wkz / ply

Light-weight Dynamic Tracer for Linux
https://wkz.github.io/ply
GNU General Public License v2.0
402 stars 156 forks source link

tracepoint self-test failed #38

Closed nikhilh-20 closed 1 year ago

nikhilh-20 commented 1 year ago

Hello,

I came across a self-test failure while I was setting up ply inside a Buildroot-generated x86-64 Linux image:

# ply --version
ply  (linux-version:393479~6.1.7)

# ply -T
WARN: Unable to verify kernel config
Ensuring that debugfs is mounted... OK
Verifying kprobe... OK
Verifying tracepoint... [ 2254.003304] traps: ply[170] trap divide error ip:7f4a30f0594f sp:7fff766703a0 error:0 in libply.so.0.0.0[7f4a30efe000+f000]
ERROR
Verifying special... OK
Verifying interval... OK

# uname -a
Linux test 6.1.7 #1 SMP PREEMPT_DYNAMIC Thu Jan 19 22:46:28 EST 2023 x86_64 GNU/Linux

Do you think it might be an issue related to the kernel version? At this point, it's the latest.

kprobe seems to be okay.

# cat opensnoop.py 
#!/sbin/ply

kprobe:do_sys_open*
{
    path[kpid] = str(arg1);
}

kretprobe:do_sys_open*
{
    printf("PID: %v PROCESS: %v PATH: %v RETVAL: %d\n", pid, comm, path[kpid], retval);
    delete path[kpid];
}

# ply opensnoop.py 
^CPID:   175 PROCESS: ply             PATH: /sys/kernel/debug/tracing/events/ply175/p5608861e6ad0_do_sys_openat2/id                                                         RETVAL: 12

I added following options to x86-64 config file before building the Linux image via Buildroot:

CONFIG_BPF_SYSCALL=y
CONFIG_UPROBES=y
CONFIG_TRACEPOINTS=y
CONFIG_FTRACE=y
CONFIG_DYNAMIC_FTRACE=y
CONFIG_PERF_EVENTS=y

CONFIG_NOP_TRACER=y
CONFIG_HAVE_FUNCTION_TRACER=y
CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
CONFIG_TRACER_MAX_TRACE=y
CONFIG_CONTEXT_SWITCH_TRACER=y
CONFIG_GENERIC_TRACER=y
CONFIG_FUNCTION_TRACER=y
CONFIG_FUNCTION_GRAPH_TRACER=y
CONFIG_SCHED_TRACER=y
CONFIG_TRACER_SNAPSHOT=y
CONFIG_STACK_TRACER=y

I'm doing this kinda thing for the first time, so please let me know if you need more information. Thanks!

nikhilh-20 commented 1 year ago

Issue might indeed be related to kernel version. I don't see an error with kernel v5.15.58

# uname -r
5.15.58

# ply --version
ply  (linux-version:331578~5.15.58)

# ply -T
[   28.457920] process '/usr/sbin/ply' started with executable stack
WARN: Unable to verify kernel config
Ensuring that debugfs is mounted... OK
Verifying kprobe... OK
Verifying tracepoint... OK
Verifying special... OK
Verifying interval... OK