Messages in this thread Patch in this message | | | Date | Wed, 16 Aug 2023 21:28:45 -0300 | From | Arnaldo Carvalho de Melo <> | Subject | Dumping a struct to a buffer in an strace like style using BTF |
| |
Hi Alan,
Something I planned to do since forever is to get the contents of syscall args and print in 'perf trace' using BTF, right now we have things like:
[root@quaco ~]# perf trace -e connect* ssh localhost 0.000 ( 0.342 ms): ssh/438068 connect(fd: 3, uservaddr: { .family: INET, port: 22, addr: 127.0.0.1 }, addrlen: 16) = 0 root@localhost's password:
in perf-tools-next when building with BUILD_BPF_SKEL=1 that will hook into that specific syscall and collect the uservaddr sockaddr struct and then pretty print it.
That is done manually (the last leg) in tools/perf/trace/beauty/sockaddr.c:
syscall_arg__scnprintf_augmented_sockaddr af_scnprintfs[family](syscall pointer contents collected via BPF)
which leads to struct sockaddr_in or sockaddr_in6 specific pretty printers, I wanted to do what these two struct specific pretty printers do but using BTF.
I guess this is already available, but from a _really_ quick look at libbpf I couldn't find it, ideas?
I want to try the code at the end of this message for another multiplexer syscall, bpf(), with this on top of what is at:
git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next.git perf-tools-next
Best regards,
- Arnaldo
diff --git a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c index 9c1d0b271b20f693..79767422efe9479c 100644 --- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c +++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c @@ -319,6 +319,27 @@ int sys_enter_perf_event_open(struct syscall_enter_args *args) return 1; /* Failure: don't filter */ } +SEC("tp/syscalls/sys_enter_bpf") +int sys_enter_bpf(struct syscall_enter_args *args) +{ + struct augmented_args_payload *augmented_args = augmented_args_payload(); + const void *attr = (void *)args->args[1]; + unsigned int size = args->args[2]; + unsigned int len = sizeof(augmented_args->args); + + if (augmented_args == NULL) + goto failure; + + size &= sizeof(augmented_args->__data) - 1; + + if (bpf_probe_read(&augmented_args->__data, size, attr) < 0) + goto failure; + + return augmented__output(args, augmented_args, len + size); +failure: + return 1; /* Failure: don't filter */ +} + SEC("tp/syscalls/sys_enter_clock_nanosleep") int sys_enter_clock_nanosleep(struct syscall_enter_args *args) {
| |