Re: Failed to attach to kprobe (non blacklisted)

[Yonghong Song <yhs@fb.com>]

On 7/6/21 4:56 AM, asaf eitani wrote:
> Hi BPF experts,
> 
> I'm having issues to attach to certain kprobes and kretprobes that are
> not in the blacklist, like ftrace_modify_all_code.
> There are kernel modules that are capable of attaching to those
> kprobes and kretprobes but I could not attach them using libbpf.

Any details what kind of kernel modules you use to make kprobes work
for ftrace_modify_all_code()?

> 
> I tried using both tracee(https://github.com/aquasecurity/tracee) and
> bpftrace(https://github.com/iovisor/bpftrace) to attach to those
> kprobes, which to my understanding uses libbpf, but both of them
> returned an "Invalid argument" error.
> 
> As the blacklist doesn't seem to cover all the functions which are not
> attachable to kprobes, is there a way to get/compile such a list?
> Also, what is the specific problem with attaching to this function
> (ftrace_modify_all_code)?

The file trace/ftrace.c is compiled without FTRACE flag.

See trace/Makefile:
ccflags-remove-$(CONFIG_FUNCTION_TRACER) += $(CC_FLAGS_FTRACE)

ffffffff811888b0 <ftrace_modify_all_code>:
ffffffff811888b0: 41 54                 pushq   %r12
ffffffff811888b2: b8 02 00 00 00        movl    $2, %eax
ffffffff811888b7: 41 89 fc              movl    %edi, %r12d
ffffffff811888ba: 55                    pushq   %rbp
ffffffff811888bb: 89 fd                 movl    %edi, %ebp

I doesn't have a call to __fentry__ like below.
ffffffff8101cae0: e8 7b 48 be 00        callq   0xffffffff81c01360 
<__fentry__>


> 
> Thanks.
>