The bpf_perf_event_read_sample() helper is to get the specified sample data (by using PERF_SAMPLE_* flag in the argument) from BPF to make a decision for filtering on samples. Currently PERF_SAMPLE_IP and PERF_SAMPLE_DATA flags are supported only. Signed-off-by: Namhyung Kim <namhyung@xxxxxxxxxx> --- include/uapi/linux/bpf.h | 23 ++++++++++++++++ kernel/trace/bpf_trace.c | 49 ++++++++++++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 23 ++++++++++++++++ 3 files changed, 95 insertions(+) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 94659f6b3395..cba501de9373 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -5481,6 +5481,28 @@ union bpf_attr { * 0 on success. * * **-ENOENT** if the bpf_local_storage cannot be found. + * + * long bpf_perf_event_read_sample(struct bpf_perf_event_data *ctx, void *buf, u32 size, u64 sample_flags) + * Description + * For an eBPF program attached to a perf event, retrieve the + * sample data associated to *ctx* and store it in the buffer + * pointed by *buf* up to size *size* bytes. + * + * The *sample_flags* should contain a single value in the + * **enum perf_event_sample_format**. + * Return + * On success, number of bytes written to *buf*. On error, a + * negative value. + * + * The *buf* can be set to **NULL** to return the number of bytes + * required to store the requested sample data. + * + * **-EINVAL** if *sample_flags* is not a PERF_SAMPLE_* flag. + * + * **-ENOENT** if the associated perf event doesn't have the data. + * + * **-ENOSYS** if system doesn't support the sample data to be + * retrieved. */ #define ___BPF_FUNC_MAPPER(FN, ctx...) \ FN(unspec, 0, ##ctx) \ @@ -5695,6 +5717,7 @@ union bpf_attr { FN(user_ringbuf_drain, 209, ##ctx) \ FN(cgrp_storage_get, 210, ##ctx) \ FN(cgrp_storage_delete, 211, ##ctx) \ + FN(perf_event_read_sample, 212, ##ctx) \ /* */ /* backwards-compatibility macros for users of __BPF_FUNC_MAPPER that don't diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index ce0228c72a93..befd937afa3c 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -28,6 +28,7 @@ #include <uapi/linux/bpf.h> #include <uapi/linux/btf.h> +#include <uapi/linux/perf_event.h> #include <asm/tlb.h> @@ -1743,6 +1744,52 @@ static const struct bpf_func_proto bpf_read_branch_records_proto = { .arg4_type = ARG_ANYTHING, }; +BPF_CALL_4(bpf_perf_event_read_sample, struct bpf_perf_event_data_kern *, ctx, + void *, buf, u32, size, u64, flags) +{ + struct perf_sample_data *sd = ctx->data; + void *data; + u32 to_copy = sizeof(u64); + + /* only allow a single sample flag */ + if (!is_power_of_2(flags)) + return -EINVAL; + + /* support reading only already populated info */ + if (flags & ~sd->sample_flags) + return -ENOENT; + + switch (flags) { + case PERF_SAMPLE_IP: + data = &sd->ip; + break; + case PERF_SAMPLE_ADDR: + data = &sd->addr; + break; + default: + return -ENOSYS; + } + + if (!buf) + return to_copy; + + if (size < to_copy) + to_copy = size; + + memcpy(buf, data, to_copy); + return to_copy; +} + +static const struct bpf_func_proto bpf_perf_event_read_sample_proto = { + .func = bpf_perf_event_read_sample, + .gpl_only = true, + .ret_type = RET_INTEGER, + .arg1_type = ARG_PTR_TO_CTX, + .arg2_type = ARG_PTR_TO_MEM_OR_NULL, + .arg3_type = ARG_CONST_SIZE_OR_ZERO, + .arg4_type = ARG_ANYTHING, +}; + static const struct bpf_func_proto * pe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) { @@ -1759,6 +1806,8 @@ pe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) return &bpf_read_branch_records_proto; case BPF_FUNC_get_attach_cookie: return &bpf_get_attach_cookie_proto_pe; + case BPF_FUNC_perf_event_read_sample: + return &bpf_perf_event_read_sample_proto; default: return bpf_tracing_func_proto(func_id, prog); } diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 94659f6b3395..cba501de9373 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -5481,6 +5481,28 @@ union bpf_attr { * 0 on success. * * **-ENOENT** if the bpf_local_storage cannot be found. + * + * long bpf_perf_event_read_sample(struct bpf_perf_event_data *ctx, void *buf, u32 size, u64 sample_flags) + * Description + * For an eBPF program attached to a perf event, retrieve the + * sample data associated to *ctx* and store it in the buffer + * pointed by *buf* up to size *size* bytes. + * + * The *sample_flags* should contain a single value in the + * **enum perf_event_sample_format**. + * Return + * On success, number of bytes written to *buf*. On error, a + * negative value. + * + * The *buf* can be set to **NULL** to return the number of bytes + * required to store the requested sample data. + * + * **-EINVAL** if *sample_flags* is not a PERF_SAMPLE_* flag. + * + * **-ENOENT** if the associated perf event doesn't have the data. + * + * **-ENOSYS** if system doesn't support the sample data to be + * retrieved. */ #define ___BPF_FUNC_MAPPER(FN, ctx...) \ FN(unspec, 0, ##ctx) \ @@ -5695,6 +5717,7 @@ union bpf_attr { FN(user_ringbuf_drain, 209, ##ctx) \ FN(cgrp_storage_get, 210, ##ctx) \ FN(cgrp_storage_delete, 211, ##ctx) \ + FN(perf_event_read_sample, 212, ##ctx) \ /* */ /* backwards-compatibility macros for users of __BPF_FUNC_MAPPER that don't -- 2.38.1.273.g43a17bfeac-goog