Kernel version detection does not work with vDSO disabled
Vyom-Yadav opened this issue · comments
Describe the bug
Automatic detection of Kernel Version is not supported without vDSO.
How to reproduce
- Disable
vDSO
on a machine. - Reboot the machine.
root@docker-vdso-test:~/ebpf-main# go test -v ./internal -run TestCurrentKernelVersion
=== RUN TestCurrentKernelVersion
version_test.go:53: finding vDSO memory address: no vdso address found in auxv
--- FAIL: TestCurrentKernelVersion (0.00s)
FAIL
FAIL github.com/cilium/ebpf/internal 0.004s
FAIL
Version information
main
For why support without vDSO is required, see: #1399
Can you explain how you disable vDSO please?
There are three different ways of "disabling" vDSO in that post. One of them strips the auxv, which is what we use. I need to know which one you're using / expect to work.
Seems like vdso=0
causes the kernel to omit AT_SYSINFO_EHDR
on am64. On arm64 the header is emitted unconditionally (maybe because arm64 doesn't allow turning of the vdso?)
My conclusion is that turning off the vdso is still kind of esoteric, and not something I want to spend a lot of effort supporting. I definitely don't want to bring back uname parsing. It also seems like it's possible to intercept gettimeofday using ltrace, so there is at least one possible work around.
If you really want this to work with vDSO off I can only offer you a partial work around. You can adjust
Line 253 in a330a78
internal.KernelVersion
on old kernels (< 5.0) by writing a feature test (see haveProgRun in prog.go for inspiration) which checks whether the kernel requires KernelVersion to be present for Kprobes.