On Fri, Mar 20, 2026 at 02:21:48PM +0100, Christian Brauner wrote: > On Fri, 20 Mar 2026 05:33:34 -0700, Breno Leitao wrote: > > Coredump is a generally useful and interesting event in the lifetime > > of a process. Add a tracepoint so it can be monitored through the > > standard kernel tracing infrastructure. > > > > BPF-based crash monitoring is an advanced approach that > > allows real-time crash interception: by attaching a BPF program at > > this point, tools can use bpf_get_stack() with BPF_F_USER_STACK to > > capture the user-space stack trace at the exact moment of the crash, > > before the process is fully terminated, without waiting for a > > coredump file to be written and parsed. > > > > [...] > > "stable" with a grain of salt. We make no such guarantees that it won't be > moved around if needed.
Ack. At least tracepoints offer more stability compared to fentry/function-based approaches which can be inlined, renamed, or otherwise modified. Thanks for reviewing this. --breno
