[FEATURE] Merge the BPF_TYPE_UPROBE_OVERRIDE and BPF_TYPE_UPROBE

[yunwei37]

Is your feature request related to a problem? Please describe.

currently we have types for BPF_TYPE_UPROBE_OVERRIDE and BPF_TYPE_UPROBE, implemented with different mechanism. I think there is no need to keep them both. We can just make the uprobe able to use bpf_override_return.

Describe the solution you'd like

remove BPF_TYPE_UPROBE_OVERRIDE and make BPF_TYPE_UPROBE using frida replace.

Describe alternatives you've considered

Is it better not to change them? I'm not sure.

[Officeyutong]

Benchmark the performance and decide whether to merge them

[Officeyutong]

According to my test using https://github.com/Officeyutong/bpftime/blob/benchmark-118/runtime/benchmark.cpp

The benchmarked function is as followed:

extern "C" __attribute__((optnone)) uint64_t uprobe_test_func(uint64_t a,
                                  uint64_t b)
{
    return a + b;
}

• Run without any probing: 5ns per call
• Run with uprobe (gum invocation listener): 310ns per call
• Run with uprobe override (gum_interceptor_replace): 447ns per call

All results are averaged with 1e8 calls

So uprobe override is 44% slower than uprobe, we may not merge them

[yunwei37]

I'm curious, why is the BPF_TYPE_UPROBE_OVERRIDE so slow?