broken ksnoop tool
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
Not getting any output for ksnoop tool. Tried multiple functions in argument, no error/failed message is appearing.
Example run below:
# ./ksnoop trace "vma_merge(mm)" -d
Debug: Parsing trace 'vma_merge(mm)'
Debug: got func 'vma_merge', args 'mm'
Debug: vma_merge =
Debug: getting BTF for vmlinux
libbpf: loading kernel BTF '/sys/kernel/btf/vmlinux': 0
Debug: arg #1:
Debug: arg #2:
Debug: arg #3:
Debug: arg #4:
Debug: arg #5:
Debug: return value: type id '496'>
Debug: 'mm' arg, predcate '(null)'
Debug: setting base arg for val mm to 1
Debug: custom trace with 1 args
libbpf: loading object 'ksnoop_bpf' from buffer
libbpf: elf: section(2) .text, size 5704, link 0, flags 6, type=1
libbpf: sec '.text': found program 'ksnoop' at insn offset 0 (0 bytes), code size 713 insns (5704 bytes)
libbpf: elf: section(3) .rel.text, size 176, link 15, flags 40, type=9
libbpf: elf: section(4) kprobe/foo, size 32, link 0, flags 6, type=1
libbpf: sec 'kprobe/foo': found program 'kprobe_entry' at insn offset 0 (0 bytes), code size 4 insns (32 bytes)
libbpf: elf: section(5) .relkprobe/foo, size 16, link 15, flags 40, type=9
libbpf: elf: section(6) kretprobe/foo, size 32, link 0, flags 6, type=1
libbpf: sec 'kretprobe/foo': found program 'kprobe_return' at insn offset 0 (0 bytes), code size 4 insns (32 bytes)
libbpf: elf: section(7) .relkretprobe/foo, size 16, link 15, flags 40, type=9
libbpf: elf: section(8) license, size 13, link 0, flags 3, type=1
libbpf: license of ksnoop_bpf is Dual BSD/GPL
libbpf: elf: section(9) .maps, size 88, link 0, flags 3, type=1
libbpf: elf: section(10) .BTF, size 8893, link 0, flags 0, type=1
libbpf: elf: section(12) .BTF.ext, size 4572, link 0, flags 0, type=1
libbpf: elf: section(15) .symtab, size 1920, link 1, flags 0, type=2
libbpf: looking for externs among 80 symbols...
libbpf: collected 0 externs total
libbpf: map 'ksnoop_func_stack': at sec_idx 9, offset 0.
libbpf: map 'ksnoop_func_stack': found type = 1.
libbpf: map 'ksnoop_func_stack': found key [8], sz = 8.
libbpf: map 'ksnoop_func_stack': found value [11], sz = 144.
libbpf: map 'ksnoop_func_stack': found max_entries = 2048.
libbpf: map 'ksnoop_func_map': at sec_idx 9, offset 32.
libbpf: map 'ksnoop_func_map': found type = 5.
libbpf: map 'ksnoop_func_map': found key [8], sz = 8.
libbpf: map 'ksnoop_func_map': found value [22], sz = 16296.
libbpf: map 'ksnoop_func_map': found max_entries = 64.
libbpf: map 'ksnoop_perf_map': at sec_idx 9, offset 64.
libbpf: map 'ksnoop_perf_map': found type = 4.
libbpf: map 'ksnoop_perf_map': found key_size = 4.
libbpf: map 'ksnoop_perf_map': found value_size = 4.
libbpf: sec '.rel.text': collecting relocation for section(2) '.text'
libbpf: sec '.rel.text': relo #0: insn #6 against 'ksnoop_func_stack'
libbpf: prog 'ksnoop': found map 0 (ksnoop_func_stack, sec 9, off 0) for insn #6
libbpf: sec '.rel.text': relo #1: insn #35 against 'ksnoop_func_stack'
libbpf: prog 'ksnoop': found map 0 (ksnoop_func_stack, sec 9, off 0) for insn #35
libbpf: sec '.rel.text': relo #2: insn #40 against 'ksnoop_func_stack'
libbpf: prog 'ksnoop': found map 0 (ksnoop_func_stack, sec 9, off 0) for insn #40
libbpf: sec '.rel.text': relo #3: insn #85 against 'ksnoop_func_map'
libbpf: prog 'ksnoop': found map 1 (ksnoop_func_map, sec 9, off 32) for insn #85
libbpf: sec '.rel.text': relo #4: insn #146 against 'ksnoop_func_map'
libbpf: prog 'ksnoop': found map 1 (ksnoop_func_map, sec 9, off 32) for insn #146
libbpf: sec '.rel.text': relo #5: insn #490 against 'ksnoop_func_stack'
libbpf: prog 'ksnoop': found map 0 (ksnoop_func_stack, sec 9, off 0) for insn #490
libbpf: sec '.rel.text': relo #6: insn #540 against 'ksnoop_func_map'
libbpf: prog 'ksnoop': found map 1 (ksnoop_func_map, sec 9, off 32) for insn #540
libbpf: sec '.rel.text': relo #7: insn #568 against 'ksnoop_perf_map'
libbpf: prog 'ksnoop': found map 2 (ksnoop_perf_map, sec 9, off 64) for insn #568
libbpf: sec '.rel.text': relo #8: insn #584 against 'ksnoop_perf_map'
libbpf: prog 'ksnoop': found map 2 (ksnoop_perf_map, sec 9, off 64) for insn #584
libbpf: sec '.rel.text': relo #9: insn #635 against 'ksnoop_func_map'
libbpf: prog 'ksnoop': found map 1 (ksnoop_func_map, sec 9, off 32) for insn #635
libbpf: sec '.rel.text': relo #10: insn #665 against 'ksnoop_perf_map'
libbpf: prog 'ksnoop': found map 2 (ksnoop_perf_map, sec 9, off 64) for insn #665
libbpf: sec '.relkprobe/foo': collecting relocation for section(4) 'kprobe/foo'
libbpf: sec '.relkprobe/foo': relo #0: insn #1 against '.text'
libbpf: sec '.relkretprobe/foo': collecting relocation for section(6) 'kretprobe/foo'
libbpf: sec '.relkretprobe/foo': relo #0: insn #1 against '.text'
libbpf: loading kernel BTF '/sys/kernel/btf/vmlinux': 0
libbpf: map 'ksnoop_func_stack': created successfully, fd=4
libbpf: map 'ksnoop_func_map': created successfully, fd=5
libbpf: map 'ksnoop_perf_map': setting size to 8
libbpf: map 'ksnoop_perf_map': created successfully, fd=6
libbpf: sec '.text': found 7 CO-RE relocations
libbpf: CO-RE relocating [70] struct pt_regs: found target candidate [111] struct pt_regs in [vmlinux]
libbpf: prog 'ksnoop': relo #0: [70] struct pt_regs.nip (0:0:1:1 @ offset 256)
libbpf: prog 'ksnoop': relo #0: matching candidate #0 [111] struct pt_regs.nip (0:0:1:1 @ offset 256)
libbpf: prog 'ksnoop': relo #0: patched insn #50 (ALU/ALU64) imm 256 -> 256
libbpf: prog 'ksnoop': relo #1: [70] struct pt_regs.gpr[3] (0:0:1:0:3 @ offset 24)
libbpf: prog 'ksnoop': relo #1: matching candidate #0 [111] struct pt_regs.gpr[3] (0:0:1:0:3 @ offset 24)
libbpf: prog 'ksnoop': relo #1: patched insn #222 (ALU/ALU64) imm 24 -> 24
libbpf: prog 'ksnoop': relo #2: [70] struct pt_regs.gpr[4] (0:0:1:0:4 @ offset 32)
libbpf: prog 'ksnoop': relo #2: matching candidate #0 [111] struct pt_regs.gpr[4] (0:0:1:0:4 @ offset 32)
libbpf: prog 'ksnoop': relo #2: patched insn #226 (ALU/ALU64) imm 32 -> 32
libbpf: prog 'ksnoop': relo #3: [70] struct pt_regs.gpr[5] (0:0:1:0:5 @ offset 40)
libbpf: prog 'ksnoop': relo #3: matching candidate #0 [111] struct pt_regs.gpr[5] (0:0:1:0:5 @ offset 40)
libbpf: prog 'ksnoop': relo #3: patched insn #230 (ALU/ALU64) imm 40 -> 40
libbpf: prog 'ksnoop': relo #4: [70] struct pt_regs.gpr[6] (0:0:1:0:6 @ offset 48)
libbpf: prog 'ksnoop': relo #4: matching candidate #0 [111] struct pt_regs.gpr[6] (0:0:1:0:6 @ offset 48)
libbpf: prog 'ksnoop': relo #4: patched insn #234 (ALU/ALU64) imm 48 -> 48
libbpf: prog 'ksnoop': relo #5: [70] struct pt_regs.gpr[7] (0:0:1:0:7 @ offset 56)
libbpf: prog 'ksnoop': relo #5: matching candidate #0 [111] struct pt_regs.gpr[7] (0:0:1:0:7 @ offset 56)
libbpf: prog 'ksnoop': relo #5: patched insn #238 (ALU/ALU64) imm 56 -> 56
libbpf: prog 'ksnoop': relo #6: [70] struct pt_regs.gpr[3] (0:0:1:0:3 @ offset 24)
libbpf: prog 'ksnoop': relo #6: matching candidate #0 [111] struct pt_regs.gpr[3] (0:0:1:0:3 @ offset 24)
libbpf: prog 'ksnoop': relo #6: patched insn #294 (ALU/ALU64) imm 24 -> 24
libbpf: prog 'kprobe_entry': added 713 insns from sub-prog 'ksnoop'
libbpf: prog 'kprobe_entry': insn #1 relocated, imm 2 points to subprog 'ksnoop' (now at 4 offset)
libbpf: prog 'kprobe_return': added 713 insns from sub-prog 'ksnoop'
libbpf: prog 'kprobe_return': insn #1 relocated, imm 2 points to subprog 'ksnoop' (now at 4 offset)
Debug: Attached kprobe for 'vma_merge'
Debug: Attached kretprobe for 'vma_merge'
TIME CPU PID FUNCTION/ARGS
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the reported `./ksnoop trace "vma_merge(mm)" -d` command and inspect the ksnoop trace entry point that attaches the kprobe and kretprobe. Determine why the command stops after printing the output header, then verify that it either emits trace events or reports a clear failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- observability-sre, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100