Kernel: BPF: retsnoop

简介

https://github.com/anakryiko/retsnoop
这个是利用bpf, 及FENTRY的功能，来实现对返回error 函数的一个跟踪调查的工具。方便kernel问题调试。It allows to capture call stacks of kernel functions that return errors (NULL or -Exxx) and emits every such detected call stack, along with the captured results.
输出实例：
$ sudo retsnoop -c bpf
Receiving data…
entry_SYSCALL_64_after_hwframe+0x44 (arch/x86/entry/entry_64.S:112:0)
do_syscall_64+0x2d (arch/x86/entry/common.c:46:12)
24us [-EINVAL] __x64_sys_bpf+0x5 (kernel/bpf/syscall.c:4351:1)
. __se_sys_bpf (kernel/bpf/syscall.c:4351:1)
__do_sys_bpf+0x5ca (kernel/bpf/syscall.c:4438:9)
. bpf_btf_load (kernel/bpf/syscall.c:3818:9)
详细说明需要看使用说明。