linux-kernel - Re: [PATCH] perf-probe: dso: Add symbols in .text.* subsections to text symbol map in kenrel modules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YDVhgENpshYqDqiO@kernel.org>
Date:   Tue, 23 Feb 2021 17:11:44 -0300
From:   Arnaldo Carvalho de Melo <acme@...nel.org>
To:     Evgenii Shatokhin <eshatokhin@...tuozzo.com>
Cc:     Masami Hiramatsu <mhiramat@...nel.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Kristen Carlson Accardi <kristen@...ux.intel.com>,
        live-patching@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>, linux-kernel@...r.kernel.org,
        Konstantin Khorenko <khorenko@...tuozzo.com>
Subject: Re: [PATCH] perf-probe: dso: Add symbols in .text.* subsections to
 text symbol map in kenrel modules

Em Tue, Feb 23, 2021 at 06:02:58PM +0300, Evgenii Shatokhin escreveu:
> On 23.02.2021 10:37, Masami Hiramatsu wrote:
> > The kernel modules have .text.* subsections such as .text.unlikely.
> > Since dso__process_kernel_symbol() only identify the symbols in the ".text"
> > section as the text symbols and inserts it in the default dso in the map,
> > the symbols in such subsections can not be found by map__find_symbol().
> > 
> > This adds the symbols in those subsections to the default dso in the map so
> > that map__find_symbol() can find them. This solves the perf-probe issue on
> > probing online module.
> > 
> > Without this fix, probing on a symbol in .text.unlikely fails.
> >    ----
> >    # perf probe -m nf_conntrack nf_l4proto_log_invalid
> >    Probe point 'nf_l4proto_log_invalid' not found.
> >      Error: Failed to add events.
> >    ----
> > 
> > With this fix, it works because map__find_symbol() can find the symbol
> > correctly.
> >    ----
> >    # perf probe -m nf_conntrack nf_l4proto_log_invalid
> >    Added new event:
> >      probe:nf_l4proto_log_invalid (on nf_l4proto_log_invalid in nf_conntrack)
> > 
> >    You can now use it in all perf tools, such as:
> > 
> >    	perf record -e probe:nf_l4proto_log_invalid -aR sleep 1
> > 
> >    ----
> > 
> > Reported-by: Evgenii Shatokhin <eshatokhin@...tuozzo.com>
> > Signed-off-by: Masami Hiramatsu <mhiramat@...nel.org>
> 
> Thanks for the fix!
> 
> It looks like it helps, at least with nf_conntrack in kernel 5.11:

So I'm taking this as you providing a:

Tested-by: Evgenii Shatokhin <eshatokhin@...tuozzo.com>

ok?

- Arnaldo

> ---------------------
> # ./perf probe -v -m nf_conntrack nf_ct_resolve_clash
> probe-definition(0): nf_ct_resolve_clash
> symbol:nf_ct_resolve_clash file:(null) line:0 offset:0 return:0 lazy:(null)
> 0 arguments
> Failed to get build-id from nf_conntrack.
> Cache open error: -1
> Open Debuginfo file:
> /lib/modules/5.11.0-test01/kernel/net/netfilter/nf_conntrack.ko
> Try to find probe point from debuginfo.
> Matched function: nf_ct_resolve_clash [33616]
> Probe point found: nf_ct_resolve_clash+0
> Found 1 probe_trace_events.
> Opening /sys/kernel/tracing//kprobe_events write=1
> Opening /sys/kernel/tracing//README write=0
> Writing event: p:probe/nf_ct_resolve_clash
> nf_conntrack:nf_ct_resolve_clash+0
> Added new event:
>   probe:nf_ct_resolve_clash (on nf_ct_resolve_clash in nf_conntrack)
> 
> You can now use it in all perf tools, such as:
> 
>         perf record -e probe:nf_ct_resolve_clash -aR sleep 1
> ---------------------
> 
> I guess, the patch is suitable for stable kernel branches as well.
> 
> Without the patch, the workaround you suggested earlier (using the full path
> to nf_conntrack.ko) works too.
> 
> > ---
> >   tools/perf/util/symbol-elf.c |    4 +++-
> >   1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
> > index 6dff843fd883..0c1113236913 100644
> > --- a/tools/perf/util/symbol-elf.c
> > +++ b/tools/perf/util/symbol-elf.c
> > @@ -985,7 +985,9 @@ static int dso__process_kernel_symbol(struct dso *dso, struct map *map,
> >   	if (strcmp(section_name, (curr_dso->short_name + dso->short_name_len)) == 0)
> >   		return 0;
> > -	if (strcmp(section_name, ".text") == 0) {
> > +	/* .text and .text.* are included in the text dso */
> > +	if (strncmp(section_name, ".text", 5) == 0 &&
> > +	    (section_name[5] == '\0' || section_name[5] == '.')) {
> >   		/*
> >   		 * The initial kernel mapping is based on
> >   		 * kallsyms and identity maps.  Overwrite it to
> > 
> > .
> > 
> 
> Regards,
> Evgenii

-- 

- Arnaldo