cc: Support for __data_loc tracepoint fields
`__data_loc` fields are dynamically sized by the kernel at runtime. The field data follows the tracepoint structure entry, and needs to be extracted in a special way. The `__data_loc` field itself is a 32-bit value that consists of two 16-bit parts: the high 16 bits are the length of the data, and the low 16 bits are the offset of the data from the beginning of the tracepoint structure. From a cursory look, there are >200 tracepoints in recent kernels that have this kind of field. This patch fixes `tp_frontend_action.cc` to recognize and emit `__data_loc` fields correctly, as 32-bit opaque fields. Then, it introduces two helper macros: `TP_DATA_LOC_READ(dst, field)` reads from `args->field` by finding the right offset and length and emitting the `bpf_probe_read` required to fetch the data. This will only work with new kernels. `TP_DATA_LOC_READ_CONST(dst, field, length)` takes a user-specified length rather than finding it from `args->field`. This will work on older kernels, where the BPF verifier doesn't allow non-constant sizes to be passed to `bpf_probe_read`.
Showing
Please register or sign in to comment