Offset support for special kprobe, kretprobe, tracepoint prefixes.
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
BCC provides trace_autoload feature where probes can be implicitly defined with the help of kprobe__, kretprobe__ prefixes. This is a great way to install the probe() without worrying much about the dirty details of various attach_XXX_probe functions. However, this method unfortunately masks off the ability to insert a probe somewhere at the middle of a function. It will be great if we can extend this mechanism to insert probe at a particular offset from the start of the function. Is there a way we can do this within the purview of C syntax ?
For eg: I was thinking of adding a '+' suffix to a probe function i.e something like below.
int kprobe____sys_socket(struct pt_regs *ctx, int f, int p, int s)+143
However, this doesn't seem like a valid C function identifier.
or
int kprobe__sys_socket(struct pt_regs *ctx, int f, int p, int s);
plausible ?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the trace_autoload handling for kprobe__, kretprobe__, and tracepoint prefixes, then trace how probe names become attach targets. The issue does not name files or tests; done would require an agreed syntax and documented behavior for selecting an offset within a function.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100