Check if raw tracepoint in module is supported

Actually there are two stages to fully support raw tracepoint: the
first stage is only for in-kernel functions, and the second stage is
for kernel modules. For the latter stage, the corresponding kernel
commit is a38d1107, and it is merged since v5.0.

Signed-off-by: Fei Li <lifei.shirley@bytedance.com>

diff --git a/src/python/bcc/__init__.py b/src/python/bcc/__init__.py
index 96c3dd6b351f8fbe6dfaebbc4296f988342cf938..ab80f81e2f98d7bebf42c85f24cfe008a7ca945e 100644 (file)
--- a/src/python/bcc/__init__.py
+++ b/src/python/bcc/__init__.py
@@ -1123,6 +1123,18 @@ class BPF(object):
             return True
         return False
 
+    @staticmethod
+    def support_raw_tracepoint_in_module():
+        # kernel symbol "bpf_trace_modules" indicates raw tp support in modules, ref: kernel commit a38d1107
+        kallsyms = "/proc/kallsyms"
+        with open(kallsyms) as syms:
+            for line in syms:
+                (_, _, name) = line.rstrip().split(" ", 2)
+                name = name.split("\t")[0]
+                if name == "bpf_trace_modules":
+                    return True
+            return False
+
     def detach_tracepoint(self, tp=b""):
         """detach_tracepoint(tp="")