@@ -34,6 +34,7 @@ class BPFHelperID(Enum):
3434 BPF_PERF_EVENT_OUTPUT = 25
3535 BPF_GET_STACK = 67
3636 BPF_PROBE_READ_KERNEL_STR = 115
37+ BPF_PROBE_READ_KERNEL = 113
3738 BPF_RINGBUF_OUTPUT = 130
3839 BPF_RINGBUF_RESERVE = 131
3940 BPF_RINGBUF_SUBMIT = 132
@@ -574,6 +575,75 @@ def bpf_probe_read_kernel_str_emitter(
574575 return result , ir .IntType (64 )
575576
576577
578+ def emit_probe_read_kernel_call (builder , dst_ptr , dst_size , src_ptr ):
579+ """Emit LLVM IR call to bpf_probe_read_kernel"""
580+
581+ fn_type = ir .FunctionType (
582+ ir .IntType (64 ),
583+ [ir .PointerType (), ir .IntType (32 ), ir .PointerType ()],
584+ var_arg = False ,
585+ )
586+ fn_ptr = builder .inttoptr (
587+ ir .Constant (ir .IntType (64 ), BPFHelperID .BPF_PROBE_READ_KERNEL .value ),
588+ ir .PointerType (fn_type ),
589+ )
590+
591+ result = builder .call (
592+ fn_ptr ,
593+ [
594+ builder .bitcast (dst_ptr , ir .PointerType ()),
595+ ir .Constant (ir .IntType (32 ), dst_size ),
596+ builder .bitcast (src_ptr , ir .PointerType ()),
597+ ],
598+ tail = False ,
599+ )
600+
601+ logger .info (f"Emitted bpf_probe_read_kernel (size={ dst_size } )" )
602+ return result
603+
604+
605+ @HelperHandlerRegistry .register (
606+ "probe_read_kernel" ,
607+ param_types = [
608+ ir .PointerType (ir .IntType (8 )),
609+ ir .PointerType (ir .IntType (8 )),
610+ ],
611+ return_type = ir .IntType (64 ),
612+ )
613+ def bpf_probe_read_kernel_emitter (
614+ call ,
615+ map_ptr ,
616+ module ,
617+ builder ,
618+ func ,
619+ local_sym_tab = None ,
620+ struct_sym_tab = None ,
621+ map_sym_tab = None ,
622+ ):
623+ """Emit LLVM IR for bpf_probe_read_kernel helper."""
624+
625+ if len (call .args ) != 2 :
626+ raise ValueError (
627+ f"probe_read_kernel expects 2 args (dst, src), got { len (call .args )} "
628+ )
629+
630+ # Get destination buffer (char array -> i8*)
631+ dst_ptr , dst_size = get_or_create_ptr_from_arg (
632+ func , module , call .args [0 ], builder , local_sym_tab , map_sym_tab , struct_sym_tab
633+ )
634+
635+ # Get source pointer (evaluate expression)
636+ src_ptr , src_type = get_ptr_from_arg (
637+ call .args [1 ], func , module , builder , local_sym_tab , map_sym_tab , struct_sym_tab
638+ )
639+
640+ # Emit the helper call
641+ result = emit_probe_read_kernel_call (builder , dst_ptr , dst_size , src_ptr )
642+
643+ logger .info (f"Emitted bpf_probe_read_kernel (size={ dst_size } )" )
644+ return result , ir .IntType (64 )
645+
646+
577647@HelperHandlerRegistry .register (
578648 "random" ,
579649 param_types = [],
0 commit comments