How to get process full command line in BPF code.

[Songrui625]

I want to get process full command line in BPF code and follow the method mentioned in bpftrace/bpftrace#2116.

However seems like bpf_probe_read_user_str will stop reading when read NULL character('\0'). And if process cmdline contains space character, the cmdline we read in BPF code is not complete.

BPF code:

#define CMDLINE_LEN 128
...
struct task_struct *tsk;
struct mm_struct *mm;
unsigned long cmdline_len, arg_start, arg_end;
char cmdline[CMDLINE_LEN];

tsk = (struct task_struct *)bpf_get_current_task();
if (!tsk)
  return 0;

arg_start = BPF_CORE_READ(tsk, mm, arg_start);
arg_end = BPF_CORE_READ(tsk, mm, arg_end);
if (arg_start >= arg_end)
  return 0;

cmdline_len = arg_end - arg_start;

bpf_probe_read_user_str(cmdline, cmdline_len & 0x7f, (const void *)arg_start);

How to get process full command line in BPF code in a right way.