Closed abhinav92003 closed 7 months ago
On doing more stress testing: unfortunately the decode errors do not go away completely even after this fix, but they have become very less frequent now (tool.kernel.simple in release build failed after 40 successful runs). The address indicated in the error message, I couldn't find it in /proc/kallsyms like before.
Fixes drmemtrace kernel trace libipt post-processing failures caused by missing instruction encodings for some kernel code execution captured using Intel-PT.
The root-cause seems to be that JIT code executed by the kernel, BPF code in this case, does not have entries in
/proc/modules
. So, our kcore dump logic did not include them. This fix looks for BPF related symbols in/proc/kallsyms
and includes them in the copied regions from/proc/kcore
.Note that BPF JIT symbols are not included in
/proc/kallsyms
by default. One needs to set/proc/sys/net/core/bpf_jit_harden
and/proc/sys/net/core/bpf_jit_kallsyms
appropriately (see https://docs.kernel.org/admin-guide/sysctl/net.html#proc-sys-net-core-network-core-options for more details). Added this suggestion to documentation. It may be better to not automatically make this possibly-too-intrusive change to the user's machine automatically in cmake. This is probably fine because the issue is not widespread (not reproduced on public Linux distributions).Tested PT tracing related tests locally on a machine that supports Intel-PT:
Unfortunately the decode errors do not go away completely even after this fix, but they have become very less frequent now (tool.kernel.simple in release build failed after 40 successful runs after this fix, which failed every run before).
Issue: #6486