• Alexei Starovoitov's avatar
    tracing, perf: Implement BPF programs attached to kprobes · 2541517c
    Alexei Starovoitov authored
    BPF programs, attached to kprobes, provide a safe way to execute
    user-defined BPF byte-code programs without being able to crash or
    hang the kernel in any way. The BPF engine makes sure that such
    programs have a finite execution time and that they cannot break
    out of their sandbox.
    
    The user interface is to attach to a kprobe via the perf syscall:
    
    	struct perf_event_attr attr = {
    		.type	= PERF_TYPE_TRACEPOINT,
    		.config	= event_id,
    		...
    	};
    
    	event_fd = perf_event_open(&attr,...);
    	ioctl(event_fd, PERF_EVENT_IOC_SET_BPF, prog_fd);
    
    'prog_fd' is a file descriptor associated with BPF program
    previously loaded.
    
    'event_id' is an ID of the kprobe created.
    
    Closing 'event_fd':
    
    	close(event_fd);
    
    ... automatically detaches BPF program from it.
    
    BPF programs can call in-kernel helper functions to:
    
      - lookup/update/delete elements in maps
    
      - probe_read - wraper of probe_kernel_read() used to access any
        kernel data structures
    
    BPF programs receive 'struct pt_regs *' as an input ('struct pt_regs' is
    architecture dependent) and return 0 to ignore the event and 1 to store
    kprobe event into the ring buffer.
    
    Note, kprobes are a fundamentally _not_ a stable kernel ABI,
    so BPF programs attached to kprobes must be recompiled for
    every kernel version and user must supply correct LINUX_VERSION_CODE
    in attr.kern_version during bpf_prog_load() call.
    Signed-off-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
    Reviewed-by: default avatarSteven Rostedt <rostedt@goodmis.org>
    Reviewed-by: default avatarMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Arnaldo Carvalho de Melo <acme@infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
    Cc: Daniel Borkmann <daniel@iogearbox.net>
    Cc: David S. Miller <davem@davemloft.net>
    Cc: Jiri Olsa <jolsa@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/1427312966-8434-4-git-send-email-ast@plumgrid.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    2541517c
trace_kprobe.c 36.4 KB