path: root/kernel/trace
diff options
authorDaniel Borkmann <>2016-04-18 21:01:24 +0200
committerDavid S. Miller <>2016-04-19 20:26:11 -0400
commitbd570ff970a54df653b48ed0cfb373f2ebed083d (patch)
tree85e4ed3aa2bb859cf770247735eb9e7d9a909cb7 /kernel/trace
parent1e33759c788c78f31d4d6f65bac647b23624734c (diff)
bpf: add event output helper for notifications/sampling/logging
This patch adds a new helper for cls/act programs that can push events to user space applications. For networking, this can be f.e. for sampling, debugging, logging purposes or pushing of arbitrary wake-up events. The idea is similar to a43eec304259 ("bpf: introduce bpf_perf_event_output() helper") and 39111695b1b8 ("samples: bpf: add bpf_perf_event_output example"). The eBPF program utilizes a perf event array map that user space populates with fds from perf_event_open(), the eBPF program calls into the helper f.e. as skb_event_output(skb, &my_map, BPF_F_CURRENT_CPU, raw, sizeof(raw)) so that the raw data is pushed into the fd f.e. at the map index of the current CPU. User space can poll/mmap/etc on this and has a data channel for receiving events that can be post-processed. The nice thing is that since the eBPF program and user space application making use of it are tightly coupled, they can define their own arbitrary raw data format and what/when they want to push. While f.e. packet headers could be one part of the meta data that is being pushed, this is not a substitute for things like packet sockets as whole packet is not being pushed and push is only done in a single direction. Intention is more of a generically usable, efficient event pipe to applications. Workflow is that tc can pin the map and applications can attach themselves e.g. after cls/act setup to one or multiple map slots, demuxing is done by the eBPF program. Adding this facility is with minimal effort, it reuses the helper introduced in a43eec304259 ("bpf: introduce bpf_perf_event_output() helper") and we get its functionality for free by overloading its BPF_FUNC_ identifier for cls/act programs, ctx is currently unused, but will be made use of in future. Example will be added to iproute2's BPF example files. Signed-off-by: Daniel Borkmann <> Signed-off-by: Alexei Starovoitov <> Signed-off-by: David S. Miller <>
Diffstat (limited to 'kernel/trace')
1 files changed, 27 insertions, 0 deletions
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index b3cc24cb4321..780bcbe1d4de 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -277,6 +277,33 @@ static const struct bpf_func_proto bpf_perf_event_output_proto = {
.arg5_type = ARG_CONST_STACK_SIZE,
+static DEFINE_PER_CPU(struct pt_regs, bpf_pt_regs);
+static u64 bpf_event_output(u64 r1, u64 r2, u64 flags, u64 r4, u64 size)
+ struct pt_regs *regs = this_cpu_ptr(&bpf_pt_regs);
+ perf_fetch_caller_regs(regs);
+ return bpf_perf_event_output((long)regs, r2, flags, r4, size);
+static const struct bpf_func_proto bpf_event_output_proto = {
+ .func = bpf_event_output,
+ .gpl_only = true,
+ .ret_type = RET_INTEGER,
+ .arg1_type = ARG_PTR_TO_CTX,
+ .arg2_type = ARG_CONST_MAP_PTR,
+ .arg3_type = ARG_ANYTHING,
+ .arg4_type = ARG_PTR_TO_STACK,
+ .arg5_type = ARG_CONST_STACK_SIZE,
+const struct bpf_func_proto *bpf_get_event_output_proto(void)
+ return &bpf_event_output_proto;
static const struct bpf_func_proto *tracing_func_proto(enum bpf_func_id func_id)
switch (func_id) {