On Tue, Jun 13, 2023 at 9:41 PM Quentin Monnet [off-list ref] wrote:

2023-06-12 15:16 UTC+0000 ~ Yafang Shao [off-list ref]

quoted

If the kernel symbol is in a module, we will dump the module name as
well.

Signed-off-by: Yafang Shao <redacted>
---
 tools/bpf/bpftool/xlated_dumper.c | 6 +++++-
 tools/bpf/bpftool/xlated_dumper.h | 2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c
index da608e1..dd917f3 100644
--- a/tools/bpf/bpftool/xlated_dumper.c
+++ b/tools/bpf/bpftool/xlated_dumper.c

@@ -46,7 +46,11 @@ void kernel_syms_load(struct dump_data *dd)
              }
              dd->sym_mapping = tmp;
              sym = &dd->sym_mapping[dd->sym_count];
-             if (sscanf(buff, "%p %*c %s", &address, sym->name) != 2)
+
+             /* module is optional */
+             sym->module[0] = '\0';
+             if (sscanf(buff, "%p %*c %s %s", &address, sym->name,
+                 sym->module) < 2)
                      continue;
              sym->address = (unsigned long)address;
              if (!strcmp(sym->name, "__bpf_call_base")) {

diff --git a/tools/bpf/bpftool/xlated_dumper.h b/tools/bpf/bpftool/xlated_dumper.h
index 9a94637..5df8025 100644
--- a/tools/bpf/bpftool/xlated_dumper.h
+++ b/tools/bpf/bpftool/xlated_dumper.h

@@ -5,12 +5,14 @@
 #define __BPF_TOOL_XLATED_DUMPER_H

 #define SYM_MAX_NAME 256
+#define MODULE_NAME_LEN      64

 struct bpf_prog_linfo;

 struct kernel_sym {
      unsigned long address;
      char name[SYM_MAX_NAME];
+     char module[MODULE_NAME_LEN];

Nit: MODULE_MAX_NAME would be more consistent and would make more sense
to me? And it would avoid confusion with MODULE_NAME_LEN from kernel,
which doesn't have the same value.

Will use MODULE_MAX_NAME instead.

-- 
Regards
Yafang