On 9/3/21 4:00 AM, Daniel Borkmann wrote:
> On 8/28/21 7:20 AM, Dave Marchevsky wrote:
>> This helper is meant to be "bpf_trace_printk, but with proper vararg
>> support". Follow bpf_snprintf's example and take a u64 pseudo-vararg
>> array. Write to /sys/kernel/debug/tracing/trace_pipe using the same
>> mechanism as bpf_trace_printk.
>>
>> Signed-off-by: Dave Marchevsky <davemarchevsky@xxxxxx>
>
> lgtm, minor comments below:
>
>> ---
>> include/linux/bpf.h | 1 +
>> include/uapi/linux/bpf.h | 9 ++++++
>> kernel/bpf/core.c | 5 ++++
>> kernel/bpf/helpers.c | 2 ++
>> kernel/trace/bpf_trace.c | 52 +++++++++++++++++++++++++++++++++-
>> tools/include/uapi/linux/bpf.h | 9 ++++++
>> 6 files changed, 77 insertions(+), 1 deletion(-)
>>
>> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
>> index be8d57e6e78a..b6c45a6cbbba 100644
>> --- a/include/linux/bpf.h
>> +++ b/include/linux/bpf.h
>> @@ -1088,6 +1088,7 @@ bool bpf_prog_array_compatible(struct bpf_array *array, const struct bpf_prog *f
>> int bpf_prog_calc_tag(struct bpf_prog *fp);
>> const struct bpf_func_proto *bpf_get_trace_printk_proto(void);
>> +const struct bpf_func_proto *bpf_get_trace_vprintk_proto(void);
>> typedef unsigned long (*bpf_ctx_copy_t)(void *dst, const void *src,
>> unsigned long off, unsigned long len);
>> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
>> index 791f31dd0abe..f171d4d33136 100644
>> --- a/include/uapi/linux/bpf.h
>> +++ b/include/uapi/linux/bpf.h
>> @@ -4877,6 +4877,14 @@ union bpf_attr {
>> * Get the struct pt_regs associated with **task**.
>> * Return
>> * A pointer to struct pt_regs.
>> + *
>> + * u64 bpf_trace_vprintk(const char *fmt, u32 fmt_size, const void *data, u32 data_len)
>
> s/u64/long/
>
>> + * Description
>> + * Behaves like **bpf_trace_printk**\ () helper, but takes an array of u64
>
> nit: maybe for users it's more clear from description if you instead mention that data_len
> needs to be multiple of 8 bytes? Or somehow mention the relation with data more clearly
> resp. which shortcoming it addresses compared to bpf_trace_printk(), so developers can more
> easily parse it.
In a previous review pass, Andrii preferred having bpf_trace_vprintk's reference other helpers
instead of copy/pasting. So in v5 (patch 9) of this patchset I've added "multiple of 8 bytes"
to helper comments for bpf_seq_printf and bpf_snprintf. Added a sentence mentioning benefits
of vprintk over printk in v5 (patch 3).
>> + * to format. Arguments are to be used as in **bpf_seq_printf**\ () helper.
>> + * Return
>> + * The number of bytes written to the buffer, or a negative error
>> + * in case of failure.
>> */
> [...]
>> default:
>> return NULL;
>> }
>> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
>> index 10672ebc63b7..ea8358b0c748 100644
>> --- a/kernel/trace/bpf_trace.c
>> +++ b/kernel/trace/bpf_trace.c
>> @@ -398,7 +398,7 @@ static const struct bpf_func_proto bpf_trace_printk_proto = {
>> .arg2_type = ARG_CONST_SIZE,
>> };
>> -const struct bpf_func_proto *bpf_get_trace_printk_proto(void)
>> +static void __set_printk_clr_event(void)
>> {
>> /*
>> * This program might be calling bpf_trace_printk,
>> @@ -410,10 +410,58 @@ const struct bpf_func_proto *bpf_get_trace_printk_proto(void)
>> */
>> if (trace_set_clr_event("bpf_trace", "bpf_trace_printk", 1))
>> pr_warn_ratelimited("could not enable bpf_trace_printk events");
>> +}
>> +const struct bpf_func_proto *bpf_get_trace_printk_proto(void)
>> +{
>> + __set_printk_clr_event();
>> return &bpf_trace_printk_proto;
>> }
>> +BPF_CALL_4(bpf_trace_vprintk, char *, fmt, u32, fmt_size, const void *, data,
>> + u32, data_len)
>> +{
>> + static char buf[BPF_TRACE_PRINTK_SIZE];
>> + unsigned long flags;
>> + int ret, num_args;
>> + u32 *bin_args;
>> +
>> + if (data_len & 7 || data_len > MAX_BPRINTF_VARARGS * 8 ||
>> + (data_len && !data))
>> + return -EINVAL;
>> + num_args = data_len / 8;
>> +
>> + ret = bpf_bprintf_prepare(fmt, fmt_size, data, &bin_args, num_args);
>> + if (ret < 0)
>> + return ret;
>
> Given you have ARG_PTR_TO_MEM_OR_NULL for data, does this gracefully handle the
> case where you pass in fmt string containing e.g. %ps but data being NULL? From
> reading bpf_bprintf_prepare() looks like it does just fine, but might be nice
> to explicitly add a tiny selftest case for it while you're at it.
>
>> + raw_spin_lock_irqsave(&trace_printk_lock, flags);
>> + ret = bstr_printf(buf, sizeof(buf), fmt, bin_args);
>> +
>> + trace_bpf_trace_printk(buf);
>> + raw_spin_unlock_irqrestore(&trace_printk_lock, flags);
>> +
>> + bpf_bprintf_cleanup();
>> +
>> + return ret;
>> +}
>
> Thanks,
> Daniel
