History

bpf: Add bpf_task_pt_regs() helper

The motivation behind this helper is to access userspace pt_regs in a kprobe handler. uprobe's ctx is the userspace pt_regs. kprobe's ctx is the kernelspace pt_regs. bpf_task_pt_regs() allows accessing userspace pt_regs in a kprobe handler. The final case (kernelspace pt_regs in uprobe) is pretty rare (usermode helper) so I think that can be solved later if necessary. More concretely, this helper is useful in doing BPF-based DWARF stack unwinding. Currently the kernel can only do framepointer based stack unwinds for userspace code. This is because the DWARF state machines are too fragile to be computed in kernelspace [0]. The idea behind DWARF-based stack unwinds w/ BPF is to copy a chunk of the userspace stack (while in prog context) and send it up to userspace for unwinding (probably with libunwind) [1]. This would effectively enable profiling applications with -fomit-frame-pointer using kprobes and uprobes. [0]: https://lkml.org/lkml/2012/2/10/356 [1]: https://github.com/danobi/bpf-dwarf-walk

Daniel Xu committed 5 years ago

Commit dd6e10f1 parent a396eda4 files · +36 −0Browse files

Unified · Split

4 files
  1. include/uapi/linux/bpf.h +7 −0
  2. kernel/bpf/helpers.c +3 −0
  3. kernel/trace/bpf_trace.c +19 −0
  4. tools/include/uapi/linux/bpf.h +7 −0
include/uapi/linux/bpf.h+7−0
@@ -4871,6 +4871,12 @@ union bpf_attr { · 4870 unmodified lines
48714871 * Return
48724872 * Value specified by user at BPF link creation/attachment time
48734873 * or 0, if it was not specified.
4874+ *
4875+ * long bpf_task_pt_regs(struct task_struct *task)
4876+ * Description
4877+ * Get the struct pt_regs associated with **task**.
4878+ * Return
4879+ * A pointer to struct pt_regs.
48744880 */
48754881 #define __BPF_FUNC_MAPPER(FN) \
48764882 FN(unspec), \
@@ -5048,6 +5054,7 @@ union bpf_attr { · 171 unmodified lines
50485054 FN(timer_cancel), \
50495055 FN(get_func_ip), \
50505056 FN(get_attach_cookie), \
5057+ FN(task_pt_regs), \
50515058 /* */
50525059
50535060 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
kernel/bpf/helpers.c+3−0
@@ -1327,6 +1327,7 @@ const struct bpf_func_proto bpf_probe_read_user_proto __weak; · 1326 unmodified lines
13271327 const struct bpf_func_proto bpf_probe_read_user_str_proto __weak;
13281328 const struct bpf_func_proto bpf_probe_read_kernel_proto __weak;
13291329 const struct bpf_func_proto bpf_probe_read_kernel_str_proto __weak;
1330+const struct bpf_func_proto bpf_task_pt_regs_proto __weak;
13301331
13311332 const struct bpf_func_proto *
13321333 bpf_base_func_proto(enum bpf_func_id func_id)
@@ -1424,6 +1425,8 @@ bpf_base_func_proto(enum bpf_func_id func_id) · 91 unmodified lines
14241425 return &bpf_snprintf_btf_proto;
14251426 case BPF_FUNC_snprintf:
14261427 return &bpf_snprintf_proto;
1428+ case BPF_FUNC_task_pt_regs:
1429+ return &bpf_task_pt_regs_proto;
14271430 default:
14281431 return NULL;
14291432 }
kernel/trace/bpf_trace.c+19−0
@@ -723,6 +723,23 @@ const struct bpf_func_proto bpf_get_current_task_btf_proto = { · 722 unmodified lines
723723 .ret_btf_id = &btf_task_struct_ids[0],
724724 };
725725
726+BPF_CALL_1(bpf_task_pt_regs, struct task_struct *, task)
727+{
728+ return (unsigned long) task_pt_regs(task);
729+}
730+
731+BTF_ID_LIST(bpf_task_pt_regs_ids)
732+BTF_ID(struct, pt_regs)
733+
734+const struct bpf_func_proto bpf_task_pt_regs_proto = {
735+ .func = bpf_task_pt_regs,
736+ .gpl_only = true,
737+ .arg1_type = ARG_PTR_TO_BTF_ID,
738+ .arg1_btf_id = &btf_task_struct_ids[0],
739+ .ret_type = RET_PTR_TO_BTF_ID,
740+ .ret_btf_id = &bpf_task_pt_regs_ids[0],
741+};
742+
726743 BPF_CALL_2(bpf_current_task_under_cgroup, struct bpf_map *, map, u32, idx)
727744 {
728745 struct bpf_array *array = container_of(map, struct bpf_array, map);
@@ -1032,6 +1049,8 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) · 303 unmodified lines
10321049 return &bpf_get_current_task_proto;
10331050 case BPF_FUNC_get_current_task_btf:
10341051 return &bpf_get_current_task_btf_proto;
1052+ case BPF_FUNC_task_pt_regs:
1053+ return &bpf_task_pt_regs_proto;
10351054 case BPF_FUNC_get_current_uid_gid:
10361055 return &bpf_get_current_uid_gid_proto;
10371056 case BPF_FUNC_get_current_comm:
tools/include/uapi/linux/bpf.h+7−0
@@ -4871,6 +4871,12 @@ union bpf_attr { · 4870 unmodified lines
48714871 * Return
48724872 * Value specified by user at BPF link creation/attachment time
48734873 * or 0, if it was not specified.
4874+ *
4875+ * long bpf_task_pt_regs(struct task_struct *task)
4876+ * Description
4877+ * Get the struct pt_regs associated with **task**.
4878+ * Return
4879+ * A pointer to struct pt_regs.
48744880 */
48754881 #define __BPF_FUNC_MAPPER(FN) \
48764882 FN(unspec), \
@@ -5048,6 +5054,7 @@ union bpf_attr { · 171 unmodified lines
50485054 FN(timer_cancel), \
50495055 FN(get_func_ip), \
50505056 FN(get_attach_cookie), \
5057+ FN(task_pt_regs), \
50515058 /* */
50525059
50535060 /* integer value in 'imm' field of BPF_CALL instruction selects which helper