linux-kernel - [ftrace-bpf 3/5] add bpf prog filter for graph trace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 12 Nov 2017 07:28:26 +0000
From:   yupeng0921@...il.com
To:     linux-kernel@...r.kernel.org
Cc:     ast@...nel.org, daniel@...earbox.net, rostedt@...dmis.org,
        mingo@...hat.com, yupeng0921@...il.com
Subject: [ftrace-bpf 3/5] add bpf prog filter for graph trace

When set a bpf prog through set_bpf_filter, graph trace will check
whether it should trace the function depend on the bpf prog return
value. It passes the parameters of the function to bpf prog, let bpf
prog determine whether this function should be traced. It only makes
sense if the user set only one function in set_graph_function, because
bpf prog is hard to distinguish different functions.

Signed-off-by: yupeng0921@...il.com
---
 kernel/trace/trace_functions_graph.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index 23c0b0c..5894439b2 100644
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -372,6 +372,24 @@ static inline int ftrace_graph_ignore_irqs(void)
 	return in_irq();
 }
 
+#ifdef FTRACE_BPF_FILTER
+static inline int ftrace_graph_bpf_filter(
+	struct trace_array *tr, struct ftrace_graph_ent *trace)
+{
+	struct bpf_prog *prog;
+	int ret = 1;
+
+	if (!ftrace_graph_addr(trace->func))
+		return ret;
+	rcu_read_lock();
+	prog = rcu_dereference(tr->prog);
+	if (prog)
+		ret = trace_call_bpf(prog, trace->ctx);
+	rcu_read_unlock();
+	return ret;
+}
+#endif
+
 int trace_graph_entry(struct ftrace_graph_ent *trace)
 {
 	struct trace_array *tr = graph_array;
@@ -391,6 +409,11 @@ int trace_graph_entry(struct ftrace_graph_ent *trace)
 	if (ftrace_graph_ignore_irqs())
 		return 0;
 
+#ifdef FTRACE_BPF_FILTER
+	if (!ftrace_graph_bpf_filter(tr, trace))
+		return 0;
+#endif
+
 	/*
 	 * Do not trace a function if it's filtered by set_graph_notrace.
 	 * Make the index of ret stack negative to indicate that it should
-- 
2.7.4