Re: [PATCH bpf-next] perf/bpf: Use prog to emit ksymbol event for main program

Yonghong Song
2024-07-19T02:25:52Z

On 7/13/24 11:55 PM, Hou Tao wrote:
> From: Hou Tao <houtao1@huawei.com>
>
> Since commit 0108a4e9f358 ("bpf: ensure main program has an extable"),
> prog->aux->func[0]->kallsyms is left as uninitialized. For bpf program
> with subprogs, the symbol for the main program is missed just as shown
> in the output of perf script below:
>
> ffffffff81284b69 qp_trie_lookup_elem+0xb9 ([kernel.kallsyms])
> ffffffffc0011125 bpf_prog_a4a0eb0651e6af8b_lookup_qp_trie+0x5d (bpf...)
> ffffffff8127bc2b bpf_for_each_array_elem+0x7b ([kernel.kallsyms])
> ffffffffc00110a1 +0x25 ()
> ffffffff8121a89a trace_call_bpf+0xca ([kernel.kallsyms])
>
> Fix it by always using prog instead prog->aux->func[0] to emit ksymbol
> event for the main program. After the fix, the output of perf script
> will be correct:
>
> ffffffff81284b96 qp_trie_lookup_elem+0xe6 ([kernel.kallsyms])
> ffffffffc001382d bpf_prog_a4a0eb0651e6af8b_lookup_qp_trie+0x5d (bpf...)
> ffffffff8127bc2b bpf_for_each_array_elem+0x7b ([kernel.kallsyms])
> ffffffffc0013779 bpf_prog_245c55ab25cfcf40_qp_trie_lookup+0x25 (bpf...)
> ffffffff8121a89a trace_call_bpf+0xca ([kernel.kallsyms])
>
> Fixes: 0108a4e9f358 ("bpf: ensure main program has an extable")
> Signed-off-by: Hou Tao <houtao1@huawei.com>
> ---
> Hi,
>
> ksymbol for bpf program had been broken twice, and I think it is better
> to add a bpf selftest for it, but I'm not so familiar with the
> perf_event_open(), for now I just post the fix patch and will post the
> selftest later.
>
> kernel/events/core.c | 28 +++++++++++++---------------
> 1 file changed, 13 insertions(+), 15 deletions(-)

I actually just hit this issue with patch in
https://lore.kernel.org/bpf/20240718205158.3651529-1-yonghong.song@linux.dev/T/#m92fd74865d93306757a10eb27d1e4f84cfffd5a8

This patch fixed the issue. So

Tested-by: Yonghong Song <yonghong.song@linux.dev>