Re: [PATCH] libtracecmd: Support changing /proc/kallsyms

On 2025-05-30 22:45, Steven Rostedt wrote:
> On Thu, 17 Apr 2025 01:13:00 +0200
> Ilya Leoshkevich <[email protected]> wrote:
> 
> I finally got some time to look at this. Sorry for the delay.
> 
>> Running BPF selftests under trace-cmd intermittently fails with:
>> 
>>     error in size of file '/proc/kallsyms'
>> 
>> This is because these selftests load and unload BPF programs.
>> bpf_prog_put() uses workqueues and RCU, so these programs disappear
>> from /proc/kallsyms after a delay.
>> 
>> trace-cmd reads /proc/kallsyms twice: the first time to compute its
>> size, and the second time to copy it into the trace file. If the
>> resulting sizes don't match, which is what happens in this case,
>> recording fails.
>> 
>> Fix by first copying /proc/kallsyms into a temporary file, and then
>> into the trace file. An alternative would be to read it into a
>> malloc()-ed buffer, but this would increase trace-cmd memory usage,
>> since /proc/kallsyms can be a few dozen megabytes large. In case
>> /tmp is tmpfs, both solutions are almost equivalent.
> 
> Actually, when compression is set, the file is already read into 
> memory,
> and then it is compressed. In fact, it's allocated twice!
> 
> The size is copied into this temp buffer. I wonder if we could just 
> update
> the size if it is different?
> 
> __hidden long long
> tcmd_do_write_check(struct tracecmd_output *handle, const void *data,
> long long size)
> {
> 	if (handle->do_compress)
> 		return tracecmd_compress_buffer_write(handle->compress, data, size);
> 
> 	if (handle->msg_handle)
> 		return tracecmd_msg_data_send(handle->msg_handle, data, size);
> 
> 	return __do_write_check(handle->fd, data, size);
> }
> 
> Now for the "do_compress" we can just update the handle->buffer[] as 
> the
> size is the first thing written into it.
> 
> For the __do_write_check() we can save the file descriptor location and 
> go
> back and update what was written.
> 
> For the "->msg_handle", for now just error out. Unless you are running 
> bpf
> programs while using trace-cmd on guests or sending off the network?
> 
> -- Steve

Thanks for taking a look.
What you propose should work for me.
Would you mind if I make do_lseek() non-static for this?
And maybe rename it to tcmd_do_lseek().
Touching do_compress/msg_handle/pointer/fd directly feels hackish.