Failed to attach to kprobe (non blacklisted)

Failed to attach to kprobe (non blacklisted)

[asaf eitani]

Hi BPF experts,

I'm having issues to attach to certain kprobes and kretprobes that are
not in the blacklist, like ftrace_modify_all_code.
There are kernel modules that are capable of attaching to those
kprobes and kretprobes but I could not attach them using libbpf.

I tried using both tracee(https://github.com/aquasecurity/tracee) and
bpftrace(https://github.com/iovisor/bpftrace) to attach to those
kprobes, which to my understanding uses libbpf, but both of them
returned an "Invalid argument" error.

As the blacklist doesn't seem to cover all the functions which are not
attachable to kprobes, is there a way to get/compile such a list?
Also, what is the specific problem with attaching to this function
(ftrace_modify_all_code)?

Thanks.

Re: Failed to attach to kprobe (non blacklisted)

[Yonghong Song]

On 7/6/21 4:56 AM, asaf eitani wrote:
> Hi BPF experts,
> 
> I'm having issues to attach to certain kprobes and kretprobes that are
> not in the blacklist, like ftrace_modify_all_code.
> There are kernel modules that are capable of attaching to those
> kprobes and kretprobes but I could not attach them using libbpf.

Any details what kind of kernel modules you use to make kprobes work
for ftrace_modify_all_code()?

> 
> I tried using both tracee(https://github.com/aquasecurity/tracee) and
> bpftrace(https://github.com/iovisor/bpftrace) to attach to those
> kprobes, which to my understanding uses libbpf, but both of them
> returned an "Invalid argument" error.
> 
> As the blacklist doesn't seem to cover all the functions which are not
> attachable to kprobes, is there a way to get/compile such a list?
> Also, what is the specific problem with attaching to this function
> (ftrace_modify_all_code)?

The file trace/ftrace.c is compiled without FTRACE flag.

See trace/Makefile:
ccflags-remove-$(CONFIG_FUNCTION_TRACER) += $(CC_FLAGS_FTRACE)

ffffffff811888b0 <ftrace_modify_all_code>:
ffffffff811888b0: 41 54                 pushq   %r12
ffffffff811888b2: b8 02 00 00 00        movl    $2, %eax
ffffffff811888b7: 41 89 fc              movl    %edi, %r12d
ffffffff811888ba: 55                    pushq   %rbp
ffffffff811888bb: 89 fd                 movl    %edi, %ebp

I doesn't have a call to __fentry__ like below.
ffffffff8101cae0: e8 7b 48 be 00        callq   0xffffffff81c01360 
<__fentry__>


> 
> Thanks.
>