Implement --output-caller

Signed-off-by: gray <gray.liang@isovalent.com>

bpf/kprobe_pwru.c

@@ -53,6 +53,7 @@ struct event_t {
 	u32 pid;
 	u32 type;
 	u64 addr;
+	u64 caller_addr;
 	u64 skb_addr;
 	u64 ts;
 	typeof(print_skb_id) print_skb_id;
@@ -429,6 +430,9 @@ kprobe_skb(struct sk_buff *skb, struct pt_regs *ctx, bool has_get_func_ip, u64 *
 	event.skb_addr = (u64) skb;
 	event.addr = has_get_func_ip ? bpf_get_func_ip(ctx) : PT_REGS_IP(ctx);
 	event.param_second = PT_REGS_PARM2(ctx);
+	if (CFG.output_caller)
+		bpf_probe_read_kernel(&event.caller_addr, sizeof(event.caller_addr), (void *)PT_REGS_SP(ctx));
+
 	bpf_map_push_elem(&events, &event, BPF_EXIST);
 
 	return BPF_OK;

internal/pwru/ksym.go

@@ -32,14 +32,14 @@ func (a *Addr2Name) findNearestSym(ip uint64) string {
 		h := int(uint(i+j) >> 1)
 		if a.Addr2NameSlice[h].addr <= ip {
 			if h+1 < total && a.Addr2NameSlice[h+1].addr > ip {
-				return a.Addr2NameSlice[h].name
+				return strings.Replace(a.Addr2NameSlice[h].name, "\t", "", -1)
 			}
 			i = h + 1
 		} else {
 			j = h
 		}
 	}
-	return a.Addr2NameSlice[i-1].name
+	return strings.Replace(a.Addr2NameSlice[i-1].name, "\t", "", -1)
 }
 
 func ParseKallsyms(funcs Funcs, all bool) (Addr2Name, BpfProgName2Addr, error) {

internal/pwru/output.go

@@ -338,8 +338,13 @@ func (o *output) Print(event *Event) {
 
 	outFuncName := getOutFuncName(o, event, addr)
 
-	fmt.Fprintf(o.writer, "%18s %6s %16s %24s", fmt.Sprintf("%#x", event.SAddr),
-		fmt.Sprintf("%d", event.CPU), fmt.Sprintf("[%s]", execName), outFuncName)
+	fmt.Fprintf(o.writer, "%18s %6s %16s", fmt.Sprintf("%#x", event.SAddr),
+		fmt.Sprintf("%d", event.CPU), fmt.Sprintf("[%s]", execName))
+	if o.flags.OutputCaller {
+		fmt.Fprintf(o.writer, "%48s", fmt.Sprintf("%s(%s)", outFuncName, o.addr2name.findNearestSym(event.CallerAddr)))
+	} else {
+		fmt.Fprintf(o.writer, "%24s", outFuncName)
+	}
 	if o.flags.OutputTS != "none" {
 		fmt.Fprintf(o.writer, " %16d", ts)
 	}

internal/pwru/types.go

@@ -140,6 +140,7 @@ type Event struct {
 	PID           uint32
 	Type          uint32
 	Addr          uint64
+	CallerAddr    uint64
 	SAddr         uint64
 	Timestamp     uint64
 	PrintSkbId    uint64

main.go

@@ -99,7 +99,8 @@ func main() {
 	}
 	// If --filter-trace-tc, it's to retrieve and print bpf prog's name.
 	addr2name, name2addr, err := pwru.ParseKallsyms(funcs, flags.OutputStack ||
-		len(flags.KMods) != 0 || flags.FilterTraceTc || len(flags.FilterNonSkbFuncs) > 0)
+		len(flags.KMods) != 0 || flags.FilterTraceTc || len(flags.FilterNonSkbFuncs) > 0 ||
+		flags.OutputCaller)
 	if err != nil {
 		log.Fatalf("Failed to get function addrs: %s", err)
 	}