Re: kallsyms in buildid - broken mapping?

[Milian Wolff <milian.wolff@kdab.com>]

On Dienstag, 27. Juni 2017 16:25:37 CEST Kim Phillips wrote:
> On Tue, 27 Jun 2017 16:16:47 +0200
> 
> Milian Wolff <milian.wolff@kdab.com> wrote:
> > a colleague of mine just sent me a `perf archive` tarball and the
> > accompanying perf.data file. The tarball contains a kallsyms entry with
> > build-id for `[kernel.kallsyms]`. But the file seems to be bogus, it only
> > contains "null" mappings, i.e.:
> > 
> > $ head kallsyms
> > 0000000000000000 A irq_stack_union
> > 0000000000000000 A __per_cpu_start
> > 0000000000000000 A exception_stacks
> > 0000000000000000 A gdt_page
> > 0000000000000000 A espfix_waddr
> > 0000000000000000 A espfix_stack
> > 0000000000000000 A cpu_info
> > 0000000000000000 A cpu_llc_shared_map
> > 0000000000000000 A cpu_core_map
> > 0000000000000000 A cpu_sibling_map
> > $ cut -f1 -d' ' < kallsyms | uniq -c
> > 
> >  144971 0000000000000000
> > 
> > He now also sent me a copy of `/proc/kallsyms` which actually seems to
> > contain a useful mapping. Any idea what lead to the broken original
> > mapping?
> permissions?
> 
> $ cat /proc/kallsyms | cut -f1 -d' ' | uniq -c | wc -l
> 1
> $ sudo cat /proc/kallsyms | cut -f1 -d' ' | uniq -c | wc -l
> 124969

Ah, thanks. I can reproduce it now locally:

~~~~~
tmp$ cat /proc/sys/kernel/kptr_restrict
1
tmp$ head /proc/kallsyms
0000000000000000 A irq_stack_union
0000000000000000 A __per_cpu_start
0000000000000000 T startup_64
0000000000000000 T _stext
0000000000000000 T _text
0000000000000000 T secondary_startup_64
0000000000000000 T start_cpu
0000000000000000 t verify_cpu
0000000000000000 T start_cpu0
0000000000000000 t bad_address
tmp$ echo 0 | sudo tee /proc/sys/kernel/kptr_restrict
0
tmp$ head /proc/kallsyms 
0000000000000000 A irq_stack_union
0000000000000000 A __per_cpu_start
ffffffff81000000 T startup_64
ffffffff81000000 T _stext
ffffffff81000000 T _text
ffffffff81000120 T secondary_startup_64
ffffffff810001b0 T start_cpu
ffffffff810001c4 t verify_cpu
ffffffff810002c0 T start_cpu0
ffffffff810002cc t bad_address
~~~~~

But when I try to record with a restricted kptr, perf shows this error:

~~~~~
WARNING: Kernel address maps (/proc/{kallsyms,modules}) are restricted,
check /proc/sys/kernel/kptr_restrict.

Samples in kernel functions may not be resolved if a suitable vmlinux
file is not found in the buildid cache or in the vmlinux path.

Samples in kernel modules won't be resolved at all.

If some relocation was applied (e.g. kexec) symbols may be misresolved
even with a suitable vmlinux or kallsyms file.
~~~~~

So how could I possibly end up with such a broken kallsyms file in my build-id 
cache?

Thanks
-- 
Milian Wolff | milian.wolff@kdab.com | Senior Software Engineer
KDAB (Deutschland) GmbH&Co KG, a KDAB Group company
Tel: +49-30-521325470
KDAB - The Qt Experts