LIBTRACEEVENT(3)

💖 NAME 💖

okay so bestie, this is the libtraceevent manual, section 3 (that's library calls, iykyk), and today's main characters are the function-related tep APIs. Say hi to the whole squad:

• tep_set_function_resolver
• tep_reset_function_resolver
• tep_register_function
• tep_register_print_string
• tep_get_function_count

They're the ones who handle function names, addresses, and modules. periodt. 💅

---

✨ SYNOPSIS ✨

lowkey just copy this exactly, don't improvise:

#include <event-parse.h>

typedef char *(tep_func_resolver_t)(void *priv, unsigned long long *addrp, char **modp);
int tep_set_function_resolver(struct tep_handle *tep, tep_func_resolver_t *func, void *priv);
void tep_reset_function_resolver(struct tep_handle *tep);
int tep_register_function(struct tep_handle *tep, char *name, unsigned long long addr, char *mod);
int tep_register_print_string(struct tep_handle *tep, const char *fmt, unsigned long long addr);
int tep_get_function_count(struct tep_handle *tep)

(and yes, that last one has no semicolon up there. iconic behavior. we don't question it. 💀)

---

🌸 DESCRIPTION 🌸

So like, some tools already have their own whole thing for resolving kernel functions, right? And these APIs let them keep using it instead of duplicating every single entry inside. No cap, it's giving "stop copy-pasting your symbol table, bestie."

🦋 the resolver type

tep_func_resolver_t is the prototype of the alternative kernel functions resolver. Not me writing a typedef that's basically a personality test for your symbol lookup. 🙈

This function receives:

1. a pointer to its custom context (set with the tep_set_function_resolver() call), and
2. the address of a kernel function, which has to be resolved.

In case of success, it should return the name of the function and its module (if any) in modp. slay. ✨

🎀 the functions themselves

• The tep_set_function_resolver() function registers func as an alternative kernel functions resolver.
  • The tep argument is the trace event parser context.
  • The priv argument is a custom context of the func function.
  • The function resolver is used by the APIs tep_find_function(3), tep_find_function_address(3), and tep_print_func_field() to resolve a function address to a function name.
• The tep_reset_function_resolver() function resets the kernel functions resolver to the default function. The tep argument is the trace event parser context. (Basically the "jk, back to normal" button. 🫶)
• These APIs can be used to find function name and start address, by given address. The given address does not have to be exact, it will select the function that would contain it. like, it's chill about it. ✨
• The tep_register_function() function registers a function name mapped to an address and (optional) module. This mapping is used in case the function tracer or events have "%pS" parameter in its format string. It is common to pass in the kallsyms function names with their corresponding addresses with this function.
  • The tep argument is the trace event parser context.
  • The name is the name of the function, the string is copied internally.
  • The addr is the start address of the function.
  • The mod is the kernel module the function may be in (NULL for none).
• The tep_register_print_string() function registers a string by the address it was stored in the kernel. Some strings internal to the kernel with static address are passed to certain events. The "%s" in the event's format field which has an address needs to know what string would be at that address. The tep_register_print_string() supplies the parsing with the mapping between kernel addresses and those strings.
  • The tep argument is the trace event parser context.
  • The fmt is the string to register, it is copied internally.
  • The addr is the address the string was located at.
• tep_get_function_count() returns the number of registered functions in a tep handler. counting the girlies. 👑

---

💫 RETURN VALUE 💫

• The tep_set_function_resolver() function returns 0 in case of success, or -1 in case of an error.
• The tep_register_function() function returns 0 in case of success. In case of an error -1 is returned, and errno is set to the appropriate error number.
• The tep_register_print_string() function returns 0 in case of success. In case of an error -1 is returned, and errno is set to the appropriate error number.

fr fr, check that return value. 0 is the good one here. not -1. bestie. 😭

---

🔥 EXAMPLE 🔥

here's the whole vibe in code form, copied exactly, don't @ me:

#include <event-parse.h>
...
struct tep_handle *tep = tep_alloc();
...
char *my_resolve_kernel_addr(void *context,
                             unsigned long long *addrp, char **modp)
{
        struct db *function_database = context;
        struct symbol *sym = sql_lookup(function_database, *addrp);

        if (!sym)
                return NULL;

        *modp = sym->module_name;
        return sym->name;
}

void show_function( unsigned long long addr)
{
        unsigned long long fstart;
        const char *fname;

        if (tep_set_function_resolver(tep, my_resolve_kernel_addr,
                                      function_database) != 0) {
                /* failed to register my_resolve_kernel_addr */
        }

        /* These APIs use my_resolve_kernel_addr() to resolve the addr */
        fname = tep_find_function(tep, addr);
        fstart = tep_find_function_address(tep, addr);

        /*
           addr is in function named fname, starting at fstart address,
           at offset (addr - fstart)
        */

        tep_reset_function_resolver(tep);

}
...
        if (tep_register_function(tep, "kvm_exit",
                                (unsigned long long) 0x12345678, "kvm") != 0) {
                /* Failed to register kvm_exit address mapping */
        }
...
        if (tep_register_print_string(tep, "print string",
                                (unsigned long long) 0x87654321, NULL) != 0) {
                /* Failed to register "print string" address mapping */
        }
...

---

🌈 FILES 🌈

• event-parse.h — Header file to include in order to have access to the library APIs.
• -ltraceevent — Linker switch to add when building a program that uses the library.

---

👑 SEE ALSO 👑

libtraceevent(3), trace-cmd(1)

---

🎀 AUTHOR 🎀

• Steven Rostedt <rostedt@goodmis.org>, author of libtraceevent.
• Tzvetomir Stoyanov <tz.stoyanov@gmail.com>, author of this man page.

---

🫶 REPORTING BUGS 🫶

Report bugs to <linux-trace-devel@vger.kernel.org>

---

💜 LICENSE 💜

libtraceevent is Free Software licensed under the GNU LGPL 2.1

---

⭐ RESOURCES ⭐

https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git/

---

🧚 NOTES 🧚

1. rostedt@goodmis.org mailto:rostedt@goodmis.org
2. tz.stoyanov@gmail.com mailto:tz.stoyanov@gmail.com
3. linux-trace-devel@vger.kernel.org mailto:linux-trace-devel@vger.kernel.org

---

and that's the whole page, bestie!! this was libtraceevent 1.9.0, dated 06/15/2026, and it's LIBTRACEEVENT(3) forever and always. go register some functions, you absolute icon. 🎀✨💖