linux-kernel - perf-kvm unable to resolve guest kernel symbols

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 26 May 2021 19:31:30 +0100
From:   "Russell King (Oracle)" <linux@...linux.org.uk>
To:     Arnaldo Carvalho de Melo <acme@...nel.org>,
        Jiri Olsa <jolsa@...hat.com>
Cc:     linux-kernel@...r.kernel.org
Subject: perf-kvm unable to resolve guest kernel symbols

Hi,

While attempting to use "perf kvm --guestkallsyms=g-kallsyms report",
I have found that perf 5.13-rc2 fails to convert IP values to symbols.

After spending a while debugging, what I've found is:

1) perf_session__new() will not read the gust kernel symbols in this
   case (data is non-NULL, and is open read-only.) The comments say
   that symbol reading will be deferred to the MMAP and MMAP2 events.

2) all of the MMAP and MMAP2 events seem to be for
   PERF_RECORD_MISC_KERNEL and PERF_RECORD_MISC_USER. There are none
   for PERF_RECORD_MISC_GUEST_KERNEL.

I have found that disabling the checks in perf_session__new() mentioned
in (1) allows the command above to give me symbolic information. As I
don't know the code all that well, I'm not sure if this is a correct
fix, or whether the problem lies in the "perf kvm record" side - that
depends whether there are supposed to be MMAP/MMAP2 events for the
guest kernel.

Below is the debug diff I've been using so far... (building out of the
kernel tree.) The change to tools/perf/util/session.c seems to be what
has fixed the problem for me, but I don't think this is the correct
fix.

diff -ur -x '*.o' -x '*.cmd' perf-5.13.0-rc2.orig/tools/perf/util/machine.c perf-5.13.0-rc2/tools/perf/util/machine.c
--- perf-5.13.0-rc2.orig/tools/perf/util/machine.c	2021-05-19 15:04:47.000000000 +0100
+++ perf-5.13.0-rc2/tools/perf/util/machine.c	2021-05-20 14:41:55.425771482 +0100
@@ -1234,7 +1234,7 @@
 	char path[PATH_MAX];
 	pid_t pid;
 	char *endp;
-
+printf("machines__create_guest_kernel_maps: %s\n", symbol_conf.default_guest_kallsyms);
 	if (symbol_conf.default_guest_vmlinux_name ||
 	    symbol_conf.default_guest_modules ||
 	    symbol_conf.default_guest_kallsyms) {
@@ -1293,7 +1293,7 @@
 int machines__create_kernel_maps(struct machines *machines, pid_t pid)
 {
 	struct machine *machine = machines__findnew(machines, pid);
-
+printf("machines__create_kernel_maps: %p\n", machine);
 	if (machine == NULL)
 		return -1;
 
@@ -1763,7 +1763,7 @@
 		bid = &__bid;
 		build_id__init(bid, event->mmap2.build_id, event->mmap2.build_id_size);
 	}
-
+printf("%s: cpumode %d\n", "machine__process_mmap2_event", sample->cpumode);
 	if (sample->cpumode == PERF_RECORD_MISC_GUEST_KERNEL ||
 	    sample->cpumode == PERF_RECORD_MISC_KERNEL) {
 		struct extra_kernel_map xm = {
@@ -1821,6 +1821,7 @@
 	if (dump_trace)
 		perf_event__fprintf_mmap(event, stdout);
 
+printf("%s: cpumode %d\n", "machine__process_mmap_event", sample->cpumode);
 	if (sample->cpumode == PERF_RECORD_MISC_GUEST_KERNEL ||
 	    sample->cpumode == PERF_RECORD_MISC_KERNEL) {
 		struct extra_kernel_map xm = {
diff -ur -x '*.o' -x '*.cmd' perf-5.13.0-rc2.orig/tools/perf/util/session.c perf-5.13.0-rc2/tools/perf/util/session.c
--- perf-5.13.0-rc2.orig/tools/perf/util/session.c	2021-05-19 15:04:47.000000000 +0100
+++ perf-5.13.0-rc2/tools/perf/util/session.c	2021-05-20 12:17:31.251730384 +0100
@@ -243,14 +243,14 @@
 	session->machines.host.single_address_space =
 		perf_env__single_address_space(session->machines.host.env);
 
-	if (!data || perf_data__is_write(data)) {
+//	if (!data || perf_data__is_write(data)) {
 		/*
 		 * In O_RDONLY mode this will be performed when reading the
 		 * kernel MMAP event, in perf_event__process_mmap().
 		 */
 		if (perf_session__create_kernel_maps(session) < 0)
 			pr_warning("Cannot read kernel map\n");
-	}
+//	}
 
 	/*
 	 * In pipe-mode, evlist is empty until PERF_RECORD_HEADER_ATTR is

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!