linux-kernel - [RFC PATCH 5/5] samples/bpf: Add sample for testing bpf fetch args

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 18 May 2015 05:30:47 +0000
From:	He Kuang <hekuang@...wei.com>
To:	<paulus@...ba.org>, <a.p.zijlstra@...llo.nl>, <mingo@...hat.com>,
	<acme@...nel.org>, <namhyung@...nel.org>, <jolsa@...nel.org>,
	<dsahern@...il.com>, <ast@...mgrid.com>, <daniel@...earbox.net>,
	<brendan.d.gregg@...il.com>, <masami.hiramatsu.pt@...achi.com>
CC:	<wangnan0@...wei.com>, <lizefan@...wei.com>,
	<linux-kernel@...r.kernel.org>, <pi3orama@....com>
Subject: [RFC PATCH 5/5] samples/bpf: Add sample for testing bpf fetch args

Sample code for testing bpf fetch args.

Works as following steps:

  $ perf bpf record --object sample_bpf_fetch_args.o -- dd if=/dev/zero of=/mnt/data/test bs=4k count=3

show result in ringbuffer:
  $ perf script
  dd  1088 [000]  5740.260451: perf_bpf_probe:generic_perform_write: (ffffffff811308ea) a_ops=0xffffffff81a20160 bytes=0x1000 page=0xffff88007c621540 pos=0
  dd  1088 [000]  5740.260451: perf_bpf_probe:generic_perform_write: (ffffffff811308ea) a_ops=0xffffffff81a20160 bytes=0x1000 page=0xffffea0001c49f40 pos=4096
  dd  1088 [000]  5740.260451: perf_bpf_probe:generic_perform_write: (ffffffff811308ea) a_ops=0xffffffff81a20160 bytes=0x1000 page=0xffffea0001c49f80 pos=8192

show result in bpf prog:
  $ cat /sys/kernel/debug/tracing/trace |grep dd
  dd-1098  [000] d...  6892.829003: : NODE_write1 a_ops=ffffffff81a20160, bytes=0000000000001000
  dd-1098  [000] d...  6892.829049: : NODE_write2 page =ffff88007c621540, pos  =          (null)
  dd-1098  [000] d...  6892.829650: : NODE_write1 a_ops=ffffffff81a20160, bytes=0000000000001000
  dd-1098  [000] d...  6892.829662: : NODE_write2 page =ffffea0001c49f40, pos  =0000000000001000
  dd-1098  [000] d...  6892.829831: : NODE_write1 a_ops=ffffffff81a20160, bytes=0000000000001000
  dd-1098  [000] d...  6892.829842: : NODE_write2 page =ffffea0001c49f80, pos  =0000000000002000

Signed-off-by: He Kuang <hekuang@...wei.com>
---
 samples/bpf/Makefile                |  1 +
 samples/bpf/sample_bpf_fetch_args.c | 43 +++++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100644 samples/bpf/sample_bpf_fetch_args.c

diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
index 8fdbd73..dc0b0e8 100644
--- a/samples/bpf/Makefile
+++ b/samples/bpf/Makefile
@@ -30,6 +30,7 @@ always += tracex2_kern.o
 always += tracex3_kern.o
 always += tracex4_kern.o
 always += tcbpf1_kern.o
+always += sample_bpf_fetch_args.o
 
 HOSTCFLAGS += -I$(objtree)/usr/include
 
diff --git a/samples/bpf/sample_bpf_fetch_args.c b/samples/bpf/sample_bpf_fetch_args.c
new file mode 100644
index 0000000..9b587df
--- /dev/null
+++ b/samples/bpf/sample_bpf_fetch_args.c
@@ -0,0 +1,43 @@
+/*
+  Sample code for bpf_fetch_args().
+*/
+
+#include <linux/writeback.h>
+#include <linux/blkdev.h>
+
+#include <uapi/linux/bpf.h>
+#include <linux/version.h>
+#include "bpf_helpers.h"
+
+SEC("generic_perform_write=generic_perform_write+122 file->f_mapping->a_ops bytes page pos")
+int NODE_generic_perform_write(struct pt_regs *ctx)
+{
+	struct param_s {
+		unsigned long a_ops;
+		unsigned long bytes;
+		unsigned long page;
+		unsigned long pos;
+	} param = {0};
+
+	bpf_fetch_args(ctx, &param);
+
+	/* actions */
+	{
+		/* 5 args max for bpf_trace_printk, print in 2 lines */
+		char fmt1[] = "NODE_write1 a_ops=%p, bytes=%p\n";
+		char fmt2[] = "NODE_write2 page =%p, pos  =%p\n";
+
+		bpf_trace_printk(fmt1, sizeof(fmt1),
+				param.a_ops,
+				param.bytes);
+
+		bpf_trace_printk(fmt2, sizeof(fmt2),
+				param.page,
+				param.pos);
+	}
+
+	return 1;
+}
+
+char _license[] SEC("license") = "GPL";
+u32 _version SEC("version") = LINUX_VERSION_CODE;
-- 
1.8.5.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/