bpf: add bpf_get_stack helper

Currently, stackmap and bpf_get_stackid helper are provided
for bpf program to get the stack trace. This approach has
a limitation though. If two stack traces have the same hash,
only one will get stored in the stackmap table,
so some stack traces are missing from user perspective.

This patch implements a new helper, bpf_get_stack, will
send stack traces directly to bpf program. The bpf program
is able to see all stack traces, and then can do in-kernel
processing or send stack traces to user space through
shared map or bpf_perf_event_output.

Acked-by: Alexei Starovoitov <ast@fb.com>
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 67 insertions, 0 deletions

diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 04f6ec1679f0..3ba102b41512 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -402,6 +402,73 @@ const struct bpf_func_proto bpf_get_stackid_proto = {
         .arg3_type      = ARG_ANYTHING,
 };
 
+BPF_CALL_4(bpf_get_stack, struct pt_regs *, regs, void *, buf, u32, size,
+           u64, flags)
+{
+        u32 init_nr, trace_nr, copy_len, elem_size, num_elem;
+        bool user_build_id = flags & BPF_F_USER_BUILD_ID;
+        u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+        bool user = flags & BPF_F_USER_STACK;
+        struct perf_callchain_entry *trace;
+        bool kernel = !user;
+        int err = -EINVAL;
+        u64 *ips;
+
+        if (unlikely(flags & ~(BPF_F_SKIP_FIELD_MASK | BPF_F_USER_STACK |
+                               BPF_F_USER_BUILD_ID)))
+                goto clear;
+        if (kernel && user_build_id)
+                goto clear;
+
+        elem_size = (user && user_build_id) ? sizeof(struct bpf_stack_build_id)
+                                            : sizeof(u64);
+        if (unlikely(size % elem_size))
+                goto clear;
+
+        num_elem = size / elem_size;
+        if (sysctl_perf_event_max_stack < num_elem)
+                init_nr = 0;
+        else
+                init_nr = sysctl_perf_event_max_stack - num_elem;
+        trace = get_perf_callchain(regs, init_nr, kernel, user,
+                                   sysctl_perf_event_max_stack, false, false);
+        if (unlikely(!trace))
+                goto err_fault;
+
+        trace_nr = trace->nr - init_nr;
+        if (trace_nr < skip)
+                goto err_fault;
+
+        trace_nr -= skip;
+        trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem;
+        copy_len = trace_nr * elem_size;
+        ips = trace->ip + skip + init_nr;
+        if (user && user_build_id)
+                stack_map_get_build_id_offset(buf, ips, trace_nr, user);
+        else
+                memcpy(buf, ips, copy_len);
+
+        if (size > copy_len)
+                memset(buf + copy_len, 0, size - copy_len);
+        return copy_len;
+
+err_fault:
+        err = -EFAULT;
+clear:
+        memset(buf, 0, size);
+        return err;
+}
+
+const struct bpf_func_proto bpf_get_stack_proto = {
+        .func           = bpf_get_stack,
+        .gpl_only       = true,
+        .ret_type       = RET_INTEGER,
+        .arg1_type      = ARG_PTR_TO_CTX,
+        .arg2_type      = ARG_PTR_TO_UNINIT_MEM,
+        .arg3_type      = ARG_CONST_SIZE_OR_ZERO,
+        .arg4_type      = ARG_ANYTHING,
+};
+
 /* Called from eBPF program */
 static void *stack_map_lookup_elem(struct bpf_map *map, void *key)
 {