nf_ct_resolve_clash (on nf_ct_resolve_clash in nf_conntrack)

You can now use it in all perf tools, such as:

         perf record -e probe:nf_ct_resolve_clash -aR sleep 1
---------------------

I guess, the patch is suitable for stable kernel branches as well.

Without the patch, the workaround you suggested earlier (using the full 
path to nf_conntrack.ko) works too.

> ---
>   tools/perf/util/symbol-elf.c |    4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
> index 6dff843fd883..0c1113236913 100644
> --- a/tools/perf/util/symbol-elf.c
> +++ b/tools/perf/util/symbol-elf.c
> @@ -985,7 +985,9 @@ static int dso__process_kernel_symbol(struct dso *dso, struct map *map,
>   	if (strcmp(section_name, (curr_dso->short_name + dso->short_name_len)) == 0)
>   		return 0;
>   
> -	if (strcmp(section_name, ".text") == 0) {
> +	/* .text and .text.* are included in the text dso */
> +	if (strncmp(section_name, ".text", 5) == 0 &&
> +	    (section_name[5] == '\0' || section_name[5] == '.')) {
>   		/*
>   		 * The initial kernel mapping is based on
>   		 * kallsyms and identity maps.  Overwrite it to
> 
> .
> 

Regards,
Evgenii