Re: [PATCH 1/3] perf probe: Set retprobe flag when probe in address-based alternative mode

[He Kuang <hekuang@zoho.com>]

On 04/13/2015 10:39 PM, Arnaldo Carvalho de Melo wrote:
> Em Mon, Apr 13, 2015 at 07:41:28PM +0800, He Kuang escreveu:
>> Perf probe misses to set retprobe flag back when falling back to
>> address-based alternative mode.
>
> And when is that happens, can you explain? Because I tried to follow your
> instructions, but in my case it worked in the same way before and after your
> patch.
>
> Can you please provide more context for reviewing your patch?
>

More details:

   [root]# perf probe -v -k vmlinux --add='sys_write%return'
   probe-definition(0): sys_write%return
   symbol:sys_write file:(null) line:0 offset:0 return:1 lazy:(null)
   0 arguments
   Use vmlinux: vmlinux
   map_groups__set_modules_path_dir: cannot open /lib/modules/4.0.0-rc6+ dir
   Problems setting modules path maps, continuing anyway...
   Using vmlinux for symbols

   Open Debuginfo file: vmlinux
   >>>==========================

   Try to find probe point from debuginfo.
   Symbol sys_write address found : ffffffff811a8cf0
   Probe point found: SyS_write+0
   Found 1 probe_trace_events.
   Opening /sys/kernel/debug/tracing/kprobe_events write=1
   Added new event:
   Writing event: p:probe/sys_write _stext+1739560
     probe:sys_write      (on sys_write%return)

   You can now use it in all perf tools, such as:

           perf record -e probe:sys_write -aR sleep 1

   [root@buildroot tmp]# cat /sys/kernel/debug/tracing/kprobe_events
   p:probe/sys_write _stext+1739560


The line I marked is different from your result, which is:
   """Could not open debuginfo. Try to use symbols."""


When perf probe searched in debuginfo and failed, it tried with 
alternative, in function get_alternative_probe_event():

         memcpy(tmp, &pev->point, sizeof(*tmp));
	memset(&pev->point, 0, sizeof(pev->point));

In this case, it drops the retprobe flag and forgets to set it back in 
find_alternative_probe_point(), so the problem occurred.



> Here are my results:
>
> Before:
>
>    [root@ssdandy ~]# perf probe -v --add='sys_write%return'
>    probe-definition(0): sys_write%return
>    symbol:sys_write file:(null) line:0 offset:0 return:1 lazy:(null)
>    0 arguments
>    Using /root/.debug/.build-id/dd/32e51921ede0fd46f034091b7f6a0f2e01ebda for symbols
>    Could not open debuginfo. Try to use symbols.
>    Opening /sys/kernel/debug/tracing/kprobe_events write=1
>    Added new event:
>    Writing event: r:probe/sys_write sys_write+0
>        probe:sys_write      (on sys_write%return)
>
>    You can now use it in all perf tools, such as:
>
> 	  perf record -e probe:sys_write -aR sleep 1
>    [root@ssdandy ~]# cat /sys/kernel/debug/tracing/kprobe_events
>    r:probe/sys_write sys_write
>
> Remove it:
>
>    [root@ssdandy ~]# perf probe --del *:*
>    Removed event: probe:sys_write
>
> After:
>
>    [root@ssdandy ~]# perf probe -v --add='sys_write%return'
>    probe-definition(0): sys_write%return
>    symbol:sys_write file:(null) line:0 offset:0 return:1 lazy:(null)
>    0 arguments
>    Using /root/.debug/.build-id/dd/32e51921ede0fd46f034091b7f6a0f2e01ebda for symbols
>    Could not open debuginfo. Try to use symbols.
>    Opening /sys/kernel/debug/tracing/kprobe_events write=1
>    Added new event:
>    Writing event: r:probe/sys_write sys_write+0
>      probe:sys_write      (on sys_write%return)
>
>    You can now use it in all perf tools, such as:
>
> 	  perf record -e probe:sys_write -aR sleep 1
>
>    [root@ssdandy ~]#
>    [root@ssdandy ~]# cat /sys/kernel/debug/tracing/kprobe_events
>    r:probe/sys_write sys_write
>
> Humm, noticed one other problem, but not with your patch, about this message:
>
> "Could not open debuginfo. Try to use symbols."
>
> That is really not clear, specially that "try to use symbols" :-)
>
> [root@ssdandy ~]# ls -la /root/.debug/.build-id/dd/32e51921ede0fd46f034091b7f6a0f2e01ebda
> lrwxrwxrwx. 1 root root 86 Apr 10 18:02 /root/.debug/.build-id/dd/32e51921ede0fd46f034091b7f6a0f2e01ebda -> ../../home/acme/git/build/v4.0.0-rc6+/vmlinux/dd32e51921ede0fd46f034091b7f6a0f2e01ebda
> [root@ssdandy ~]# ls -la /root/.debug/.build-id/dd/../../home/acme/git/build/v4.0.0-rc6+/vmlinux/dd32e51921ede0fd46f034091b7f6a0f2e01ebda
> -rwxr-xr-x. 1 root root 22698661 Apr 10 18:02 /root/.debug/.build-id/dd/../../home/acme/git/build/v4.0.0-rc6+/vmlinux/dd32e51921ede0fd46f034091b7f6a0f2e01ebda
> [root@ssdandy ~]# ls -la /root/.debug/.build-id/dd/../../home/acme/git/build/v4.0.0-rc6+/vmlinux/dd32e51921ede0fd46f034091b7f6a0f2e01ebda
>
> I.e. it managed to read the debuginfo, its just that it has no symbols in it :-)
>
> Anyway, digression ended.
>
> - Arnaldo
>
>> Can be reproduced as following:
>>
>>    $ perf probe -v -k vmlinux --add='sys_write%return'
>>    ...
>>    Added new event:
>>    Writing event: p:probe/sys_write _stext+1584952
>>      probe:sys_write      (on sys_write%return)
>>
>>    $ cat /sys/kernel/debug/tracing/kprobe_events
>>    p:probe/sys_write _stext+1584952
>>
>> After this patch:
>>
>>    $ perf probe -v -k vmlinux --add='sys_write%return'
>>    Added new event:
>>    Writing event: r:probe/sys_write SyS_write+0
>>      probe:sys_write      (on sys_write%return)
>>
>>    $ cat /sys/kernel/debug/tracing/kprobe_events
>>    r:probe/sys_write SyS_write
>>
>> Signed-off-by: He Kuang <hekuang@huawei.com>
>> ---
>>   tools/perf/util/probe-event.c | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
>> index 30545ce..5483d98 100644
>> --- a/tools/perf/util/probe-event.c
>> +++ b/tools/perf/util/probe-event.c
>> @@ -332,6 +332,7 @@ static int find_alternative_probe_point(struct debuginfo *dinfo,
>>   	else {
>>   		result->offset += pp->offset;
>>   		result->line += pp->line;
>> +		result->retprobe = pp->retprobe;
>>   		ret = 0;
>>   	}
>>
>> --
>> 2.3.3.220.g9ab698f
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>