Re: [PATCH v3 bpf-next 2/7] bpf: add bpf_trace_vprintk helper
flat view
From: Daniel Borkmann <daniel@iogearbox.net>
Date: 2021-09-03 08:00:06
Also in:
bpf
On 8/28/21 7:20 AM, Dave Marchevsky wrote:
This helper is meant to be "bpf_trace_printk, but with proper vararg support". Follow bpf_snprintf's example and take a u64 pseudo-vararg array. Write to /sys/kernel/debug/tracing/trace_pipe using the same mechanism as bpf_trace_printk. Signed-off-by: Dave Marchevsky <redacted>
lgtm, minor comments below:
quoted hunk ↗ jump to hunk
--- include/linux/bpf.h | 1 + include/uapi/linux/bpf.h | 9 ++++++ kernel/bpf/core.c | 5 ++++ kernel/bpf/helpers.c | 2 ++ kernel/trace/bpf_trace.c | 52 +++++++++++++++++++++++++++++++++- tools/include/uapi/linux/bpf.h | 9 ++++++ 6 files changed, 77 insertions(+), 1 deletion(-)diff --git a/include/linux/bpf.h b/include/linux/bpf.h index be8d57e6e78a..b6c45a6cbbba 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h@@ -1088,6 +1088,7 @@ bool bpf_prog_array_compatible(struct bpf_array *array, const struct bpf_prog *f int bpf_prog_calc_tag(struct bpf_prog *fp); const struct bpf_func_proto *bpf_get_trace_printk_proto(void); +const struct bpf_func_proto *bpf_get_trace_vprintk_proto(void); typedef unsigned long (*bpf_ctx_copy_t)(void *dst, const void *src, unsigned long off, unsigned long len);diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 791f31dd0abe..f171d4d33136 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h@@ -4877,6 +4877,14 @@ union bpf_attr { * Get the struct pt_regs associated with **task**. * Return * A pointer to struct pt_regs. + * + * u64 bpf_trace_vprintk(const char *fmt, u32 fmt_size, const void *data, u32 data_len)
s/u64/long/
+ * Description + * Behaves like **bpf_trace_printk**\ () helper, but takes an array of u64
nit: maybe for users it's more clear from description if you instead mention that data_len needs to be multiple of 8 bytes? Or somehow mention the relation with data more clearly resp. which shortcoming it addresses compared to bpf_trace_printk(), so developers can more easily parse it.
quoted hunk ↗ jump to hunk
+ * to format. Arguments are to be used as in **bpf_seq_printf**\ () helper. + * Return + * The number of bytes written to the buffer, or a negative error + * in case of failure. */
[...]
quoted hunk ↗ jump to hunk
default: return NULL; }diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 10672ebc63b7..ea8358b0c748 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c@@ -398,7 +398,7 @@ static const struct bpf_func_proto bpf_trace_printk_proto = { .arg2_type = ARG_CONST_SIZE, }; -const struct bpf_func_proto *bpf_get_trace_printk_proto(void) +static void __set_printk_clr_event(void) { /* * This program might be calling bpf_trace_printk,@@ -410,10 +410,58 @@ const struct bpf_func_proto *bpf_get_trace_printk_proto(void) */ if (trace_set_clr_event("bpf_trace", "bpf_trace_printk", 1)) pr_warn_ratelimited("could not enable bpf_trace_printk events"); +} +const struct bpf_func_proto *bpf_get_trace_printk_proto(void) +{ + __set_printk_clr_event(); return &bpf_trace_printk_proto; } +BPF_CALL_4(bpf_trace_vprintk, char *, fmt, u32, fmt_size, const void *, data, + u32, data_len) +{ + static char buf[BPF_TRACE_PRINTK_SIZE]; + unsigned long flags; + int ret, num_args; + u32 *bin_args; + + if (data_len & 7 || data_len > MAX_BPRINTF_VARARGS * 8 || + (data_len && !data)) + return -EINVAL; + num_args = data_len / 8; + + ret = bpf_bprintf_prepare(fmt, fmt_size, data, &bin_args, num_args); + if (ret < 0) + return ret;
Given you have ARG_PTR_TO_MEM_OR_NULL for data, does this gracefully handle the case where you pass in fmt string containing e.g. %ps but data being NULL? From reading bpf_bprintf_prepare() looks like it does just fine, but might be nice to explicitly add a tiny selftest case for it while you're at it.
quoted hunk ↗ jump to hunk
+ raw_spin_lock_irqsave(&trace_printk_lock, flags); + ret = bstr_printf(buf, sizeof(buf), fmt, bin_args); + + trace_bpf_trace_printk(buf); + raw_spin_unlock_irqrestore(&trace_printk_lock, flags); + + bpf_bprintf_cleanup(); + + return ret; +}
Thanks, Daniel