Error digging out d_name from struct file about bcc

[drzaeus77]

Not doing it wrong...this is a limitation of the currently implemented BCC rewriter. It only supports one level of variable dereference via bpf_probe_read (up to fpath.dentry).

Try the following:

#include <linux/fs.h>

void run_read(struct pt_regs *ctx, struct file *file)
{
    struct dentry *dent = file->f_path.dentry;
    if (file != NULL && dent != NULL) {
        struct qstr d_name = {};
        bpf_probe_read(&d_name, sizeof(d_name), &dent->d_name);
        bpf_trace_printk("read %s\n", d_name.name);
    } else {
        bpf_trace_printk("was null");
    }
}

Let's leave this issue open, I consider this limitation worth fixing.

[brendangregg]

Ok, thanks.

I'm going to postpone this approach for now: walking the d_parent entries to reconstruct a pathname (or at least get the parent directory) means a lot of code and strings. I'll see what I can do with just d_iname.

[drzaeus77]

Give it a shot! :)

[brendangregg]

Wow:

# diff fsslower.old fsslower.new
81,86c81
<   struct vfsmount *mnt = file->f_path.mnt;
<   struct super_block *mnt_sb = NULL;
<   bpf_probe_read(&mnt_sb, sizeof(mnt_sb), &mnt->mnt_sb);
<   u64 s_bdev = 0;
<   bpf_probe_read(&s_bdev, sizeof(s_bdev), &mnt_sb->s_bdev);
<   if (s_bdev == 0) {
---
>   if (file->f_path.mnt->mnt_sb->s_bdev == 0) {

Thanks!

[yonghong-song]

Actually, internally rewriter generates:

#include <linux/fs.h>

// void run_read(struct pt_regs *ctx, struct file *file, struct dentry
*dentry)
attribute((section(".bpf.fn.run_read")))
void run_read(struct pt_regs *ctx, struct file *file)
{file = ctx->di;
// void *name = 0;

if (file != NULL && ({ struct dentry * _val; memset(&_val, 0,

sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)file +
offsetof(struct file, f_path.dentry)); _val; }) != NULL) {
// bpf_trace_printk("read %s\n", file->f_path.dentry->d_iname);
({ char fmt[] = "read %s\n"; bpf_trace_printk(_fmt, sizeof(_fmt),
({ const unsigned char * _val; memset(&_val, 0, sizeof(_val));
bpf_probe_read(&_val, sizeof(_val), (u64)({ struct dentry * _val;
memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val),
(u64)file + offsetof(struct file, f_path.dentry)); _val; }) +
offsetof(struct dentry, d_name.name)); _val; })); });
} else {
({ char fmt[] = "was null"; bpf_trace_printk(_fmt, sizeof(_fmt));
});
}
}

Add debug=4 to BPF constructor will show the above debug information.

Very nice work.

On Tue, Sep 15, 2015 at 4:48 PM, Brendan Gregg [email protected]
wrote:

Wow:

diff fsslower.old fsslower.new

81,86c81
< struct vfsmount *mnt = file->f_path.mnt;
< struct super_block *mnt_sb = NULL;
< bpf_probe_read(&mnt_sb, sizeof(mnt_sb), &mnt->mnt_sb);
< u64 s_bdev = 0;
< bpf_probe_read(&s_bdev, sizeof(s_bdev), &mnt_sb->s_bdev);

< if (s_bdev == 0) {

if (file->f_path.mnt->mnt_sb->s_bdev == 0) {

Thanks!

—
Reply to this email directly or view it on GitHub
#188 (comment).