Re: [PATCH] libtracecmd: Support changing /proc/kallsyms

On Thu, 17 Apr 2025 01:13:00 +0200
Ilya Leoshkevich <[email protected]> wrote:

I finally got some time to look at this. Sorry for the delay.

> Running BPF selftests under trace-cmd intermittently fails with:
> 
>     error in size of file '/proc/kallsyms'
> 
> This is because these selftests load and unload BPF programs.
> bpf_prog_put() uses workqueues and RCU, so these programs disappear
> from /proc/kallsyms after a delay.
> 
> trace-cmd reads /proc/kallsyms twice: the first time to compute its
> size, and the second time to copy it into the trace file. If the
> resulting sizes don't match, which is what happens in this case,
> recording fails.
> 
> Fix by first copying /proc/kallsyms into a temporary file, and then
> into the trace file. An alternative would be to read it into a
> malloc()-ed buffer, but this would increase trace-cmd memory usage,
> since /proc/kallsyms can be a few dozen megabytes large. In case
> /tmp is tmpfs, both solutions are almost equivalent.

Actually, when compression is set, the file is already read into memory,
and then it is compressed. In fact, it's allocated twice!

The size is copied into this temp buffer. I wonder if we could just update
the size if it is different?

__hidden long long
tcmd_do_write_check(struct tracecmd_output *handle, const void *data, long long size)
{
	if (handle->do_compress)
		return tracecmd_compress_buffer_write(handle->compress, data, size);

	if (handle->msg_handle)
		return tracecmd_msg_data_send(handle->msg_handle, data, size);

	return __do_write_check(handle->fd, data, size);
}

Now for the "do_compress" we can just update the handle->buffer[] as the
size is the first thing written into it.

For the __do_write_check() we can save the file descriptor location and go
back and update what was written.

For the "->msg_handle", for now just error out. Unless you are running bpf
programs while using trace-cmd on guests or sending off the network?

-- Steve