PT_REGS_IP Determinism

[holmanb]

From your README:

ksym

KSym decoder takes kernel address and converts that to the function name.

Note that sometimes you can observe PT_REGS_IP being off by one. You can subtract 1 in your code to make it point to the right instruction that can be found /proc/kallsyms.

This documents behavior that I believe is a bug.

I recognize that this is not behavior defined in ebpf_exporter, but is there a way to deterministically know whether this off-by-one behavior will occur?

[bobrik]

I don't know if there's a way. I'm happy to update the vendored gobpf when the issue is fixed there, though.

[holmanb]

Thanks for the response @bobrik. I dug around in the bcc code to figure out why this isn't a problem in their tools, and I discovered that their code is a little bit more complicated. bcc.BPF.ksym() is capable of resolving symbols from addresses given by PT_REGS_IP without the off by one issue. Additionally, there's a pull request to the gobpf repo that does effectively the same thing. If that request (or something similar) gets merged in then we will have a more robust solution.

[bobrik]

See: https://github.com/iovisor/bcc/blob/v0.25.0/libbpf-tools/ksnoop.h#L52-L59

/* for kprobes, entry is function IP + sizeof(kprobe_opcode_t),
 * subtract in BPF prog context to get fn address.
 */
#ifdef __TARGET_ARCH_x86
#define KSNOOP_IP_FIX(ip)		(ip - sizeof(kprobe_opcode_t))
#else
#define KSNOOP_IP_FIX(ip)		ip
#endif