Getting flags from clone3 systemcall using BPF_KPROBE about libbpf-bootstrap HOT 7 CLOSED

Have you looked at SEC("ksyscall") and BPF_KSYSCALL macro? See https://github.com/libbpf/libbpf-bootstrap/blob/master/examples/c/ksyscall.bpf.c for an example, maybe that will help.

from libbpf-bootstrap.

Thanks for the reply! need to update my kernel to try BPF_KSYSCALL will do that and comeback with results.

from libbpf-bootstrap.

it's purely libbpf-side thing (both SEC("ksyscall") and BPF_KSYSCALL), it's built on top of normal kprobes. So you shouldn't need upgrading.

from libbpf-bootstrap.

Hi, thanks for the notice, you are right, I do not need to upgrade.
I got it properly working now with this code, if anyone in the future needs to access something like clone_args:

SEC("ksyscall/clone3")
int BPF_KSYSCALL(clone3,struct clone_args *cl_args)
{

	__u64 pid_tgid = bpf_get_current_pid_tgid();
	__u32 pid = pid_tgid >> 32;
	__u32 tid = (__u32)pid_tgid;

    int THREAD_FLAG = 0x0010000;

	__u64 clone_flags;

	struct clone_args clone_args_new;

	bpf_probe_read_user(&clone_args_new, sizeof(clone_args_new), cl_args);


	if ((clone_args_new.flags & THREAD_FLAG)){
		bpf_printk("A thread was created using clone3\n");
	}

        return 0;
}

I followed the example from [1] and I think this is correct. Will close the issue since this seems solved.
[1]https://elixir.bootlin.com/linux/latest/source/tools/testing/selftests/bpf/progs/test_probe_user.c#L22

from libbpf-bootstrap.

Reopening this issue for a quick question is there a bpf_ksyscall equivalent for bpf_kretprobe?

from libbpf-bootstrap.

Reopening this issue for a quick question is there a bpf_ksyscall equivalent for bpf_kretprobe?

SEC("kretsyscall/<syscall>")
int BPF_KRETPROBE(name, int ret) {
   ...
}

from libbpf-bootstrap.

Thanks!

from libbpf-bootstrap.