• Sasha Goldshtein's avatar
    cc: Support for __data_loc tracepoint fields · b9545a5c
    Sasha Goldshtein authored
    `__data_loc` fields are dynamically sized by the kernel at
    runtime. The field data follows the tracepoint structure entry,
    and needs to be extracted in a special way. The `__data_loc` field
    itself is a 32-bit value that consists of two 16-bit parts: the
    high 16 bits are the length of the data, and the low 16 bits are
    the offset of the data from the beginning of the tracepoint
    structure. From a cursory look, there are >200 tracepoints in
    recent kernels that have this kind of field.
    
    This patch fixes `tp_frontend_action.cc` to recognize and emit
    `__data_loc` fields correctly, as 32-bit opaque fields. Then, it
    introduces two helper macros:
    
    `TP_DATA_LOC_READ(dst, field)` reads from `args->field` by finding
    the right offset and length and emitting the `bpf_probe_read`
    required to fetch the data. This will only work with new kernels.
    
    `TP_DATA_LOC_READ_CONST(dst, field, length)` takes a user-specified
    length rather than finding it from `args->field`. This will work
    on older kernels, where the BPF verifier doesn't allow non-constant
    sizes to be passed to `bpf_probe_read`.
    b9545a5c
tp_frontend_action.cc 6.7 KB