Instrument functions called in eBPF program using eBPF

561 views Asked by At

I would like to write an eBPF program in order to track the functions being called in a separate running eBPF program. Also, I would like to count the number of times the respective functions have been called.

Is this possible? And if so, could someone please hint me towards what could be used in order to achieve this?

(Note: I am looking for the idea/concept behind achieving this functionality (i.e. the specific kprobe to be used) rather than a fully developed solution.)

Preferably, I am looking for a solution which can be implemented using python bcc or bpftrace.

Update: I would like to count the number of times "user-defined" functions are being called inside an eBPF program.

For example, if I create an eBPF program in the kernel code:

SEC("kprobe/tcp_v4_connect")
int bpf_sample_prog(struct pt_regs *ctx) {
    int x, y, ...; /* local variables to which I assign data from context */

    foo(x);        /* user-defined function */
    bar(y);        /* user-defined function */
    return 0;
}

, and I attach it to the kprobe from the userspace code, I would like to be able to count using a completely separate eBPF program the number of times the foo and bar functions have been called inside the bpf_sample_prog program.

Thank you in advance.

0

There are 0 answers