diff options
Diffstat (limited to 'internal/generate/bpfhandler.go')
| -rw-r--r-- | internal/generate/bpfhandler.go | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go index 6c9c314..50917e7 100644 --- a/internal/generate/bpfhandler.go +++ b/internal/generate/bpfhandler.go @@ -76,7 +76,7 @@ func generateExtra(tp GeneratedTracepoint, isEnter bool) string { case KindSocket: return generateExtraSocket() case KindSocketpair: - return generateExtraSocketpair() + return generateExtraSocketpair(isEnter) case KindOpen: return generateExtraOpen(f) case KindPathname: @@ -157,8 +157,11 @@ func generateExtraSocket() string { return " ev->family = (__s32)ctx->args[0];\n ev->type = (__s32)ctx->args[1];\n ev->protocol = (__s32)ctx->args[2];\n" } -func generateExtraSocketpair() string { - return " int sv[2];\n __builtin_memset(&sv, 0xff, sizeof(sv));\n if (ctx->args[3] != 0) {\n bpf_probe_read_user(&sv, sizeof(sv), (void *)ctx->args[3]);\n }\n ev->family = (__s32)ctx->args[0];\n ev->type = (__s32)ctx->args[1];\n ev->protocol = (__s32)ctx->args[2];\n ev->sv0 = (__s32)sv[0];\n ev->sv1 = (__s32)sv[1];\n" +func generateExtraSocketpair(isEnter bool) string { + if isEnter { + return " struct socketpair_ctx pending;\n pending.usockvec = ctx->args[3];\n pending.family = (__s32)ctx->args[0];\n pending.type = (__s32)ctx->args[1];\n pending.protocol = (__s32)ctx->args[2];\n bpf_map_update_elem(&socketpair_ctx_map, &tid, &pending, BPF_ANY);\n ev->family = pending.family;\n ev->type = pending.type;\n ev->protocol = pending.protocol;\n ev->sv0 = -1;\n ev->sv1 = -1;\n ev->ret = 0;\n" + } + return " __s32 family = -1;\n __s32 type = -1;\n __s32 protocol = -1;\n __s32 sv0 = -1;\n __s32 sv1 = -1;\n struct socketpair_ctx *pending = bpf_map_lookup_elem(&socketpair_ctx_map, &tid);\n if (pending) {\n family = pending->family;\n type = pending->type;\n protocol = pending->protocol;\n if (ctx->ret == 0 && pending->usockvec != 0) {\n int sv[2];\n if (bpf_probe_read_user(&sv, sizeof(sv), (void *)pending->usockvec) == 0) {\n sv0 = (__s32)sv[0];\n sv1 = (__s32)sv[1];\n }\n }\n bpf_map_delete_elem(&socketpair_ctx_map, &tid);\n }\n ev->family = family;\n ev->type = type;\n ev->protocol = protocol;\n ev->sv0 = sv0;\n ev->sv1 = sv1;\n ev->ret = ctx->ret;\n" } // eventStructName returns the C struct name for a TracepointKind. The mapping |