probe.go

package manager

import (
	"errors"
	"fmt"
	"io"
	"sync"
	"syscall"
	"time"

	"github.com/cilium/ebpf"
	"github.com/vishvananda/netlink"
	"golang.org/x/sys/unix"

	"github.com/DataDog/ebpf-manager/internal"
)

type AttachMethod uint32

const (
	AttachMethodNotSet AttachMethod = iota
	AttachWithPerfEventOpen
	AttachWithProbeEvents
)

// Probe - Main eBPF probe wrapper. This structure is used to store the required data to attach a loaded eBPF
// program to its hook point.
type Probe struct {
	netlinkSocketCache      *netlinkSocketCache
	program                 *ebpf.Program
	programSpec             *ebpf.ProgramSpec
	perfEventFD             *fd
	state                   state
	stateLock               sync.RWMutex
	manualLoadNeeded        bool
	checkPin                bool
	attachPID               int
	attachRetryAttempt      uint
	attachedWithDebugFS     bool
	kprobeHookPointNotExist bool
	systemWideID            int
	programTag              string
	kprobeType              string
	link                    netlink.Link
	tcFilter                netlink.BpfFilter
	tcClsActQdisc           netlink.Qdisc
	progLink                io.Closer

	// lastError - stores the last error that the probe encountered, it is used to surface a more useful error message
	// when one of the validators (see Options.ActivatedProbes) fails.
	lastError error

	// ProbeIdentificationPair is used to identify the current probe
	ProbeIdentificationPair

	// CopyProgram - When enabled, this option will make a unique copy of the program section for the current program
	CopyProgram bool

	// KeepProgramSpec - Defines if the internal *ProgramSpec should be cleaned up after the probe has been successfully
	// attached to free up memory. If you intend to make a copy of this Probe later, you should explicitly set this
	// option to true.
	KeepProgramSpec bool

	// SyscallFuncName - Name of the syscall on which the program should be hooked. As the exact kernel symbol may
	// differ from one kernel version to the other, the right prefix will be computed automatically at runtime.
	// If a syscall name is not provided, the section name (without its probe type prefix) is assumed to be the
	// hook point.
	SyscallFuncName string

	// MatchFuncName - Pattern used to find the function(s) to attach to
	// FOR KPROBES: When this field is used, the provided pattern is matched against the list of available symbols
	// in /sys/kernel/debug/tracing/available_filter_functions. If the exact function does not exist, then the first
	// symbol matching the provided pattern will be used. This option requires debugfs.
	//
	// FOR UPROBES: When this field is used, the provided pattern is matched against the list of symbols in the symbol
	// table of the provided elf binary. If the exact function does not exist, then the first symbol matching the
	// provided pattern will be used.
	MatchFuncName string

	// HookFuncName - Exact name of the symbol to hook onto. When this field is set, MatchFuncName and SyscallFuncName
	// are ignored.
	HookFuncName string

	// TracepointCategory - (Tracepoint) The manager expects the tracepoint category to be parsed from the eBPF section
	// in which the eBPF function of this Probe lives (SEC("tracepoint/[category]/[name]")). However, you can use this
	// field to override it.
	TracepointCategory string

	// TracepointName - (Tracepoint) The manager expects the tracepoint name to be parsed from the eBPF section
	// in which the eBPF function of this Probe lives (SEC("tracepoint/[category]/[name]")). However, you can use this
	// field to override it.
	TracepointName string

	// Enabled - Indicates if a probe should be enabled or not. This parameter can be set at runtime using the
	// Manager options (see ActivatedProbes)
	Enabled bool

	// PinPath - Once loaded, the eBPF program will be pinned to this path. If the eBPF program has already been pinned
	// and is already running in the kernel, then it will be loaded from this path.
	PinPath string

	// KProbeMaxActive - (kretprobes) With kretprobes, you can configure the maximum number of instances of the function that can be
	// probed simultaneously with maxactive. If maxactive is 0 it will be set to the default value: if CONFIG_PREEMPT is
	// enabled, this is max(10, 2*NR_CPUS); otherwise, it is NR_CPUS. For kprobes, maxactive is ignored.
	KProbeMaxActive int

	// KprobeAttachMethod - Method to use for attaching the kprobe. Either use perfEventOpen ABI or kprobe events
	KprobeAttachMethod KprobeAttachMethod

	// UprobeAttachMethod - Method to use for attaching the uprobe. Either use perfEventOpen ABI or uprobe events
	UprobeAttachMethod AttachMethod

	// UprobeOffset - If UprobeOffset is provided, the uprobe will be attached to it directly without looking for the
	// symbol in the elf binary. If the file is a non-PIE executable, the provided address must be a virtual address,
	// otherwise it must be an offset relative to the file load address.
	UprobeOffset uint64

	// ProbeRetry - Defines the number of times that the probe will retry to attach / detach on error.
	ProbeRetry uint

	// ProbeRetryDelay - Defines the delay to wait before the probe should retry to attach / detach on error.
	ProbeRetryDelay time.Duration

	// BinaryPath - (uprobes) A Uprobe is attached to a specific symbol in a user space binary. The offset is
	// automatically computed for the symbol name provided in the uprobe section ( SEC("uprobe/[symbol_name]") ).
	BinaryPath string

	// CGroupPath - (cgroup family programs) All CGroup programs are attached to a CGroup (v2). This field provides the
	// path to the CGroup to which the probe should be attached. The attach type is determined by the section.
	CGroupPath string

	// SocketFD - (socket filter) Socket filter programs are bound to a socket and filter the packets they receive
	// before they reach user space. The probe will be bound to the provided file descriptor
	SocketFD int

	// IfIndex - (TC classifier & XDP) Interface index used to identify the interface on which the probe will be
	// attached. If not set, fall back to `IfName`.
	IfIndex int

	// IfName - (TC Classifier & XDP) Interface name on which the probe will be attached.
	IfName string

	// IfIndexNetns - (TC Classifier & XDP) Network namespace in which the network interface lives. If this value is
	// provided, then IfIndexNetnsID is required too.
	// WARNING: it is up to the caller of "Probe.Start()" to close this netns handle. Failing to close this handle may
	// lead to leaking the network namespace. This handle can be safely closed once "Probe.Start()" returns.
	IfIndexNetns uint64

	// IfIndexNetnsID - (TC Classifier & XDP) Network namespace ID associated of the IfIndexNetns handle. If this value
	// is provided, then IfIndexNetns is required too.
	// WARNING: it is up to the caller of "Probe.Start()" to call "manager.CleanupNetworkNamespace()" once the provided
	// IfIndexNetnsID is no longer needed. Failing to call this cleanup function may lead to leaking the network
	// namespace. Remember that "manager.CleanupNetworkNamespace()" will close the netlink socket opened with the netns
	// handle provided above. If you want to start the probe again, you'll need to provide a new valid netns handle so
	// that a new netlink socket can be created in that namespace.
	IfIndexNetnsID uint32

	// XDPAttachMode - (XDP) XDP attach mode. If not provided the kernel will automatically select the best available
	// mode.
	XDPAttachMode XdpAttachMode

	// NetworkDirection - (TC classifier) Network traffic direction of the classifier. Can be either Ingress or Egress. Keep
	// in mind that if you are hooking on the host side of a virtual ethernet pair, Ingress and Egress are inverted.
	NetworkDirection TrafficType

	// TCFilterHandle - (TC classifier) defines the handle to use when loading the classifier. Leave unset to let the kernel decide which handle to use.
	TCFilterHandle uint32

	// TCFilterPrio - (TC classifier) defines the priority of the classifier added to the clsact qdisc. Defaults to DefaultTCFilterPriority.
	TCFilterPrio uint16

	// TCCleanupQDisc - (TC classifier) defines if the manager should clean up the clsact qdisc when a probe is unloaded
	TCCleanupQDisc bool

	// TCFilterProtocol - (TC classifier) defines the protocol to match in order to trigger the classifier. Defaults to
	// ETH_P_ALL.
	TCFilterProtocol uint16

	// SamplePeriod - (Perf event) This parameter defines when the perf_event eBPF program is triggered. When SamplePeriod > 0
	// the program will be triggered every SamplePeriod events.
	SamplePeriod int

	// SampleFrequency - (Perf event) This parameter defines when the perf_event eBPF program is triggered. When
	// SampleFrequency > 0, SamplePeriod is ignored and the eBPF program is triggered at the requested frequency.
	SampleFrequency int

	// PerfEventType - (Perf event) This parameter defines the type of the perf_event program. Allowed values are
	// unix.PERF_TYPE_HARDWARE and unix.PERF_TYPE_SOFTWARE
	PerfEventType int

	// PerfEventPID - (Perf event, uprobes) This parameter defines the PID for which the program should be triggered.
	// Do not set this value to monitor the whole host.
	PerfEventPID int

	// PerfEventConfig - (Perf event) This parameter defines which software or hardware event is being monitored. See the
	// PERF_COUNT_SW_* and PERF_COUNT_HW_* constants in the unix package.
	PerfEventConfig int

	// PerfEventCPUCount - (Perf event) This parameter defines the number of CPUs to monitor. If not set, defaults to
	// runtime.NumCPU(). Disclaimer: in containerized environment and depending on the CPU affinity of the program
	// holding the manager, runtime.NumCPU might not return the real CPU count of the host.
	PerfEventCPUCount int

	// perfEventCPUFDs - (Perf event) holds the fd of the perf_event program per CPU
	perfEventCPUFDs []*fd
}

// GetEBPFFuncName - Returns EBPFFuncName with the UID as a postfix if the Probe was copied
func (p *Probe) GetEBPFFuncName() string {
	if p.CopyProgram {
		return fmt.Sprintf("%s_%s", p.EBPFFuncName, p.UID)
	}
	return p.EBPFFuncName
}

// Copy - Returns a copy of the current probe instance. Only the exported fields are copied.
func (p *Probe) Copy() *Probe {
	return &Probe{
		ProbeIdentificationPair: ProbeIdentificationPair{
			UID:          p.UID,
			EBPFFuncName: p.EBPFFuncName,
		},
		SyscallFuncName:    p.SyscallFuncName,
		CopyProgram:        p.CopyProgram,
		KeepProgramSpec:    p.KeepProgramSpec,
		SamplePeriod:       p.SamplePeriod,
		SampleFrequency:    p.SampleFrequency,
		PerfEventType:      p.PerfEventType,
		PerfEventPID:       p.PerfEventPID,
		PerfEventConfig:    p.PerfEventConfig,
		MatchFuncName:      p.MatchFuncName,
		TracepointCategory: p.TracepointCategory,
		TracepointName:     p.TracepointName,
		Enabled:            p.Enabled,
		PinPath:            p.PinPath,
		KProbeMaxActive:    p.KProbeMaxActive,
		BinaryPath:         p.BinaryPath,
		CGroupPath:         p.CGroupPath,
		SocketFD:           p.SocketFD,
		IfIndex:            p.IfIndex,
		IfName:             p.IfName,
		IfIndexNetns:       p.IfIndexNetns,
		IfIndexNetnsID:     p.IfIndexNetnsID,
		XDPAttachMode:      p.XDPAttachMode,
		NetworkDirection:   p.NetworkDirection,
		ProbeRetry:         p.ProbeRetry,
		ProbeRetryDelay:    p.ProbeRetryDelay,
		TCFilterProtocol:   p.TCFilterProtocol,
		TCFilterPrio:       p.TCFilterPrio,
	}
}

// GetLastError - Returns the last error that the probe encountered
func (p *Probe) GetLastError() error {
	return p.lastError
}

// ID returns the system-wide unique ID for this program
func (p *Probe) ID() uint32 {
	return uint32(p.systemWideID)
}

// IsRunning - Returns true if the probe was successfully initialized, started and is currently running or paused.
func (p *Probe) IsRunning() bool {
	p.stateLock.RLock()
	defer p.stateLock.RUnlock()
	return p.state == running || p.state == paused
}

// IsInitialized - Returns true if the probe was successfully initialized.
func (p *Probe) IsInitialized() bool {
	p.stateLock.RLock()
	defer p.stateLock.RUnlock()
	return p.state >= initialized
}

// Test - Triggers the probe with the provided test data. Returns the length of the output, the raw output or an error.
func (p *Probe) Test(in []byte) (uint32, []byte, error) {
	return p.program.Test(in)
}

// Benchmark - Benchmark runs the Program with the given input for a number of times and returns the time taken per
// iteration.
//
// Returns the result of the last execution of the program and the time per run or an error. reset is called whenever
// the benchmark syscall is interrupted, and should be set to testing.B.ResetTimer or similar.
func (p *Probe) Benchmark(in []byte, repeat int, reset func()) (uint32, time.Duration, error) {
	return p.program.Benchmark(in, repeat, reset)
}

// initWithOptions - Initializes a probe with options
func (p *Probe) initWithOptions(manager *Manager, manualLoadNeeded bool, checkPin bool) error {
	if !p.Enabled {
		p.cleanupProgramSpec()
		return nil
	}

	p.stateLock.Lock()
	defer p.stateLock.Unlock()
	p.manualLoadNeeded = manualLoadNeeded
	p.checkPin = checkPin
	return p.internalInit(manager)
}

// init - Initialize a probe
func (p *Probe) init(manager *Manager) error {
	if !p.Enabled {
		p.cleanupProgramSpec()
		return nil
	}
	p.stateLock.Lock()
	defer p.stateLock.Unlock()
	return p.internalInit(manager)
}

func (p *Probe) Program() *ebpf.Program {
	return p.program
}

func (p *Probe) internalInit(manager *Manager) error {
	if p.state >= initialized {
		return nil
	}

	p.netlinkSocketCache = manager.netlinkSocketCache
	p.state = reset
	// Load spec if necessary
	if p.manualLoadNeeded {
		prog, err := ebpf.NewProgramWithOptions(p.programSpec, manager.options.VerifierOptions.Programs)
		if err != nil {
			p.lastError = err
			var ve *ebpf.VerifierError
			if errors.As(err, &ve) {
				// include error twice to preserve context, and still allow unwrapping if desired
				return fmt.Errorf("verifier error loading new probe %v: %w\n%+v", p.ProbeIdentificationPair, err, ve)
			}
			return fmt.Errorf("couldn't load new probe %v: %w", p.ProbeIdentificationPair, err)
		}
		p.program = prog
	}

	// Retrieve eBPF program if one isn't already set
	if p.program == nil {
		if p.program, p.lastError = manager.getProbeProgram(p.GetEBPFFuncName()); p.lastError != nil {
			return fmt.Errorf("couldn't find program %s: %w", p.GetEBPFFuncName(), ErrUnknownSectionOrFuncName)
		}
		p.checkPin = true
	}

	if p.programSpec == nil {
		if p.programSpec, p.lastError = manager.getProbeProgramSpec(p.GetEBPFFuncName()); p.lastError != nil {
			return fmt.Errorf("couldn't find program spec %s: %w", p.GetEBPFFuncName(), ErrUnknownSectionOrFuncName)
		}
	}

	if p.programSpec.Type == ebpf.SchedCLS {
		// sanity check
		if p.NetworkDirection != Egress && p.NetworkDirection != Ingress {
			return fmt.Errorf("%s has an invalid configuration: %w", p.ProbeIdentificationPair, ErrNoNetworkDirection)
		}
	}

	if p.checkPin {
		// Pin program if needed
		if p.PinPath != "" {
			if err := p.program.Pin(p.PinPath); err != nil {
				p.lastError = err
				return fmt.Errorf("couldn't pin program %s at %s: %w", p.GetEBPFFuncName(), p.PinPath, err)
			}
		}
		p.checkPin = false
	}

	// Update syscall function name with the correct arch prefix
	if p.SyscallFuncName != "" && len(p.HookFuncName) == 0 {
		var err error
		p.HookFuncName, err = GetSyscallFnNameWithSymFile(p.SyscallFuncName, manager.options.SymFile)
		if err != nil {
			p.lastError = err
			return err
		}
	}

	// Find function name match if required
	if p.MatchFuncName != "" && len(p.HookFuncName) == 0 {
		// if this is a kprobe or a kretprobe, look for the symbol now
		if p.GetKprobeType() != UnknownProbeType {
			var err error
			p.HookFuncName, err = FindFilterFunction(p.MatchFuncName)
			if err != nil {
				p.lastError = err
				return err
			}
		}
	}

	if len(p.HookFuncName) == 0 {
		// default back to the AttachTo field in Program, as parsed by Cilium
		p.HookFuncName = p.programSpec.AttachTo
	}

	// resolve netns ID from netns handle
	if p.IfIndexNetns == 0 && p.IfIndexNetnsID != 0 || p.IfIndexNetns != 0 && p.IfIndexNetnsID == 0 {
		return fmt.Errorf("both IfIndexNetns and IfIndexNetnsID are required if one is provided (IfIndexNetns: %d IfIndexNetnsID: %d)", p.IfIndexNetns, p.IfIndexNetnsID)
	}

	// set default TC classifier priority
	if p.TCFilterPrio == 0 {
		p.TCFilterPrio = DefaultTCFilterPriority
	}

	// set default TC classifier protocol
	if p.TCFilterProtocol == 0 {
		p.TCFilterProtocol = unix.ETH_P_ALL
	}

	// Default max active value
	if p.KProbeMaxActive == 0 {
		p.KProbeMaxActive = manager.options.DefaultKProbeMaxActive
	}

	// Default retry
	if p.ProbeRetry == 0 {
		p.ProbeRetry = manager.options.DefaultProbeRetry
	}

	// Default retry delay
	if p.ProbeRetryDelay == 0 {
		p.ProbeRetryDelay = manager.options.DefaultProbeRetryDelay
	}

	// fetch system-wide program ID, if the feature is available
	if p.program != nil {
		programInfo, err := p.program.Info()
		if err == nil {
			p.programTag = programInfo.Tag
			id, available := programInfo.ID()
			if available {
				p.systemWideID = int(id)
			}
		}
	}

	// set default kprobe attach method
	if p.KprobeAttachMethod == AttachKprobeMethodNotSet {
		if manager != nil {
			p.KprobeAttachMethod = manager.options.DefaultKprobeAttachMethod
		}
		if p.KprobeAttachMethod == AttachKprobeMethodNotSet {
			p.KprobeAttachMethod = AttachKprobeWithPerfEventOpen
		}
	}

	// set default uprobe attach method
	if p.UprobeAttachMethod == AttachMethodNotSet {
		if manager != nil {
			p.UprobeAttachMethod = manager.options.DefaultUprobeAttachMethod
		}
		if p.UprobeAttachMethod == AttachMethodNotSet {
			p.UprobeAttachMethod = AttachWithPerfEventOpen
		}
	}

	// update probe state
	p.state = initialized
	p.cleanupProgramSpec()
	return nil
}

// Attach - Attaches the probe to the right hook point in the kernel depending on the program type and the provided
// parameters.
func (p *Probe) Attach() error {
	return internal.Retry(func() error {
		p.attachRetryAttempt++
		err := p.attach()
		if err == nil {
			return nil
		}

		// not available, not a temporary error
		if errors.Is(err, syscall.ENOENT) || errors.Is(err, syscall.EINVAL) {
			return nil
		}

		return err
	}, p.getRetryAttemptCount(), p.ProbeRetryDelay)
}

func (p *Probe) Pause() error {
	return p.pause()
}

func (p *Probe) Resume() error {
	return p.resume()
}

// attach - Thread unsafe version of attach
func (p *Probe) attach() error {
	p.stateLock.Lock()
	defer p.stateLock.Unlock()
	if p.state >= paused || !p.Enabled {
		return nil
	}
	if p.state < initialized {
		if p.lastError == nil {
			p.lastError = ErrProbeNotInitialized
		}
		return ErrProbeNotInitialized
	}

	p.attachPID = Getpid()

	// Per program type start
	var err error
	switch p.programSpec.Type {
	case ebpf.UnspecifiedProgram:
		err = fmt.Errorf("invalid program type, make sure to use the right section prefix: %w", ErrSectionFormat)
	case ebpf.Kprobe:
		err = p.attachKprobe()
	case ebpf.TracePoint:
		err = p.attachTracepoint()
	case ebpf.RawTracepoint, ebpf.RawTracepointWritable:
		err = p.attachRawTracepoint()
	case ebpf.CGroupDevice, ebpf.CGroupSKB, ebpf.CGroupSock, ebpf.CGroupSockAddr, ebpf.CGroupSockopt, ebpf.CGroupSysctl:
		err = p.attachCGroup()
	case ebpf.SocketFilter:
		err = p.attachSocket()
	case ebpf.SchedCLS:
		err = p.attachTCCLS()
	case ebpf.XDP:
		err = p.attachXDP()
	case ebpf.LSM:
		err = p.attachLSM()
	case ebpf.PerfEvent:
		err = p.attachPerfEvent()
	case ebpf.Tracing:
		err = p.attachTracing()
	default:
		err = fmt.Errorf("program type %s not implemented yet", p.programSpec.Type)
	}
	if err != nil {
		p.lastError = err
		// Clean up any progress made in the attach attempt
		_ = p.stop(false)
		return fmt.Errorf("couldn't start probe %s: %w", p.ProbeIdentificationPair, err)
	}

	// update probe state
	p.state = running
	p.attachRetryAttempt = p.getRetryAttemptCount()
	return nil
}

// cleanupProgramSpec - Cleans up the internal ProgramSpec attribute to free up some memory
func (p *Probe) cleanupProgramSpec() {
	if p.KeepProgramSpec {
		return
	}
	cleanupProgramSpec(p.programSpec)
}

func (p *Probe) pause() error {
	p.stateLock.Lock()
	defer p.stateLock.Unlock()
	if p.state <= paused || !p.Enabled {
		return nil
	}

	var err error
	switch p.programSpec.Type {
	case ebpf.Kprobe:
		err = p.pauseKprobe()
	case ebpf.SocketFilter:
		err = p.detachSocket()
	case ebpf.TracePoint:
		err = p.pauseTracepoint()
	default:
		return fmt.Errorf("pause not supported for program type %s", p.programSpec.Type)
	}
	if err != nil {
		p.lastError = err
		return fmt.Errorf("error pausing probe %s: %w", p.ProbeIdentificationPair, err)
	}

	p.state = paused
	return nil
}

func (p *Probe) resume() error {
	p.stateLock.Lock()
	defer p.stateLock.Unlock()
	if p.state != paused || !p.Enabled {
		return nil
	}

	var err error
	switch p.programSpec.Type {
	case ebpf.Kprobe:
		err = p.resumeKprobe()
	case ebpf.SocketFilter:
		err = p.attachSocket()
	case ebpf.TracePoint:
		err = p.resumeTracepoint()
	default:
		return fmt.Errorf("resume not supported for program type %s", p.programSpec.Type)
	}
	if err != nil {
		p.lastError = err
		return fmt.Errorf("error resuming probe %s: %w", p.ProbeIdentificationPair, err)
	}

	p.state = running
	return nil
}

// Detach - Detaches the probe from its hook point depending on the program type and the provided parameters. This
// method does not close the underlying eBPF program, which means that Attach can be called again later.
func (p *Probe) Detach() error {
	p.stateLock.Lock()
	defer p.stateLock.Unlock()
	if p.state < paused || !p.Enabled {
		return nil
	}

	// detach from hook point
	err := p.detachRetry()

	// update state of the probe
	if err != nil {
		p.lastError = err
	} else {
		p.state = initialized
	}

	return err
}

// detachRetry - Thread unsafe version of Detach with retry
func (p *Probe) detachRetry() error {
	return internal.Retry(p.detach, p.getRetryAttemptCount(), p.ProbeRetryDelay)
}

// detach - Thread unsafe version of Detach.
func (p *Probe) detach() error {
	err := p.program.Unpin()
	// Shared with all probes: close the perf event file descriptor
	if p.perfEventFD != nil {
		err = p.perfEventFD.Close()
	}

	// Per program type cleanup
	switch p.programSpec.Type {
	case ebpf.UnspecifiedProgram:
		// nothing to do
		break
	case ebpf.Kprobe:
		err = errors.Join(err, p.detachKprobe())
	case ebpf.SocketFilter:
		err = errors.Join(err, p.detachSocket())
	case ebpf.SchedCLS:
		err = errors.Join(err, p.detachTCCLS())
	case ebpf.PerfEvent:
		err = errors.Join(err, p.detachPerfEvent())
	default:
		if p.progLink != nil {
			err = errors.Join(err, p.progLink.Close())
		}
	}
	return err
}

// Stop - Detaches the probe from its hook point and close the underlying eBPF program.
func (p *Probe) Stop() error {
	p.stateLock.Lock()
	defer p.stateLock.Unlock()
	if p.state < paused || !p.Enabled {
		p.reset()
		return nil
	}
	return p.stop(true)
}

func (p *Probe) stop(saveStopError bool) error {
	// detach from hook point
	err := p.detachRetry()

	// close the loaded program
	if p.attachRetryAttempt >= p.getRetryAttemptCount() {
		err = errors.Join(err, p.program.Close())
	}

	// update state of the probe
	if saveStopError {
		p.lastError = errors.Join(p.lastError, err)
	}

	// Cleanup probe if stop was successful
	if err == nil && p.attachRetryAttempt >= p.getRetryAttemptCount() {
		p.reset()
	}
	if err != nil {
		return fmt.Errorf("couldn't stop probe %s: %w", p.ProbeIdentificationPair, err)
	}
	return nil
}

// reset - Cleans up the internal fields of the probe
func (p *Probe) reset() {
	p.kprobeType = ""
	p.netlinkSocketCache = nil
	p.program = nil
	p.programSpec = nil
	p.perfEventFD = nil
	p.state = reset
	p.manualLoadNeeded = false
	p.checkPin = false
	p.attachPID = 0
	p.attachRetryAttempt = 0
	p.attachedWithDebugFS = false
	p.kprobeHookPointNotExist = false
	p.systemWideID = 0
	p.programTag = ""
	p.tcFilter = netlink.BpfFilter{}
	p.tcClsActQdisc = nil
}

func (p *Probe) getRetryAttemptCount() uint {
	return p.ProbeRetry + 1
}