eBPF programs attached to kprobes need to filter based on current->pid, uid and other fields, so introduce helper functions: u64 bpf_get_current_pid_tgid(void) Return: current->tgid << 32 | current->pid u64 bpf_get_current_uid_gid(void) Return: current_gid << 32 | current_uid bpf_get_current_comm(char *buf, int size_of_buf) stores current->comm into buf They can be used from the programs attached to TC as well to classify packets based on current task fields. Update tracex2 example to print histogram of write syscalls for each process instead of aggregated for all.
Showing the changes to include/uapi (1 of 9 files). Show all
Unified · Split
| @@ -230,6 +230,25 @@ enum bpf_func_id { · 229 unmodified lines | ||
| 230 | 230 | * Return: 0 on success |
| 231 | 231 | */ |
| 232 | 232 | BPF_FUNC_clone_redirect, |
| 233 | + | |
| 234 | + /** | |
| 235 | + * u64 bpf_get_current_pid_tgid(void) | |
| 236 | + * Return: current->tgid << 32 | current->pid | |
| 237 | + */ | |
| 238 | + BPF_FUNC_get_current_pid_tgid, | |
| 239 | + | |
| 240 | + /** | |
| 241 | + * u64 bpf_get_current_uid_gid(void) | |
| 242 | + * Return: current_gid << 32 | current_uid | |
| 243 | + */ | |
| 244 | + BPF_FUNC_get_current_uid_gid, | |
| 245 | + | |
| 246 | + /** | |
| 247 | + * bpf_get_current_comm(char *buf, int size_of_buf) | |
| 248 | + * stores current->comm into buf | |
| 249 | + * Return: 0 on success | |
| 250 | + */ | |
| 251 | + BPF_FUNC_get_current_comm, | |
| 233 | 252 | __BPF_FUNC_MAX_ID, |
| 234 | 253 | }; |
| 235 | 254 | |