Skip to content

Commit 90164ae

Browse files
yinjipingyinjiping
committed
feat: agent - eBPF Support for the NO_FTRACE_SYSCALL scenario
1 parent d34c22c commit 90164ae

File tree

1 file changed

+110
-1
lines changed

1 file changed

+110
-1
lines changed

‎agent/src/ebpf/kernel/socket_trace.bpf.c

+110-1
Original file line numberDiff line numberDiff line change
@@ -1832,9 +1832,15 @@ static __inline void process_syscall_data_vecs(struct pt_regs *ctx, __u64 id,
18321832
* BPF syscall probe/tracepoint/kfunc function entry-points
18331833
***********************************************************/
18341834
#ifndef LINUX_VER_KFUNC
1835+
#ifdef NO_FTRACE_SYSCALL
1836+
KPROG(ksys_write) (struct pt_regs* ctx) {
1837+
int fd = (int)PT_REGS_PARM1(ctx);
1838+
char *buf = (char *)PT_REGS_PARM2(ctx);
1839+
#else
18351840
TP_SYSCALL_PROG(enter_write) (struct syscall_comm_enter_ctx * ctx) {
18361841
int fd = (int)ctx->fd;
18371842
char *buf = (char *)ctx->buf;
1843+
#endif /*NO_FTRACE_SYSCALL*/
18381844
#else
18391845
// ssize_t ksys_write(unsigned int fd, const char __user *buf, size_t count)
18401846
KFUNC_PROG(ksys_write, unsigned int fd, const char __user * buf, size_t count)
@@ -1857,9 +1863,14 @@ KFUNC_PROG(ksys_write, unsigned int fd, const char __user * buf, size_t count)
18571863
}
18581864

18591865
#ifndef LINUX_VER_KFUNC
1866+
#ifdef NO_FTRACE_SYSCALL
1867+
KRETPROG(ksys_write) (struct pt_regs* ctx) {
1868+
ssize_t bytes_count = PT_REGS_RC(ctx);
1869+
#else
18601870
// /sys/kernel/debug/tracing/events/syscalls/sys_exit_write/format
18611871
TP_SYSCALL_PROG(exit_write) (struct syscall_comm_exit_ctx * ctx) {
18621872
ssize_t bytes_count = ctx->ret;
1873+
#endif /*NO_FTRACE_SYSCALL*/
18631874
#else
18641875
KRETFUNC_PROG(ksys_write, unsigned int fd, const char __user * buf,
18651876
size_t count, ssize_t ret)
@@ -1881,10 +1892,17 @@ KRETFUNC_PROG(ksys_write, unsigned int fd, const char __user * buf,
18811892
}
18821893

18831894
#ifndef LINUX_VER_KFUNC
1895+
#ifdef NO_FTRACE_SYSCALL
1896+
// ssize_t read(int fd, void *buf, size_t count);
1897+
KPROG(ksys_read) (struct pt_regs* ctx) {
1898+
int fd = (unsigned int)PT_REGS_PARM1(ctx);
1899+
char *buf = (char *)PT_REGS_PARM2(ctx);
1900+
#else
18841901
// ssize_t read(int fd, void *buf, size_t count);
18851902
TP_SYSCALL_PROG(enter_read) (struct syscall_comm_enter_ctx * ctx) {
18861903
int fd = (int)ctx->fd;
18871904
char *buf = (char *)ctx->buf;
1905+
#endif /*NO_FTRACE_SYSCALL*/
18881906
#else
18891907
// ssize_t ksys_read(unsigned int fd, char __user *buf, size_t count)
18901908
KFUNC_PROG(ksys_read, unsigned int fd, const char __user * buf, size_t count)
@@ -1908,9 +1926,14 @@ KFUNC_PROG(ksys_read, unsigned int fd, const char __user * buf, size_t count)
19081926
}
19091927

19101928
#ifndef LINUX_VER_KFUNC
1929+
#ifdef NO_FTRACE_SYSCALL
1930+
KRETPROG(ksys_read) (struct pt_regs* ctx) {
1931+
ssize_t bytes_count = PT_REGS_RC(ctx);
1932+
#else
19111933
// /sys/kernel/debug/tracing/events/syscalls/sys_exit_read/format
19121934
TP_SYSCALL_PROG(exit_read) (struct syscall_comm_exit_ctx * ctx) {
19131935
ssize_t bytes_count = ctx->ret;
1936+
#endif /*NO_FTRACE_SYSCALL*/
19141937
#else
19151938
// ssize_t ksys_read(unsigned int fd, char __user *buf, size_t count)
19161939
KRETFUNC_PROG(ksys_read, unsigned int fd, const char __user * buf, size_t count,
@@ -1955,9 +1978,17 @@ KRETFUNC_PROG(ksys_read, unsigned int fd, const char __user * buf, size_t count,
19551978
* types of system calls, we need to save this information beforehand.
19561979
*/
19571980
#ifndef LINUX_VER_KFUNC
1981+
#ifdef NO_FTRACE_SYSCALL
1982+
// ssize_t sendto(int sockfd, const void *buf, size_t len, int flags,
1983+
// const struct sockaddr *dest_addr, socklen_t addrlen);
1984+
KPROG(__sys_sendto) (struct pt_regs* ctx) {
1985+
int sockfd = (int)PT_REGS_PARM1(ctx);
1986+
char *buf = (char *)PT_REGS_PARM2(ctx);
1987+
#else
19581988
TP_SYSCALL_PROG(enter_sendto) (struct syscall_comm_enter_ctx * ctx) {
19591989
int sockfd = (int)ctx->fd;
19601990
char *buf = (char *)ctx->buf;
1991+
#endif /*NO_FTRACE_SYSCALL*/
19611992
#else
19621993
//int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags,
19631994
// struct sockaddr __user *addr, int addr_len)
@@ -2015,9 +2046,14 @@ KFUNC_PROG(__sys_sendto, int fd, void __user * buff, size_t len,
20152046
}
20162047

20172048
#ifndef LINUX_VER_KFUNC
2049+
#ifdef NO_FTRACE_SYSCALL
2050+
KRETPROG(__sys_sendto) (struct pt_regs* ctx) {
2051+
ssize_t bytes_count = PT_REGS_RC(ctx);
2052+
#else
20182053
// /sys/kernel/debug/tracing/events/syscalls/sys_exit_sendto/format
20192054
TP_SYSCALL_PROG(exit_sendto) (struct syscall_comm_exit_ctx * ctx) {
20202055
ssize_t bytes_count = ctx->ret;
2056+
#endif /*NO_FTRACE_SYSCALL*/
20212057
#else
20222058
KRETFUNC_PROG(__sys_sendto, int fd, void __user * buff, size_t len,
20232059
unsigned int flags, struct sockaddr __user * u_addr, int addr_len,
@@ -2039,6 +2075,18 @@ KRETFUNC_PROG(__sys_sendto, int fd, void __user * buff, size_t len,
20392075
}
20402076

20412077
#ifndef LINUX_VER_KFUNC
2078+
#ifdef NO_FTRACE_SYSCALL
2079+
// ssize_t recvfrom(int sockfd, void *buf, size_t len, int flags,
2080+
// struct sockaddr *src_addr, socklen_t *addrlen);
2081+
KPROG(__sys_recvfrom) (struct pt_regs* ctx) {
2082+
int sockfd = (int)PT_REGS_PARM1(ctx);
2083+
char *buf = (char *)PT_REGS_PARM2(ctx);
2084+
int flags = (int)PT_REGS_PARM4(ctx);
2085+
// If flags contains MSG_PEEK, it is returned directly.
2086+
// ref : https://linux.die.net/man/2/recvfrom
2087+
if (flags & MSG_PEEK)
2088+
return 0;
2089+
#else
20422090
// ssize_t recvfrom(int sockfd, void *buf, size_t len, int flags,
20432091
// struct sockaddr *src_addr, socklen_t *addrlen);
20442092
TP_SYSCALL_PROG(enter_recvfrom) (struct syscall_comm_enter_ctx * ctx) {
@@ -2048,6 +2096,7 @@ TP_SYSCALL_PROG(enter_recvfrom) (struct syscall_comm_enter_ctx * ctx) {
20482096
return 0;
20492097
int sockfd = (int)ctx->fd;
20502098
char *buf = (char *)ctx->buf;
2099+
#endif /*NO_FTRACE_SYSCALL*/
20512100
#else
20522101
//int __sys_recvfrom(int fd, void __user *ubuf, size_t size, unsigned int flags,
20532102
// struct sockaddr __user *addr, int __user *addr_len)
@@ -2078,9 +2127,15 @@ KFUNC_PROG(__sys_recvfrom, int fd, void __user * ubuf, size_t size,
20782127
}
20792128

20802129
#ifndef LINUX_VER_KFUNC
2130+
#ifdef NO_FTRACE_SYSCALL
2131+
// /sys/kernel/debug/tracing/events/syscalls/sys_exit_recvfrom/format
2132+
KRETPROG(__sys_recvfrom) (struct pt_regs* ctx) {
2133+
ssize_t bytes_count = PT_REGS_RC(ctx);
2134+
#else
20812135
// /sys/kernel/debug/tracing/events/syscalls/sys_exit_recvfrom/format
20822136
TP_SYSCALL_PROG(exit_recvfrom) (struct syscall_comm_exit_ctx * ctx) {
20832137
ssize_t bytes_count = ctx->ret;
2138+
#endif /*NO_FTRACE_SYSCALL*/
20842139
#else
20852140
KRETFUNC_PROG(__sys_recvfrom, int fd, void __user * ubuf, size_t size,
20862141
unsigned int flags, struct sockaddr __user * addr,
@@ -2142,9 +2197,14 @@ KFUNC_PROG(__sys_sendmsg, int fd, struct user_msghdr __user * msg,
21422197
}
21432198

21442199
#ifndef LINUX_VER_KFUNC
2200+
#ifdef NO_FTRACE_SYSCALL
2201+
KRETPROG(__sys_sendmsg) (struct pt_regs* ctx) {
2202+
ssize_t bytes_count = PT_REGS_RC(ctx);
2203+
#else
21452204
// /sys/kernel/debug/tracing/events/syscalls/sys_exit_sendmsg/format
21462205
TP_SYSCALL_PROG(exit_sendmsg) (struct syscall_comm_exit_ctx * ctx) {
21472206
ssize_t bytes_count = ctx->ret;
2207+
#endif /*NO_FTRACE_SYSCALL*/
21482208
#else
21492209
KRETFUNC_PROG(__sys_sendmsg, int sockfd, const struct msghdr * msg, int flags,
21502210
bool forbid_cmsg_compat, long ret)
@@ -2206,9 +2266,14 @@ KFUNC_PROG(__sys_sendmmsg, int fd, struct mmsghdr __user * mmsg,
22062266
}
22072267

22082268
#ifndef LINUX_VER_KFUNC
2269+
#ifdef NO_FTRACE_SYSCALL
2270+
KRETPROG(__sys_sendmmsg)(struct pt_regs* ctx) {
2271+
int num_msgs = PT_REGS_RC(ctx);
2272+
#else
22092273
// /sys/kernel/debug/tracing/events/syscalls/sys_exit_sendmmsg/format
22102274
TP_SYSCALL_PROG(exit_sendmmsg) (struct syscall_comm_exit_ctx * ctx) {
22112275
int num_msgs = ctx->ret;
2276+
#endif /* NO_FTRACE_SYSCALL */
22122277
#else
22132278
KRETFUNC_PROG(__sys_sendmmsg, int fd, struct mmsghdr __user * mmsg,
22142279
unsigned int vlen, unsigned int flags, bool forbid_cmsg_compat,
@@ -2276,9 +2341,14 @@ KFUNC_PROG(__sys_recvmsg, int fd, struct user_msghdr __user * msg,
22762341
}
22772342

22782343
#ifndef LINUX_VER_KFUNC
2344+
#ifdef NO_FTRACE_SYSCALL
2345+
KRETPROG(__sys_recvmsg) (struct pt_regs* ctx) {
2346+
ssize_t bytes_count = PT_REGS_RC(ctx);
2347+
#else
22792348
// /sys/kernel/debug/tracing/events/syscalls/sys_exit_recvmsg/format
22802349
TP_SYSCALL_PROG(exit_recvmsg) (struct syscall_comm_exit_ctx * ctx) {
22812350
ssize_t bytes_count = ctx->ret;
2351+
#endif /* NO_FTRACE_SYSCALL */
22822352
#else
22832353
KRETFUNC_PROG(__sys_recvmsg, int fd, struct user_msghdr __user * msg,
22842354
unsigned int flags, bool forbid_cmsg_compat, long ret)
@@ -2357,9 +2427,14 @@ KFUNC_PROG(__sys_recvmmsg, int fd, struct mmsghdr __user * mmsg,
23572427
}
23582428

23592429
#ifndef LINUX_VER_KFUNC
2430+
#ifdef NO_FTRACE_SYSCALL
2431+
KRETPROG(__sys_recvmmsg) (struct pt_regs* ctx) {
2432+
int num_msgs = PT_REGS_RC(ctx);
2433+
#else
23602434
// /sys/kernel/debug/tracing/events/syscalls/sys_exit_recvmmsg/format
23612435
TP_SYSCALL_PROG(exit_recvmmsg) (struct syscall_comm_exit_ctx * ctx) {
23622436
int num_msgs = ctx->ret;
2437+
#endif /* NO_FTRACE_SYSCALL */
23632438
#else
23642439
KRETFUNC_PROG(__sys_recvmmsg, int fd, struct mmsghdr __user * mmsg,
23652440
unsigned int vlen, unsigned int flags,
@@ -2421,9 +2496,14 @@ KFUNC_PROG(do_writev, unsigned long fd, const struct iovec __user * vec,
24212496
}
24222497

24232498
#ifndef LINUX_VER_KFUNC
2499+
#ifdef NO_FTRACE_SYSCALL
2500+
KRETPROG(do_writev) (struct pt_regs* ctx) {
2501+
ssize_t bytes_count = PT_REGS_RC(ctx);
2502+
#else
24242503
// /sys/kernel/debug/tracing/events/syscalls/sys_exit_writev/format
24252504
TP_SYSCALL_PROG(exit_writev) (struct syscall_comm_exit_ctx * ctx) {
24262505
ssize_t bytes_count = ctx->ret;
2506+
#endif /* NO_FTRACE_SYSCALL */
24272507
#else
24282508
KRETFUNC_PROG(do_writev, unsigned long fd, const struct iovec __user * vec,
24292509
unsigned long vlen, rwf_t flags, ssize_t ret)
@@ -2481,9 +2561,14 @@ KFUNC_PROG(do_readv, unsigned long fd, const struct iovec __user * vec,
24812561
}
24822562

24832563
#ifndef LINUX_VER_KFUNC
2564+
#ifdef NO_FTRACE_SYSCALL
2565+
KRETPROG(do_readv) (struct pt_regs* ctx) {
2566+
ssize_t bytes_count = PT_REGS_RC(ctx);
2567+
#else
24842568
// /sys/kernel/debug/tracing/events/syscalls/sys_exit_readv/format
24852569
TP_SYSCALL_PROG(exit_readv) (struct syscall_comm_exit_ctx * ctx) {
24862570
ssize_t bytes_count = ctx->ret;
2571+
#endif /* NO_FTRACE_SYSCALL */
24872572
#else
24882573
KRETFUNC_PROG(do_readv, unsigned long fd, const struct iovec __user * vec,
24892574
unsigned long vlen, rwf_t flags, ssize_t ret)
@@ -2557,9 +2642,14 @@ static __inline void __push_close_event(__u64 pid_tgid, __u64 uid, __u64 seq,
25572642
}
25582643

25592644
#ifndef LINUX_VER_KFUNC
2645+
#ifdef NO_FTRACE_SYSCALL
2646+
KPROG(__close_fd) (struct pt_regs* ctx) {
2647+
int fd = (int)PT_REGS_PARM2(ctx);
2648+
#else
25602649
// /sys/kernel/debug/tracing/events/syscalls/sys_enter_close/format
25612650
TP_SYSCALL_PROG(enter_close) (struct syscall_comm_enter_ctx * ctx) {
25622651
int fd = ctx->fd;
2652+
#endif /* NO_FTRACE_SYSCALL */
25632653
#else
25642654
#if defined(__x86_64__)
25652655
//asmlinkage long __x64_sys_close(const struct pt_regs *regs) {
@@ -2605,8 +2695,13 @@ KFUNC_PROG(__arm64_sys_close, const struct pt_regs *regs)
26052695
//int __sys_socket(int family, int type, int protocol)
26062696
// /sys/kernel/debug/tracing/events/syscalls/sys_exit_socket/format
26072697
#ifndef LINUX_VER_KFUNC
2698+
#ifdef NO_FTRACE_SYSCALL
2699+
KRETPROG(__sys_socket) (struct pt_regs* ctx) {
2700+
__u64 fd = (__u64)PT_REGS_RC(ctx);
2701+
#else
26082702
TP_SYSCALL_PROG(exit_socket) (struct syscall_comm_exit_ctx * ctx) {
26092703
__u64 fd = (__u64) ctx->ret;
2704+
#endif /* NO_FTRACE_SYSCALL */
26102705
#else
26112706
KRETFUNC_PROG(__sys_socket, int family, int type, int protocol, int ret)
26122707
{
@@ -2655,8 +2750,13 @@ KRETFUNC_PROG(__sys_socket, int family, int type, int protocol, int ret)
26552750
* `kfunc` type should directly use `__sys_accept4()`.
26562751
*/
26572752
#ifndef LINUX_VER_KFUNC
2753+
#ifdef NO_FTRACE_SYSCALL
2754+
KRETPROG(__sys_accept4) (struct pt_regs* ctx) {
2755+
int sockfd = PT_REGS_RC(ctx);
2756+
#else
26582757
TP_SYSCALL_PROG(exit_accept) (struct syscall_comm_exit_ctx * ctx) {
26592758
int sockfd = ctx->ret;
2759+
#endif /* NO_FTRACE_SYSCALL */
26602760
#else
26612761
//int __sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
26622762
// int __user *upeer_addrlen, int flags)
@@ -2673,7 +2773,7 @@ KRETFUNC_PROG(__sys_accept4, int fd, struct sockaddr __user * upeer_sockaddr,
26732773
return 0;
26742774
}
26752775

2676-
#ifndef LINUX_VER_KFUNC
2776+
#if !defined(LINUX_VER_KFUNC) && !defined(NO_FTRACE_SYSCALL)
26772777
TP_SYSCALL_PROG(exit_accept4) (struct syscall_comm_exit_ctx * ctx) {
26782778
int sockfd = ctx->ret;
26792779
__u64 pid_tgid = bpf_get_current_pid_tgid();
@@ -2686,8 +2786,13 @@ TP_SYSCALL_PROG(exit_accept4) (struct syscall_comm_exit_ctx * ctx) {
26862786
#endif
26872787

26882788
#ifndef LINUX_VER_KFUNC
2789+
#ifdef NO_FTRACE_SYSCALL
2790+
KPROG(__sys_connect) (struct pt_regs* ctx) {
2791+
int sockfd = (int)PT_REGS_PARM1(ctx);
2792+
#else
26892793
TP_SYSCALL_PROG(enter_connect) (struct syscall_comm_enter_ctx * ctx) {
26902794
int sockfd = ctx->fd;
2795+
#endif /* NO_FTRACE_SYSCALL */
26912796
#else
26922797
// int __sys_connect(int fd, struct sockaddr __user *uservaddr, int addrlen)
26932798
KFUNC_PROG(__sys_connect, int fd, struct sockaddr __user * uservaddr,
@@ -3394,7 +3499,11 @@ static __inline int push_socket_data(struct syscall_comm_enter_ctx *ctx)
33943499
// /sys/kernel/debug/tracing/events/syscalls/sys_enter_getppid
33953500
// Here, the tracepoint is used to periodically send the data residing in the cache but not
33963501
// yet transmitted to the user-level receiving program for processing.
3502+
#ifdef NO_FTRACE_SYSCALL
3503+
KPROG(sys_getppid) (struct pt_regs* ctx) {
3504+
#else
33973505
TP_SYSCALL_PROG(enter_getppid) (struct syscall_comm_enter_ctx * ctx) {
3506+
#endif /* NO_FTRACE_SYSCALL */
33983507
// Only pre-specified Pid is allowed to trigger.
33993508
if (!check_pid_validity())
34003509
return 0;

0 commit comments

Comments
 (0)