From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.82.198 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792714637; b=siRa65gqYEo0tOo3a1nAxlT6cXfIrY2bKult4BjkBBaCUG1ABDJsuyh3S3uaPFkB4HL4 tp4rULSMWNNshYsG0u1fo4htezZrIe5BY8IykUjlV4FyRyKUxniTTcc7CpDwUMmleOMl2 mOr+nPH/PFtbgQV3j5AMQlVM1YADWJbVtDkvA2ZxcjgEVPeIR21f/MkRzDygXzjM5TVgT Wl1sn5zoRl7BgtX+FJMzPeK/o5zqa1CuXQgdevH/gqOn01z1pejcmW2kocVheWy0Nihuk HRQGz+o0CL3UB6d9VlWaralRxdzKjYj9Gso67aWYAJMf7YNdpSAv9JWlWMcp6jGrbIg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792714637; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:Mime-Version: X-Mailer:Message-ID:Subject:From:To:Cc:Content-Type; bh=k9AsLihF+plfOh4bix9+PxHbqUaaLj3NetmJnD5B0HA=; b=BACBtnGP9ykG4LuAE1wmTyqHyxcsqNgnusW3CaqH9m7EnuoTSvBSW68Xmulc3/IfzlwD Zk7Tgl+5M2PmjHsv9B1yK+MSWY2vXy2yR5BLeSdaZXCrFmD2MR4hpjhIBwPuMob72bBe3 zREaF2Wbc3X85Xym8e9ivYuK8VYi5HhEXhyCz7UzNys/BEJ+jTm/ImtSQzl3eE2WxyiyA j488NMGgDvhhcTf6qDlFouF7lmjk5+c26IrvWaybwIy79f1LR6DnNeFXqOuOV+GBUV8XX zDl70i70v563ue4x0cwVJMFlJsbE2FzTRqtQNy/5rZDG929ed4U9yB6v4QVp4weU5nA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--wusamuel.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=b+lefz++; arc=none smtp.remote-ip=74.125.82.198 Received: from mail-dy1-f198.google.com (mail-dy1-f198.google.com [74.125.82.198]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6F96D606A31A for ; Fri, 23 Oct 2026 00:17:16 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 6F96D606A31A Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--wusamuel.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=b+lefz++ Received: by mail-dy1-f198.google.com with SMTP id 5a478bee46e88-351788121cfso1244819eec.0 for ; Thu, 22 Oct 2026 17:17:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1792714635; x=1793319435; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:mime-version:date:from :to:cc:subject:date:message-id:reply-to:content-type; bh=k9AsLihF+plfOh4bix9+PxHbqUaaLj3NetmJnD5B0HA=; b=b+lefz++RY2Vf+vwPTZKdVHK2gPGoWcL5qKzIYEIZlGq1QuO7Fb+Langj4r599r0pZ SgowuDwyHZQIUwoSDKrZ1tm7P2Y00cpjASYrPKTmPttnr3qBfGqLPw0eikfWOWQBvgoT G9HA+Rloyr9LKBsBo44Fwh4ORzs9F6yo/t+UcyOuEFcHhJl1g1pypjL2wmKG576A9zXP 7j7fch9H4Piad2uCHWgA3ljFsGw4zw8PwW2Uj3GW+MdWXNj2YoutMVXrJO7jgeNW2jcr 9/rh0STYq871H+QY6H8mx28wdSRwy3yGI92/+49RlhDLIMlDnLINFr9ZhzDhPDeYWJKG gvMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792714635; x=1793319435; h=content-type:cc:to:from:subject:message-id:mime-version:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=k9AsLihF+plfOh4bix9+PxHbqUaaLj3NetmJnD5B0HA=; b=Nu/LyyOGV83KurwAK+PX7xnmWion82n4p7IeLu4DSOAMoy7gY/HzQaSDjB533znXf1 MeWf04/VwHXkLsNnlHkIRwZkwhUguis5oXEuHBQHG4uyOoCx2gmj9tW6dYmPa1FsCH0v QPBfJ6oXOv6efVZGRR+1+pbBof9Lu5zpDMYj5zT3Hy7EMHx7x3qLdMdtp0LTm+gU1H8B nPNwqiEyOQ6sp1Iw8PjwCJeje+Y5soPZVKnhKjw3FTnOOEb8K6zo6l+1E6+HicrBTLTI nAhXVUdUX5KQMSoBYhserq/5kgmLrU9rXEsc+Bst16uvK31BMAqeNu1gZlrWjzPgxvUS njDA== X-Forwarded-Encrypted: i=1; AKwUvBxV1lfXfCwe0kb7c5vO93C26sCAgjs1dOGJfQHvlikjT0V8romym191psldhOU0fj5fWA/TQ4X7oKChkhWKS78=@vger.kernel.org X-Gm-Message-State: AFq9FYIyU65jii52iarAOVSbZ6hAKbO/vLMFBnM1Et1rXOlkr42USj+g IK5dOddkuGQ2p8AgAhd0tB/s+LGlOuH9nQypl8qIZsJNDBhK2G9fXCwyg0J0MQp2tndsqV+7aIX M9o3bL45xJArbqA== X-Received: from dyuq24.prod.google.com ([2002:a05:693c:66d8:b0:351:4a2a:1ece]) (user=wusamuel job=prod-delivery.src-stubby-dispatcher) by 2002:a05:7300:a225:b0:351:6b27:d67d with SMTP id 5a478bee46e88-369d9802e3amr774839eec.30.1792714635111; Thu, 22 Oct 2026 17:17:15 -0700 (PDT) Date: Thu, 22 Oct 2026 17:16:01 -0700 X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 X-Mailer: git-send-email 2.56.0.257.gf7497c7d27-goog Message-ID: <20261023001603.560210-8-wusamuel@google.com> Subject: [PATCH bpf-next v2 0/6] kallsyms: Add KALLSYMS_QUERY ioctl to /proc/kallsyms From: Samuel Wu To: Jonathan Corbet , Shuah Khan , Randy Dunlap , Alexander Viro , Christian Brauner , Jan Kara , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , Nathan Chancellor , Nick Desaulniers , Bill Wendling , Justin Stitt Cc: Samuel Wu , kernel-team@android.com, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-doc@vger.kernel.org, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, llvm@lists.linux.dev Content-Type: text/plain; charset="UTF-8" /proc/kallsyms is the primary interface for userspace to query the kernel symbol table. However, resolving even a handful of symbols or addresses requires reading and parsing the entire text file, which is often several megabytes and takes thousands of read() syscalls. This patchseries adds an extensible KALLSYMS_QUERY ioctl() to /proc/kallsyms with two query modes: 1. KALLSYMS_QUERY_BY_SYMBOL: Resolves a NUL-terminated symbol name to its address. Searches vmlinux first with binary search, then falls back to loaded modules. Matches names exactly (without stripping .llvm. suffixes) and rejects ambiguous symbols with different addresses. 2. KALLSYMS_QUERY_BY_ADDR: Resolves a kernel address to the symbol's name, covering vmlinux, loaded modules, BPF JIT programs, and ftrace trampolines. Access control matches reading /proc/kallsyms directly: the ioctl checks the kallsyms_show_value() result cached at open() time and returns -EPERM whenever symbol addresses would be masked to zero. There were significant performance improvements with this patchseries: 1. libbpf typeless ksym resolution (8-CPU x86-64 Cuttlefish VM, BPF object with 11 typeless ksyms): Metric Text parse KALLSYMS_QUERY Change -------------------------- ---------- --------------- ------------ Resolve 11 typeless ksyms 157 ms 0.7 ms ~220x faster 2. Perfetto symbolization & callstack sampling (8-CPU x86-64 VM, 175k-line /proc/kallsyms): Metric Text parse KALLSYMS_QUERY Change -------------------------- ---------- --------------- ------------ Init 155.7 ms 0.44 ms 352x faster 50k lookups 25.2 ms 2.2 ms 11.7x faster traced_probes VmRSS 15.1 MB 4.8 MB -68% traced_probes VmHWM 23.9 MB 4.8 MB -80% Changes in v2: - Replaced the BPF syscall approach in libbpf with the more generalizable KALLSYMS_QUERY ioctl() on /proc/kallsyms, per Andrii - Added KALLSYMS_QUERY_BY_ADDR for address-to-symbol lookup - Added proc and bpf selftests and procfs documentation - v1 link: https://lore.kernel.org/all/20261009130708.1370675-1-wusamuel@google.com/ Samuel Wu (6): kallsyms: Add KALLSYMS_QUERY ioctl to /proc/kallsyms tools: Copy KALLSYMS_QUERY definitions to linux/fs.h docs/procfs: Document KALLSYMS_QUERY ioctl on /proc/kallsyms libbpf: Resolve typeless ksyms via KALLSYMS_QUERY ioctl selftests/bpf: Test typeless module ksym resolution selftests/proc: Add KALLSYMS_QUERY tests Documentation/filesystems/proc.rst | 15 ++ include/uapi/linux/fs.h | 41 ++++ kernel/kallsyms.c | 132 +++++++++++ tools/include/uapi/linux/fs.h | 41 ++++ tools/lib/bpf/libbpf.c | 78 ++++++- .../testing/selftests/bpf/prog_tests/ksyms.c | 7 + .../testing/selftests/bpf/progs/test_ksyms.c | 3 + tools/testing/selftests/proc/.gitignore | 1 + tools/testing/selftests/proc/Makefile | 1 + .../selftests/proc/proc-kallsyms-query.c | 213 ++++++++++++++++++ 10 files changed, 530 insertions(+), 2 deletions(-) create mode 100644 tools/testing/selftests/proc/proc-kallsyms-query.c -- 2.56.0.257.gf7497c7d27-goog