Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] perf probe: Provide more detail with relocation warning
To:     Masami Hiramatsu <mhiramat@kernel.org>
Cc:     acme@kernel.org, jolsa@redhat.com, linux-kernel@vger.kernel.org,
        aneesh.kumar@linux.ibm.com,
        Ravi Bangoria <ravi.bangoria@linux.ibm.com>
References: <20210525043744.193297-1-ravi.bangoria@linux.ibm.com>
 <20210525214858.33a66846ac09e499c3268a63@kernel.org>
From:   Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Message-ID: <05e32c82-1009-03ba-d973-8b1bc0582ce2@linux.ibm.com>
Date:   Wed, 26 May 2021 10:23:18 +0530
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.10.1
MIME-Version: 1.0
In-Reply-To: <20210525214858.33a66846ac09e499c3268a63@kernel.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 5/25/21 6:18 PM, Masami Hiramatsu wrote:
> On Tue, 25 May 2021 10:07:44 +0530
> Ravi Bangoria <ravi.bangoria@linux.ibm.com> wrote:
> 
>> When run as normal user with default sysctl kernel.kptr_restrict=0
>> and kernel.perf_event_paranoid=2, perf probe fails with:
>>
>>    $ ./perf probe move_page_tables
>>    Relocated base symbol is not found!
>>
>> The warning message is not much informative. The reason perf fails
>> is because /proc/kallsyms is restricted by perf_event_paranoid=2
>> for normal user and thus perf fails to read relocated address of
>> the base symbol.
>>
>> Tweaking kptr_restrict and perf_event_paranoid can change the
>> behavior of perf probe. Also, running as root or privileged user
>> works too. Add these details in the warning message.
>>
>> Plus, kmap->ref_reloc_sym might not be always set even if
>> host_machine is initialized. Above is the example of the same.
>> Remove that comment.
> 
> Yes, those are restricted in some cases. Anyway without priviledged
> (super) user, perf probe can not set the probe in ftrace.
> 
> Hmm, I think it should check the effective user-id at first. If it
> is not super user and the action will access tracefs and kallsyms,
> it should warn at that point.

If kptr_restrict=2, perf probe fails with same error even for root user.
That's why I thought to just change this warning message.

Different combinations of privilege, perf_event_paranoid, kptr_restrict:

   Normal/Root user
    |   perf_event_paranoid
    V    V   kptr_restrict        perf probe error
   ----------------------------------------------------------------
    N   -1    0     Failed to open kprobe_events: Permission denied
    N    0    0     Failed to open kprobe_events: Permission denied
    N    1    0     Failed to open kprobe_events: Permission denied
    N    2    0     Relocated base symbol is not found!
   
    N   -1    1     Relocated base symbol is not found!
    N    0    1     Relocated base symbol is not found!
    N    1    1     Relocated base symbol is not found!
    N    2    1     Relocated base symbol is not found!
   
    N   -1    2     Relocated base symbol is not found!
    N    0    2     Relocated base symbol is not found!
    N    1    2     Relocated base symbol is not found!
    N    2    2     Relocated base symbol is not found!
   
    R   -1    0     No error.
    R    0    0     No error.
    R    1    0     No error.
    R    2    0     No error.
   
    R   -1    1     No error.
    R    0    1     No error.
    R    1    1     No error.
    R    2    1     No error.
   
    R   -1    2     Relocated base symbol is not found!
    R    0    2     Relocated base symbol is not found!
    R    1    2     Relocated base symbol is not found!
    R    2    2     Relocated base symbol is not found!

Ravi