On 9/19/23 06:55, 刘畅 wrote:
Hi all I attached an fentry eBPF program to a kernel function, i.e., tcp_transmit_skb(). I want to implement different logic in the bpf program for different calling stack cases, e.g., __tcp_retransmit_skb()->tcp_transmit_skb() and tcp_write_xmit()->tcp_transmit_skb(). I know that I can access stack traces using the bpf_get_stack() helper function. However, in the fentry eBPF program, I don't know the value of the RSP and RBP register, which means I can not locate the return address even if I can get the stack traces. I want to know if there's any way that I can get the return address and thus get the function calling stack in an fentry bpf program. I'd be appreciate if you can help me. Chang Liu Tsinghua University, China
Once you get stack returned by bpf_get_stack(), it is an array of addresses. For example, __u64 buf[256]; bpf_get_stack(ctx, buf, 256, 0); buf[0], buf[1], ... will be addresses of caller sites from most inner.
