search

iovisor / bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Apache License 2.0
20.57k stars 3.88k forks source link

Offset support for special kprobe, kretprobe, tracepoint prefixes. #2435

Open vijunag opened 5 years ago

vijunag commented 5 years ago

BCC provides trace_autoload feature where probes can be implicitly defined with the help of kprobe, kretprobe prefixes. This is a great way to install the probe() without worrying much about the dirty details of various attach_XXX_probe functions. However, this method unfortunately masks off the ability to insert a probe somewhere at the middle of a function. It will be great if we can extend this mechanism to insert probe at a particular offset from the start of the function. Is there a way we can do this within the purview of C syntax ?

For eg: I was thinking of adding a '+' suffix to a probe function i.e something like below.
int kprobe__sys_socket(struct pt_regs *ctx, int f, int p, int s)+143 However, this doesn't seem like a valid C function identifier.
or int kprobesys_socket(struct pt_regs *ctx, int f, int p, int s); plausible ?

pchaigno commented 5 years ago

I'm not sure this is a good idea. While kprobe__sys_socket remains reasonably clear for the end users, kprobe__143__sys_socket or something similar is likely to cause a lot of confusion. Do we really need it? Why is using the Python methods not enough?