使用 kprobe_events 过滤 sys_enter_splice 函数参数并检查文件类型

echo 'p:th1nk_test sys_enter_splice source_fd=+44(%di) target_fd=%si len=%dx flags=%cx; u32 f_mode = (u32)(&((struct file*)$si)->f_mode); u32 pipe_flag = (u32)($si+0x60); if (f_mode & 0x10000 && pipe_flag == 0x4000) { printk("f_mode is file flag and pipe flag is set\n"); }' >> /sys/kernel/debug/tracing/kprobe_events