On Tue, May 23, 2023 at 9:17 AM Jiri Olsa <olsajiri@xxxxxxxxx> wrote: > > On Tue, May 23, 2023 at 09:25:47PM +0800, Jackie Liu wrote: > > From: Jackie Liu <liuyun01@xxxxxxxxxx> > > > > When using regular expression matching with "kprobe multi", it scans all > > the functions under "/proc/kallsyms" that can be matched. However, not all > > of them can be traced by kprobe.multi. If any one of the functions fails > > to be traced, it will result in the failure of all functions. The best > > approach is to filter out the functions that cannot be traced to ensure > > proper tracking of the functions. > > > > But, the addition of these checks will frequently probe whether a function > > complies with "available_filter_functions" and ensure that it has not been > > filtered by kprobe's blacklist. As a result, it may take a longer time > > during startup. The function implementation is referenced from BCC's > > "kprobe_exists()" > > > > Here is the test eBPF program [1]. > > [1] https://github.com/JackieLiu1/ketones/commit/a9e76d1ba57390e533b8b3eadde97f7a4535e867 > > > > Signed-off-by: Jackie Liu <liuyun01@xxxxxxxxxx> > > --- > > tools/lib/bpf/libbpf.c | 47 ++++++++++++++++++++++++++++++++++++++++++ > > 1 file changed, 47 insertions(+) > > > > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c > > index ad1ec893b41b..6a201267fa08 100644 > > --- a/tools/lib/bpf/libbpf.c > > +++ b/tools/lib/bpf/libbpf.c > > @@ -10421,6 +10421,50 @@ struct kprobe_multi_resolve { > > size_t cnt; > > }; > > > > +static bool filter_available_function(const char *name) > > +{ > > + char addr_range[256]; > > + char sym_name[256]; > > + FILE *f; > > + int ret; > > + > > + f = fopen("/sys/kernel/debug/kprobes/blacklist", "r"); > > + if (!f) > > + goto avail_filter; > > + > > + while (true) { > > + ret = fscanf(f, "%s %s%*[^\n]\n", addr_range, sym_name); > > + if (ret == EOF && feof(f)) > > + break; > > + if (ret != 2) > > + break; > > + if (!strcmp(name, sym_name)) { > > + fclose(f); > > + return false; > > + } > > + } > > + fclose(f); > > so available_filter_functions already contains all traceable symbols > for kprobe_multi/fprobe > > kprobes/blacklist is kprobe specific and does not apply to fprobe, > is there a crash when attaching function from kprobes/blacklist ? > > > + > > +avail_filter: > > + f = fopen("/sys/kernel/debug/tracing/available_filter_functions", "r"); > > + if (!f) > > + return true; > > + > > + while (true) { > > + ret = fscanf(f, "%s%*[^\n]\n", sym_name); > > + if (ret == EOF && feof(f)) > > + break; > > + if (ret != 1) > > + break; > > + if (!strcmp(name, sym_name)) { > > + fclose(f); > > + return true; > > + } > > + } > > + fclose(f); > > + return false; > > +} > > + > > static int > > resolve_kprobe_multi_cb(unsigned long long sym_addr, char sym_type, > > const char *sym_name, void *ctx) > > @@ -10431,6 +10475,9 @@ resolve_kprobe_multi_cb(unsigned long long sym_addr, char sym_type, > > if (!glob_match(sym_name, res->pattern)) > > return 0; > > > > + if (!filter_available_function(sym_name)) > > + return 0; > > I think it'd be better to parse available_filter_functions directly > for kprobe_multi instead of filtering out kallsyms entries yep, available_filter_functions should be cheaper to parse than kallsyms. We can probably fallback to kallsyms still, if available_filter_functions are missing. Furthermore, me and Steven chatted at lsfmm2023 about having an available_filter_functions-like file with kernel function addresses (not just names), which would speed up attachment as well. It could be useful in some other scenarios as well (e.g., I think retsnoop has to join kallsyms and available_filter_functions). I think it's still a good idea to add this new file, given kernel has all this information readily available anyways. > > we could add libbpf_available_filter_functions_parse function with > similar callback to go over available_filter_functions file or iterator ;) but either way, current approach will do linear scan for each matched function, which is hugely inefficient, so definitely a no go > > > jirka > > > + > > err = libbpf_ensure_mem((void **) &res->addrs, &res->cap, sizeof(unsigned long), > > res->cnt + 1); > > if (err) > > -- > > 2.25.1 > > > >
