[PATCH 06/15] perf symbol: Fall back to fetching the vmlinux by build ID

From: Arnaldo Carvalho de Melo

Date: Thu Sep 17 2026 - 12:10:47 EST


From: Arnaldo Carvalho de Melo <acme@xxxxxxxxxx>

A profile recorded on a kernel that is no longer installed, e.g. one
processed on another machine or after a kernel upgrade, cannot have its
kernel symbols resolved: /proc/kallsyms does not match it and the
build-id cache may carry only a kallsyms copy with zeroed addresses.
Fetch the vmlinux keyed by the build ID recorded in perf.data, using
debuginfod, as a last resort when no local source was found, honoring
symbol_conf.ignore_vmlinux and ignore_vmlinux_buildid like the other
vmlinux sources.

The fetch runs with dso->lock dropped, like dso__debuginfo(), and the
file is loaded with the lock held again, only if no other thread got the
symbols meanwhile (dso__has_symbols(), not dso__loaded(): the latter is
set even for failed attempts). With the lock dropped two threads can
map the x86-64 entry trampolines at once, so that mapping is now
idempotent.

Assisted-by: LLM
Signed-off-by: Arnaldo Carvalho de Melo <acme@xxxxxxxxxx>
---
tools/perf/util/machine.c | 11 ++++++--
tools/perf/util/symbol.c | 55 ++++++++++++++++++++++++++++++++++++++-
2 files changed, 63 insertions(+), 3 deletions(-)

diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index a1288fbed8330a23..8aa9f5f12d3ea4bf 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1139,12 +1139,19 @@ static int machine__map_x86_64_entry_trampolines_cb(struct map *map, void *data)
if (!kmap || !is_entry_trampoline(kmap->name))
return 0;

+ args->found = true;
+
+ /*
+ * pgoff is a virtual address when the trampoline maps are created and
+ * a vmlinux offset once mapped, so a second pass, e.g. a concurrent
+ * dso__load() of the kernel dso, finds no map and has nothing to
+ * translate: leave the map alone, never dereference a NULL dest_map.
+ */
dest_map = maps__find(args->kmaps, map__pgoff(map));
- if (RC_CHK_ACCESS(dest_map) != RC_CHK_ACCESS(map))
+ if (dest_map != NULL && RC_CHK_ACCESS(dest_map) != RC_CHK_ACCESS(map))
map__set_pgoff(map, map__map_ip(dest_map, map__pgoff(map)));

map__put(dest_map);
- args->found = true;
return 0;
}

diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index fbad770cb96f8294..7a84dc8420975ab6 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -20,6 +20,7 @@
#include "cap.h"
#include "cpumap.h"
#include "debug.h"
+#include "debuginfo.h"
#include "demangle-cxx.h"
#include "demangle-java.h"
#include "demangle-ocaml.h"
@@ -2191,12 +2192,28 @@ static char *dso__find_kallsyms(struct dso *dso, struct map *map)
return strdup(path);
}

+/*
+ * Last resort when the symbols for the kernel the profile was recorded
+ * on can't be found locally: fetch the vmlinux keyed by the build ID
+ * recorded in perf.data, e.g. when processing the profile on another
+ * machine or after the kernel got upgraded in between.
+ */
+/* Called by dso__load_kernel_sym() with dso->lock dropped, see there. */
+static int dso__fetch_vmlinux_build_id(struct dso *dso, char **path)
+{
+ if (!dso__has_build_id(dso))
+ return -1;
+
+ return debuginfo__find_build_id(dso__bid(dso), path);
+}
+
static int dso__load_kernel_sym(struct dso *dso, struct map *map)
{
int err;
const char *kallsyms_filename = NULL;
char *kallsyms_allocated_filename = NULL;
char *filename = NULL;
+ bool user_kallsyms = false;

/*
* Step 1: if the user specified a kallsyms or vmlinux filename, use
@@ -2215,6 +2232,7 @@ static int dso__load_kernel_sym(struct dso *dso, struct map *map)
*/
if (symbol_conf.kallsyms_name != NULL) {
kallsyms_filename = symbol_conf.kallsyms_name;
+ user_kallsyms = true;
goto do_kallsyms;
}

@@ -2257,7 +2275,42 @@ static int dso__load_kernel_sym(struct dso *dso, struct map *map)
pr_debug("Using %s for symbols\n", kallsyms_filename);
free(kallsyms_allocated_filename);

- if (err > 0 && !dso__is_kcore(dso)) {
+ /*
+ * The kallsyms may be unavailable or restricted, try to fetch the
+ * vmlinux keyed by the build ID using debuginfod as a last resort,
+ * honoring ignore_vmlinux/ignore_vmlinux_buildid like the sources above.
+ */
+ if (err <= 0 && !user_kallsyms &&
+ !symbol_conf.ignore_vmlinux &&
+ !symbol_conf.ignore_vmlinux_buildid) {
+ char *fetched_path = NULL;
+
+ /*
+ * dso__load() holds dso->lock while it calls us, and the fetch below
+ * can block for a long time: do it with the lock dropped, like
+ * dso__debuginfo(), and load the symbols with the lock held again.
+ */
+ mutex_unlock(dso__lock(dso));
+ err = dso__fetch_vmlinux_build_id(dso, &fetched_path);
+ mutex_lock(dso__lock(dso));
+
+ if (err) {
+ zfree(&fetched_path);
+ } else if (dso__has_symbols(dso)) {
+ /*
+ * Somebody else got the symbols while the lock was dropped for the
+ * fetch, use those instead. dso__has_symbols() and not dso__loaded():
+ * the latter is set even for failed attempts.
+ */
+ pr_debug("%s got its symbols while its vmlinux was being fetched, using them\n",
+ dso__name(dso));
+ zfree(&fetched_path);
+ err = 1;
+ } else {
+ /* Takes ownership of 'fetched_path' even when it fails */
+ err = dso__load_vmlinux(dso, map, fetched_path, true);
+ }
+ } else if (err > 0 && !dso__is_kcore(dso)) {
struct maps *kmaps = map__kmaps(map);

dso__set_binary_type(dso, DSO_BINARY_TYPE__KALLSYMS);
--
2.55.0