On Sat, 4 Mar 2017 11:35:51 +0900 Masami Hiramatsu <mhira...@kernel.org> wrote:
> On Sat, 4 Mar 2017 09:49:11 +0900 > Masami Hiramatsu <mhira...@kernel.org> wrote: > > > On Thu, 2 Mar 2017 23:25:06 +0530 > > "Naveen N. Rao" <naveen.n....@linux.vnet.ibm.com> wrote: > > > > > We indicate support for accepting sym+offset with kretprobes through a > > > line in ftrace README. Parse the same to identify support and choose the > > > appropriate format for kprobe_events. > > > > Could you give us an example of this change here? :) > > for example, comment of commit 613f050d68a8 . > > > > I think the code is OK, but we need actual example of result. > > Hi Naveen, > > I've tried following commands > > $ grep "[Tt] user_read$" /proc/kallsyms > 0000000000000000 T user_read > 0000000000000000 t user_read > $ sudo ./perf probe -D user_read%return > r:probe/user_read _text+3539616 > r:probe/user_read_1 _text+3653408 > > OK, looks good. However, when I set the retprobes, I got an error. > > $ sudo ./perf probe -a user_read%return > Failed to write event: Invalid argument > Error: Failed to add events. > > And kernel rejected that. > > $ dmesg -k | tail -n 1 > [ 850.315068] Given offset is not valid for return probe. > > Hmm, curious.. > > I tried normal probes > > $ sudo ./perf probe -D user_read > p:probe/user_read _text+3539616 > p:probe/user_read_1 _text+3653408 > $ sudo ./perf probe -a user_read > Added new events: > probe:user_read (on user_read) > probe:user_read_1 (on user_read) > > You can now use it in all perf tools, such as: > > perf record -e probe:user_read_1 -aR sleep 1 > > It works! > > $ sudo ./perf probe -l > probe:user_read (on user_read@security/keys/user_defined.c) > probe:user_read_1 (on user_read@selinux/ss/policydb.c) > $ sudo cat /sys/kernel/debug/kprobes/list > ffffffff9237bf20 k user_read+0x0 [DISABLED][FTRACE] > ffffffff923602a0 k user_read+0x0 [DISABLED][FTRACE] > > So, the both "_text+3539616" and "_text+3653408" are correctly located > on the entry address of user_read functions. It seems kernel-side > symbol+offset check is wrong. FYI, without this patch, perf probe returns same place for same-name functions. So this patch itself looks good. $ sudo ./perf probe -D user_read%return r:probe/user_read user_read+0 r:probe/user_read_1 user_read+0 Thanks, -- Masami Hiramatsu <mhira...@kernel.org>
