Re: [PATCH] tracing/selftests: Ignore __pfx_ symbols in kprobe test

[Peter Zijlstra]

On Thu, Feb 09, 2023 at 11:23:05PM +0900, Masami Hiramatsu wrote:

> BTW, currently kprobe event rejects this __pfx_ symbols because it is notrace
> symbols, thus we can trace it if CONFIG_KPROBE_EVENTS_ON_NOTRACE=y.
> But I guess it should not probe that place always because it should never
> executed right?

Execution can take place in those ranges when X86_FEATURE_CALL_DEPTH is
enabled or when CONFIG_KCFI && X86_FEATURE_IBT.

In the first of those cases the prefix bytes are filled with call
accounting instructions and every direct call to $sym is patched to
point to __pfx_$sym+6 (aka $sym-10).

  https://lore.kernel.org/all/20220915111039.092790446@xxxxxxxxxxxxx/

In the second case (FineIBT) it is probably easiest if you look at the
comment in arch/x86/kernel/alternative.c near CONFIG_FINEIBT.

  https://lore.kernel.org/all/20221027092812.185993858@xxxxxxxxxxxxx/

The __pfx_ and __cfi_ symbols are the same (in fact, when
CONFIG_CFI_CLANG=y the compiler generates them and objtool no longer
emits the __pfx_ symbols).

  https://lore.kernel.org/all/20221028194453.592512209@xxxxxxxxxxxxx/