eBPF uprobe not triggering for user-space function in Rust (libbpf-rs)

[lalitb]

eBPF Uprobe Not Triggering for User-Space Function in Rust (libbpf-rs)

Issue

I am working on an eBPF uprober using libbpf-rs to attach to a user-space function (test_function) in a statically compiled binary (test_program). However, while the uprober successfully attaches, no events are captured in trace_pipe.

I believe I am missing something simple, but I haven’t been able to figure it out. Any suggestions or help would be greatly appreciated. Thanks!

Here are the steps I followed, while the full code is here - https://github.com/lalitb/ebpf-uprober/

---

Setup & Steps Taken

1️⃣ Compiling test_program.c

• Verified test_function exists using:

$ cat ~/test_program.c
#include <stdio.h>
#include <unistd.h>

void test_function() {
    printf("Inside test_function()\n");
}

int main() {
    while (1) {
        test_function();
        sleep(1);
    }
    return 0;
}

$ objdump -t /tmp/test_program | grep test_function
0000000000001169 g     F .text  000000000000001a              test_function
$

2️⃣ eBPF Program (uprober.bpf.c)

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>

SEC("uprobe/test_function")  // ✅ Ensured it's uprobe, NOT kprobe
int uprobe_test_function(struct pt_regs *ctx) {
    bpf_printk("Uprobe hit: test_function()");
    return 0;
}

char _license[] SEC("license") = "GPL";

3️⃣ Rust Userspace Code (main.rs)

let opts = UprobeOpts {
    func_name: "test_function".into(),
    retprobe: false,
    ref_ctr_offset: 0,
    cookie: 0,
    _non_exhaustive: (),
};

4️⃣ Attaching the Uprobe

• Running the program:

$ sudo target/release/ebpf-uprober
Getting offset for symbol: "test_function" inside "/tmp/test_program"
Found test_function at offset: 0x1169
Opening skeleton...
Loading skeleton...
Program name: "uprobe_test_function"
Program type: Kprobe
Attaching uprobe at offset 0x1169...
Uprobe attached successfully!
Current uprobe events:

Monitoring traces...
Press Ctrl+C to exit...
Reading from /sys/kernel/debug/tracing/trace
[/sys/kernel/debug/tracing/trace] # tracer: nop
[/sys/kernel/debug/tracing/trace] #
[/sys/kernel/debug/tracing/trace] # entries-in-buffer/entries-written: 0/0   #P:1
[/sys/kernel/debug/tracing/trace] #
[/sys/kernel/debug/tracing/trace] #                                _-----=> irqs-off/BH-disabled
[/sys/kernel/debug/tracing/trace] #                               / _----=> need-resched
[/sys/kernel/debug/tracing/trace] #                              | / _---=> hardirq/softirq
[/sys/kernel/debug/tracing/trace] #                              || / _--=> preempt-depth
[/sys/kernel/debug/tracing/trace] #                              ||| / _-=> migrate-disable
[/sys/kernel/debug/tracing/trace] #                              |||| /     delay
[/sys/kernel/debug/tracing/trace] #           TASK-PID     CPU#  |||||  TIMESTAMP  FUNCTION
[/sys/kernel/debug/tracing/trace] #              | |         |   |||||     |         |
Reading from /sys/kernel/debug/tracing/trace_pipe

• Verified probe attachment:

$ sudo cat /sys/kernel/debug/tracing/uprobe_events
$ sudo bpftool prog list | grep test_function
439: kprobe  name uprobe_test_function  tag ba9e69e3d92186e2  gpl
$

❌ Unexpectedly, it appears as a kprobe instead of a uprobe!
Also, 🚨 Issue: No logs appear! in /sys/kernel/debug/tracing/trace_pipe when test_program is executed.

[chenhengqi]

Uprobe is implemented as kprobe in kernel, that's alright.

No fancy emoji in your trace_printk please.

[lalitb]

Uprobe is implemented as kprobe in kernel, that's alright.

Thanks for confirming this.

No fancy emoji in your trace_printk please.

It got added by mistake while drafting the discussion. I have removed it now from my message. The actual code here doesn't have any emoji.

That said, the actual problem still persists —no logs appear in /sys/kernel/debug/tracing/trace_pipe when test_program is executed.

[chenhengqi]

I check your example, you also misuse the func_offset, that is the offset adding to function entry resolved from function name.

[chenhengqi]

With Daniel's comment below, you should resolve the issue.

[danielocfb]

https://github.com/lalitb/ebpf-uprober/blob/57812dac7d5fa8ed3599051e73c14bedf65bf439/src/main.rs#L71

I suspect you are dropping the link, detaching the probe. Also see #874 for additional advice.

[chenhengqi]

The func_offset is wrong, just set it to 0. See my previous comment.

[lalitb]

@chenhengqi @danielocfb Thanks for the suggestions. It worked now. I didn't realise that func_offset is the offset within the function so should be 0. I have separate question - how will it work if the binary to probe is stripped - Specifying the function_name + offset willnot work in that case right?

[chenhengqi]

Yes.

[lalitb]

Thanks for the clarification @chenhengqi ! Since real-world applications are often stripped and do not contain function symbols, is there an API in libbpf-rs that allows attaching a uprobe directly using a known function offset within the binary, without relying on function names?

[chenhengqi]

It seems like the C library allows specify the func_offset directly without specify func_name. I guess the Rust API should follow that.