Re: Question: fentry on kernel func optimized by compiler

[Tao Chen <chen.dylane@linux.dev>]

在 2025/3/29 01:21, Andrii Nakryiko 写道:

Hi Andrri,

> On Thu, Mar 27, 2025 at 9:03 AM Tao Chen <chen.dylane@linux.dev> wrote:
>>
>> Hi,
>>
>> I recently encountered a problem when using fentry to trace kernel
>> functions optimized by compiler, the specific situation is as follows:
>> https://github.com/bpftrace/bpftrace/issues/3940
>>
>> Simply put, some functions have been optimized by the compiler. The
>> original function names are found through BTF, but the optimized
>> functions are the ones that exist in kallsyms_lookup_name. Therefore,
>> the two do not match.
>>
>>           func_proto = btf_type_by_id(desc_btf, func->type);
>>           if (!func_proto || !btf_type_is_func_proto(func_proto)) {
>>                   verbose(env, "kernel function btf_id %u does not have a
>> valid func_proto\n",
>>                           func_id);
>>                   return -EINVAL;
>>           }
>>
>>           func_name = btf_name_by_offset(desc_btf, func->name_off);
>>           addr = kallsyms_lookup_name(func_name);
>>           if (!addr) {
>>                   verbose(env, "cannot find address for kernel function
>> %s\n",
>>                           func_name);
>>                   return -EINVAL;
>>           }
>>
>> I have made a simple statistics and there are approximately more than
>> 2,000 functions in Ubuntu 24.04.
>>
>> dylane@2404:~$ cat /proc/kallsyms | grep isra | wc -l
>> 2324
>>
>> So can we add a judgment from libbpf. If it is an optimized function,
> 
> No, we cannot. It's a different function at that point and libbpf
> isn't going to be in the business of guessing on behalf of the user
> whether it's ok to do or not.
> 
> But the user can use multi-kprobe with `prefix*` naming, if they
> encountered (or are anticipating) this situation and think it's fine
> for them.
> 

I will try multi-kprobe feature, and briefly checked and found that the 
multi-kprobe is implemented based on fprobe. Is its performance similar 
to that of fentry? Thanks.

> As for fentry/fexit, you need to have the correct BTF ID associated
> with that function anyways, so I'm not sure that currently you can
> attach fentry/fexit to such compiler-optimized functions at all
> (pahole won't produce BTF for such functions, right?).
>

Yes, it is.

>> pass the suffix of the optimized function from the user space to the
>> kernel, and then perform a function name concatenation, like:
>>
>>           func_name = btf_name_by_offset(desc_btf, func->name_off);
>>          if (optimize) {
>>                  func_name = func_name + ".isra.0"
>>          }
>>           addr = kallsyms_lookup_name(func_name);
>>
>> --
>> Best Regards
>> Tao Chen
>>
>>


-- 
Best Regards
Tao Chen