uprobe DWARF location attachment does not work with uprobe_multi

[viktormalik]

#3095 introduced parsing of DWARF for a binary and attaching uprobes after the function prologue. This is currently not used in combination with uprobe_multi, compare:

# bpftrace  -e 'uprobe:tests/testprogs/uprobe_loop:uprobeFunction1 {  printf("%s\n", ustack); exit(); }' -c tests/testprogs/uprobe_loop
Attaching 1 probe...

        uprobeFunction1+13
        spin+37
        main+25
        __libc_start_call_main+122
        __libc_start_main_alias_1+139
        _start+37

# bpftrace  -e 'uprobe:tests/testprogs/uprobe_loop:uprobeFunction* {  printf("%s\n", ustack); exit(); }' -c tests/testprogs/uprobe_loop
Attaching 1 probe...

        uprobeFunction1+0
        main+25
        __libc_start_call_main+122
        __libc_start_main_alias_1+139
        _start+37

In the second stack, uprobe is not attached after the prologue.

Since uprobe_multi link actually accepts offsets rather that function names, it should be possible to use these two mechanisms together.

cc @ttreyer

[ttreyer]

Since uprobe_multi link actually accepts offsets rather that function names, it should be possible to use these two mechanisms together.

Just to understand clearly, I could pass something like "uprobeFunction1+1234" inside the probe.funcs vector and the Kernel will set the probe at the specified offset? Or does it accept stringified addresses too?

[ajor]

It's bpftrace that does the symbol resolution already in resolve_offset_uprobe_multi.

Then we just pass the raw offsets to the kernel here:

bpftrace/src/attached_probe.cpp

Line 1102 in d592be8

opts.uprobe_multi.offsets = offsets.data();

[viktormalik]

It's bpftrace that does the symbol resolution already in resolve_offset_uprobe_multi.

Then we just pass the raw offsets to the kernel here:

bpftrace/src/attached_probe.cpp

Line 1102 in d592be8

opts.uprobe_multi.offsets = offsets.data();

Exactly. So, we could support storing function+offset in probe.funcs and then just add offset to the raw ELF offset passed to opts.uprobe_multi.offsets.

[ttreyer]

Is there something I need to enable in the Kernel?
I'm running Linux 6.8.9-300.fc40.aarch64, but bpftrace --info shows:

Probe types
  kprobe: yes
  tracepoint: yes
  perf_event: yes
  kfunc: yes
  kprobe_multi: no
  uprobe_multi: no
  raw_tp_special: yes
  iter: yes

[ajor]

I don't think there are any kernel settings to configure. Have you got a recent version of libbpf? Looks like it'll need 1.3 or newer: https://github.com/libbpf/libbpf/releases