This helper function uses kernel structure trace_probe and related fetch functions for fetching variables described in 'SEC' to bpf stack.
Signed-off-by: He Kuang <[email protected]> --- include/uapi/linux/bpf.h | 1 + kernel/trace/bpf_trace.c | 38 ++++++++++++++++++++++++++++++++++++++ samples/bpf/bpf_helpers.h | 2 ++ 3 files changed, 41 insertions(+) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index a9ebdf5..b1a7685 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -210,6 +210,7 @@ enum bpf_func_id { * Return: 0 on success */ BPF_FUNC_l4_csum_replace, + BPF_FUNC_fetch_args, __BPF_FUNC_MAX_ID, }; diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 2d56ce5..ba601da 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -12,6 +12,7 @@ #include <linux/uaccess.h> #include <linux/ctype.h> #include "trace.h" +#include "trace_probe.h" static DEFINE_PER_CPU(int, bpf_prog_active); @@ -159,6 +160,39 @@ static const struct bpf_func_proto bpf_trace_printk_proto = { .arg2_type = ARG_CONST_STACK_SIZE, }; +/* Store the value of each argument */ +static void +bpf_store_trace_args(struct pt_regs *regs, struct trace_probe *tp, + u8 *data) +{ + int i; + + for (i = 0; i < tp->nr_args; i++) { + /* Just fetching data normally */ + call_fetch(&tp->args[i].fetch, regs, + data + tp->args[i].offset); + } +} + +static u64 bpf_fetch_args(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5) +{ + struct pt_regs *regs = (struct pt_regs *)(long)r1; + struct trace_probe *tp = ((struct bpf_pt_regs *)regs)->tp; + void *data = (void *)(long)r2; + + bpf_store_trace_args(regs, tp, data); + + return 0; +} + +static const struct bpf_func_proto bpf_fetch_args_proto = { + .func = bpf_fetch_args, + .gpl_only = true, + .ret_type = RET_INTEGER, + .arg1_type = ARG_PTR_TO_CTX, + .arg2_type = ARG_PTR_TO_STACK, +}; + static const struct bpf_func_proto *kprobe_prog_func_proto(enum bpf_func_id func_id) { switch (func_id) { @@ -181,6 +215,10 @@ static const struct bpf_func_proto *kprobe_prog_func_proto(enum bpf_func_id func trace_printk_init_buffers(); return &bpf_trace_printk_proto; + + case BPF_FUNC_fetch_args: + return &bpf_fetch_args_proto; + default: return NULL; } diff --git a/samples/bpf/bpf_helpers.h b/samples/bpf/bpf_helpers.h index f960b5f..578a8e3 100644 --- a/samples/bpf/bpf_helpers.h +++ b/samples/bpf/bpf_helpers.h @@ -21,6 +21,8 @@ static unsigned long long (*bpf_ktime_get_ns)(void) = (void *) BPF_FUNC_ktime_get_ns; static int (*bpf_trace_printk)(const char *fmt, int fmt_size, ...) = (void *) BPF_FUNC_trace_printk; +static int (*bpf_fetch_args)(void *ctx, void *data) = + (void *) BPF_FUNC_fetch_args; /* llvm builtin functions that eBPF C program may use to * emit BPF_LD_ABS and BPF_LD_IND instructions -- 1.8.5.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
