• Alan Maguire's avatar
    libbpf: Support function name-based attach uprobes · 433966e3
    Alan Maguire authored
    kprobe attach is name-based, using lookups of kallsyms to translate
    a function name to an address.  Currently uprobe attach is done
    via an offset value as described in [1].  Extend uprobe opts
    for attach to include a function name which can then be converted
    into a uprobe-friendly offset.  The calcualation is done in
    several steps:
    
    1. First, determine the symbol address using libelf; this gives us
       the offset as reported by objdump
    2. If the function is a shared library function - and the binary
       provided is a shared library - no further work is required;
       the address found is the required address
    3. Finally, if the function is local, subtract the base address
       associated with the object, retrieved from ELF program headers.
    
    The resultant value is then added to the func_offset value passed
    in to specify the uprobe attach address.  So specifying a func_offset
    of 0 along with a function name "printf" will attach to printf entry.
    
    The modes of operation supported are then
    
    1. to attach to a local function in a binary; function "foo1" in
       "/usr/bin/foo"
    2. to attach to a shared library function in a shared library -
       function "malloc" in libc.
    
    [1] https://www.kernel.org/doc/html/latest/trace/uprobetracer.htmlSigned-off-by: default avatarAlan Maguire <alan.maguire@oracle.com>
    Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
    Link: https://lore.kernel.org/bpf/1648654000-21758-3-git-send-email-alan.maguire@oracle.com
    433966e3
libbpf.h 59.2 KB