linux-kernel - Re: [PATCH] perf-probe: dso: Add symbols in .text.* subsections to text symbol map in kenrel modules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 24 Feb 2021 10:47:23 +0300
From:   Evgenii Shatokhin <eshatokhin@...tuozzo.com>
To:     Arnaldo Carvalho de Melo <acme@...nel.org>
Cc:     Masami Hiramatsu <mhiramat@...nel.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Kristen Carlson Accardi <kristen@...ux.intel.com>,
        live-patching@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>, linux-kernel@...r.kernel.org,
        Konstantin Khorenko <khorenko@...tuozzo.com>
Subject: Re: [PATCH] perf-probe: dso: Add symbols in .text.* subsections to
 text symbol map in kenrel modules

On 23.02.2021 23:11, Arnaldo Carvalho de Melo wrote:
> Em Tue, Feb 23, 2021 at 06:02:58PM +0300, Evgenii Shatokhin escreveu:
>> On 23.02.2021 10:37, Masami Hiramatsu wrote:
>>> The kernel modules have .text.* subsections such as .text.unlikely.
>>> Since dso__process_kernel_symbol() only identify the symbols in the ".text"
>>> section as the text symbols and inserts it in the default dso in the map,
>>> the symbols in such subsections can not be found by map__find_symbol().
>>>
>>> This adds the symbols in those subsections to the default dso in the map so
>>> that map__find_symbol() can find them. This solves the perf-probe issue on
>>> probing online module.
>>>
>>> Without this fix, probing on a symbol in .text.unlikely fails.
>>>     ----
>>>     # perf probe -m nf_conntrack nf_l4proto_log_invalid
>>>     Probe point 'nf_l4proto_log_invalid' not found.
>>>       Error: Failed to add events.
>>>     ----
>>>
>>> With this fix, it works because map__find_symbol() can find the symbol
>>> correctly.
>>>     ----
>>>     # perf probe -m nf_conntrack nf_l4proto_log_invalid
>>>     Added new event:
>>>       probe:nf_l4proto_log_invalid (on nf_l4proto_log_invalid in nf_conntrack)
>>>
>>>     You can now use it in all perf tools, such as:
>>>
>>>     	perf record -e probe:nf_l4proto_log_invalid -aR sleep 1
>>>
>>>     ----
>>>
>>> Reported-by: Evgenii Shatokhin <eshatokhin@...tuozzo.com>
>>> Signed-off-by: Masami Hiramatsu <mhiramat@...nel.org>
>>
>> Thanks for the fix!
>>
>> It looks like it helps, at least with nf_conntrack in kernel 5.11:
> 
> So I'm taking this as you providing a:
> 
> Tested-by: Evgenii Shatokhin <eshatokhin@...tuozzo.com>
> 
> ok?

Sure, thanks!

> 
> - Arnaldo
> 
>> ---------------------
>> # ./perf probe -v -m nf_conntrack nf_ct_resolve_clash
>> probe-definition(0): nf_ct_resolve_clash
>> symbol:nf_ct_resolve_clash file:(null) line:0 offset:0 return:0 lazy:(null)
>> 0 arguments
>> Failed to get build-id from nf_conntrack.
>> Cache open error: -1
>> Open Debuginfo file:
>> /lib/modules/5.11.0-test01/kernel/net/netfilter/nf_conntrack.ko
>> Try to find probe point from debuginfo.
>> Matched function: nf_ct_resolve_clash [33616]
>> Probe point found: nf_ct_resolve_clash+0
>> Found 1 probe_trace_events.
>> Opening /sys/kernel/tracing//kprobe_events write=1
>> Opening /sys/kernel/tracing//README write=0
>> Writing event: p:probe/nf_ct_resolve_clash
>> nf_conntrack:nf_ct_resolve_clash+0
>> Added new event:
>>    probe:nf_ct_resolve_clash (on nf_ct_resolve_clash in nf_conntrack)
>>
>> You can now use it in all perf tools, such as:
>>
>>          perf record -e probe:nf_ct_resolve_clash -aR sleep 1
>> ---------------------
>>
>> I guess, the patch is suitable for stable kernel branches as well.
>>
>> Without the patch, the workaround you suggested earlier (using the full path
>> to nf_conntrack.ko) works too.
>>
>>> ---
>>>    tools/perf/util/symbol-elf.c |    4 +++-
>>>    1 file changed, 3 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
>>> index 6dff843fd883..0c1113236913 100644
>>> --- a/tools/perf/util/symbol-elf.c
>>> +++ b/tools/perf/util/symbol-elf.c
>>> @@ -985,7 +985,9 @@ static int dso__process_kernel_symbol(struct dso *dso, struct map *map,
>>>    	if (strcmp(section_name, (curr_dso->short_name + dso->short_name_len)) == 0)
>>>    		return 0;
>>> -	if (strcmp(section_name, ".text") == 0) {
>>> +	/* .text and .text.* are included in the text dso */
>>> +	if (strncmp(section_name, ".text", 5) == 0 &&
>>> +	    (section_name[5] == '\0' || section_name[5] == '.')) {
>>>    		/*
>>>    		 * The initial kernel mapping is based on
>>>    		 * kallsyms and identity maps.  Overwrite it to
>>>
>>> .
>>>
>>
>> Regards,
>> Evgenii
>