bpftrace: bpftrace fails to attach to some probe points

For some reason I can’t get bpftrace to attach to this one specific uprobe…

What reproduces the bug?

$ sudo ./build/src/bpftrace -lv 'uprobe:/usr/lib/xorg/modules/input/libinput_drv.so:open_restricted'
uprobe:/usr/lib/xorg/modules/input/libinput_drv.so:open_restricted
    const char* path
    int flags
    void* data
$ sudo ./build/src/bpftrace -e 'uprobe:/usr/lib/xorg/modules/input/libinput_drv.so:open_restricted {}'
No probes to attach

debug info

$ debuginfod-find debuginfo /usr/lib/xorg/modules/input/libinput_drv.so # https://debuginfod.archlinux.org/buildid/3edee3fb40fd1b126fc72a33a90d2abb7aabe46a/debuginfo
$ objdump --dwarf=info ~/.cache/debuginfod_client/3edee3fb40fd1b126fc72a33a90d2abb7aabe46a/debuginfo
[...]
 <2><158ab>: Abbrev Number: 5 (DW_TAG_member)
    <158ac>   DW_AT_name        : (indirect string, offset: 0x7132): open_restricted
    <158b0>   DW_AT_decl_file   : 49
    <158b1>   DW_AT_decl_line   : 3513
    <158b3>   DW_AT_decl_column : 8
    <158b4>   DW_AT_type        : <0x158e6>
    <158b8>   DW_AT_data_member_location: 0
[...]
 <1><1a560>: Abbrev Number: 13 (DW_TAG_subprogram)
    <1a561>   DW_AT_name        : (indirect string, offset: 0x7132): open_restricted
    <1a565>   DW_AT_decl_file   : 52
    <1a566>   DW_AT_decl_line   : 2683
    <1a568>   DW_AT_decl_column : 1
    <1a568>   DW_AT_prototyped  : 1
    <1a568>   DW_AT_type        : <0xfe56>
    <1a56c>   DW_AT_sibling     : <0x1a5c0>
[...]

bpftrace --info

$ sudo ./build/src/bpftrace --info
System
  OS: Linux 6.6.3-arch1-1 #1 SMP PREEMPT_DYNAMIC Wed, 29 Nov 2023 00:37:40 +0000
  Arch: x86_64

Build
  version: v0.19.0-79-gdb63
  LLVM: 16.0.6
  unsafe probe: no
  bfd: yes
  libdw (DWARF support): yes

Kernel helpers
  probe_read: yes
  probe_read_str: yes
  probe_read_user: yes
  probe_read_user_str: yes
  probe_read_kernel: yes
  probe_read_kernel_str: yes
  get_current_cgroup_id: yes
  send_signal: yes
  override_return: yes
  get_boot_ns: yes
  dpath: yes
  skboutput: yes
  get_tai_ns: yes
  get_func_ip: yes
  jiffies64: yes

Kernel features
  Instruction limit: 1000000
  Loop support: yes
  btf: yes
  module btf: yes
  map batch: yes
  uprobe refcount (depends on Build:bcc bpf_attach_uprobe refcount): yes

Map types
  hash: yes
  percpu hash: yes
  array: yes
  percpu array: yes
  stack_trace: yes
  perf_event_array: yes
  ringbuf: yes

Probe types
  kprobe: yes
  tracepoint: yes
  perf_event: yes
  kfunc: yes
  kprobe_multi: yes
  uprobe_multi: no
  raw_tp_special: yes
  iter: yes

About this issue

Original URL
State: open
Created 7 months ago
Comments: 18 (13 by maintainers)

Most upvoted comments

I pretty much agree with @danobi here.

One addition from my side - our plan is to slowly move away from the dependency on BCC. Currently, the main target is to do that for program loading and attachment, but symbol resolution is another part where we heavily depend on BCC. If we eventually want to drop it, we will end up doing (3) anyways.

viktormalik on Dec 11, 2023

I run arch linux as well - here’s my libinput_drv.so if it helps.

libinput_drv.so.zip

Thanks, that could be useful for debugging. At the moment, I think that we know the issue, but it’d have to be fixed in BCC.

It’s a bit surprising to me bcc parses dwarf. I don’t see any reference to that in bcc source (didn’t look very hard though)

I believe it’s here.

viktormalik on Dec 6, 2023