Fix imports and type issues for bpf_probe_read

This commit is contained in:
Pragyansh Chaturvedi
2025-11-01 13:50:23 +05:30
parent 2257c175ed
commit ec2ea835e5
3 changed files with 30 additions and 17 deletions

View File

@ -1,7 +1,17 @@
from .helper_registry import HelperHandlerRegistry from .helper_registry import HelperHandlerRegistry
from .helper_utils import reset_scratch_pool from .helper_utils import reset_scratch_pool
from .bpf_helper_handler import handle_helper_call, emit_probe_read_kernel_str_call from .bpf_helper_handler import handle_helper_call, emit_probe_read_kernel_str_call
from .helpers import ktime, pid, deref, comm, probe_read_str, random, XDP_DROP, XDP_PASS from .helpers import (
ktime,
pid,
deref,
comm,
probe_read_str,
random,
probe_read,
XDP_DROP,
XDP_PASS,
)
# Register the helper handler with expr module # Register the helper handler with expr module
@ -66,6 +76,7 @@ __all__ = [
"comm", "comm",
"probe_read_str", "probe_read_str",
"random", "random",
"probe_read",
"XDP_DROP", "XDP_DROP",
"XDP_PASS", "XDP_PASS",
] ]

View File

@ -476,23 +476,20 @@ def bpf_probe_read_emitter(
if len(call.args) != 3: if len(call.args) != 3:
logger.warn("Expected 3 args for probe_read helper") logger.warn("Expected 3 args for probe_read helper")
return return
dst_ptr, _ = get_ptr_from_arg( dst_ptr = get_or_create_ptr_from_arg(
call.args[0], func, module, builder, local_sym_tab, map_sym_tab, struct_sym_tab func, module, call.args[0], builder, local_sym_tab, map_sym_tab, struct_sym_tab
) )
size_val = ( size_val = get_int_value_from_arg(
get_int_value_from_arg( call.args[1],
call.args[1], func,
func, module,
module, builder,
builder, local_sym_tab,
local_sym_tab, map_sym_tab,
map_sym_tab, struct_sym_tab,
struct_sym_tab,
)
& 0xFFFFFFFF
) )
src_ptr, _ = get_ptr_from_arg( src_ptr = get_or_create_ptr_from_arg(
call.args[2], func, module, builder, local_sym_tab, map_sym_tab, struct_sym_tab func, module, call.args[2], builder, local_sym_tab, map_sym_tab, struct_sym_tab
) )
fn_type = ir.FunctionType( fn_type = ir.FunctionType(
ir.IntType(64), ir.IntType(64),
@ -507,7 +504,7 @@ def bpf_probe_read_emitter(
fn_ptr, fn_ptr,
[ [
builder.bitcast(dst_ptr, ir.PointerType()), builder.bitcast(dst_ptr, ir.PointerType()),
ir.Constant(ir.IntType(32), size_val), builder.trunc(size_val, ir.IntType(32)),
builder.bitcast(src_ptr, ir.PointerType()), builder.bitcast(src_ptr, ir.PointerType()),
], ],
tail=False, tail=False,

View File

@ -32,6 +32,11 @@ def random():
return ctypes.c_int32(0) return ctypes.c_int32(0)
def probe_read(dst, size, src):
"""Safely read data from kernel memory"""
return ctypes.c_int64(0)
XDP_ABORTED = ctypes.c_int64(0) XDP_ABORTED = ctypes.c_int64(0)
XDP_DROP = ctypes.c_int64(1) XDP_DROP = ctypes.c_int64(1)
XDP_PASS = ctypes.c_int64(2) XDP_PASS = ctypes.c_int64(2)