Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

elf: Add kprobe EventNameOption for unique eventName per Module #293

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

elf: Add kprobe EventNameOption for unique eventName per Module #293

wants to merge 1 commit into from

Conversation

intr3p1d
Copy link

#251 : can't attach two functions for the same kprobe event
#271 : make uprobe eventname with symbol address (maybe similar issue)

Intention

Currently, gobpf/elf Module make kprobe eventName like this:

eventName := probeType + funcName

gobpf/elf/module.go

Lines 746 to 751 in 2289761

if isKretprobe {
funcName = strings.TrimPrefix(name, "kretprobe/")
err = disableKprobe("r" + funcName)
} else {
funcName = strings.TrimPrefix(name, "kprobe/")
err = disableKprobe("p" + funcName)

Such a naming works well when we use it temporarily.
However, this situation can happen: (Also I get stuck)

  1. Program 1 attaches a probe at an address (such as kprobe/tcp_sendmsg)
  2. Program 2 attaches a probe at the address
  3. Even though eBPF allows multiple probes at the same address*, error occurred: "could not enable kprobe_events: file exists"

*The Kernel document says that we can actually attach two different probes at the same address.
https://www.kernel.org/doc/Documentation/kprobes.txt : 5. Kprobes Features and Limitations

I know that this issue is a little tricky to handle in the library. I tried to fix this issue in my use.
But It was much more tricky to handle unexported fields and methods... So I made this PR.

Changed Files

  • elf/module.go : Add a field kprobeEvOpts EventNameOption in Module therefore we can seperate a namespace of each Module.
  • elf/module_unsupported.go : Adjust for unsupported module

Need to Fix

  • Change gobpf/bcc.Module to work same as above.
  • Move the body of TrySetKprobeEventNameOpts() to the constructor of elf.Module (?)
    - There are already 4 constructor in elf.Module such as... : NewModuleWithLog, NewModuleFromReaderWithLog, NewModule, NewModuleFromReader. Therefore I didn't make additional constructor.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant