Core: Let probe_read_kernel read into a scalar, from a register address

A non-char-array destination is sized from its pointee, and a 64-bit
integer source (a pt_regs field) is the address to read from, as with
(void *)ctx->si in C. Also export probe_read_kernel from pythonbpf.helper;
it had an emitter but no importable name.

Author: varun-r-mallya

pythonbpf/helper/__init__.py

@@ -11,6 +11,7 @@
     deref,
     comm,
     probe_read_str,
+    probe_read_kernel,
     random,
     probe_read,
     smp_processor_id,
@@ -78,6 +79,7 @@ def helper_call_handler(call, compilation_context, builder, func, local_sym_tab)
     "deref",
     "comm",
     "probe_read_str",
+    "probe_read_kernel",
     "random",
     "probe_read",
     "smp_processor_id",

pythonbpf/helper/bpf_helper_handler.py

@@ -651,10 +651,21 @@ def bpf_probe_read_kernel_emitter(
             f"probe_read_kernel expects 2 args (dst, src), got {len(call.args)}"
         )
 
-    # Get destination buffer (char array -> i8*)
-    dst_ptr, dst_size = get_or_create_ptr_from_arg(
+    # Destination: a char array reads its length, a scalar reads its width
+    dst = get_or_create_ptr_from_arg(
         func, compilation_context, call.args[0], builder, local_sym_tab
     )
+    if isinstance(dst, tuple):
+        dst_ptr, dst_size = dst
+    else:
+        dst_ptr = dst
+        pointee = dst_ptr.type.pointee
+        if not isinstance(pointee, ir.IntType):
+            raise ValueError(
+                f"probe_read_kernel destination must be a char array or an "
+                f"integer, got {pointee}"
+            )
+        dst_size = pointee.width // 8
 
     # Get source pointer (evaluate expression)
     src_ptr, src_type = get_ptr_from_arg(

pythonbpf/helper/helper_utils.py

@@ -341,6 +341,12 @@ def get_ptr_from_arg(arg, func, compilation_context, builder, local_sym_tab):
 
     val, val_type = result
 
+    # An address held in a 64-bit integer, such as a pt_regs register field:
+    # the C spelling is (void *)ctx->si
+    if isinstance(val.type, ir.IntType) and val.type.width == 64:
+        ptr_type = ir.PointerType(ir.IntType(8))
+        return builder.inttoptr(val, ptr_type), ptr_type
+
     if not isinstance(val_type, ir.PointerType):
         raise ValueError(f"Expected pointer type, got {val_type}")
 

pythonbpf/helper/helpers.py

@@ -27,6 +27,11 @@ def probe_read_str(dst, src):
     return ctypes.c_int64(0)
 
 
+def probe_read_kernel(dst, src):
+    """Safely read sizeof(dst) bytes from kernel memory"""
+    return ctypes.c_int64(0)
+
+
 def random():
     """get a pseudorandom u32 number"""
     return ctypes.c_int32(0)