bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Jackie Liu <liu.yun@linux.dev>
To: olsajiri@gmail.com, andrii@kernel.org
Cc: martin.lau@linux.dev, song@kernel.org, yhs@fb.com,
	bpf@vger.kernel.org, liuyun01@kylinos.cn
Subject: [PATCH v7] libbpf: kprobe.multi: Filter with available_filter_functions
Date: Tue, 30 May 2023 09:08:01 +0800	[thread overview]
Message-ID: <20230530010801.1558937-1-liu.yun@linux.dev> (raw)

From: Jackie Liu <liuyun01@kylinos.cn>

When using regular expression matching with "kprobe multi", it scans all
the functions under "/proc/kallsyms" that can be matched. However, not all
of them can be traced by kprobe.multi. If any one of the functions fails
to be traced, it will result in the failure of all functions. The best
approach is to filter out the functions that cannot be traced to ensure
proper tracking of the functions.

Use available_filter_functions check first, if failed, fallback to
kallsyms.

Here is the test eBPF program [1].
[1] https://github.com/JackieLiu1/ketones/commit/a9e76d1ba57390e533b8b3eadde97f7a4535e867

Suggested-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
---
 tools/lib/bpf/libbpf.c | 104 ++++++++++++++++++++++++++++++++++++++---
 1 file changed, 97 insertions(+), 7 deletions(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index ad1ec893b41b..a7f64c5f3a3b 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -10106,6 +10106,12 @@ static const char *tracefs_uprobe_events(void)
 	return use_debugfs() ? DEBUGFS"/uprobe_events" : TRACEFS"/uprobe_events";
 }
 
+static const char *tracefs_available_filter_functions(void)
+{
+	return use_debugfs() ? DEBUGFS"/available_filter_functions" :
+			       TRACEFS"/available_filter_functions";
+}
+
 static void gen_kprobe_legacy_event_name(char *buf, size_t buf_sz,
 					 const char *kfunc_name, size_t offset)
 {
@@ -10417,13 +10423,14 @@ static bool glob_match(const char *str, const char *pat)
 struct kprobe_multi_resolve {
 	const char *pattern;
 	unsigned long *addrs;
+	const char **syms;
 	size_t cap;
 	size_t cnt;
 };
 
 static int
-resolve_kprobe_multi_cb(unsigned long long sym_addr, char sym_type,
-			const char *sym_name, void *ctx)
+kallsyms_resolve_kprobe_multi_cb(unsigned long long sym_addr, char sym_type,
+				 const char *sym_name, void *ctx)
 {
 	struct kprobe_multi_resolve *res = ctx;
 	int err;
@@ -10440,6 +10447,81 @@ resolve_kprobe_multi_cb(unsigned long long sym_addr, char sym_type,
 	return 0;
 }
 
+static int ftrace_resolve_kprobe_multi_cb(const char *sym_name, void *ctx)
+{
+	struct kprobe_multi_resolve *res = ctx;
+	int err;
+	char *name;
+
+	if (!glob_match(sym_name, res->pattern))
+		return 0;
+
+	err = libbpf_ensure_mem((void **) &res->syms, &res->cap,
+				sizeof(const char *), res->cnt + 1);
+	if (err)
+		return err;
+
+	name = strdup(sym_name);
+	if (!name)
+		return -errno;
+
+	res->syms[res->cnt++] = name;
+	return 0;
+}
+
+typedef int (*available_kprobe_cb_t)(const char *sym_name, void *ctx);
+
+static int
+libbpf_available_kprobes_parse(available_kprobe_cb_t cb, void *ctx)
+{
+	char sym_name[256];
+	FILE *f;
+	int ret, err = 0;
+	const char *available_path = tracefs_available_filter_functions();
+
+	f = fopen(available_path, "r");
+	if (!f) {
+		err = -errno;
+		pr_warn("failed to open %s, fallback to /proc/kallsyms.\n",
+			available_path);
+		return err;
+	}
+
+	while (true) {
+		ret = fscanf(f, "%255s%*[^\n]\n", sym_name);
+		if (ret == EOF && feof(f))
+			break;
+		if (ret != 1) {
+			pr_warn("failed to read available kprobe entry: %d\n",
+				ret);
+			err = -EINVAL;
+			break;
+		}
+
+		err = cb(sym_name, ctx);
+		if (err)
+			break;
+	}
+
+	fclose(f);
+	return err;
+}
+
+static void kprobe_multi_resolve_free(struct kprobe_multi_resolve *res)
+{
+	while (res->syms && res->cnt)
+		free((char *)res->syms[--res->cnt]);
+
+	free(res->syms);
+	free(res->addrs);
+
+	/* reset to zero, when fallback */
+	res->cap = 0;
+	res->cnt = 0;
+	res->syms = NULL;
+	res->addrs = NULL;
+}
+
 struct bpf_link *
 bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
 				      const char *pattern,
@@ -10476,13 +10558,21 @@ bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
 		return libbpf_err_ptr(-EINVAL);
 
 	if (pattern) {
-		err = libbpf_kallsyms_parse(resolve_kprobe_multi_cb, &res);
-		if (err)
-			goto error;
+		err = libbpf_available_kprobes_parse(ftrace_resolve_kprobe_multi_cb,
+						     &res);
+		if (err) {
+			/* fallback to kallsyms */
+			kprobe_multi_resolve_free(&res);
+			err = libbpf_kallsyms_parse(kallsyms_resolve_kprobe_multi_cb,
+						    &res);
+			if (err)
+				goto error;
+		}
 		if (!res.cnt) {
 			err = -ENOENT;
 			goto error;
 		}
+		syms = res.syms;
 		addrs = res.addrs;
 		cnt = res.cnt;
 	}
@@ -10511,12 +10601,12 @@ bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
 		goto error;
 	}
 	link->fd = link_fd;
-	free(res.addrs);
+	kprobe_multi_resolve_free(&res);
 	return link;
 
 error:
 	free(link);
-	free(res.addrs);
+	kprobe_multi_resolve_free(&res);
 	return libbpf_err_ptr(err);
 }
 
-- 
2.25.1


WARNING: multiple messages have this Message-ID (diff)
From: Ratheesh Kannoth <rkannoth@marvell.com>
To: <liu.yun@linux.dev>, <olsajiri@gmail.com>, <andrii@kernel.org>
Cc: <bpf@vger.kernel.org>, <liuyun01@kylinos.cn>,
	<martin.lau@linux.dev>, <song@kernel.org>, <yhs@fb.com>
Subject: [PATCH v7] libbpf: kprobe.multi: Filter with available_filter_functions
Date: Tue, 30 May 2023 09:14:41 +0530	[thread overview]
Message-ID: <20230530010801.1558937-1-liu.yun@linux.dev> (raw)
Message-ID: <20230530034441.HyplBADIGlOg810xxLPc3SjvRPbajmdW6EJ711JYXS0@z> (raw)
In-Reply-To: <20230530010801.1558937-1-liu.yun@linux.dev>

From: Jackie Liu <liu.yun@linux.dev>

>+
>+	if (!glob_match(sym_name, res->pattern))
>+		return 0;
>+
>+	err = libbpf_ensure_mem((void **) &res->syms, &res->cap,
>+				sizeof(const char *), res->cnt + 1);
>+	if (err)
>+		return err;
>+
>+	name = strdup(sym_name);
>+	if (!name)
>+		return -errno;
>+
>+	res->syms[res->cnt++] = name;
>+	return 0;
>+}
>+
>+typedef int (*available_kprobe_cb_t)(const char *sym_name, void *ctx);
>+
>+static int
>+libbpf_available_kprobes_parse(available_kprobe_cb_t cb, void *ctx)
>+{
>+	char sym_name[256];
>+	FILE *f;
>+	int ret, err = 0;
>+	const char *available_path = tracefs_available_filter_functions();
Dont we need to follow reverse x-mas tree ?

>+
>+	f = fopen(available_path, "r");
>+	if (!f) {
>+		err = -errno;
>+		pr_warn("failed to open %s, fallback to /proc/kallsyms.\n",
>+			available_path);
>+		return err;
>+	}
>+
>+	while (true) {
>+		ret = fscanf(f, "%255s%*[^\n]\n", sym_name);
>+		if (ret == EOF && feof(f))
>+			break;
why fscanf() is not setting EOF. Why did you use feof() ?

>+		if (ret != 1) {
>+			pr_warn("failed to read available kprobe entry: %d\n",
>+				ret);
>+			err = -EINVAL;
>+			break;
>+		}
>+
>+		err = cb(sym_name, ctx);
>+		if (err)
>+			break;
>+	}
>+
>+	fclose(f);
>+	return err;
>+}
>+
>+static void kprobe_multi_resolve_free(struct kprobe_multi_resolve *res)
>+{
>+	while (res->syms && res->cnt)
>+		free((char *)res->syms[--res->cnt]);
>+
>+	free(res->syms);
>+	free(res->addrs);

it looks odd to do allocation in libbpf_xxx (libbpf_ensure_mem ) function and
freeing in a static function.

>+
>+	/* reset to zero, when fallback */
>+	res->cap = 0;
>+	res->cnt = 0;
>+	res->syms = NULL;
>+	res->addrs = NULL;
>+}
>+
> struct bpf_link *
> bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
> 				      const char *pattern,
>@@ -10476,13 +10558,21 @@ bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
> 		return libbpf_err_ptr(-EINVAL);
>
> 	if (pattern) {
>-		err = libbpf_kallsyms_parse(resolve_kprobe_multi_cb, &res);
>-		if (err)
>-			goto error;
>+		err = libbpf_available_kprobes_parse(ftrace_resolve_kprobe_multi_cb,
>+						     &res);
>+		if (err) {
>+			/* fallback to kallsyms */
>+			kprobe_multi_resolve_free(&res);
>+			err = libbpf_kallsyms_parse(kallsyms_resolve_kprobe_multi_cb,
>+						    &res);
>+			if (err)
>+				goto error;
>+		}
> 		if (!res.cnt) {
> 			err = -ENOENT;
> 			goto error;
> 		}
>+		syms = res.syms;
> 		addrs = res.addrs;
> 		cnt = res.cnt;
> 	}
>@@ -10511,12 +10601,12 @@ bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
> 		goto error;
> 	}
> 	link->fd = link_fd;
>-	free(res.addrs);
>+	kprobe_multi_resolve_free(&res);
> 	return link;
>
> error:
> 	free(link);
>-	free(res.addrs);
>+	kprobe_multi_resolve_free(&res);
> 	return libbpf_err_ptr(err);
> }
>
>--
>2.25.1

             reply	other threads:[~2023-05-30  1:08 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-05-30  1:08 Jackie Liu [this message]
2023-05-30  3:44 ` [PATCH v7] libbpf: kprobe.multi: Filter with available_filter_functions Ratheesh Kannoth
2023-05-30  6:07 ` Jackie Liu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230530010801.1558937-1-liu.yun@linux.dev \
    --to=liu.yun@linux.dev \
    --cc=andrii@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=liuyun01@kylinos.cn \
    --cc=martin.lau@linux.dev \
    --cc=olsajiri@gmail.com \
    --cc=song@kernel.org \
    --cc=yhs@fb.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).