Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

libbpf: name-based u[ret]probe attach #227

Closed
wants to merge 6 commits into from
Closed

libbpf: name-based u[ret]probe attach #227

wants to merge 6 commits into from

Commits on Apr 4, 2022

  1. adding ci files

    Nobody committed Apr 4, 2022
    Configuration menu
    Copy the full SHA
    a36db67 View commit details
    Browse the repository at this point in the history

  2. libbpf: bpf_program__attach_uprobe_opts() should determine paths for … 

    …programs/libraries where possible

bpf_program__attach_uprobe_opts() requires a binary_path argument
specifying binary to instrument.  Supporting simply specifying
"libc.so.6" or "foo" should be possible too.

Library search checks LD_LIBRARY_PATH, then /usr/lib64, /usr/lib.
This allows users to run BPF programs prefixed with
LD_LIBRARY_PATH=/path2/lib while still searching standard locations.
Similarly for non .so files, we check PATH and /usr/bin, /usr/sbin.

Path determination will be useful for auto-attach of BPF uprobe programs
using SEC() definition.

Signed-off-by: Alan Maguire <[email protected]>
    @alan-maguire
    alan-maguire authored and Nobody committed Apr 4, 2022
    Configuration menu
    Copy the full SHA
    537ebf6 View commit details
    Browse the repository at this point in the history

  3. libbpf: support function name-based attach uprobes 

    kprobe attach is name-based, using lookups of kallsyms to translate
a function name to an address.  Currently uprobe attach is done
via an offset value as described in [1].  Extend uprobe opts
for attach to include a function name which can then be converted
into a uprobe-friendly offset.  The calcualation is done in
several steps:

1. First, determine the symbol address using libelf; this gives us
   the offset as reported by objdump
2. If the function is a shared library function - and the binary
   provided is a shared library - no further work is required;
   the address found is the required address
3. Finally, if the function is local, subtract the base address
   associated with the object, retrieved from ELF program headers.

The resultant value is then added to the func_offset value passed
in to specify the uprobe attach address.  So specifying a func_offset
of 0 along with a function name "printf" will attach to printf entry.

The modes of operation supported are then

1. to attach to a local function in a binary; function "foo1" in
   "/usr/bin/foo"
2. to attach to a shared library function in a shared library -
   function "malloc" in libc.

[1] https://www.kernel.org/doc/html/latest/trace/uprobetracer.html

Signed-off-by: Alan Maguire <[email protected]>
    @alan-maguire
    alan-maguire authored and Nobody committed Apr 4, 2022
    Configuration menu
    Copy the full SHA
    2c85c92 View commit details
    Browse the repository at this point in the history

  4. libbpf: add auto-attach for uprobes based on section name 

    Now that u[ret]probes can use name-based specification, it makes
sense to add support for auto-attach based on SEC() definition.
The format proposed is

        SEC("u[ret]probe/binary:[raw_offset|[function_name[+offset]]")

For example, to trace malloc() in libc:

        SEC("uprobe/libc.so.6:malloc")

...or to trace function foo2 in /usr/bin/foo:

        SEC("uprobe//usr/bin/foo:foo2")

Auto-attach is done for all tasks (pid -1).  prog can be an absolute
path or simply a program/library name; in the latter case, we use
PATH/LD_LIBRARY_PATH to resolve the full path, falling back to
standard locations (/usr/bin:/usr/sbin or /usr/lib64:/usr/lib) if
the file is not found via environment-variable specified locations.

Signed-off-by: Alan Maguire <[email protected]>
    @alan-maguire
    alan-maguire authored and Nobody committed Apr 4, 2022
    Configuration menu
    Copy the full SHA
    1b0ca31 View commit details
    Browse the repository at this point in the history

  5. selftests/bpf: add tests for u[ret]probe attach by name 

    add tests that verify attaching by name for

1. local functions in a program
2. library functions in a shared object

...succeed for uprobe and uretprobes using new "func_name"
option for bpf_program__attach_uprobe_opts().  Also verify
auto-attach works where uprobe, path to binary and function
name are specified, but fails with -EOPNOTSUPP with a SEC
name that does not specify binary path/function.

Signed-off-by: Alan Maguire <[email protected]>
    @alan-maguire
    alan-maguire authored and Nobody committed Apr 4, 2022
    Configuration menu
    Copy the full SHA
    69f35bc View commit details
    Browse the repository at this point in the history

  6. selftests/bpf: add tests for uprobe auto-attach via skeleton 

    tests that verify auto-attach works for function entry/return for
local functions in program and library functions in a library.

Signed-off-by: Alan Maguire <[email protected]>
    @alan-maguire
    alan-maguire authored and Nobody committed Apr 4, 2022
    Configuration menu
    Copy the full SHA
    1eac245 View commit details
    Browse the repository at this point in the history