Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20230608212613.424070-1-jolsa@kernel.org> <CAEf4BzbNakGzcycJJJqLsFwonOmya8=hKLD41TWX2zCJbh=r-Q@mail.gmail.com>
 <20230608192748.435a1dbf@gandalf.local.home> <CAEf4BzYkNHu7hiMYWQWs_gpYOfHL0FVuf-O0787Si2ze=PFX5w@mail.gmail.com>
 <ZILhqvrjeFIPHauy@FVFF77S0Q05N> <ZINW9FqIoja76DRa@krava>
In-Reply-To: <ZINW9FqIoja76DRa@krava>
From:   Andrii Nakryiko <andrii.nakryiko@gmail.com>
Date:   Fri, 9 Jun 2023 11:29:59 -0700
Message-ID: <CAEf4BzbgsLOoLKyscq6S95QeehVoAzOnQ=xmsFz8dfEUAnhObw@mail.gmail.com>
Subject: Re: [PATCH RFC] ftrace: Show all functions with addresses in available_filter_functions_addrs
To:     Jiri Olsa <olsajiri@gmail.com>
Cc:     Mark Rutland <mark.rutland@arm.com>,
        Steven Rostedt <rostedt@goodmis.org>,
        Masami Hiramatsu <mhiramat@kernel.org>,
        Andrii Nakryiko <andrii@kernel.org>,
        lkml <linux-kernel@vger.kernel.org>,
        linux-trace-kernel@vger.kernel.org, bpf@vger.kernel.org,
        Jackie Liu <liu.yun@linux.dev>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Fri, Jun 9, 2023 at 9:44=E2=80=AFAM Jiri Olsa <olsajiri@gmail.com> wrote=
:
>
> On Fri, Jun 09, 2023 at 09:24:10AM +0100, Mark Rutland wrote:
> > On Thu, Jun 08, 2023 at 04:55:40PM -0700, Andrii Nakryiko wrote:
> > > On Thu, Jun 8, 2023 at 4:27=E2=80=AFPM Steven Rostedt <rostedt@goodmi=
s.org> wrote:
> > > > On Thu, 8 Jun 2023 15:43:03 -0700 Andrii Nakryiko <andrii.nakryiko@=
gmail.com> wrote:
> > > > > On Thu, Jun 8, 2023 at 2:26=E2=80=AFPM Jiri Olsa <jolsa@kernel.or=
g> wrote:
> >
> > > There are BPF tools that allow user to specify regex/glob of kernel
> > > functions to attach to. This regex/glob is checked against
> > > available_filter_functions to check which functions are traceable. Al=
l
> > > good. But then also it's important to have corresponding memory
> > > addresses for selected functions (for many reasons, e.g., to have
> > > non-ambiguous and fast attachment by address instead of by name, or
> > > for some post-processing based on captured IP addresses, etc). And
> > > that means that now we need to also parse /proc/kallsyms and
> > > cross-join it with data fetched from available_filter_functions.
> > >
> > > All this is unnecessary if avalable_filter_functions would just
> > > provide function address in the first place. It's a huge
> > > simplification. And saves memory and CPU.
> >
> > Do you need the address of the function entry-point or the address of t=
he
> > patch-site within the function? Those can differ, and the rec->ip addre=
ss won't
> > necessarily equal the address in /proc/kallsyms, so the pointer in
> > /proc/kallsyms won't (always) match the address we could print for the =
ftrace site.
> >
> > On arm64, today we can have offsets of +0, +4, and +8, and within a sin=
gle
> > kernel image different functions can have different offsets. I suspect =
in
> > future that we may have more potential offsets (e.g. due to changes for=
 HW/SW
> > CFI).
>
> so we need that for kprobe_multi bpf link, which is based on fprobe,
> and that uses ftrace_set_filter_ips to setup the ftrace_ops filter
>
> and ftrace_set_filter_ips works fine with ip address being the address
> of the patched instruction (it's matched in ftrace_location)
>
> but right, I did not realize this.. it might cause confusion if people
> don't know it's patch-side addresses..  not sure if there's easy way to
> get real function address out of rec->ip, but it will also get more
> complicated on x86 when IBT is enabled, will check

ok, sorry, I'm confused. Two questions:

1. when attaching kprobe_multi, does bpf() syscall expect function
address or (func+offset_of_mcount) address? I hope it's the former,
just function's address?

2. If rec->ip is not function's address, can we somehow adjust the
value to be a function address before printing it?

In short, I think it's confusing to have addresses with +0 or +4 or +8
offsets. It would be great if we can just keep it +0 at the interface
level (when attach and in available_filter_functions_addrs).

>
> or we could just use patch-side addresses and reflect that in the file's
> name like 'available_filter_functions_patch_addrs' .. it's already long
> name ;-)
>
> jirka