How are uprobes "remembered" in the kernel from a conceptual standpoint? Where is the attach point stored? Is it basically a hashmap with JMP instructions for each function that is being attached to? What exactly does the cleanup process look like if the attach point disappears? Example of a use case: let's say a uprobe is to "SSL_read" in /proc/[root_pid]/root/.../libssl.so where [root_pid] is the root process of a container. If the container dies, then does that uprobe hang around attaching to empty air or gets deleted as well? Yadunandan Pillai
