AddressToOffset compared virtual addresses with strict inequality against
each executable ELF section load address. PCs landing exactly on Section
.Addr were never matched while still within [Addr, Addr+Size).
Use inclusive lower bounds so the scan matches the usual VMA half-open
interval.
* proc/internal/ebpf,build: extend eBPF tracing type support and update Docker build
Add support for additional Go types in the eBPF tracing backend:
- Bool: use BoolType with ByteSize 1 instead of IntType with ByteSize 8
- Int/Uint: use actual DWARF size instead of hardcoded ByteSize 8
- Float32/Float64: synthesize FloatType, detect XMM registers as unreadable
- Complex64/Complex128: synthesize ComplexType with XMM detection
- Pointer: capture pointer address and dereference pointed-to value via
bpf_probe_read_user in eBPF C code
- Slice: capture slice header (ptr+len+cap) and dereference element data
- Graceful degradation: map, chan, interface, func, struct, and array
types now produce specific "not yet supported" errors instead of
generic "type not supported by ebpf"
Add Unreadable field to RawUProbeParam so the Go-side parser can
propagate specific error messages through to Variable display.
Update eBPF build infrastructure:
- Replace EOL Ubuntu 21.04 base image with Ubuntu 22.04
- Use clang-12 (required: newer clang generates BPF code that fails
the kernel verifier with "dereference of modified ctx ptr disallowed")
- Update Go from 1.17 to 1.24
- Remove sudo requirement from build-ebpf-builder-img.sh
- Add -u flag to Docker run to avoid root-owned output files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* dwarf/godwarf,proc: fix slice ReflectKind and address PR review feedback
Fix a bug in the DWARF type parser where SliceType.ReflectKind was not
set (stayed 0/reflect.Invalid). When parsing struct types, the code
creates a new StructType, sets ReflectKind on it, then for slices
creates a new SliceType and reassigns the pointer — losing the
ReflectKind. The String case already had an explicit fix for this
(str.ReflectKind = reflect.String), but the Slice case was missing it.
This caused the eBPF tracing backend (which uses dt.Common().ReflectKind
to determine type kind) to see kind=0 for slice parameters, making them
appear as unsupported types. The ptrace backend was unaffected because it
uses Go type assertions (case *godwarf.SliceType) instead of ReflectKind.
Also addresses PR review feedback:
- Add t.Parallel() to TestTraceEBPFTypes subtests
- Use regexp matching for pointer/slice address verification
- Add content verification for slice test output
- Add comment explaining -u flag in build-ebpf-objects.sh
- Add comment explaining amd64-only XMM register threshold
- Handle CreateCompositeMemory errors in target.go
- Remove debug prints from target.go
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: document eBPF type support pipeline and TestTraceEBPFTypes
Add documentation for the eBPF type support pipeline, currently
supported types, the canonical test (TestTraceEBPFTypes) for adding
new type support, and the clang-12 build constraint.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* proc/internal/ebpf: clarify pointer/slice comments per review
Clarify that the eBPF probe does capture dereferenced data, but
loadValue runs Go-side after the probe returns and cannot follow
pointer chains through fake memory addresses. Also remove unicode
arrow from XMM register comment.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* proc/internal/ebpf: clarify pointer/slice deref_val limitations
Explain why we display raw addresses instead of dereferenced values:
element type info isn't propagated through the eBPF pipeline, and
deref_val is limited to 48 bytes which is insufficient for nested
or variable-length types.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* address review feedback
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Adds a comprehensive parity test ensuring ptrace and eBPF trace backends
produce identical output, preventing formatting divergence as new types
are added.
The test revealed and fixes several eBPF formatting issues:
1. Goroutine format: Now uses "goroutine(N):" to match ptrace
2. Return value format: Now uses ">> goroutine(N): func => (val)"
3. String capture bug: Strings were showing as empty - fixed by adding
StringType to eBPF helpers so string values are properly loaded
Test coverage:
- Fixture tests all currently supported types: int64, uint64, bool,
string
- Runs dlv trace with both backends on same function
- Compares outputs byte-for-byte (filtering process exit messages)
- Updated all existing eBPF test expectations to match new format
All eBPF trace tests now pass with consistent formatting between
backends.
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
The update of gilium/ebpf introduced a beaking change in it's API: The `offset` in the UprobeOptions is now relative to the added option `address`. Since `address` was only default initalized, the library did not use `address` and `offset` as address for the uprobe, but tried to calculate the offset itself based on the given symbol. Since we set the path of the executable as symbol, the library errored when trying to resolve it.
Fixes https://github.com/go-delve/delve/pull/3491
From the Go specification:
"1. For a nil slice, the number of iterations is 0." [1]
Therefore, an additional nil check for before the loop is unnecessary.
[1]: https://go.dev/ref/spec#For_range
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
Uprobes get automatically cleaned and removed when the reference to
the Link object is lost. Hold a reference to any active Uprobe Link
for duration of Delve execution and ensure they are cleaned up
at exit.
Fixes ebpf probes don't work after time.Sleep() #3227
* Remove standard C headers since we have vmlinux.h already
* Simplify get_goroutine_id() implementation, this reduces a map
and thus reduces runtime memory comsumption.
While at it, unify all indention using 4 spaces.
Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
This patch removes the old error-prone way of tracking
whether the tracepoint is for a function entry or
return. Instead of trying to guess, let the data structure
simply tell us directly.
The ebpf implementations uses cgo, but only to access some C struct
definitions. Instead of using cgo simply duplicate the defintion of
those two structs in Go and add a test to check that the duplicate
definitions remain synchronized.
Fixes#2827
Add some dummy go files so that 'go mod vendor' works for modules that
require Delve, becuase directories that do not contain any go code will
not be vendored.
This patch enables the eBPF tracer backend to parse the ID of the
Goroutine which hit the uprobe. This implementation is specific to AMD64
and will have to be generalized further in order to be used on other
architectures.
