diff --git a/examples/execve2.py b/examples/execve2.py index 94e87a8..f70d628 100644 --- a/examples/execve2.py +++ b/examples/execve2.py @@ -1,6 +1,6 @@ from pythonbpf.decorators import bpf, section from ctypes import c_void_p, c_int64, c_int32 - +from pythonbpf.helpers import bpf_ktime_get_ns @bpf @section("tracepoint/syscalls/sys_enter_execve") @@ -11,8 +11,9 @@ def hello(ctx: c_void_p) -> c_int32: @bpf @section("tracepoint/syscalls/sys_exit_execve") -def hello_again(ctx: c_void_p) -> c_int32: +def hello_again(ctx: c_void_p) -> c_int64: print("exited") - return c_int32(0) + ts = bpf_ktime_get_ns() + return c_int64(0) LICENSE = "GPL" diff --git a/pythonbpf/bpf_helper_handler.py b/pythonbpf/bpf_helper_handler.py index d8358da..0efe5b6 100644 --- a/pythonbpf/bpf_helper_handler.py +++ b/pythonbpf/bpf_helper_handler.py @@ -1,6 +1,9 @@ import ast from llvmlite import ir +def bpf_ktime_get_ns_emitter(call, module, builder, func): + pass + def bpf_printk_emitter(call, module, builder, func): if not hasattr(func, "_fmt_counter"): func._fmt_counter = 0 diff --git a/pythonbpf/functions_pass.py b/pythonbpf/functions_pass.py index 9c579f2..2f7e976 100644 --- a/pythonbpf/functions_pass.py +++ b/pythonbpf/functions_pass.py @@ -1,7 +1,7 @@ from llvmlite import ir import ast -from .bpf_helper_handler import bpf_printk_emitter +from .bpf_helper_handler import bpf_printk_emitter, bpf_ktime_get_ns_emitter from .type_deducer import ctypes_to_ir def get_probe_string(func_node): @@ -29,6 +29,8 @@ def process_func_body(module, builder, func_node, func, ret_type): call = stmt.value if isinstance(call.func, ast.Name) and call.func.id == "print": bpf_printk_emitter(call, module, builder, func) + if isinstance(call.func, ast.Name) and call.func.id == "bpf_ktime_get_ns": + bpf_ktime_get_ns_emitter(call, module, builder, func) elif isinstance(stmt, ast.Return): if stmt.value is None: builder.ret(ir.Constant(ir.IntType(32), 0)) diff --git a/pythonbpf/helpers.py b/pythonbpf/helpers.py new file mode 100644 index 0000000..ddefe9e --- /dev/null +++ b/pythonbpf/helpers.py @@ -0,0 +1,2 @@ +def bpf_ktime_get_ns(): + return bpf_ktime_get_ns()