0x1000 offset in symbol resolution?

[Milian Wolff]

On Montag, 11. Januar 2021 17:05:30 CET Mark Wielaard wrote:
> Hi Milian,
> 
> On Wed, 2020-12-30 at 16:51 +0100, Milian Wolff wrote:
> > I stumbled upon a strange behavior while symbolizing a perf.data file
> > with
> > hotspot/perfparser/elfutils that I have trouble understanding. I hope it's
> > ok to send this call for help here.
> > 
> > I'm running with elfutils 0.181, g++ 10.2, glibc 2.32 on archlinux with
> > kernel 5.9.14.
> > [...]
> > So here, the address `0x555555555a40` should come from the second mapping,
> > which has an offset 0x0 and starts at `0x555555555000` and has a size of
> > `0x1000`. How can that possibly map to the `main` symbol which has an
> > offset of `0x1a40`?
> > 
> > Does anyone know what's going on here?
> 
> Isn't this simply the ELF file being loaded/mmapped in separate
> (overlapping) chunks?

Ah, indeed - thanks for this question! It actually seems like perf only 
records this one single mmap event. I.e.:

```
$ perf record ./a.out
$ perf script --show-mmap-events | grep -E 'MMAP.*a.out' 
           a.out 139334 16992.223215: PERF_RECORD_MMAP2 139334/139334: 
[0x55bb21e70000(0x1000) @ 0 fe:00 8009266 4286144336]: r-xp /home/milian/
projects/kdab/rnd/hotspot/build/a.out
```

And that is probably the bug. Because when I run the following slightly 
changed perf session, the issue doesn't occur - and I see more mmap events 
too:

```
$ perf record --call-graph dwarf ./a.out
$ perf script --show-mmap-events 2>/dev/null | grep -E 'MMAP.*a.out' 
a.out 139453 17065.223302: PERF_RECORD_MMAP2 139453/139453: 
[0x5589a3711000(0x5000) @ 0 fe:00 8009266 4286144336]: r--p /home/milian/
projects/kdab/rnd/hotspot/build/a.out
a.out 139453 17065.223305: PERF_RECORD_MMAP2 139453/139453: 
[0x5589a3712000(0x1000) @ 0 fe:00 8009266 4286144336]: r-xp /home/milian/
projects/kdab/rnd/hotspot/build/a.out
a.out 139453 17065.223306: PERF_RECORD_MMAP2 139453/139453: 
[0x5589a3713000(0x2000) @ 0 fe:00 8009266 4286144336]: rw-p /home/milian/
projects/kdab/rnd/hotspot/build/a.out
a.out 139453 17065.223307: PERF_RECORD_MMAP2 139453/139453: 
[0x5589a3715000(0x1000) @ 0x1000 fe:00 8009266 4286144336]: rw-p /home/milian/
projects/kdab/rnd/hotspot/build/a.out
a.out 139453 17065.223994: PERF_RECORD_MMAP2 139453/139453: 
[0x5589a3713000(0x2000) @ 0 fe:00 8009266 4286144336]: r--p /home/milian/
projects/kdab/rnd/hotspot/build/a.out
```

Thank you Mark, I'll take this over to the perf mailing list, as it doesn't 
seem to be a problem with elfutils.

> What does eu-readelf -l show?

Probably irrelevant now, but here is the output nevertheless:

```
Program Headers:
  Type           Offset   VirtAddr           PhysAddr           FileSiz  
MemSiz   Flg Align
  PHDR           0x000040 0x0000000000000040 0x0000000000000040 0x000268 
0x000268 R   0x8
  INTERP         0x0002a8 0x00000000000002a8 0x00000000000002a8 0x00001c 
0x00001c R   0x1
        [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
  LOAD           0x000000 0x0000000000000000 0x0000000000000000 0x000934 
0x000934 R   0x1000
  LOAD           0x000940 0x0000000000001940 0x0000000000001940 0x000530 
0x000530 R E 0x1000
  LOAD           0x000e70 0x0000000000002e70 0x0000000000002e70 0x000218 
0x000218 RW  0x1000
  LOAD           0x001088 0x0000000000004088 0x0000000000004088 0x000050 
0x0001c8 RW  0x1000
  DYNAMIC        0x000e88 0x0000000000002e88 0x0000000000002e88 0x0001d0 
0x0001d0 RW  0x8
  GNU_RELRO      0x000e70 0x0000000000002e70 0x0000000000002e70 0x000218 
0x001190 R   0x1
  GNU_EH_FRAME   0x000828 0x0000000000000828 0x0000000000000828 0x000034 
0x000034 R   0x4
  GNU_STACK      0x000000 0x0000000000000000 0x0000000000000000 0x000000 
0x000000 RW  0x0
  NOTE           0x0002c4 0x00000000000002c4 0x00000000000002c4 0x000038 
0x000038 R   0x4

 Section to Segment mapping:
  Segment Sections...
   00     
   01      [RO: .interp]
   02      [RO: .interp .note.ABI-tag .note.gnu.build-id .dynsym .gnu.version 
.gnu.version_r .gnu.hash .dynstr .rela.dyn .rela.plt .rodata .eh_frame_hdr 
.eh_frame]
   03      [RO: .text .init .fini .plt]
   04      [RELRO: .fini_array .init_array .dynamic .got]
   05      .data .got.plt .bss
   06      [RELRO: .dynamic]
   07      [RELRO: .fini_array .init_array .dynamic .got]
   08      [RO: .eh_frame_hdr]
   09     
   10      [RO: .note.ABI-tag .note.gnu.build-id]
```

> Is the address/offset range loaded/mmapped executable?

See above, I now believe the problem is the lack of reported mmap event to 
begin with.

-- 
Milian Wolff
mail@milianw.de
http://milianw.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <https://sourceware.org/pipermail/elfutils-devel/attachments/20210111/841d52bc/attachment-0001.sig>