iovisor / iovisor/bcc

BPF().sym doesn't take env var BCC_SYMFS into account

Open
#3,369 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

# Background

I'm working on a bcc tool to trace golang programs, and it's a common case that many golang binaries accross the cloud industry are stripped, rendering an essential necessity for the bcc tool to trace programs with deparate debug files.

After diving deep in the bcc source, I'm happy to realize the env var `BCC_SYMFS` adds a perfect approach to trace a stripped binary, as long as there's an additional non-stripped binary set somewhere in the disk.

For your reference, the `BCC_SYMFS` related code is located here:

https://github.com/iovisor/bcc/blob/0cf8166505ba89f14545d6fc54d088aad127d870/src/cc/bcc_elf.c#L572-L610

# Issues

The `BCC_SYMFS` only takes effects at `BPF().attach_uprobe` (to be specific, at `lib.bcc_resolve_symname`), where the function `find_debug_file` will try to find a debug file according to the aforementioned env var.

However it doesn't make difference to `BPF().sym` function, which is used for symbol resolution in user space, and I'm counting on that to generate stack trackback.

Maybe it's a good idea to have `BPF().sym` function to work along with `BCC_SYMFS`?

I decided against exemplifying the issue by a step-by-step process for concise consideration, but if anyone feels like a detailed case, I'll offer that.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.