From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexei Starovoitov Subject: [PATCH RFC v7 net-next 19/28] tracing: allow eBPF programs to be attached to kprobe/kretprobe Date: Tue, 26 Aug 2014 19:29:33 -0700 Message-ID: <1409106582-10095-20-git-send-email-ast@plumgrid.com> References: <1409106582-10095-1-git-send-email-ast@plumgrid.com> Cc: Ingo Molnar , Linus Torvalds , Andy Lutomirski , Steven Rostedt , Daniel Borkmann , Chema Gonzalez , Eric Dumazet , Peter Zijlstra , Brendan Gregg , Namhyung Kim , "H. Peter Anvin" , Andrew Morton , Kees Cook , linux-api@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org To: "David S. Miller" Return-path: In-Reply-To: <1409106582-10095-1-git-send-email-ast@plumgrid.com> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org Signed-off-by: Alexei Starovoitov --- kernel/trace/trace_kprobe.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c index 282f6e4e5539..b6db92207c99 100644 --- a/kernel/trace/trace_kprobe.c +++ b/kernel/trace/trace_kprobe.c @@ -19,6 +19,7 @@ #include #include +#include #include "trace_probe.h" @@ -930,6 +931,22 @@ __kprobe_trace_func(struct trace_kprobe *tk, struct pt_regs *regs, if (ftrace_trigger_soft_disabled(ftrace_file)) return; + if (call->flags & TRACE_EVENT_FL_BPF) { + struct bpf_context ctx = {}; + unsigned long args[3]; + /* get first 3 arguments of the function. x64 syscall ABI uses + * the same 3 registers as x64 calling convention. + * todo: implement it cleanly via arch specific + * regs_get_argument_nth() helper + */ + syscall_get_arguments(current, regs, 0, 3, args); + ctx.arg1 = args[0]; + ctx.arg2 = args[1]; + ctx.arg3 = args[2]; + trace_filter_call_bpf(ftrace_file->filter, &ctx); + return; + } + local_save_flags(irq_flags); pc = preempt_count(); @@ -978,6 +995,17 @@ __kretprobe_trace_func(struct trace_kprobe *tk, struct kretprobe_instance *ri, if (ftrace_trigger_soft_disabled(ftrace_file)) return; + if (call->flags & TRACE_EVENT_FL_BPF) { + struct bpf_context ctx = {}; + /* assume that register used to return a value from syscall is + * the same as register used to return a value from a function + * todo: provide arch specific helper + */ + ctx.ret = syscall_get_return_value(current, regs); + trace_filter_call_bpf(ftrace_file->filter, &ctx); + return; + } + local_save_flags(irq_flags); pc = preempt_count(); -- 1.7.9.5