bpf_program__attach_kprobe_opts() currently attaches a single kprobe only
by func_name, with an optional offset. This covers only the symbol-
based form, not the raw-address form that the kernel already supports
for both kprobe PMU events and legacy tracefs/debugfs kprobes. Callers
that already have a target IP still have to drop down to
perf_event_open() or direct tracefs writes.
libbpf already exposes address-based attach for kprobe_multi through
bpf_kprobe_multi_opts.addrs. This commit adds bpf_kprobe_opts.addr so
that single kprobes can be attached either by func_name + offset or by
raw address.
Signed-off-by: Hoyeon Lee <hoyeon.lee@suse.com>
---
tools/lib/bpf/libbpf.c | 88 +++++++++++++++++++++++++++++-------------
tools/lib/bpf/libbpf.h | 5 ++-
2 files changed, 65 insertions(+), 28 deletions(-)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 9ea41f40dc82..8e1e99ba38ad 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -11523,7 +11523,8 @@ static int determine_uprobe_retprobe_bit(void)
#define PERF_UPROBE_REF_CTR_OFFSET_SHIFT 32
static int perf_event_open_probe(bool uprobe, bool retprobe, const char *name,
- uint64_t offset, int pid, size_t ref_ctr_off)
+ uint64_t offset_or_addr, int pid,
+ size_t ref_ctr_off)
{
const size_t attr_sz = sizeof(struct perf_event_attr);
struct perf_event_attr attr;
@@ -11558,7 +11559,7 @@ static int perf_event_open_probe(bool uprobe, bool retprobe, const char *name,
attr.type = type;
attr.config |= (__u64)ref_ctr_off << PERF_UPROBE_REF_CTR_OFFSET_SHIFT;
attr.config1 = ptr_to_u64(name); /* kprobe_func or uprobe_path */
- attr.config2 = offset; /* kprobe_addr or probe_offset */
+ attr.config2 = offset_or_addr; /* kprobe_addr or probe_offset */
/* pid filter is meaningful only for uprobes */
pfd = syscall(__NR_perf_event_open, &attr,
@@ -11633,13 +11634,15 @@ static const char *tracefs_available_filter_functions_addrs(void)
}
static void gen_probe_legacy_event_name(char *buf, size_t buf_sz,
- const char *name, size_t offset)
+ const char *name,
+ uint64_t offset_or_addr)
{
static int index = 0;
int i;
- snprintf(buf, buf_sz, "libbpf_%u_%d_%s_0x%zx", getpid(),
- __sync_fetch_and_add(&index, 1), name, offset);
+ snprintf(buf, buf_sz, "libbpf_%u_%d_%s_0x%" PRIx64, getpid(),
+ __sync_fetch_and_add(&index, 1), name ?: "addr",
+ offset_or_addr);
/* sanitize name in the probe name */
for (i = 0; buf[i]; i++) {
@@ -11648,13 +11651,28 @@ static void gen_probe_legacy_event_name(char *buf, size_t buf_sz,
}
}
+static void gen_kprobe_target(char *buf, size_t buf_sz, const char *name,
+ uint64_t offset_or_addr)
+{
+ if (name)
+ snprintf(buf, buf_sz, "%s+0x%" PRIx64, name, offset_or_addr);
+ else
+ snprintf(buf, buf_sz, "0x%" PRIx64, offset_or_addr);
+}
+
static int add_kprobe_event_legacy(const char *probe_name, bool retprobe,
- const char *kfunc_name, size_t offset)
+ const char *kfunc_name,
+ uint64_t offset_or_addr)
{
- return append_to_file(tracefs_kprobe_events(), "%c:%s/%s %s+0x%zx",
+ char probe_target[128];
+
+ gen_kprobe_target(probe_target, sizeof(probe_target), kfunc_name,
+ offset_or_addr);
+
+ return append_to_file(tracefs_kprobe_events(), "%c:%s/%s %s",
retprobe ? 'r' : 'p',
retprobe ? "kretprobes" : "kprobes",
- probe_name, kfunc_name, offset);
+ probe_name, probe_target);
}
static int remove_kprobe_event_legacy(const char *probe_name, bool retprobe)
@@ -11674,25 +11692,29 @@ static int determine_kprobe_perf_type_legacy(const char *probe_name, bool retpro
}
static int perf_event_kprobe_open_legacy(const char *probe_name, bool retprobe,
- const char *kfunc_name, size_t offset, int pid)
+ const char *kfunc_name,
+ uint64_t offset_or_addr, int pid)
{
const size_t attr_sz = sizeof(struct perf_event_attr);
struct perf_event_attr attr;
int type, pfd, err;
+ char probe_target[128];
- err = add_kprobe_event_legacy(probe_name, retprobe, kfunc_name, offset);
+ gen_kprobe_target(probe_target, sizeof(probe_target), kfunc_name,
+ offset_or_addr);
+
+ err = add_kprobe_event_legacy(probe_name, retprobe, kfunc_name,
+ offset_or_addr);
if (err < 0) {
- pr_warn("failed to add legacy kprobe event for '%s+0x%zx': %s\n",
- kfunc_name, offset,
- errstr(err));
+ pr_warn("failed to add legacy kprobe event for '%s': %s\n",
+ probe_target, errstr(err));
return err;
}
type = determine_kprobe_perf_type_legacy(probe_name, retprobe);
if (type < 0) {
err = type;
- pr_warn("failed to determine legacy kprobe event id for '%s+0x%zx': %s\n",
- kfunc_name, offset,
- errstr(err));
+ pr_warn("failed to determine legacy kprobe event id for '%s': %s\n",
+ probe_target, errstr(err));
goto err_clean_legacy;
}
@@ -11784,6 +11806,9 @@ bpf_program__attach_kprobe_opts(const struct bpf_program *prog,
enum probe_attach_mode attach_mode;
char *legacy_probe = NULL;
struct bpf_link *link;
+ uint64_t offset_or_addr;
+ char probe_target[128];
+ unsigned long addr;
size_t offset;
bool retprobe, legacy;
int pfd, err;
@@ -11794,8 +11819,18 @@ bpf_program__attach_kprobe_opts(const struct bpf_program *prog,
attach_mode = OPTS_GET(opts, attach_mode, PROBE_ATTACH_MODE_DEFAULT);
retprobe = OPTS_GET(opts, retprobe, false);
offset = OPTS_GET(opts, offset, 0);
+ addr = OPTS_GET(opts, addr, 0);
+ offset_or_addr = func_name ? offset : addr;
pe_opts.bpf_cookie = OPTS_GET(opts, bpf_cookie, 0);
+ if (!!func_name == !!addr)
+ return libbpf_err_ptr(-EINVAL);
+ if (addr && offset)
+ return libbpf_err_ptr(-EINVAL);
+
+ gen_kprobe_target(probe_target, sizeof(probe_target), func_name,
+ offset_or_addr);
+
legacy = determine_kprobe_perf_type() < 0;
switch (attach_mode) {
case PROBE_ATTACH_MODE_LEGACY:
@@ -11819,37 +11854,36 @@ bpf_program__attach_kprobe_opts(const struct bpf_program *prog,
if (!legacy) {
pfd = perf_event_open_probe(false /* uprobe */, retprobe,
- func_name, offset,
+ func_name, offset_or_addr,
-1 /* pid */, 0 /* ref_ctr_off */);
} else {
char probe_name[MAX_EVENT_NAME_LEN];
gen_probe_legacy_event_name(probe_name, sizeof(probe_name),
- func_name, offset);
+ func_name, offset_or_addr);
legacy_probe = strdup(probe_name);
if (!legacy_probe)
return libbpf_err_ptr(-ENOMEM);
- pfd = perf_event_kprobe_open_legacy(legacy_probe, retprobe, func_name,
- offset, -1 /* pid */);
+ pfd = perf_event_kprobe_open_legacy(legacy_probe, retprobe,
+ func_name, offset_or_addr,
+ -1 /* pid */);
}
if (pfd < 0) {
- err = -errno;
- pr_warn("prog '%s': failed to create %s '%s+0x%zx' perf event: %s\n",
+ err = pfd;
+ pr_warn("prog '%s': failed to create %s '%s' perf event: %s\n",
prog->name, retprobe ? "kretprobe" : "kprobe",
- func_name, offset,
- errstr(err));
+ probe_target, errstr(err));
goto err_out;
}
link = bpf_program__attach_perf_event_opts(prog, pfd, &pe_opts);
err = libbpf_get_error(link);
if (err) {
close(pfd);
- pr_warn("prog '%s': failed to attach to %s '%s+0x%zx': %s\n",
+ pr_warn("prog '%s': failed to attach to %s '%s': %s\n",
prog->name, retprobe ? "kretprobe" : "kprobe",
- func_name, offset,
- errstr(err));
+ probe_target, errstr(err));
goto err_clean_legacy;
}
if (legacy) {
diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index 0be34852350f..a5ad174d9add 100644
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -563,9 +563,12 @@ struct bpf_kprobe_opts {
bool retprobe;
/* kprobe attach mode */
enum probe_attach_mode attach_mode;
+ /* kernel address for kprobe. If specified, offset must be 0 */
+ unsigned long addr;
size_t :0;
};
-#define bpf_kprobe_opts__last_field attach_mode
+
+#define bpf_kprobe_opts__last_field addr
LIBBPF_API struct bpf_link *
bpf_program__attach_kprobe(const struct bpf_program *prog, bool retprobe,
--
2.52.0On Sun, Mar 29, 2026 at 5:44 AM Hoyeon Lee <hoyeon.lee@suse.com> wrote:
>
> bpf_program__attach_kprobe_opts() currently attaches a single kprobe only
> by func_name, with an optional offset. This covers only the symbol-
have you tried passing NULL for func_name and specifying absolute
address in opts.offset? Looking at the code I don't see why that won't
work, we don't enforce func_name to be non-NULL
This NULL will turn into config1 = 0, and offset will be config 2,
which I think is what you want to attach by address, according to
perf_event_open documentation
union {
__u64 bp_addr; /* breakpoint address */
__u64 kprobe_func; /* for perf_kprobe */
__u64 uprobe_path; /* for perf_uprobe */
__u64 config1; /* extension of config */
};
union {
__u64 bp_len; /* breakpoint size */
__u64 kprobe_addr; /* with kprobe_func == NULL */
__u64 probe_offset; /* for perf_[k,u]probe */
__u64 config2; /* extension of config1 */
};
This is the same approach as with uprobes, btw.
> based form, not the raw-address form that the kernel already supports
> for both kprobe PMU events and legacy tracefs/debugfs kprobes. Callers
> that already have a target IP still have to drop down to
> perf_event_open() or direct tracefs writes.
>
> libbpf already exposes address-based attach for kprobe_multi through
> bpf_kprobe_multi_opts.addrs. This commit adds bpf_kprobe_opts.addr so
> that single kprobes can be attached either by func_name + offset or by
> raw address.
>
> Signed-off-by: Hoyeon Lee <hoyeon.lee@suse.com>
> ---
> tools/lib/bpf/libbpf.c | 88 +++++++++++++++++++++++++++++-------------
> tools/lib/bpf/libbpf.h | 5 ++-
> 2 files changed, 65 insertions(+), 28 deletions(-)
>
[...]
On Tue, Mar 31, 2026 at 9:33 AM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
>
> On Sun, Mar 29, 2026 at 5:44 AM Hoyeon Lee <hoyeon.lee@suse.com> wrote:
> >
> > bpf_program__attach_kprobe_opts() currently attaches a single kprobe only
> > by func_name, with an optional offset. This covers only the symbol-
>
> have you tried passing NULL for func_name and specifying absolute
> address in opts.offset? Looking at the code I don't see why that won't
> work, we don't enforce func_name to be non-NULL
>
> This NULL will turn into config1 = 0, and offset will be config 2,
> which I think is what you want to attach by address, according to
> perf_event_open documentation
>
> union {
> __u64 bp_addr; /* breakpoint address */
> __u64 kprobe_func; /* for perf_kprobe */
> __u64 uprobe_path; /* for perf_uprobe */
> __u64 config1; /* extension of config */
> };
>
> union {
> __u64 bp_len; /* breakpoint size */
> __u64 kprobe_addr; /* with kprobe_func == NULL */
> __u64 probe_offset; /* for perf_[k,u]probe */
> __u64 config2; /* extension of config1 */
> };
>
> This is the same approach as with uprobes, btw.
>
>
I tested this after your comment, and you are right. For PMU-based
non-legacy attach, func_name = NULL with opts.offset = <raw-address>
already works today.
However, this does not work for legacy tracefs/debugfs kprobes, because
the tracefs event string formatting still expects symbol-based input.
So for v3, instead of adding new field to bpf_kprobe_opts(), I'll document
that offset can be treated as an absolute address when func_name = NULL,
and make legacy path support the same raw-address form as well.
> > based form, not the raw-address form that the kernel already supports
> > for both kprobe PMU events and legacy tracefs/debugfs kprobes. Callers
> > that already have a target IP still have to drop down to
> > perf_event_open() or direct tracefs writes.
> >
> > libbpf already exposes address-based attach for kprobe_multi through
> > bpf_kprobe_multi_opts.addrs. This commit adds bpf_kprobe_opts.addr so
> > that single kprobes can be attached either by func_name + offset or by
> > raw address.
> >
> > Signed-off-by: Hoyeon Lee <hoyeon.lee@suse.com>
> > ---
> > tools/lib/bpf/libbpf.c | 88 +++++++++++++++++++++++++++++-------------
> > tools/lib/bpf/libbpf.h | 5 ++-
> > 2 files changed, 65 insertions(+), 28 deletions(-)
> >
>
> [...]
On Mon, Mar 30, 2026 at 6:49 PM Hoyeon Lee <hoyeon.lee@suse.com> wrote:
>
> On Tue, Mar 31, 2026 at 9:33 AM Andrii Nakryiko
> <andrii.nakryiko@gmail.com> wrote:
> >
> > On Sun, Mar 29, 2026 at 5:44 AM Hoyeon Lee <hoyeon.lee@suse.com> wrote:
> > >
> > > bpf_program__attach_kprobe_opts() currently attaches a single kprobe only
> > > by func_name, with an optional offset. This covers only the symbol-
> >
> > have you tried passing NULL for func_name and specifying absolute
> > address in opts.offset? Looking at the code I don't see why that won't
> > work, we don't enforce func_name to be non-NULL
> >
> > This NULL will turn into config1 = 0, and offset will be config 2,
> > which I think is what you want to attach by address, according to
> > perf_event_open documentation
> >
> > union {
> > __u64 bp_addr; /* breakpoint address */
> > __u64 kprobe_func; /* for perf_kprobe */
> > __u64 uprobe_path; /* for perf_uprobe */
> > __u64 config1; /* extension of config */
> > };
> >
> > union {
> > __u64 bp_len; /* breakpoint size */
> > __u64 kprobe_addr; /* with kprobe_func == NULL */
> > __u64 probe_offset; /* for perf_[k,u]probe */
> > __u64 config2; /* extension of config1 */
> > };
> >
> > This is the same approach as with uprobes, btw.
> >
> >
>
> I tested this after your comment, and you are right. For PMU-based
> non-legacy attach, func_name = NULL with opts.offset = <raw-address>
> already works today.
>
> However, this does not work for legacy tracefs/debugfs kprobes, because
> the tracefs event string formatting still expects symbol-based input.
>
> So for v3, instead of adding new field to bpf_kprobe_opts(), I'll document
> that offset can be treated as an absolute address when func_name = NULL,
This is fine.
> and make legacy path support the same raw-address form as well.
but not this. libbpf doesn't need to support legacy interfaces.
On Tue, Mar 31, 2026 at 11:15 AM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Mon, Mar 30, 2026 at 6:49 PM Hoyeon Lee <hoyeon.lee@suse.com> wrote:
> >
> > On Tue, Mar 31, 2026 at 9:33 AM Andrii Nakryiko
> > <andrii.nakryiko@gmail.com> wrote:
> > >
> > > On Sun, Mar 29, 2026 at 5:44 AM Hoyeon Lee <hoyeon.lee@suse.com> wrote:
> > > >
> > > > bpf_program__attach_kprobe_opts() currently attaches a single kprobe only
> > > > by func_name, with an optional offset. This covers only the symbol-
> > >
> > > have you tried passing NULL for func_name and specifying absolute
> > > address in opts.offset? Looking at the code I don't see why that won't
> > > work, we don't enforce func_name to be non-NULL
> > >
> > > This NULL will turn into config1 = 0, and offset will be config 2,
> > > which I think is what you want to attach by address, according to
> > > perf_event_open documentation
> > >
> > > union {
> > > __u64 bp_addr; /* breakpoint address */
> > > __u64 kprobe_func; /* for perf_kprobe */
> > > __u64 uprobe_path; /* for perf_uprobe */
> > > __u64 config1; /* extension of config */
> > > };
> > >
> > > union {
> > > __u64 bp_len; /* breakpoint size */
> > > __u64 kprobe_addr; /* with kprobe_func == NULL */
> > > __u64 probe_offset; /* for perf_[k,u]probe */
> > > __u64 config2; /* extension of config1 */
> > > };
> > >
> > > This is the same approach as with uprobes, btw.
> > >
> > >
> >
> > I tested this after your comment, and you are right. For PMU-based
> > non-legacy attach, func_name = NULL with opts.offset = <raw-address>
> > already works today.
> >
> > However, this does not work for legacy tracefs/debugfs kprobes, because
> > the tracefs event string formatting still expects symbol-based input.
> >
> > So for v3, instead of adding new field to bpf_kprobe_opts(), I'll document
> > that offset can be treated as an absolute address when func_name = NULL,
>
> This is fine.
>
> > and make legacy path support the same raw-address form as well.
>
> but not this. libbpf doesn't need to support legacy interfaces.
Understood. I'll make the legacy kprobe attach API reject func_name =
NULL with offset set to a raw address in v3.
On Sun, Mar 29, 2026 at 09:43:38PM +0900, Hoyeon Lee wrote:
> bpf_program__attach_kprobe_opts() currently attaches a single kprobe only
> by func_name, with an optional offset. This covers only the symbol-
> based form, not the raw-address form that the kernel already supports
> for both kprobe PMU events and legacy tracefs/debugfs kprobes. Callers
> that already have a target IP still have to drop down to
> perf_event_open() or direct tracefs writes.
>
> libbpf already exposes address-based attach for kprobe_multi through
> bpf_kprobe_multi_opts.addrs. This commit adds bpf_kprobe_opts.addr so
> that single kprobes can be attached either by func_name + offset or by
> raw address.
curious, is this change just for the api to be complete or you do have
a usecase where you can't use kprobe_multi and need to attach kprobe
by address?
SNIP
> static void gen_probe_legacy_event_name(char *buf, size_t buf_sz,
> - const char *name, size_t offset)
> + const char *name,
> + uint64_t offset_or_addr)
> {
> static int index = 0;
> int i;
>
> - snprintf(buf, buf_sz, "libbpf_%u_%d_%s_0x%zx", getpid(),
> - __sync_fetch_and_add(&index, 1), name, offset);
> + snprintf(buf, buf_sz, "libbpf_%u_%d_%s_0x%" PRIx64, getpid(),
> + __sync_fetch_and_add(&index, 1), name ?: "addr",
> + offset_or_addr);
>
> /* sanitize name in the probe name */
> for (i = 0; buf[i]; i++) {
> @@ -11648,13 +11651,28 @@ static void gen_probe_legacy_event_name(char *buf, size_t buf_sz,
> }
> }
>
> +static void gen_kprobe_target(char *buf, size_t buf_sz, const char *name,
> + uint64_t offset_or_addr)
> +{
> + if (name)
> + snprintf(buf, buf_sz, "%s+0x%" PRIx64, name, offset_or_addr);
> + else
> + snprintf(buf, buf_sz, "0x%" PRIx64, offset_or_addr);
> +}
> +
> static int add_kprobe_event_legacy(const char *probe_name, bool retprobe,
> - const char *kfunc_name, size_t offset)
> + const char *kfunc_name,
> + uint64_t offset_or_addr)
> {
> - return append_to_file(tracefs_kprobe_events(), "%c:%s/%s %s+0x%zx",
> + char probe_target[128];
> +
> + gen_kprobe_target(probe_target, sizeof(probe_target), kfunc_name,
> + offset_or_addr);
> +
it seems like it'd be easier to get probe_target (via gen_kprobe_target)
in bpf_program__attach_kprobe_opts and pass it down instead of generating
it over and over again
> + return append_to_file(tracefs_kprobe_events(), "%c:%s/%s %s",
> retprobe ? 'r' : 'p',
> retprobe ? "kretprobes" : "kprobes",
> - probe_name, kfunc_name, offset);
> + probe_name, probe_target);
> }
>
> static int remove_kprobe_event_legacy(const char *probe_name, bool retprobe)
> @@ -11674,25 +11692,29 @@ static int determine_kprobe_perf_type_legacy(const char *probe_name, bool retpro
> }
>
> static int perf_event_kprobe_open_legacy(const char *probe_name, bool retprobe,
> - const char *kfunc_name, size_t offset, int pid)
> + const char *kfunc_name,
> + uint64_t offset_or_addr, int pid)
> {
> const size_t attr_sz = sizeof(struct perf_event_attr);
> struct perf_event_attr attr;
> int type, pfd, err;
> + char probe_target[128];
we need bigger buffer as explained by sashiko [1]
[1] https://sashiko.dev/#/patchset/20260329124429.689912-1-hoyeon.lee%40suse.com
jirka
>
> - err = add_kprobe_event_legacy(probe_name, retprobe, kfunc_name, offset);
> + gen_kprobe_target(probe_target, sizeof(probe_target), kfunc_name,
> + offset_or_addr);
> +
> + err = add_kprobe_event_legacy(probe_name, retprobe, kfunc_name,
> + offset_or_addr);
> if (err < 0) {
> - pr_warn("failed to add legacy kprobe event for '%s+0x%zx': %s\n",
> - kfunc_name, offset,
> - errstr(err));
> + pr_warn("failed to add legacy kprobe event for '%s': %s\n",
> + probe_target, errstr(err));
> return err;
> }
> type = determine_kprobe_perf_type_legacy(probe_name, retprobe);
> if (type < 0) {
> err = type;
> - pr_warn("failed to determine legacy kprobe event id for '%s+0x%zx': %s\n",
> - kfunc_name, offset,
> - errstr(err));
> + pr_warn("failed to determine legacy kprobe event id for '%s': %s\n",
> + probe_target, errstr(err));
> goto err_clean_legacy;
> }
>
SNIP
On Mon, Mar 30, 2026 at 7:08 PM Jiri Olsa <olsajiri@gmail.com> wrote:
>
> On Sun, Mar 29, 2026 at 09:43:38PM +0900, Hoyeon Lee wrote:
> > bpf_program__attach_kprobe_opts() currently attaches a single kprobe only
> > by func_name, with an optional offset. This covers only the symbol-
> > based form, not the raw-address form that the kernel already supports
> > for both kprobe PMU events and legacy tracefs/debugfs kprobes. Callers
> > that already have a target IP still have to drop down to
> > perf_event_open() or direct tracefs writes.
> >
> > libbpf already exposes address-based attach for kprobe_multi through
> > bpf_kprobe_multi_opts.addrs. This commit adds bpf_kprobe_opts.addr so
> > that single kprobes can be attached either by func_name + offset or by
> > raw address.
>
> curious, is this change just for the api to be complete or you do have
> a usecase where you can't use kprobe_multi and need to attach kprobe
> by address?
>
The main motivation was to fill the single-kprobe API gap, not to
replace kprobe_multi. There is also a case where kprobe_multi is not a
drop-in replacement. bpf_task_fd_query() operates on perf event fds and
does not support generic link fds, while kprobe_multi returns a link fd.
That link fd can be queried through bpf_link_get_info_by_fd(), but it
still cannot be used as a drop-in replacement here.
For PMU-based non-legacy attach, Andrii is right that func_name = NULL
with opts.offset = <raw-address> already works today. However, this does
not work for legacy tracefs/debugfs kprobes, because the tracefs event
string formatting still expects symbol-based input.
So I think the better direction for v3 is to avoid adding a new field to
bpf_kprobe_opts(), document that offset is treated as an absolute
address when func_name = NULL, and make the legacy path support the
same raw-address form as well.
> SNIP
>
> > static void gen_probe_legacy_event_name(char *buf, size_t buf_sz,
> > - const char *name, size_t offset)
> > + const char *name,
> > + uint64_t offset_or_addr)
> > {
> > static int index = 0;
> > int i;
> >
> > - snprintf(buf, buf_sz, "libbpf_%u_%d_%s_0x%zx", getpid(),
> > - __sync_fetch_and_add(&index, 1), name, offset);
> > + snprintf(buf, buf_sz, "libbpf_%u_%d_%s_0x%" PRIx64, getpid(),
> > + __sync_fetch_and_add(&index, 1), name ?: "addr",
> > + offset_or_addr);
> >
> > /* sanitize name in the probe name */
> > for (i = 0; buf[i]; i++) {
> > @@ -11648,13 +11651,28 @@ static void gen_probe_legacy_event_name(char *buf, size_t buf_sz,
> > }
> > }
> >
> > +static void gen_kprobe_target(char *buf, size_t buf_sz, const char *name,
> > + uint64_t offset_or_addr)
> > +{
> > + if (name)
> > + snprintf(buf, buf_sz, "%s+0x%" PRIx64, name, offset_or_addr);
> > + else
> > + snprintf(buf, buf_sz, "0x%" PRIx64, offset_or_addr);
> > +}
> > +
> > static int add_kprobe_event_legacy(const char *probe_name, bool retprobe,
> > - const char *kfunc_name, size_t offset)
> > + const char *kfunc_name,
> > + uint64_t offset_or_addr)
> > {
> > - return append_to_file(tracefs_kprobe_events(), "%c:%s/%s %s+0x%zx",
> > + char probe_target[128];
> > +
> > + gen_kprobe_target(probe_target, sizeof(probe_target), kfunc_name,
> > + offset_or_addr);
> > +
>
> it seems like it'd be easier to get probe_target (via gen_kprobe_target)
> in bpf_program__attach_kprobe_opts and pass it down instead of generating
> it over and over again
>
Good point. I'll simplify this in v3 and build probe_target once in
bpf_program__attach_kprobe_opts(), then pass it down.
> > + return append_to_file(tracefs_kprobe_events(), "%c:%s/%s %s",
> > retprobe ? 'r' : 'p',
> > retprobe ? "kretprobes" : "kprobes",
> > - probe_name, kfunc_name, offset);
> > + probe_name, probe_target);
> > }
> >
> > static int remove_kprobe_event_legacy(const char *probe_name, bool retprobe)
> > @@ -11674,25 +11692,29 @@ static int determine_kprobe_perf_type_legacy(const char *probe_name, bool retpro
> > }
> >
> > static int perf_event_kprobe_open_legacy(const char *probe_name, bool retprobe,
> > - const char *kfunc_name, size_t offset, int pid)
> > + const char *kfunc_name,
> > + uint64_t offset_or_addr, int pid)
> > {
> > const size_t attr_sz = sizeof(struct perf_event_attr);
> > struct perf_event_attr attr;
> > int type, pfd, err;
> > + char probe_target[128];
>
> we need bigger buffer as explained by sashiko [1]
>
Thanks for the pointer! I'll switch this to a larger buffer in v3.
> [1] https://sashiko.dev/#/patchset/20260329124429.689912-1-hoyeon.lee%40suse.com
>
> jirka
>
> SNIP
© 2016 - 2026 Red Hat, Inc.