Andrea
04/21/2023, 9:59 AMkprobe
. I don’t think we can trace a returning function with the kretprobe
though. Is that correct or am I missing something ? my use case would be tracing tcp_v4_connect
the same way bcc/tools/tcpconnect
does, which looks better for tracing local/destination address+port than tracing connect() bind() accept() separately (again..unless I missed something 🙂 ). Any pointer would be appreciated! thanksalessandrogario
04/21/2023, 10:40 AMint tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len);
tob::ebpfpub::IFunctionTracer::ParameterList parameter_list = {
{
"sk",
tob::ebpfpub::IFunctionTracer::Parameter::Type::Integer,
tob::ebpfpub::IFunctionTracer::Parameter::Mode::In,
8U
},
{
"uaddr",
tob::ebpfpub::IFunctionTracer::Parameter::Type::Buffer,
tob::ebpfpub::IFunctionTracer::Parameter::Mode::In,
"addr_len"
},
{
"addr_len",
tob::ebpfpub::IFunctionTracer::Parameter::Type::Integer,
tob::ebpfpub::IFunctionTracer::Parameter::Mode::In,
8U
}
};
struct sock
{
"sk",
tob::ebpfpub::IFunctionTracer::Parameter::Type::Buffer,
tob::ebpfpub::IFunctionTracer::Parameter::Mode::In,
1U // <- buffer size here
},
But you won't be able to dereference pointers within the struct sock ptrAndrea
04/21/2023, 12:01 PMkretprobe
comes into play in the library though 🤔alessandrogario
04/21/2023, 12:33 PMAndrea
04/21/2023, 12:39 PMtob::ebpfpub::IFunctionTracer::createFromKprobe
API in ifunctiontracer.h but I don’t see anything about tracing kretprobe
More about that: from our code we can’t really inspect much state in the kernel, and we have to rely on what we can capture through the function signatureyeah that’s why I reckon tracing kretprobe for that specific call is necessary 🤔
alessandrogario
04/21/2023, 12:40 PMAndrea
04/21/2023, 12:41 PMalessandrogario
04/21/2023, 12:43 PMAndrea
04/21/2023, 12:45 PM