Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add "request read" event #2705

Merged
merged 3 commits into from
Apr 16, 2024
Merged

Add "request read" event #2705

merged 3 commits into from
Apr 16, 2024

Conversation

umanwizard
Copy link
Contributor

If a page is not mapped in a process, bpf_probe_read_user will not be able to read it (even if the page is resident, so reading would have only caused a minor fault).

In this case, instead of giving up, we can ask the agent to fault it into the process by reading /proc//mem at the specified offset.

To test, compile the following program with -O0 and attempt to profile it:

#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

void x(uint64_t orig_page) {
        uint64_t this_page = ((uint64_t)(&orig_page) >> 12);

        if (this_page != orig_page) {
                pid_t pid = fork();
                if (pid)
                        printf("Forked child pid: %d\n", pid);
                else
                        for (;;)
                                ;
        } else
                x(orig_page);
}

int main(int argc, char *argv[]) {
        x((uint64_t)(&argc) >> 12);
}

This program does the following:

  1. Recurses until the stack crosses a page boundary
  2. Forks -- the new process will initially not have any pages mapped in its address space
  3. Loops forever -- thus it will never go back to the old stack frame and read it.

This program consistently produces 100% PreviousRipZero errors before this commit, but with this commit, it eventually starts bieng profiled successfully.

If a page is not mapped in a process, `bpf_probe_read_user` will not
be able to read it (even if the page is resident, so reading would
have only caused a minor fault).

In this case, instead of giving up, we can ask the agent to fault it
into the process by reading /proc/<pid>/mem at the specified offset.

To test, compile the following program with `-O0` and attempt to
profile it:

    #include <stdint.h>
    #include <stdio.h>
    #include <stdlib.h>
    #include <unistd.h>

    void x(uint64_t orig_page) {
            uint64_t this_page = ((uint64_t)(&orig_page) >> 12);

            if (this_page != orig_page) {
                    pid_t pid = fork();
                    if (pid)
                            printf("Forked child pid: %d\n", pid);
                    else
                            for (;;)
                                    ;
            } else
                    x(orig_page);
    }

    int main(int argc, char *argv[]) {
            x((uint64_t)(&argc) >> 12);
    }

This program does the following:

1. Recurses until the stack crosses a page boundary
2. Forks -- the new process will initially not have any pages
   mapped in its address space
3. Loops forever -- thus it will never go back to the old stack frame
   and read it.

This program consistently produces 100% `PreviousRipZero` errors
before this commit, but with this commit, it eventually starts bieng
profiled successfully.
@umanwizard umanwizard requested a review from a team as a code owner April 15, 2024 13:33
Copy link
Member

@kakkoyun kakkoyun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks promising indeed 🎉 🌮

@kakkoyun kakkoyun merged commit 31bdda2 into parca-dev:main Apr 16, 2024
11 of 12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants