tools/testing/selftests/bpf/test_get_stack_rawtp.c

   1 // SPDX-License-Identifier: GPL-2.0
   2
   3 #include <linux/bpf.h>
   4 #include "bpf_helpers.h"
   5
   6 /* Permit pretty deep stack traces */
   7 #define MAX_STACK_RAWTP 100
   8 struct stack_trace_t {
   9         int pid;
  10         int kern_stack_size;
  11         int user_stack_size;
  12         int user_stack_buildid_size;
  13         __u64 kern_stack[MAX_STACK_RAWTP];
  14         __u64 user_stack[MAX_STACK_RAWTP];
  15         struct bpf_stack_build_id user_stack_buildid[MAX_STACK_RAWTP];
  16 };
  17
  18 struct bpf_map_def SEC("maps") perfmap = {
  19         .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
  20         .key_size = sizeof(int),
  21         .value_size = sizeof(__u32),
  22         .max_entries = 2,
  23 };
  24
  25 struct bpf_map_def SEC("maps") stackdata_map = {
  26         .type = BPF_MAP_TYPE_PERCPU_ARRAY,
  27         .key_size = sizeof(__u32),
  28         .value_size = sizeof(struct stack_trace_t),
  29         .max_entries = 1,
  30 };
  31
  32 /* Allocate per-cpu space twice the needed. For the code below
  33  *   usize = bpf_get_stack(ctx, raw_data, max_len, BPF_F_USER_STACK);
  34  *   if (usize < 0)
  35  *     return 0;
  36  *   ksize = bpf_get_stack(ctx, raw_data + usize, max_len - usize, 0);
  37  *
  38  * If we have value_size = MAX_STACK_RAWTP * sizeof(__u64),
  39  * verifier will complain that access "raw_data + usize"
  40  * with size "max_len - usize" may be out of bound.
  41  * The maximum "raw_data + usize" is "raw_data + max_len"
  42  * and the maximum "max_len - usize" is "max_len", verifier
  43  * concludes that the maximum buffer access range is
  44  * "raw_data[0...max_len * 2 - 1]" and hence reject the program.
  45  *
  46  * Doubling the to-be-used max buffer size can fix this verifier
  47  * issue and avoid complicated C programming massaging.
  48  * This is an acceptable workaround since there is one entry here.
  49  */
  50 struct bpf_map_def SEC("maps") rawdata_map = {
  51         .type = BPF_MAP_TYPE_PERCPU_ARRAY,
  52         .key_size = sizeof(__u32),
  53         .value_size = MAX_STACK_RAWTP * sizeof(__u64) * 2,
  54         .max_entries = 1,
  55 };
  56
  57 SEC("tracepoint/raw_syscalls/sys_enter")
  58 int bpf_prog1(void *ctx)
  59 {
  60         int max_len, max_buildid_len, usize, ksize, total_size;
  61         struct stack_trace_t *data;
  62         void *raw_data;
  63         __u32 key = 0;
  64
  65         data = bpf_map_lookup_elem(&stackdata_map, &key);
  66         if (!data)
  67                 return 0;
  68
  69         max_len = MAX_STACK_RAWTP * sizeof(__u64);
  70         max_buildid_len = MAX_STACK_RAWTP * sizeof(struct bpf_stack_build_id);
  71         data->pid = bpf_get_current_pid_tgid();
  72         data->kern_stack_size = bpf_get_stack(ctx, data->kern_stack,
  73                                               max_len, 0);
  74         data->user_stack_size = bpf_get_stack(ctx, data->user_stack, max_len,
  75                                             BPF_F_USER_STACK);
  76         data->user_stack_buildid_size = bpf_get_stack(
  77                 ctx, data->user_stack_buildid, max_buildid_len,
  78                 BPF_F_USER_STACK | BPF_F_USER_BUILD_ID);
  79         bpf_perf_event_output(ctx, &perfmap, 0, data, sizeof(*data));
  80
  81         /* write both kernel and user stacks to the same buffer */
  82         raw_data = bpf_map_lookup_elem(&rawdata_map, &key);
  83         if (!raw_data)
  84                 return 0;
  85
  86         usize = bpf_get_stack(ctx, raw_data, max_len, BPF_F_USER_STACK);
  87         if (usize < 0)
  88                 return 0;
  89
  90         ksize = bpf_get_stack(ctx, raw_data + usize, max_len - usize, 0);
  91         if (ksize < 0)
  92                 return 0;
  93
  94         total_size = usize + ksize;
  95         if (total_size > 0 && total_size <= max_len)
  96                 bpf_perf_event_output(ctx, &perfmap, 0, raw_data, total_size);
  97
  98         return 0;
  99 }
 100
 101 char _license[] SEC("license") = "GPL";
 102 __u32 _version SEC("version") = 1; /* ignored by tracepoints, required by libbpf.a */