Open ajwerner opened 2 months ago
CC @golang/compiler
go is not friendly to things like ebpf return probes (uretprobe)
See #22008
Thanks for the cross-reference! To clarify, this issue would help not in that it would make uretprobes work, but that it makes them easier to simulate with uprobes because it'll make it easier to find the return points using debug information rather than having to parse the program text.
Go does not currently (as of go1.23) emit epilogue_begin markers around where functions return. It does emit
prologue_end
.The motivation here is that go is not friendly to things like ebpf return probes (uretprobe) because they inject a call frame into the stack (see https://github.com/iovisor/bcc/issues/1320).
What folks do instead is simulate these return probes by finding all of the returns sites by parsing the text of the program (see https://github.com/iovisor/bcc/issues/1320#issuecomment-982020012). A more general approach that doesn't require access to the binary would be to store the relevant information in the line info.