I would like to write an eBPF program in order to track the functions being called in a separate running eBPF program. Also, I would like to count the number of times the respective functions have been called.
Is this possible? And if so, could someone please hint me towards what could be used in order to achieve this?
(Note: I am looking for the idea/concept behind achieving this functionality (i.e. the specific kprobe to be used) rather than a fully developed solution.)
Preferably, I am looking for a solution which can be implemented using python bcc
or bpftrace
.
Update: I would like to count the number of times "user-defined" functions are being called inside an eBPF program.
For example, if I create an eBPF program in the kernel code:
SEC("kprobe/tcp_v4_connect")
int bpf_sample_prog(struct pt_regs *ctx) {
int x, y, ...; /* local variables to which I assign data from context */
foo(x); /* user-defined function */
bar(y); /* user-defined function */
return 0;
}
, and I attach it to the kprobe from the userspace code, I would like to be able to count using a completely separate eBPF program the number of times the foo
and bar
functions have been called inside the bpf_sample_prog
program.
Thank you in advance.