Hi Steven,

On Aug 6, 2024, at 11:44 AM, Steven Rostedt [off-list ref] wrote:

On Fri,  2 Aug 2024 14:08:35 -0700
Song Liu [off-list ref] wrote:

quoted

Use the new kallsyms APIs that matches symbols name with .XXX
suffix. This allows userspace tools to get kprobes on the expected
function name, while the actual symbol has a .llvm.<hash> suffix.

This only effects kernel compile with CONFIG_LTO_CLANG.

Signed-off-by: Song Liu <song@kernel.org>
---
kernel/kprobes.c            |  6 +++++-
kernel/trace/trace_kprobe.c | 11 ++++++++++-
2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index e85de37d9e1e..99102283b076 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c

@@ -70,7 +70,11 @@ static DEFINE_PER_CPU(struct kprobe *, kprobe_instance);

kprobe_opcode_t * __weak kprobe_lookup_name(const char *name,
unsigned int __unused)
{
- return ((kprobe_opcode_t *)(kallsyms_lookup_name(name)));
+ unsigned long addr = kallsyms_lookup_name(name);
+
+ if (IS_ENABLED(CONFIG_LTO_CLANG) && !addr)
+ addr = kallsyms_lookup_name_without_suffix(name);
+ return ((kprobe_opcode_t *)(addr));
}

/*

diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 61a6da808203..d2ad0c561c83 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c

@@ -203,6 +203,10 @@ unsigned long trace_kprobe_address(struct trace_kprobe *tk)

if (tk->symbol) {
addr = (unsigned long)
kallsyms_lookup_name(trace_kprobe_symbol(tk));
+
+ if (IS_ENABLED(CONFIG_LTO_CLANG) && !addr)
+ addr = kallsyms_lookup_name_without_suffix(trace_kprobe_symbol(tk));
+

So you do the lookup twice if this is enabled?

Why not just use "kallsyms_lookup_name_without_suffix()" the entire time,
and it should work just the same as "kallsyms_lookup_name()" if it's not
needed?

We still want to give priority to full match. For example, we have:

[root@~]# grep c_next /proc/kallsyms
ffffffff81419dc0 t c_next.llvm.7567888411731313343
ffffffff81680600 t c_next
ffffffff81854380 t c_next.llvm.14337844803752139461

If the goal is to explicitly trace c_next.llvm.7567888411731313343, the
user can provide the full name. If we always match _without_suffix, all
of the 3 will match to the first one. 

Does this make sense?

Thanks,
Song