proc/internal/ebpf: switch to header+param event ring buffer protocol#4352
Merged
aarzilli merged 2 commits intoMay 25, 2026
Merged
Conversation
Replace the monolithic function_parameter_list_t ring buffer write with a structured two-event protocol: a HEADER event followed by per-parameter PARAM events. Each param event carries the parameter's val and deref_val data inline (0x30 bytes each), matching the original data model. Key changes: - BPF C: new event_header_t/param_event_t wire protocol with per-param bpf_ringbuf_reserve/submit, register snapshot via stack array - Go helpers: deadline-based ring buffer polling (no more blocking Read()), pending event reassembly with goroutine+fn+is_ret keying, DWARF type and parameter name lookup by global index, type synthesis from reflect.Kind for backward compatibility - LoadConfig plumbing: thread LoadConfig through RPC → debugger → target so trace output verbosity is configurable - CFA offset fix: compute uprobe PC via FirstPCAfterPrologue and use frame table CFA offset for correct RSP-relative stack parameter locations (input vs return params now evaluated differently) - Build: upgrade Docker image to Ubuntu 26.04 / clang-22
545e403 to
59abd8e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace the single bpf_ringbuf_reserve/submit of the entire function_parameter_list_t struct with a multi-event protocol: one HEADER event per uprobe hit followed by one PARAM event per parameter. Each PARAM event carries the parameter's kind, val (0x30 bytes), and deref_val (0x30 bytes) inline via bpf_ringbuf_reserve/submit.
BPF changes:
Go-side changes:
Other changes:
This sets the stage for additional changes to be submitted later to allow for larger structs / arrays and dereferencing pointers.