Use pre-calculated function addresses in funccount

Hash map updates are not safe in recursive context. Change the
implementation of funccount to be read-only by converting
lookup_or_init() to lookup(). When run in interval mode, zero the counts
table instead of clearing it.

Signed-off-by: Brenden Blanco <[email protected]>

tools/funccount.py

@@ -65,9 +65,13 @@ def signal_ignore(signal, frame):
 int trace_count(struct pt_regs *ctx) {
  FILTER
  struct key_t key = {};
- u64 zero = 0, *val;
- key.ip = ctx->ip;
- val = counts.lookup_or_init(&key, &zero);
+ u64 *val;
+ // the kprobe pc is slightly after the function starting address, align
+ // back to the start (4 byte alignment) in order to match /proc/kallsyms
+ key.ip = ctx->ip & ~3ull;
+ val = counts.lookup(&key);
+ if (!val)
+ return 0;
  (*val)++;
  return 0;
 }
@@ -81,6 +85,16 @@ def signal_ignore(signal, frame):
 if debug:
  print(bpf_text)
 b = BPF(text=bpf_text)
+counts = b.get_table("counts")
+
+# pre-insert the function addresses into the counts table
+fns = b._get_kprobe_functions(pattern)
+for fn in fns:
+ addr = b.ksymname(fn)
+ if addr == -1:
+ raise Exception("Unknown symbol name %s" % fn)
+ counts[counts.Key(addr)] = counts.Leaf()
+
 b.attach_kprobe(event_re=pattern, fn_name="trace_count")
 matched = b.num_open_kprobes()
 if matched == 0:
@@ -106,10 +120,10 @@ def signal_ignore(signal, frame):
  print("%-8s\n" % strftime("%H:%M:%S"), end="")
 
  print("%-16s %-26s %8s" % ("ADDR", "FUNC", "COUNT"))
- counts = b.get_table("counts")
  for k, v in sorted(counts.items(), key=lambda counts: counts[1].value):
+ if v.value == 0: continue
  print("%-16x %-26s %8d" % (k.ip, b.ksym(k.ip), v.value))
- counts.clear()
+ counts.zero()
 
  if exiting:
  print("Detaching...")