On Thu, Jun 08, 2023 at 04:55:40PM -0700, Andrii Nakryiko wrote: > On Thu, Jun 8, 2023 at 4:27 PM Steven Rostedt <rostedt@xxxxxxxxxxx> wrote: > > On Thu, 8 Jun 2023 15:43:03 -0700 Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx> wrote: > > > On Thu, Jun 8, 2023 at 2:26 PM Jiri Olsa <jolsa@xxxxxxxxxx> wrote: > There are BPF tools that allow user to specify regex/glob of kernel > functions to attach to. This regex/glob is checked against > available_filter_functions to check which functions are traceable. All > good. But then also it's important to have corresponding memory > addresses for selected functions (for many reasons, e.g., to have > non-ambiguous and fast attachment by address instead of by name, or > for some post-processing based on captured IP addresses, etc). And > that means that now we need to also parse /proc/kallsyms and > cross-join it with data fetched from available_filter_functions. > > All this is unnecessary if avalable_filter_functions would just > provide function address in the first place. It's a huge > simplification. And saves memory and CPU. Do you need the address of the function entry-point or the address of the patch-site within the function? Those can differ, and the rec->ip address won't necessarily equal the address in /proc/kallsyms, so the pointer in /proc/kallsyms won't (always) match the address we could print for the ftrace site. On arm64, today we can have offsets of +0, +4, and +8, and within a single kernel image different functions can have different offsets. I suspect in future that we may have more potential offsets (e.g. due to changes for HW/SW CFI). Thanks, Mark.
