Take name of called function in eBPF

Question

I'd like to trace functions of the particular PID and collect some stats (total calls, total times, etc.), and it's not completely clear for me how to create BPF_HASH with pairs of funcname+my_struct.

Is there any way to obtain names of called functions in BPF program?

I suppose I should read IP register using "PT_REGS_IP(ctx)" but I don't completely understand how translate the value to human-readable string.

At the moment BPF program looks in the following way:

#include <uapi/linux/ptrace.h>
#include <linux/sched.h>

struct data_t {
    u32 pid;
    u64 delta;
    u64 start;
} __attribute__((packed));

BPF_HASH(faddr, u64, struct data_t);
BPF_PERF_OUTPUT(events);

int do_entry(struct pt_regs *ctx) {
    struct data_t *data;
    data->start = bpf_ktime_get_ns();
    u64 ip = PT_REGS_IP(ctx);
    faddr.update(&ip, data);

    return 0;
}

int do_return(struct pt_regs *ctx) {
    struct data_t *data;
    u64 ip = PT_REGS_IP(ctx);
    data = faddr.lookup(&ip);

    if (data->start == 0)
        return 0;       // missed start

    data->delta = bpf_ktime_get_ns() - data->start;
    data->pid = bpf_get_current_pid_tgid();

    events.perf_submit(ctx, &data, sizeof(data));
    faddr.delete(&ip);

    return 0;
}

But at startup I got:

error: <unknown>:0:0: in function do_entry i32 (%struct.pt_regs*): A call to built-in function 'abort' is not supported.

Answer 1

You have an error in your do_entry function. You're trying to dereference a null pointer:

struct data_t *data;
data->start = bpf_ktime_get_ns();

The following should work better:

int do_entry(struct pt_regs *ctx) {
    struct data_t data = {}; // initializes data with zeros.
    data.start = bpf_ktime_get_ns();
    u64 ip = PT_REGS_IP(ctx);
    faddr.update(&ip, &data);
    return 0;
}

I don't understand why the error message mentions abort though. I'll ask around.

---

How to translate memory addresses to function names will depend on the userspace library you're using. If you're using bcc, there's a ksym method you can use. I don't know if there's an equivalent in gobpf.

---

You have at least one other error, in do_return:

data = faddr.lookup(&ip);
if (data->start == 0)
    return 0;       // missed start

You will need to check data is not null before dereferencing it. Otherwise, the verifier will reject your program.

data = faddr.lookup(&ip);
if (!data || data->start == 0)
    return 0;       // missed start