On Tue, Mar 31, 2026 at 11:15 AM Alexei Starovoitov <[email protected]> wrote: > > On Mon, Mar 30, 2026 at 6:49 PM Hoyeon Lee <[email protected]> wrote: > > > > On Tue, Mar 31, 2026 at 9:33 AM Andrii Nakryiko > > <[email protected]> wrote: > > > > > > On Sun, Mar 29, 2026 at 5:44 AM Hoyeon Lee <[email protected]> wrote: > > > > > > > > bpf_program__attach_kprobe_opts() currently attaches a single kprobe > > > > only > > > > by func_name, with an optional offset. This covers only the symbol- > > > > > > have you tried passing NULL for func_name and specifying absolute > > > address in opts.offset? Looking at the code I don't see why that won't > > > work, we don't enforce func_name to be non-NULL > > > > > > This NULL will turn into config1 = 0, and offset will be config 2, > > > which I think is what you want to attach by address, according to > > > perf_event_open documentation > > > > > > union { > > > __u64 bp_addr; /* breakpoint address */ > > > __u64 kprobe_func; /* for perf_kprobe */ > > > __u64 uprobe_path; /* for perf_uprobe */ > > > __u64 config1; /* extension of config */ > > > }; > > > > > > union { > > > __u64 bp_len; /* breakpoint size */ > > > __u64 kprobe_addr; /* with kprobe_func == NULL */ > > > __u64 probe_offset; /* for perf_[k,u]probe */ > > > __u64 config2; /* extension of config1 */ > > > }; > > > > > > This is the same approach as with uprobes, btw. > > > > > > > > > > I tested this after your comment, and you are right. For PMU-based > > non-legacy attach, func_name = NULL with opts.offset = <raw-address> > > already works today. > > > > However, this does not work for legacy tracefs/debugfs kprobes, because > > the tracefs event string formatting still expects symbol-based input. > > > > So for v3, instead of adding new field to bpf_kprobe_opts(), I'll document > > that offset can be treated as an absolute address when func_name = NULL, > > This is fine. > > > and make legacy path support the same raw-address form as well. > > but not this. libbpf doesn't need to support legacy interfaces.
Understood. I'll make the legacy kprobe attach API reject func_name = NULL with offset set to a raw address in v3.
