On Fri, Jun 9, 2023 at 9:44 AM Jiri Olsa <olsajiri@xxxxxxxxx> wrote: > > On Fri, Jun 09, 2023 at 09:24:10AM +0100, Mark Rutland wrote: > > On Thu, Jun 08, 2023 at 04:55:40PM -0700, Andrii Nakryiko wrote: > > > On Thu, Jun 8, 2023 at 4:27 PM Steven Rostedt <rostedt@xxxxxxxxxxx> wrote: > > > > On Thu, 8 Jun 2023 15:43:03 -0700 Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx> wrote: > > > > > On Thu, Jun 8, 2023 at 2:26 PM Jiri Olsa <jolsa@xxxxxxxxxx> wrote: > > > > > There are BPF tools that allow user to specify regex/glob of kernel > > > functions to attach to. This regex/glob is checked against > > > available_filter_functions to check which functions are traceable. All > > > good. But then also it's important to have corresponding memory > > > addresses for selected functions (for many reasons, e.g., to have > > > non-ambiguous and fast attachment by address instead of by name, or > > > for some post-processing based on captured IP addresses, etc). And > > > that means that now we need to also parse /proc/kallsyms and > > > cross-join it with data fetched from available_filter_functions. > > > > > > All this is unnecessary if avalable_filter_functions would just > > > provide function address in the first place. It's a huge > > > simplification. And saves memory and CPU. > > > > Do you need the address of the function entry-point or the address of the > > patch-site within the function? Those can differ, and the rec->ip address won't > > necessarily equal the address in /proc/kallsyms, so the pointer in > > /proc/kallsyms won't (always) match the address we could print for the ftrace site. > > > > On arm64, today we can have offsets of +0, +4, and +8, and within a single > > kernel image different functions can have different offsets. I suspect in > > future that we may have more potential offsets (e.g. due to changes for HW/SW > > CFI). > > so we need that for kprobe_multi bpf link, which is based on fprobe, > and that uses ftrace_set_filter_ips to setup the ftrace_ops filter > > and ftrace_set_filter_ips works fine with ip address being the address > of the patched instruction (it's matched in ftrace_location) > > but right, I did not realize this.. it might cause confusion if people > don't know it's patch-side addresses.. not sure if there's easy way to > get real function address out of rec->ip, but it will also get more > complicated on x86 when IBT is enabled, will check ok, sorry, I'm confused. Two questions: 1. when attaching kprobe_multi, does bpf() syscall expect function address or (func+offset_of_mcount) address? I hope it's the former, just function's address? 2. If rec->ip is not function's address, can we somehow adjust the value to be a function address before printing it? In short, I think it's confusing to have addresses with +0 or +4 or +8 offsets. It would be great if we can just keep it +0 at the interface level (when attach and in available_filter_functions_addrs). > > or we could just use patch-side addresses and reflect that in the file's > name like 'available_filter_functions_patch_addrs' .. it's already long > name ;-) > > jirka
