Merge pull request #154 from parca-dev/rtld-improve

Improvements to AttachUSDTProbe

Author: gnurizen

.github/workflows/unit-test-on-pull-request.yml

@@ -232,3 +232,33 @@ jobs:
         run: |
           uname -a
           sudo go test ./interpreter/... -v -run TestIntegration
+
+  rtld-qemu-tests:
+    name: RTLD QEMU tests (kernel ${{ matrix.kernel }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    strategy:
+      matrix:
+        kernel:
+          - 5.10.217  # Pre-6.6, uses single-shot mode
+          - 6.8.10    # Post-6.6, supports multi-uprobe
+    steps:
+      - name: Clone code
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+      - name: Install dependencies
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y qemu-system-x86 debootstrap
+      - name: Download kernel
+        run: |
+          cd test/rtld-qemu
+          ./download-kernel.sh ${{ matrix.kernel }}
+      - name: Run RTLD tests in QEMU
+        run: |
+          cd test/rtld-qemu
+          ./build-and-run.sh ${{ matrix.kernel }}

interpreter/instancestubs.go

@@ -4,12 +4,17 @@
 package interpreter // import "go.opentelemetry.io/ebpf-profiler/interpreter"
 
 import (
+	"unsafe"
+
 	"go.opentelemetry.io/ebpf-profiler/host"
 	"go.opentelemetry.io/ebpf-profiler/libpf"
+	"go.opentelemetry.io/ebpf-profiler/libpf/pfelf"
+	"go.opentelemetry.io/ebpf-profiler/lpm"
 	"go.opentelemetry.io/ebpf-profiler/metrics"
 	"go.opentelemetry.io/ebpf-profiler/process"
 	"go.opentelemetry.io/ebpf-profiler/reporter"
 	"go.opentelemetry.io/ebpf-profiler/tpbase"
+	"go.opentelemetry.io/ebpf-profiler/util"
 )
 
 // InstanceStubs provides empty implementations of Instance hooks that are
@@ -37,3 +42,44 @@ func (is *InstanceStubs) GetAndResetMetrics() ([]metrics.Metric, error) {
 func (is *InstanceStubs) Symbolize(*host.Frame, *libpf.Frames) error {
 	return ErrMismatchInterpreterType
 }
+
+type EbpfHandlerStubs struct{}
+
+func (m *EbpfHandlerStubs) UpdatePidInterpreterMapping(_ libpf.PID,
+	pfx lpm.Prefix, _ uint8, _ host.FileID, _ uint64) error {
+	return nil
+}
+
+func (m *EbpfHandlerStubs) DeletePidInterpreterMapping(_ libpf.PID, _ lpm.Prefix) error {
+	return nil
+}
+
+func (m *EbpfHandlerStubs) CoredumpTest() bool {
+	return false
+}
+
+func (m *EbpfHandlerStubs) UpdateInterpreterOffsets(uint16, host.FileID,
+	[]util.Range) error {
+	return nil
+}
+
+func (m *EbpfHandlerStubs) UpdateProcData(libpf.InterpreterType, libpf.PID,
+	unsafe.Pointer) error {
+	return nil
+}
+
+func (m *EbpfHandlerStubs) DeleteProcData(libpf.InterpreterType, libpf.PID) error {
+	return nil
+}
+
+func (mockup *EbpfHandlerStubs) AttachUSDTProbes(libpf.PID, string, string, []pfelf.USDTProbe,
+	[]uint64, []string, bool) (LinkCloser, error) {
+	return nil, nil
+}
+
+func (mockup *EbpfHandlerStubs) TriggerProcessSync(libpf.PID) error {
+	return nil
+}
+
+func (mockup *EbpfHandlerStubs) SetProcessSyncTrigger(func(pid libpf.PID)) {
+}

interpreter/luajit/mappings_test.go

@@ -13,17 +13,13 @@ package luajit
 import (
 	"debug/elf"
 	"testing"
-	"unsafe"
 
-	"github.com/cilium/ebpf/link"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/ebpf-profiler/host"
 	"go.opentelemetry.io/ebpf-profiler/interpreter"
 	"go.opentelemetry.io/ebpf-profiler/libpf"
-	"go.opentelemetry.io/ebpf-profiler/libpf/pfelf"
 	"go.opentelemetry.io/ebpf-profiler/lpm"
 	"go.opentelemetry.io/ebpf-profiler/process"
-	"go.opentelemetry.io/ebpf-profiler/util"
 )
 
 type prefixKey struct {
@@ -33,15 +29,12 @@ type prefixKey struct {
 
 // ebpfMapsMockup implements the ebpf interface as test mockup
 type ebpfMapsMockup struct {
+	interpreter.EbpfHandlerStubs
 	prefixes map[prefixKey]lpm.Prefix
 }
 
 var _ interpreter.EbpfHandler = &ebpfMapsMockup{}
 
-func (m *ebpfMapsMockup) CoredumpTest() bool {
-	return false
-}
-
 func (m *ebpfMapsMockup) UpdatePidInterpreterMapping(pid libpf.PID,
 	pfx lpm.Prefix, _ uint8, _ host.FileID, _ uint64) error {
 	m.prefixes[prefixKey{pid: pid, pfx: pfx}] = pfx
@@ -53,25 +46,6 @@ func (m *ebpfMapsMockup) DeletePidInterpreterMapping(pid libpf.PID, pfx lpm.Pref
 	return nil
 }
 
-func (m *ebpfMapsMockup) UpdateInterpreterOffsets(uint16, host.FileID,
-	[]util.Range) error {
-	return nil
-}
-
-func (m *ebpfMapsMockup) UpdateProcData(libpf.InterpreterType, libpf.PID,
-	unsafe.Pointer) error {
-	return nil
-}
-
-func (m *ebpfMapsMockup) DeleteProcData(libpf.InterpreterType, libpf.PID) error {
-	return nil
-}
-
-func (mockup *ebpfMapsMockup) AttachUSDTProbe(_ libpf.PID, _ string, _ pfelf.USDTProbe,
-	_ string) (link.Link, error) {
-	return nil, nil
-}
-
 // TestSynchronizeMappings tests that if a mapping is realloc'd we do the right thing.
 func TestSynchronizeMappings(t *testing.T) {
 	for _, tc := range []struct {

interpreter/rtld/rtld.go

@@ -5,34 +5,44 @@ package rtld // import "go.opentelemetry.io/ebpf-profiler/interpreter/rtld"
 
 import (
 	"fmt"
-	"strings"
+	"path"
+	"regexp"
 
-	"github.com/cilium/ebpf/link"
 	log "github.com/sirupsen/logrus"
 	"go.opentelemetry.io/ebpf-profiler/interpreter"
 	"go.opentelemetry.io/ebpf-profiler/libpf"
 	"go.opentelemetry.io/ebpf-profiler/libpf/pfelf"
 	"go.opentelemetry.io/ebpf-profiler/remotememory"
 )
 
+// LdsoRegexp matches ld.so filenames across different distributions
+var LdsoRegexp = regexp.MustCompile(
+	`^ld(?:-linux)?(?:-x86-64|-aarch64)?\.so\.\d+$|` +
+		`^ld\.so\.\d+$|` +
+		`^ld-\d+\.\d+\.so$|` +
+		`^ld-musl-[^/]+\.so\.\d+$`)
+
 // data holds the Uprobe link to keep it in memory
 type data struct {
-	probe     pfelf.USDTProbe
 	path      string
-	probeLink link.Link
+	usePoller bool
+	probe     pfelf.USDTProbe
+	lc        interpreter.LinkCloser
 }
 
 // instance represents a per-PID instance of the rtld interpreter
 type instance struct {
 	interpreter.InstanceStubs
-	link link.Link
+	usePoller bool
+	lc        interpreter.LinkCloser
 }
 
 // Loader detects if the ELF file contains the rtld:map_complete USDT probe
-func Loader(_ interpreter.EbpfHandler, info *interpreter.LoaderInfo) (interpreter.Data, error) {
-	// Check if this is ld.so by examining the filename
+func Loader(ebpf interpreter.EbpfHandler, info *interpreter.LoaderInfo) (interpreter.Data, error) {
+	// Check if this is ld.so by examining just the basename
 	fileName := info.FileName()
-	if !strings.Contains(fileName, "ld-") && !strings.Contains(fileName, "ld.so") {
+	baseName := path.Base(fileName)
+	if !LdsoRegexp.MatchString(baseName) {
 		return nil, nil
 	}
 
@@ -44,55 +54,87 @@ func Loader(_ interpreter.EbpfHandler, info *interpreter.LoaderInfo) (interprete
 	// Look for .note.stapsdt section which contains USDT probes
 	sec := ef.Section(".note.stapsdt")
 	if sec == nil {
-		log.Debugf("No .note.stapsdt section found in %s", fileName)
-		return nil, nil
+		log.Debugf("No .note.stapsdt section found in %s, will use poller fallback", fileName)
+		return &data{
+			path:      fileName,
+			usePoller: true,
+		}, nil
 	}
 
 	// Parse USDT probes from the section
 	probes, err := pfelf.ParseUSDTProbes(sec)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse USDT probes: %w", err)
 	}
-
 	// Look for rtld:map_complete probe
 	for _, probe := range probes {
-		if probe.Provider == "rtld" && probe.Name == "map_complete" {
-			log.Infof("Found rtld:map_complete USDT probe in %s at 0x%x",
-				fileName, probe.Location)
-			return &data{
-				path:  fileName,
-				probe: probe,
-			}, nil
+		if probe.Provider != "rtld" || probe.Name != "map_complete" {
+			continue
 		}
+		log.Debugf("Found rtld:map_complete USDT probe in %s at 0x%x",
+			fileName, probe.Location)
+
+		return &data{
+			probe: probe,
+			path:  fileName,
+		}, nil
 	}
 
-	return nil, nil
+	// No rtld:map_complete probe found, use poller fallback
+	log.Debugf("No rtld:map_complete probe found in %s, will use poller fallback", fileName)
+	return &data{
+		path:      fileName,
+		usePoller: true,
+	}, nil
 }
 
-// Attach attaches the uprobe to the rtld:map_complete USDT probe
+// Attach attaches the uprobe to the rtld:map_complete USDT probe or registers with poller
 func (d *data) Attach(ebpf interpreter.EbpfHandler, pid libpf.PID, _ libpf.Address,
 	_ remotememory.RemoteMemory) (interpreter.Instance, error) {
-	link, err := ebpf.AttachUSDTProbe(pid, d.path, d.probe, "usdt_rtld_map_complete")
-	if err != nil {
-		return nil, fmt.Errorf("failed to attach uprobe to rtld:map_complete usdt: %w", err)
+	if d.usePoller {
+		// Register this PID with the global poller
+		// Create a trigger function that calls TriggerProcessSync on the ebpf handler
+		triggerFunc := func(triggerPID libpf.PID) {
+			if err := ebpf.TriggerProcessSync(triggerPID); err != nil {
+				log.Debugf("[rtld] TriggerProcessSync failed for PID %d: %v", triggerPID, err)
+			}
+		}
+		getPoller(triggerFunc).registerPID(pid)
+		log.Debugf("[rtld] Registered PID %d with poller for %s", pid, d.path)
+
+		return &instance{usePoller: true}, nil
+	} else {
+		prog := "usdt_rtld_map_complete"
+		lc, err := ebpf.AttachUSDTProbes(
+			pid, d.path, prog, []pfelf.USDTProbe{d.probe}, nil, nil, false)
+		if err != nil {
+			return nil, fmt.Errorf("failed to attach uprobe to rtld:map_complete usdt: %w", err)
+		}
+		log.Debugf("[rtld] Using USDT probe for PID %d on %s", pid, d.path)
+		d.lc = lc
+		return &instance{lc: lc}, nil
 	}
-	log.Infof("Attached uprobe to rtld:map_complete usdt in PID %d", pid)
-	return &instance{link: link}, nil
 }
 
-// Detach removes the uprobe
+// Detach removes the uprobe or deregisters from poller
 func (i *instance) Detach(_ interpreter.EbpfHandler, pid libpf.PID) error {
 	log.Debugf("[rtld] Detach called for PID %d", pid)
+	if i.usePoller {
+		// Deregister this PID from the global poller
+		// Pass a nil trigger function since we're just deregistering
+		getPoller(nil).deregisterPID(pid)
+		log.Debugf("[rtld] Deregistered PID %d from poller", pid)
+	}
 	return nil
 }
 
 // Unload cleans up the uprobe link
 func (d *data) Unload(_ interpreter.EbpfHandler) {
-	if d.probeLink != nil {
-		if err := d.probeLink.Close(); err != nil {
-			log.Errorf("[rtld] Failed to close uprobe link: %v", err)
+	if d.lc != nil {
+		if err := d.lc.Unload(); err != nil {
+			log.Errorf("[rtld] Failed to unload uprobe link: %v", err)
 		}
-		d.probeLink = nil
+		d.lc = nil
 	}
 	log.Debugf("[rtld] Unloaded uprobe for %s", d.path)
 }