Commit Graph

10 Commits (bebe98e6706ec4c149508f8aabdd44707d1c6d73)

Author SHA1 Message Date
Johannes Edmeier 2d79f22b40 aya-bpf: use bpf_read_probe for reading pt_regs
Linux Kernels < 5.5 don't support bpf_probe_read_kernel. Therefore
bpf_probe_read must be used for compatibility reasons.
2 years ago
Dave Tucker 05c1586202 bpf: bpf_probe_read_kernel fields in pt_regs
As it turns out, the verifier gets upset if you try to read the values
directly without using bpf_probe_read.

Signed-off-by: Dave Tucker <dave@dtucker.co.uk>
2 years ago
Dave Tucker e3c8c659a1 bpf: arm fix pt_regs handling
Signed-off-by: Dave Tucker <dave@dtucker.co.uk>
2 years ago
Dave Tucker 218d4842d6 bpf: Be consistent with arm target_arch
This is `arm` in bindings but `armv7` in args.
Let's use `arm`

Signed-off-by: Dave Tucker <dave@dtucker.co.uk>
2 years ago
Dave Tucker 7f6da53c34 bpf: Fix pt_regs for aarch64 (again)
Signed-off-by: Dave Tucker <dave@dtucker.co.uk>
2 years ago
Dave Tucker 7e828df1c9 bpf: Fix aarch64 access to regs
Signed-off-by: Dave Tucker <dave@dtucker.co.uk>
2 years ago
Dave Tucker 8672ff6c56 bpf: Remove generated getters
Signed-off-by: Dave Tucker <dave@dtucker.co.uk>
2 years ago
Dave Tucker 4acd996cb8 bpf: Add PtRegs wrapper
This adds a portable wrapper around pt_regs and user_pt_regs.
It makes writing Raw Tracepoint or KProbe programs easier when the
arguments are one of these types while also ensuring code is portable
across architectures

Signed-off-by: Dave Tucker <dave@dtucker.co.uk>
2 years ago
Michal Rostecki 54377b6140 aya-bpf: Allow to convert probe arguments to mutable pointers
Before this change, arguments fetched with `arg` from `ProbeContext`
could be only fetched as const pointers. This change allows to get mut
pointers as well.

Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
3 years ago
William Findlay 89dee1a114
aya-bpf: implement argument coercion for pt_regs and BTF programs
Implements argument and return value coercion helpers for:
    - LSM programs
    - BTF tracepoints
    - [ku]{ret}probes

Signed-off-by: William Findlay <william@williamfindlay.com>
3 years ago