The 'bpf -p <ID>' command shows truncated kprobe kernel function name
Issue
- The 'bpf -p ID' command shows truncated kprobe kernel function name.
- Execute the 'bpf -p ID' command from the "crash>" prompt.
crash> bpf -p 267
ID BPF_PROG BPF_PROG_AUX BPF_PROG_TYPE TAG USED_MAPS
267 ffffb2f200039000 ffff8aa34267c000 KPROBE 1e982cb7ead83e56 95,96
XLATED: 712 JITED: 439 MEMLOCK: 4096
LOAD_TIME: Tue Jun 14 03:23:49 2022
GPL_COMPATIBLE: yes NAME: "__blk_account_i" UID: 0
^^^^^^^^^^^^^^^
crash> bpf -p 268
ID BPF_PROG BPF_PROG_AUX BPF_PROG_TYPE TAG USED_MAPS
268 ffffb2f200197000 ffff8aa34267e400 KPROBE aa1489189b0a912d 95
XLATED: 120 JITED: 75 MEMLOCK: 4096
LOAD_TIME: Tue Jun 14 03:23:48 2022
GPL_COMPATIBLE: yes NAME: "__blk_account_i" UID: 0
^^^^^^^^^^^^^^^
- The size of 'bpf_prog_info.name[BPF_OBJ_NAME_LEN]' and 'bpf_prog_aux.name[BPF_OBJ_NAME_LEN]' are limited to 16 chars which leads to truncated names since many BPF program have a much longer name.
crash> struct bpf_prog_info.name -ox
struct bpf_prog_info {
[0x40] char name[16];
}
crash> struct bpf_prog_aux.name -ox
struct bpf_prog_aux {
[0x210] char name[16];
}
-
The actual kprobe kernel functions are "__blk_account_io_start" and "__blk_account_io_done" in RHEL 9.
-
The actual kprobe kernel functions are "blk_account_io_start" and "blk_account_io_done" in RHEL 8.
crash> kprobe_table | grep 0xff | awk '{print "kprobe.symbol_name,pre_handler " $NF}' > kprobe
RHEL 9.0 :
crash> < kprobe | grep -v crash | paste - - | cat -n | column -t
1 symbol_name = 0xffff8aa34409ff40 "__blk_account_io_start", pre_handler = 0xffffffff9c82b9e0 <kprobe_dispatcher>,
2 symbol_name = 0xffff8aa34409fda0 "__blk_account_io_done", pre_handler = 0xffffffff9c82b9e0 <kprobe_dispatcher>,
RHEL 8 :
crash> < kprobe | grep -v crash | paste - - | cat -n | column -t
1 symbol_name = 0xffff92f21b54a000 "blk_account_io_done" pre_handler = 0xffffffff9001bec0
2 symbol_name = 0xffff92f21b54ade0 "blk_account_io_start" pre_handler = 0xffffffff9001bec0
Environment
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- crash
- bpftrace
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.