iovisor / iovisor/bcc

Offset support for special kprobe, kretprobe, tracepoint prefixes.

Open
#2,435 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

BCC provides trace_autoload feature where probes can be implicitly defined with the help of kprobe__, kretprobe__ prefixes. This is a great way to install the probe() without worrying much about the dirty details of various attach_XXX_probe functions. However, this method unfortunately masks off the ability to insert a probe somewhere at the middle of a function. It will be great if we can extend this mechanism to insert probe at a particular offset from the start of the function. Is there a way we can do this within the purview of C syntax ?

For eg: I was thinking of adding a '+' suffix to a probe function i.e something like below.
int kprobe____sys_socket(struct pt_regs *ctx, int f, int p, int s)+143
However, this doesn't seem like a valid C function identifier.
or
int kprobe__sys_socket(struct pt_regs *ctx, int f, int p, int s);
plausible ?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the trace_autoload handling for kprobe__, kretprobe__, and tracepoint prefixes, then trace how probe names become attach targets. The issue does not name files or tests; done would require an agreed syntax and documented behavior for selecting an offset within a function.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
operating-systems
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.