The 'bpf -p <ID>' command shows truncated kprobe kernel function name

Solution In Progress - Updated -

Issue

  • The 'bpf -p ID' command shows truncated kprobe kernel function name.
  • Execute the 'bpf -p ID' command from the "crash>" prompt.
crash> bpf -p 267                                                              
 ID      BPF_PROG       BPF_PROG_AUX   BPF_PROG_TYPE       TAG        USED_MAPS      
267  ffffb2f200039000 ffff8aa34267c000    KPROBE     1e982cb7ead83e56   95,96        
     XLATED: 712  JITED: 439  MEMLOCK: 4096                                          
     LOAD_TIME: Tue Jun 14 03:23:49 2022                                             
     GPL_COMPATIBLE: yes  NAME: "__blk_account_i"  UID: 0                            
                                 ^^^^^^^^^^^^^^^                                                                                                                      
crash> bpf -p 268                                                              
 ID      BPF_PROG       BPF_PROG_AUX   BPF_PROG_TYPE       TAG        USED_MAPS
268  ffffb2f200197000 ffff8aa34267e400    KPROBE     aa1489189b0a912d    95     
     XLATED: 120  JITED: 75  MEMLOCK: 4096
     LOAD_TIME: Tue Jun 14 03:23:48 2022
     GPL_COMPATIBLE: yes  NAME: "__blk_account_i"  UID: 0
                                 ^^^^^^^^^^^^^^^  
  • The size of 'bpf_prog_info.name[BPF_OBJ_NAME_LEN]' and 'bpf_prog_aux.name[BPF_OBJ_NAME_LEN]' are limited to 16 chars which leads to truncated names since many BPF program have a much longer name.
crash> struct bpf_prog_info.name -ox
struct bpf_prog_info {
  [0x40] char name[16];
}

crash> struct bpf_prog_aux.name -ox
struct bpf_prog_aux {
  [0x210] char name[16];
}
  • The actual kprobe kernel functions are "__blk_account_io_start" and "__blk_account_io_done" in RHEL 9.

  • The actual kprobe kernel functions are "blk_account_io_start" and "blk_account_io_done" in RHEL 8.

crash> kprobe_table | grep 0xff | awk '{print "kprobe.symbol_name,pre_handler " $NF}' > kprobe

RHEL 9.0 :
crash> < kprobe | grep -v crash | paste - - | cat -n | column -t
1  symbol_name  =  0xffff8aa34409ff40  "__blk_account_io_start",  pre_handler  =  0xffffffff9c82b9e0  <kprobe_dispatcher>,
2  symbol_name  =  0xffff8aa34409fda0  "__blk_account_io_done",   pre_handler  =  0xffffffff9c82b9e0  <kprobe_dispatcher>,

RHEL 8 :
crash> < kprobe | grep -v crash | paste - - | cat -n | column -t
1  symbol_name  =  0xffff92f21b54a000  "blk_account_io_done"   pre_handler  =  0xffffffff9001bec0
2  symbol_name  =  0xffff92f21b54ade0  "blk_account_io_start"  pre_handler  =  0xffffffff9001bec0

Environment

  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • crash
  • bpftrace

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content