Add GetBase support for ASLR kernel mappings #371

rauls5382 · 2018-05-03T15:06:53Z

ASLR kernel mappings include offset == start.
Currently GetBase() cannot handle such a case.

This behavior can be seen from a perf.report data with samples in the kernel:

$ sudo perf report -D perf.data | grep MMAP
0 0x108 [0x50]: PERF_RECORD_MMAP -1/0: [0xffffffffaf800000(0x1087a000) @ 0xffffffffaf800000]: x [kernel.kallsyms]_text

Also added a testcase to reproduce and document.

Linux Perf reports kernel mappings with an offset == start. Currently GetBase() cannot handle such a case. This behavior can be seen from a perf.report data with samples in the kernel: $ sudo perf report -D perf.data | grep MMAP 0 0x108 [0x50]: PERF_RECORD_MMAP -1/0: [0xffffffffaf800000(0x1087a000) @ 0xffffffffaf800000]: x [kernel.kallsyms]_text

codecov-io · 2018-05-03T15:20:51Z

Codecov Report

Merging #371 into master will increase coverage by 0.01%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master     #371      +/-   ##
==========================================
+ Coverage   66.88%   66.89%   +0.01%     
==========================================
  Files          36       36              
  Lines        7495     7495              
==========================================
+ Hits         5013     5014       +1     
+ Misses       2080     2079       -1     
  Partials      402      402

Impacted Files	Coverage Δ
internal/elfexec/elfexec.go	`27.73% <100%> (+0.84%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a50cffb...b534978. Read the comment docs.

aalexand · 2018-05-04T06:44:38Z

internal/elfexec/elfexec.go

 			// Some kernels look like:
 			//       VADDR=0xffffffff80200000
 			// stextOffset=0xffffffff80200198
 			//       Start=0xffffffff83200000
 			//       Limit=0xffffffff84200000
-			//      Offset=0 (0xc000000000000000 for PowerPC64)
+			//      Offset=0 (0xc000000000000000 for PowerPC64) (==Start for Linux Perf)


I think this case corresponds to when KASLR is active, so I'd reflect that in the comment and PR description. Some experimentation:

$ sudo cat /proc/kallsyms | grep _stext ffffffff866002b8 T _stext $ sudo perf record sleep 5 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.018 MB perf.data (7 samples) ] $ pprof -raw perf.data | tail -3 Mappings 1: 0x0/0x1/0x0 perf_4.9 <build ID redacted> 2: 0xffffffff86600000/0xffffffffc030a000/0xffffffff86600000 [kernel.kallsyms] <build ID redacted>

Then rebooted the machine and did the same (note changed addresses):

$ sudo cat /proc/kallsyms | grep _stext [sudo] password for aalexand: ffffffff892002b8 T _stext $ sudo perf record sleep 5 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.018 MB perf.data (2 samples) ] $ pprof -raw perf.data | tail -3 Mappings 1: 0x0/0x1/0x0 perf_4.9 <build ID redacted> 2: 0xffffffff89200000/0xffffffffc0338000/0xffffffff89200000 [kernel.kallsyms] <build ID redacted>

aalexand · 2018-05-04T06:47:06Z

internal/elfexec/elfexec_test.go

@@ -55,6 +55,8 @@ func TestGetBase(t *testing.T) {
 		{"exec offset 2", fhExec, lsOffset, nil, 0x200000, 0x600000, 0, 0, false},
 		{"exec nomap", fhExec, nil, nil, 0, 0, 0, 0, false},
 		{"exec kernel", fhExec, kernelHeader, uint64p(0xffffffff81000198), 0xffffffff82000198, 0xffffffff83000198, 0, 0x1000000, false},
+		{"exec kernel perf offset0", fhExec, kernelHeader, uint64p(0xffffffff810002b8), 0xffffffff81000000, 0xffffffffa0000000, 0x0, 0x0, false},
+		{"exec kernel perf", fhExec, kernelHeader, uint64p(0xffffffff810002b8), 0xffffffff81000000, 0xffffffffa0000000, 0xffffffff81000000, 0x0, false},
 		{"exec PPC64 kernel", fhExec, ppc64KernelHeader, uint64p(0xc000000000000000), 0xc000000000000000, 0xd00000001a730000, 0xc000000000000000, 0x0, false},


Looks like this case passes the new check so the condition for pageOffsetPpc64 and the constant can be removed?

aalexand · 2018-05-04T06:48:18Z

internal/elfexec/elfexec_test.go

@@ -55,6 +55,8 @@ func TestGetBase(t *testing.T) {
 		{"exec offset 2", fhExec, lsOffset, nil, 0x200000, 0x600000, 0, 0, false},
 		{"exec nomap", fhExec, nil, nil, 0, 0, 0, 0, false},
 		{"exec kernel", fhExec, kernelHeader, uint64p(0xffffffff81000198), 0xffffffff82000198, 0xffffffff83000198, 0, 0x1000000, false},
+		{"exec kernel perf offset0", fhExec, kernelHeader, uint64p(0xffffffff810002b8), 0xffffffff81000000, 0xffffffffa0000000, 0x0, 0x0, false},


Similar to other comments, I'd maybe say "KASLR" instead of "perf" in this and next test case since I am not sure there is much specifics to Linux perf, I think it's more about the mechanics of kernel loading.

…perf_getbase

aalexand · 2018-05-04T16:13:13Z

For the record, #299 also fixed some issues with processing KASLR'ed kernels. The MMAP in the perf.data there was

0 0x108 [0x50]: PERF_RECORD_MMAP -1/0: [0xffffffff89200000(0x37138000) @ 0xffffffff89200000]: x [kernel.kallsyms]_text

which I think the same what we are seeing here, not sure why #299 worked there but not here.

rauls5382 · 2018-05-05T02:08:05Z

The only way I can see #299 work is if loadSegment.Vaddr == loadSegment.Off
That is not the case on the files I'm seeing, though.

* 'master' of github.com:google/pprof: (32 commits) record diff base profile label key/value constant (google#384) apply additional command overrides based on report format (google#381) profile: fix legacy format Go heap profile parsing (google#382) add -diff flag for better profile comparision (google#369) Use -u flag in pprof installation command so that it updates if needed. (google#376) Add GetBase support for ASLR kernel mappings (google#371) Add show_from profile filter. (google#372) Update README.md due to 8dff45d (google#375) Remove stale docs, move useful ones. (google#374) internal/driver: skip tests requiring tcp on js (google#373) Add "trim path" option which can be used to relocate sources. (google#366) Move update_d3flamegraph.sh script from the root directory. (google#370) Skip unsymbolizable mapping during symbolz pass. (google#368) remove -positive_percentages flag (google#365) Render icicle graph in "Flame Graph" view (google#367) Add command-line editing support for interactive pprof (google#362) Improve profile filter unit tests, fix show filtering of mappings (google#354) Fake mappings should be merged into a single one during merging (google#357) Hack the code so that both existing Go versions and current Go master format it the same (google#358) moved filter tests into their own test file which matches the implementation file, filter.go. (google#356) ...

Add GetBase support for kernel mappings as reported by Linux Perf Linux Perf reports kernel mappings with an offset == start. Currently GetBase() cannot handle such a case. This behavior can be seen from a perf.report data with samples in the kernel: $ sudo perf report -D perf.data | grep MMAP 0 0x108 [0x50]: PERF_RECORD_MMAP -1/0: [0xffffffffaf800000(0x1087a000) @ 0xffffffffaf800000]: x [kernel.kallsyms]_text

rauls5382 added 2 commits May 3, 2018 08:00

Remove duplicate testcase

d28b23e

googlebot added the cla: yes label May 3, 2018

rauls5382 requested a review from aalexand May 3, 2018 15:30

Merge branch 'master' into perf_getbase

21e271a

aalexand reviewed May 4, 2018

View reviewed changes

rauls5382 added 2 commits May 4, 2018 09:01

Update comments to more accurate describe this as kernel ASLR support

7a58954

Merge branch 'perf_getbase' of ssh://github.com/rauls5382/pprof into …

5459b37

…perf_getbase

aalexand mentioned this pull request May 4, 2018

perf_to_profile: All kernel symbols are collapesed to [[kernel.kallsyms]] google/perf_data_converter#36

Closed

rauls5382 changed the title ~~Add GetBase support for kernel mappings as reported by Linux Perf~~ Add GetBase support for ASLR kernel mappings May 4, 2018

rauls5382 and others added 3 commits May 4, 2018 19:08

Merge branch 'master' into perf_getbase

dccb175

Merge branch 'master' into perf_getbase

38b459c

Merge branch 'master' into perf_getbase

b534978

aalexand approved these changes May 8, 2018

View reviewed changes

aalexand merged commit 520140b into google:master May 8, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add GetBase support for ASLR kernel mappings #371

Add GetBase support for ASLR kernel mappings #371

rauls5382 commented May 3, 2018 •

edited

Loading

codecov-io commented May 3, 2018 •

edited

Loading

aalexand May 4, 2018

aalexand May 4, 2018

aalexand May 4, 2018

aalexand commented May 4, 2018

rauls5382 commented May 5, 2018

Add GetBase support for ASLR kernel mappings #371

Add GetBase support for ASLR kernel mappings #371

Conversation

rauls5382 commented May 3, 2018 • edited Loading

codecov-io commented May 3, 2018 • edited Loading

Codecov Report

aalexand May 4, 2018

Choose a reason for hiding this comment

aalexand May 4, 2018

Choose a reason for hiding this comment

aalexand May 4, 2018

Choose a reason for hiding this comment

aalexand commented May 4, 2018

rauls5382 commented May 5, 2018

rauls5382 commented May 3, 2018 •

edited

Loading

codecov-io commented May 3, 2018 •

edited

Loading