1414 * code that will combine entry/exit in a strace like way.
1515 */
1616
17- #include <unistd.h>
17+ #include <linux/bpf.h>
18+ #include <bpf/bpf_helpers.h>
1819#include <linux/limits.h>
19- #include <linux/socket.h>
20- #include <pid_filter.h>
20+
21+ // FIXME: These should come from system headers
22+ typedef char bool ;
23+ typedef int pid_t ;
2124
2225/* bpf-output associated map */
23- bpf_map (__augmented_syscalls__ , PERF_EVENT_ARRAY , int , u32 , __NR_CPUS__ );
26+ struct __augmented_syscalls__ {
27+ __uint (type , BPF_MAP_TYPE_PERF_EVENT_ARRAY );
28+ __type (key , int );
29+ __type (value , __u32 );
30+ __uint (max_entries , __NR_CPUS__ );
31+ } __augmented_syscalls__ SEC (".maps" );
2432
2533/*
2634 * string_args_len: one per syscall arg, 0 means not a string or don't copy it,
@@ -29,24 +37,39 @@ bpf_map(__augmented_syscalls__, PERF_EVENT_ARRAY, int, u32, __NR_CPUS__);
2937 */
3038struct syscall {
3139 bool enabled ;
32- u16 string_args_len [6 ];
40+ __u16 string_args_len [6 ];
3341};
3442
35- bpf_map (syscalls , ARRAY , int , struct syscall , 512 );
43+ struct syscalls {
44+ __uint (type , BPF_MAP_TYPE_ARRAY );
45+ __type (key , int );
46+ __type (value , struct syscall );
47+ __uint (max_entries , 512 );
48+ } syscalls SEC (".maps" );
3649
3750/*
3851 * What to augment at entry?
3952 *
4053 * Pointer arg payloads (filenames, etc) passed from userspace to the kernel
4154 */
42- bpf_map (syscalls_sys_enter , PROG_ARRAY , u32 , u32 , 512 );
55+ struct syscalls_sys_enter {
56+ __uint (type , BPF_MAP_TYPE_PROG_ARRAY );
57+ __type (key , __u32 );
58+ __type (value , __u32 );
59+ __uint (max_entries , 512 );
60+ } syscalls_sys_enter SEC (".maps" );
4361
4462/*
4563 * What to augment at exit?
4664 *
4765 * Pointer arg payloads returned from the kernel (struct stat, etc) to userspace.
4866 */
49- bpf_map (syscalls_sys_exit , PROG_ARRAY , u32 , u32 , 512 );
67+ struct syscalls_sys_exit {
68+ __uint (type , BPF_MAP_TYPE_PROG_ARRAY );
69+ __type (key , __u32 );
70+ __type (value , __u32 );
71+ __uint (max_entries , 512 );
72+ } syscalls_sys_exit SEC (".maps" );
5073
5174struct syscall_enter_args {
5275 unsigned long long common_tp_fields ;
@@ -66,7 +89,38 @@ struct augmented_arg {
6689 char value [PATH_MAX ];
6790};
6891
69- pid_filter (pids_filtered );
92+ struct pids_filtered {
93+ __uint (type , BPF_MAP_TYPE_HASH );
94+ __type (key , pid_t );
95+ __type (value , bool );
96+ __uint (max_entries , 64 );
97+ } pids_filtered SEC (".maps" );
98+
99+ /*
100+ * Desired design of maximum size and alignment (see RFC2553)
101+ */
102+ #define SS_MAXSIZE 128 /* Implementation specific max size */
103+
104+ typedef unsigned short sa_family_t ;
105+
106+ /*
107+ * FIXME: Should come from system headers
108+ *
109+ * The definition uses anonymous union and struct in order to control the
110+ * default alignment.
111+ */
112+ struct sockaddr_storage {
113+ union {
114+ struct {
115+ sa_family_t ss_family ; /* address family */
116+ /* Following field(s) are implementation specific */
117+ char __data [SS_MAXSIZE - sizeof (unsigned short )];
118+ /* space to achieve desired size, */
119+ /* _SS_MAXSIZE value minus size of ss_family */
120+ };
121+ void * __align ; /* implementation specific desired alignment */
122+ };
123+ };
70124
71125struct augmented_args_payload {
72126 struct syscall_enter_args args ;
@@ -79,7 +133,12 @@ struct augmented_args_payload {
79133};
80134
81135// We need more tmp space than the BPF stack can give us
82- bpf_map (augmented_args_tmp , PERCPU_ARRAY , int , struct augmented_args_payload , 1 );
136+ struct augmented_args_tmp {
137+ __uint (type , BPF_MAP_TYPE_PERCPU_ARRAY );
138+ __type (key , int );
139+ __type (value , struct augmented_args_payload );
140+ __uint (max_entries , 1 );
141+ } augmented_args_tmp SEC (".maps" );
83142
84143static inline struct augmented_args_payload * augmented_args_payload (void )
85144{
@@ -90,14 +149,14 @@ static inline struct augmented_args_payload *augmented_args_payload(void)
90149static inline int augmented__output (void * ctx , struct augmented_args_payload * args , int len )
91150{
92151 /* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */
93- return perf_event_output (ctx , & __augmented_syscalls__ , BPF_F_CURRENT_CPU , args , len );
152+ return bpf_perf_event_output (ctx , & __augmented_syscalls__ , BPF_F_CURRENT_CPU , args , len );
94153}
95154
96155static inline
97156unsigned int augmented_arg__read_str (struct augmented_arg * augmented_arg , const void * arg , unsigned int arg_len )
98157{
99158 unsigned int augmented_len = sizeof (* augmented_arg );
100- int string_len = probe_read_str (& augmented_arg -> value , arg_len , arg );
159+ int string_len = bpf_probe_read_str (& augmented_arg -> value , arg_len , arg );
101160
102161 augmented_arg -> size = augmented_arg -> err = 0 ;
103162 /*
@@ -146,7 +205,7 @@ int sys_enter_connect(struct syscall_enter_args *args)
146205 if (socklen > sizeof (augmented_args -> saddr ))
147206 socklen = sizeof (augmented_args -> saddr );
148207
149- probe_read (& augmented_args -> saddr , socklen , sockaddr_arg );
208+ bpf_probe_read (& augmented_args -> saddr , socklen , sockaddr_arg );
150209
151210 return augmented__output (args , augmented_args , len + socklen );
152211}
@@ -165,7 +224,7 @@ int sys_enter_sendto(struct syscall_enter_args *args)
165224 if (socklen > sizeof (augmented_args -> saddr ))
166225 socklen = sizeof (augmented_args -> saddr );
167226
168- probe_read (& augmented_args -> saddr , socklen , sockaddr_arg );
227+ bpf_probe_read (& augmented_args -> saddr , socklen , sockaddr_arg );
169228
170229 return augmented__output (args , augmented_args , len + socklen );
171230}
@@ -234,6 +293,16 @@ int sys_enter_renameat(struct syscall_enter_args *args)
234293 return augmented__output (args , augmented_args , len );
235294}
236295
296+ static pid_t getpid (void )
297+ {
298+ return bpf_get_current_pid_tgid ();
299+ }
300+
301+ static bool pid_filter__has (struct pids_filtered * pids , pid_t pid )
302+ {
303+ return bpf_map_lookup_elem (pids , & pid ) != NULL ;
304+ }
305+
237306SEC ("raw_syscalls:sys_enter" )
238307int sys_enter (struct syscall_enter_args * args )
239308{
@@ -257,7 +326,7 @@ int sys_enter(struct syscall_enter_args *args)
257326 if (augmented_args == NULL )
258327 return 1 ;
259328
260- probe_read (& augmented_args -> args , sizeof (augmented_args -> args ), args );
329+ bpf_probe_read (& augmented_args -> args , sizeof (augmented_args -> args ), args );
261330
262331 /*
263332 * Jump to syscall specific augmenter, even if the default one,
@@ -278,7 +347,7 @@ int sys_exit(struct syscall_exit_args *args)
278347 if (pid_filter__has (& pids_filtered , getpid ()))
279348 return 0 ;
280349
281- probe_read (& exit_args , sizeof (exit_args ), args );
350+ bpf_probe_read (& exit_args , sizeof (exit_args ), args );
282351 /*
283352 * Jump to syscall specific return augmenter, even if the default one,
284353 * "!raw_syscalls:unaugmented" that will just return 1 to return the
@@ -291,4 +360,4 @@ int sys_exit(struct syscall_exit_args *args)
291360 return 0 ;
292361}
293362
294- license ( GPL ) ;
363+ char _license [] SEC ( "license" ) = "GPL" ;
0 commit comments