-
Notifications
You must be signed in to change notification settings - Fork 111
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for attaching uprobes and uretprobes to offsets #1419
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1419 +/- ##
==========================================
- Coverage 81.07% 80.93% -0.14%
==========================================
Files 149 149
Lines 15130 15250 +120
==========================================
+ Hits 12266 12342 +76
- Misses 2272 2301 +29
- Partials 592 607 +15
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
720fc67
to
bf7c80d
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM! Very cool refactor and so nice to see we use the same mechanism now for Go and non-Go.
bf7c80d
to
7005f63
Compare
74b4f55
to
1e50a27
Compare
In its core, this PR adds support for attaching ebf programs to (start and return) offsets, in the same fashion done for "goprobes". The motivation is also the same: uretprobes attachments can be unreliable in contexts where the target process stack changes. In such scenarios, attaching uretprobes may cause the target process to crash.
Under the hood, we scan the target binary for the offsets of the symbols we want to attach to: the start offset, and the offset of every
RET
instruction present in that function. This approach is not flawless, and will fail if the the function/symbol in question does not posses anyRET
instruction due to compiler optimisations (see here for an example).Due to the requirement of handling uprobe offsets, codewise the handling of uprobes and goprobes becomes less distinct. The ultimate goal would be to merge their corresponding code and remove considerable code duplication. A central piece for this is the repurposing of
ebpfcommon.FuncPrograms
into a more comprehensive data structure that carries the entire context (relevant to our use cases) of ebpf attachments: apart from the start and end programs, it now features the symbol name and the offsets. This also enables us to ditch a few maps that were being used for this purpose, and simplifies the code considerably.