Date:   Fri, 10 Feb 2023 10:51:00 +0100
From:   Peter Zijlstra <peterz@infradead.org>
To:     Masami Hiramatsu <mhiramat@kernel.org>
Cc:     Steven Rostedt <rostedt@goodmis.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Linux Trace Kernel <linux-trace-kernel@vger.kernel.org>,
        Shuah Khan <shuah@kernel.org>,
        Shuah Khan <skhan@linuxfoundation.org>
Subject: Re: [PATCH] tracing/selftests: Ignore __pfx_ symbols in kprobe test
Message-ID: <Y+YThNzVa1ECIuYM@hirez.programming.kicks-ass.net>
References: <20230207135147.5ce618d6@gandalf.local.home>
 <20230207135402.38f73bb6@gandalf.local.home>
 <Y+PkVD1+myADYns+@hirez.programming.kicks-ass.net>
 <20230209232305.672dd0249e0db41552b28763@kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230209232305.672dd0249e0db41552b28763@kernel.org>
Precedence: bulk

On Thu, Feb 09, 2023 at 11:23:05PM +0900, Masami Hiramatsu wrote:

> BTW, currently kprobe event rejects this __pfx_ symbols because it is notrace
> symbols, thus we can trace it if CONFIG_KPROBE_EVENTS_ON_NOTRACE=y.
> But I guess it should not probe that place always because it should never
> executed right?

Execution can take place in those ranges when X86_FEATURE_CALL_DEPTH is
enabled or when CONFIG_KCFI && X86_FEATURE_IBT.

In the first of those cases the prefix bytes are filled with call
accounting instructions and every direct call to $sym is patched to
point to __pfx_$sym+6 (aka $sym-10).

  https://lore.kernel.org/all/20220915111039.092790446@infradead.org/

In the second case (FineIBT) it is probably easiest if you look at the
comment in arch/x86/kernel/alternative.c near CONFIG_FINEIBT.

  https://lore.kernel.org/all/20221027092812.185993858@infradead.org/

The __pfx_ and __cfi_ symbols are the same (in fact, when
CONFIG_CFI_CLANG=y the compiler generates them and objtool no longer
emits the __pfx_ symbols).

  https://lore.kernel.org/all/20221028194453.592512209@infradead.org/