Re: [RFC PATCH 3/5] bpf: Add helper function for fetching variables at probe point

[Alexei Starovoitov <ast@plumgrid.com>]

On 5/17/15 10:30 PM, He Kuang wrote:
> This helper function uses kernel structure trace_probe and related fetch
> functions for fetching variables described in 'SEC' to bpf stack.
>
> Signed-off-by: He Kuang <hekuang@huawei.com>
...
> +/* Store the value of each argument */
> +static void
> +bpf_store_trace_args(struct pt_regs *regs, struct trace_probe *tp,
> +		u8 *data)
> +{
> +	int i;
> +
> +	for (i = 0; i < tp->nr_args; i++) {
> +		/* Just fetching data normally */
> +		call_fetch(&tp->args[i].fetch, regs,
> +			data + tp->args[i].offset);

that is slower than generating bpf by user space, but more importantly
that's invalid. There is no size check.
r2 in fetch_args points to stack, but nothing checks the stack limits.
You need to add code here to dynamically check it as well.
which will be adding runtime overhead as well.

Your first approach of generating argument accessors in user space
was better.
I think the limit of 3 or 4 arguments was fine.
We need to generate the code for non-debug case anyway,
like my earlier suggestion:
SEC("kprobe/generic_perform_write(void*, void*, long long)")
without debug info it will copy ctx->di into r2, ctx->si into r3
and ctx->dx into r4.