How to associate Elf with Dwfl_Module returned by dwfl_report_module

[Mark Wielaard]

Hi Milian,

On Sat, Mar 17, 2018 at 02:14:48PM +0100, Milian Wolff wrote:
> a recurring issue in the libdwfl integration of perf and perfparser are 
> supposedly overlapping modules. The perf data file contains the exact mappings 
> for all files corresponding to the actual mmap events that occurred during 
> runtime, e.g.:
> 
> ```
> $ perf script --show-mmap-events | grep MMAP | grep stdc
> heaptrack_print 13962 87163.483450: PERF_RECORD_MMAP2 13962/13962: 
> [0x7fd0aea84000(0x387000) @ 0 08:03 413039 3864781083]: r-xp /usr/lib/libstdc+
> +.so.6.0.24
> heaptrack_print 13962 87163.483454: PERF_RECORD_MMAP2 13962/13962: 
> [0x7fd0aebfc000(0x1ff000) @ 0x178000 08:03 413039 3864781083]: ---p /usr/lib/
> libstdc++.so.6.0.24
> heaptrack_print 13962 87163.483458: PERF_RECORD_MMAP2 13962/13962: 
> [0x7fd0aedfb000(0xd000) @ 0x177000 08:03 413039 3864781083]: rw-p /usr/lib/
> libstdc++.so.6.0.24
> heaptrack_print 13962 87163.484860: PERF_RECORD_MMAP2 13962/13962: 
> [0x7fd0aedfb000(0xc000) @ 0x177000 08:03 413039 3864781083]: r--p /usr/lib/
> libstdc++.so.6.0.24
> ```
> So far, both perf and perfparser are using dwfl_report_elf to report the file. 
> But that API is deducing the mapping addresses internally, which may or may 
> not be what we saw at runtime. I suspect that this is the reason for some 
> issues we are seeing, such as supposedly overlapping modules. 

How exactly are you calling dwfl_report_elf?
Specifically are you using false for the add_p_vaddr argument?

And could you provide some example where the reported address is
wrong/different from the start address of the Dwfl_Module?

> Looking at the Dwfl API, I cannot figure out how to feed the mapping directly. 
> There's dwfl_report_module, but how would I associate an Elf* and int fd with 
> it, as done by dwfl_report_elf?

When using dwfl_report_module the find_elf callback will be called that
you registered with dwfl_begin. That callback is called "lazily" the
first time dwfl_module_getelf is called. The callback can then set the
Elf*. But that does mean you have to keep track yourself (or immediately
call dwfl_module_getelf).

I would like to understand better what is really going wrong with
dwfl_report_elf before diving into using dwfl_module_report.

Cheers,

Mark