get_kprobe_functions(): detect more non-attachable functions (#2077)

* get_kprobe_functions(): detect more non-attachable functions

Improve get_kprobe_functions() to exclude more non-attachable functions
like IRQ routines and functions in kernel modules blacklisted via
NOKPROBE_SYMBOLS().
Signed-off-by: Andrea Righi <righi.andrea@gmail.com>

* get_kprobe_functions: fix bytes/str type error
Signed-off-by: Andrea Righi <righi.andrea@gmail.com>

src/python/bcc/__init__.py

@@ -515,9 +515,12 @@ class BPF(object):
         fns = []
 
         in_init_section = 0
+        in_irq_section = 0
         with open("/proc/kallsyms", "rb") as avail_file:
             for line in avail_file:
                 (t, fn) = line.rstrip().split()[1:3]
+                # Skip all functions defined between __init_begin and
+                # __init_end
                 if in_init_section == 0:
                     if fn == b'__init_begin':
                         in_init_section = 1
@@ -526,6 +529,26 @@ class BPF(object):
                     if fn == b'__init_end':
                         in_init_section = 2
                     continue
+                # Skip all functions defined between __irqentry_text_start and
+                # __irqentry_text_end
+                if in_irq_section == 0:
+                    if fn == b'__irqentry_text_start':
+                        in_irq_section = 1
+                        continue
+                elif in_irq_section == 1:
+                    if fn == b'__irqentry_text_end':
+                        in_irq_section = 2
+                    continue
+                # All functions defined as NOKPROBE_SYMBOL() start with the
+                # prefix _kbl_addr_*, blacklisting them by looking at the name
+                # allows to catch also those symbols that are defined in kernel
+                # modules.
+                if fn.startswith(b'_kbl_addr_'):
+                    continue
+                # Explicitly blacklist perf-related functions, they are all
+                # non-attachable.
+                elif fn.startswith(b'__perf') or fn.startswith(b'perf_'):
+                    continue
                 if (t.lower() in [b't', b'w']) and re.match(event_re, fn) \
                     and fn not in blacklist:
                     fns.append(fn)