Commit b8ebce86 authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Daniel Borkmann
Browse files

libbpf: Provide CO-RE variants of PT_REGS macros 



Syscall raw tracepoints have struct pt_regs pointer as tracepoint's first
argument. After that, reading any of pt_regs fields requires bpf_probe_read(),
even for tp_btf programs. Due to that, PT_REGS_PARMx macros are not usable as
is. This patch adds CO-RE variants of those macros that use BPF_CORE_READ() to
read necessary fields. This provides relocatable architecture-agnostic pt_regs
field accesses.

Signed-off-by: default avatarAndrii Nakryiko <andriin@fb.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200313172336.1879637-4-andriin@fb.com
parent d121e1d3

tools/lib/bpf/bpf_tracing.h

+103 −0
Original line number Diff line number Diff line
@@ -50,6 +50,7 @@ 
#if defined(bpf_target_x86)



#if defined(__KERNEL__) || defined(__VMLINUX_H__)



#define PT_REGS_PARM1(x) ((x)->di)

#define PT_REGS_PARM2(x) ((x)->si)

#define PT_REGS_PARM3(x) ((x)->dx)
@@ -60,7 +61,20 @@ 
#define PT_REGS_RC(x) ((x)->ax)

#define PT_REGS_SP(x) ((x)->sp)

#define PT_REGS_IP(x) ((x)->ip)



#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), di)

#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), si)

#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), dx)

#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((x), cx)

#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), r8)

#define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), sp)

#define PT_REGS_FP_CORE(x) BPF_CORE_READ((x), bp)

#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), ax)

#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), sp)

#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), ip)



#else



#ifdef __i386__

/* i386 kernel is built with -mregparm=3 */

#define PT_REGS_PARM1(x) ((x)->eax)
@@ -73,7 +87,20 @@ 
#define PT_REGS_RC(x) ((x)->eax)

#define PT_REGS_SP(x) ((x)->esp)

#define PT_REGS_IP(x) ((x)->eip)



#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), eax)

#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), edx)

#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), ecx)

#define PT_REGS_PARM4_CORE(x) 0

#define PT_REGS_PARM5_CORE(x) 0

#define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), esp)

#define PT_REGS_FP_CORE(x) BPF_CORE_READ((x), ebp)

#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), eax)

#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), esp)

#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), eip)



#else



#define PT_REGS_PARM1(x) ((x)->rdi)

#define PT_REGS_PARM2(x) ((x)->rsi)

#define PT_REGS_PARM3(x) ((x)->rdx)
@@ -84,6 +111,18 @@ 
#define PT_REGS_RC(x) ((x)->rax)

#define PT_REGS_SP(x) ((x)->rsp)

#define PT_REGS_IP(x) ((x)->rip)



#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), rdi)

#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), rsi)

#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), rdx)

#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((x), rcx)

#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), r8)

#define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), rsp)

#define PT_REGS_FP_CORE(x) BPF_CORE_READ((x), rbp)

#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), rax)

#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), rsp)

#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), rip)



#endif

#endif
@@ -104,6 +143,17 @@ struct pt_regs; 
#define PT_REGS_SP(x) (((PT_REGS_S390 *)(x))->gprs[15])

#define PT_REGS_IP(x) (((PT_REGS_S390 *)(x))->psw.addr)



#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[2])

#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[3])

#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[4])

#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[5])

#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[6])

#define PT_REGS_RET_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), grps[14])

#define PT_REGS_FP_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[11])

#define PT_REGS_RC_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[2])

#define PT_REGS_SP_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), gprs[15])

#define PT_REGS_IP_CORE(x) BPF_CORE_READ((PT_REGS_S390 *)(x), pdw.addr)



#elif defined(bpf_target_arm)



#define PT_REGS_PARM1(x) ((x)->uregs[0])
@@ -117,6 +167,17 @@ struct pt_regs; 
#define PT_REGS_SP(x) ((x)->uregs[13])

#define PT_REGS_IP(x) ((x)->uregs[12])



#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), uregs[0])

#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), uregs[1])

#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), uregs[2])

#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((x), uregs[3])

#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), uregs[4])

#define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), uregs[14])

#define PT_REGS_FP_CORE(x) BPF_CORE_READ((x), uregs[11])

#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), uregs[0])

#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), uregs[13])

#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), uregs[12])



#elif defined(bpf_target_arm64)



/* arm64 provides struct user_pt_regs instead of struct pt_regs to userspace */
@@ -134,6 +195,17 @@ struct pt_regs; 
#define PT_REGS_SP(x) (((PT_REGS_ARM64 *)(x))->sp)

#define PT_REGS_IP(x) (((PT_REGS_ARM64 *)(x))->pc)



#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[0])

#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[1])

#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[2])

#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[3])

#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[4])

#define PT_REGS_RET_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[30])

#define PT_REGS_FP_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[29])

#define PT_REGS_RC_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), regs[0])

#define PT_REGS_SP_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), sp)

#define PT_REGS_IP_CORE(x) BPF_CORE_READ((PT_REGS_ARM64 *)(x), pc)



#elif defined(bpf_target_mips)



#define PT_REGS_PARM1(x) ((x)->regs[4])
@@ -147,6 +219,17 @@ struct pt_regs; 
#define PT_REGS_SP(x) ((x)->regs[29])

#define PT_REGS_IP(x) ((x)->cp0_epc)



#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), regs[4])

#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), regs[5])

#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), regs[6])

#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((x), regs[7])

#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), regs[8])

#define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), regs[31])

#define PT_REGS_FP_CORE(x) BPF_CORE_READ((x), regs[30])

#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), regs[1])

#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), regs[29])

#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), cp0_epc)



#elif defined(bpf_target_powerpc)



#define PT_REGS_PARM1(x) ((x)->gpr[3])
@@ -158,6 +241,15 @@ struct pt_regs; 
#define PT_REGS_SP(x) ((x)->sp)

#define PT_REGS_IP(x) ((x)->nip)



#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), gpr[3])

#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), gpr[4])

#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), gpr[5])

#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((x), gpr[6])

#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), gpr[7])

#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), gpr[3])

#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), sp)

#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), nip)



#elif defined(bpf_target_sparc)



#define PT_REGS_PARM1(x) ((x)->u_regs[UREG_I0])
@@ -169,11 +261,22 @@ struct pt_regs; 
#define PT_REGS_RC(x) ((x)->u_regs[UREG_I0])

#define PT_REGS_SP(x) ((x)->u_regs[UREG_FP])



#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I0])

#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I1])

#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I2])

#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I3])

#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I4])

#define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I7])

#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), u_regs[UREG_I0])

#define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), u_regs[UREG_FP])



/* Should this also be a bpf_target check for the sparc case? */

#if defined(__arch64__)

#define PT_REGS_IP(x) ((x)->tpc)

#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), tpc)

#else

#define PT_REGS_IP(x) ((x)->pc)

#define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), pc)

#endif



#endif

CRA Git | Maintained and supported by SUSTech CRA and CCSE