link/kprobe: specify symbol offset

[xpu22]

This patch adds kprobe symbol offset and its unit test.
With symbol offset, we can insert kprobe for functions
inlined.

[PR closed https://github.com//pull/613]

Signed-off-by: Tonghao Zhang zhangtonghao@didiglobal.com

[lmb]

I'm assuming that the kprobe only fires if the PC is exactly that of sym + offset. Is there a way to add a test where Offset != 0 to make sure this actually works all the way?

[lmb]

According to https://classes.engineering.wustl.edu/cse522/man-pages/perf_event_open.2.pdf VER1 is available from 2.6 so this doesn't change the minimum required version.

[xpu22]

if we don't set .size , the kernel will use the PERF_ATTR_SIZE_VER0 64B as default. The config2 will be not included in perf_event_attr.

the kernel code:
static int perf_copy_attr(struct perf_event_attr __user *uattr, struct perf_event_attr attr)
.....
/ ABI compatibility quirk: */
if (!size)
size = PERF_ATTR_SIZE_VER0; // config2 is not in VER0

[xpu22]

Offset == 0 is ok, it is an option for linux kernel.
https://www.kernel.org/doc/html/latest/trace/kprobetrace.html

[mmat11]

@lmb for more context, it's the same issue as #293

https://elixir.bootlin.com/linux/v5.17.1/source/include/uapi/linux/perf_event.h#L323

[lmb]

I should've been clearer, using ver1 LGTM.

[lmb]

I'm happy with this change, but would like a test. Maybe we can have a negative test where we get an error if we pass math.MaxUint32 or similar if using a valid offset is too complicated.

[xpu22]

@lmb Hi
This patch add the kprobeToken unit test only. Offset is different for different kernel function. Offset is set by user who should know what they are doing. For math.MaxUint32, the kprobe(symbol tcp_recvmsg) does't work, because the vmlinux .text section + offset < .text section + math.MaxUint32, then the kernel return err. I think we should allow the user to set Offset they want. If Offset is not suitable, the kernel will return err value.
https://elixir.bootlin.com/linux/v5.13.3/source/kernel/kprobes.c#L1557

@mmat11 @lmb any thoughts ? this pr should be merged to master ?

[mmat11]

@nickcooper-zhangtonghao as @lmb suggested you could test this either with a negative test that will fail when using a bad offset or with a normal test (if you already know the offset for tcp_recvmsg and it's more or less stable from kernel to kernel, you could use that)

[xpu22]

@nickcooper-zhangtonghao as @lmb suggested you could test this either with a negative test that will fail when using a bad offset or with a normal test (if you already know the offset for tcp_recvmsg and it's more or less stable from kernel to kernel, you could use that)

HI @mmat11
I add kprobe offset test. I use the ksym(vprintk) as symbol, because it present on all tested kernels.
the offset is 0/math.MaxUint64, because use them as offset to insert kprobe, we can get return value we expected