nullptr
nullptr

Reputation: 25

How to get attached kprobe kernel function name in bpf(libbpf) handler(kernel function tracing)

Use case : Given executable we are trying to trace user space (uprobes) and kernel (kprobes functions of that process.

./profiler vfs_* => this should trace all vfs calls invoked by that executable.

In below kprobe entry and exit handler i need to capture name of the kprobe. count number of times invoked, time spents etc. send it to user space.

In bpf (libbpf) i could do that by attaching cookie with kprobe to uniquely identify kern function (bpf_get_attach_cookie) but issues is we need to support kernel without that cookie API.

Any alternatives approaches would be helpful

Should be able to get kprobe names in entry and exit handlers. any bpf API exists.

user space program :

  
static int attach_kprobes(struct funclatency_bpf *obj)
{
    obj->links.dummy_kprobe =
        bpf_program__attach_kprobe(obj->progs.dummy_kprobe, false,
                       env.funcname);
    if (!obj->links.dummy_kprobe) {
        warn("failed to attach kprobe: %d\n", -errno);
        return -1;
    }

    obj->links.dummy_kretprobe =
        bpf_program__attach_kprobe(obj->progs.dummy_kretprobe, true,
                       env.funcname);
    if (!obj->links.dummy_kretprobe) {
        warn("failed to attach kretprobe: %d\n", -errno);
        return -1;
    }

    return 0;
}

main ()
{
  bpf setup using skeleton;
   attach_kprobes
}

kernel code


#include "vmlinux.h"
#include <bpf/bpf_core_read.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>


SEC("kprobe/dummy_kprobe")
int BPF_KPROBE(dummy_kprobe)
{
    entry();
    return 0;
}

SEC("kretprobe/dummy_kretprobe")
int BPF_KRETPROBE(dummy_kretprobe)
{
    exit();
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

Upvotes: 0

Views: 110

Answers (0)

Related Questions