4 * Copyright (C) 2015 He Kuang <hekuang@huawei.com>
5 * Copyright (C) 2015 Wang Nan <wangnan0@huawei.com>
6 * Copyright (C) 2015 Huawei Inc.
9 #include <bpf/libbpf.h>
12 #include "bpf-loader.h"
13 #include "bpf-prologue.h"
14 #include "probe-finder.h"
15 #include <dwarf-regs.h>
16 #include <linux/filter.h>
18 #define BPF_REG_SIZE 8
20 #define JMP_TO_ERROR_CODE -1
21 #define JMP_TO_SUCCESS_CODE -2
22 #define JMP_TO_USER_CODE -3
25 struct bpf_insn
*begin
;
31 pos_get_cnt(struct bpf_insn_pos
*pos
)
33 return pos
->pos
- pos
->begin
;
37 append_insn(struct bpf_insn new_insn
, struct bpf_insn_pos
*pos
)
40 return -BPF_LOADER_ERRNO__PROLOGUE2BIG
;
42 if (pos
->pos
+ 1 >= pos
->end
) {
43 pr_err("bpf prologue: prologue too long\n");
45 return -BPF_LOADER_ERRNO__PROLOGUE2BIG
;
48 *(pos
->pos
)++ = new_insn
;
53 check_pos(struct bpf_insn_pos
*pos
)
55 if (!pos
->pos
|| pos
->pos
>= pos
->end
)
56 return -BPF_LOADER_ERRNO__PROLOGUE2BIG
;
60 /* Give it a shorter name */
61 #define ins(i, p) append_insn((i), (p))
64 * Give a register name (in 'reg'), generate instruction to
65 * load register into an eBPF register rd:
66 * 'ldd target_reg, offset(ctx_reg)', where:
67 * ctx_reg is pre initialized to pointer of 'struct pt_regs'.
70 gen_ldx_reg_from_ctx(struct bpf_insn_pos
*pos
, int ctx_reg
,
71 const char *reg
, int target_reg
)
73 int offset
= regs_query_register_offset(reg
);
76 pr_err("bpf: prologue: failed to get register %s\n",
80 ins(BPF_LDX_MEM(BPF_DW
, target_reg
, ctx_reg
, offset
), pos
);
82 return check_pos(pos
);
86 * Generate a BPF_FUNC_probe_read function call.
88 * src_base_addr_reg is a register holding base address,
89 * dst_addr_reg is a register holding dest address (on stack),
92 * *[dst_addr_reg] = *([src_base_addr_reg] + offset)
94 * Arguments of BPF_FUNC_probe_read:
95 * ARG1: ptr to stack (dest)
97 * ARG3: unsafe ptr (src)
100 gen_read_mem(struct bpf_insn_pos
*pos
,
101 int src_base_addr_reg
,
105 /* mov arg3, src_base_addr_reg */
106 if (src_base_addr_reg
!= BPF_REG_ARG3
)
107 ins(BPF_MOV64_REG(BPF_REG_ARG3
, src_base_addr_reg
), pos
);
108 /* add arg3, #offset */
110 ins(BPF_ALU64_IMM(BPF_ADD
, BPF_REG_ARG3
, offset
), pos
);
112 /* mov arg2, #reg_size */
113 ins(BPF_ALU64_IMM(BPF_MOV
, BPF_REG_ARG2
, BPF_REG_SIZE
), pos
);
115 /* mov arg1, dst_addr_reg */
116 if (dst_addr_reg
!= BPF_REG_ARG1
)
117 ins(BPF_MOV64_REG(BPF_REG_ARG1
, dst_addr_reg
), pos
);
119 /* Call probe_read */
120 ins(BPF_EMIT_CALL(BPF_FUNC_probe_read
), pos
);
122 * Error processing: if read fail, goto error code,
123 * will be relocated. Target should be the start of
124 * error processing code.
126 ins(BPF_JMP_IMM(BPF_JNE
, BPF_REG_0
, 0, JMP_TO_ERROR_CODE
),
129 return check_pos(pos
);
133 * Each arg should be bare register. Fetch and save them into argument
134 * registers (r3 - r5).
136 * BPF_REG_1 should have been initialized with pointer to
140 gen_prologue_fastpath(struct bpf_insn_pos
*pos
,
141 struct probe_trace_arg
*args
, int nargs
)
145 for (i
= 0; i
< nargs
; i
++) {
146 err
= gen_ldx_reg_from_ctx(pos
, BPF_REG_1
, args
[i
].value
,
147 BPF_PROLOGUE_START_ARG_REG
+ i
);
152 return check_pos(pos
);
159 * At least one argument has the form of 'offset($rx)'.
161 * Following code first stores them into stack, then loads all of then
163 * Before final loading, the final result should be:
166 * BPF_REG_FP - 24 ARG3
167 * BPF_REG_FP - 16 ARG2
168 * BPF_REG_FP - 8 ARG1
172 * For each argument (described as: offn(...off2(off1(reg)))),
173 * generates following code:
176 * r7 <- r7 - stack_offset // Ideal code should initialize r7 using
177 * // fp before generating args. However,
178 * // eBPF won't regard r7 as stack pointer
179 * // if it is generated by minus 8 from
180 * // another stack pointer except fp.
181 * // This is why we have to set r7
182 * // to fp for each variable.
183 * r3 <- value of 'reg'-> generated using gen_ldx_reg_from_ctx()
184 * (r7) <- r3 // skip following instructions for bare reg
185 * r3 <- r3 + off1 . // skip if off1 == 0
187 * r1 <- r7 |-> generated by gen_read_mem()
191 * r3 <- r3 + off2 . // skip if off2 == 0
192 * r2 <- 8 \ // r2 may be broken by probe_read, so set again
193 * r1 <- r7 |-> generated by gen_read_mem()
199 gen_prologue_slowpath(struct bpf_insn_pos
*pos
,
200 struct probe_trace_arg
*args
, int nargs
)
204 for (i
= 0; i
< nargs
; i
++) {
205 struct probe_trace_arg
*arg
= &args
[i
];
206 const char *reg
= arg
->value
;
207 struct probe_trace_arg_ref
*ref
= NULL
;
208 int stack_offset
= (i
+ 1) * -8;
210 pr_debug("prologue: fetch arg %d, base reg is %s\n",
213 /* value of base register is stored into ARG3 */
214 err
= gen_ldx_reg_from_ctx(pos
, BPF_REG_CTX
, reg
,
217 pr_err("prologue: failed to get offset of register %s\n",
222 /* Make r7 the stack pointer. */
223 ins(BPF_MOV64_REG(BPF_REG_7
, BPF_REG_FP
), pos
);
225 ins(BPF_ALU64_IMM(BPF_ADD
, BPF_REG_7
, stack_offset
), pos
);
227 * Store r3 (base register) onto stack
228 * Ensure fp[offset] is set.
229 * fp is the only valid base register when storing
230 * into stack. We are not allowed to use r7 as base
233 ins(BPF_STX_MEM(BPF_DW
, BPF_REG_FP
, BPF_REG_ARG3
,
238 pr_debug("prologue: arg %d: offset %ld\n",
240 err
= gen_read_mem(pos
, BPF_REG_3
, BPF_REG_7
,
243 pr_err("prologue: failed to generate probe_read function call\n");
249 * Load previous result into ARG3. Use
250 * BPF_REG_FP instead of r7 because verifier
251 * allows FP based addressing only.
254 ins(BPF_LDX_MEM(BPF_DW
, BPF_REG_ARG3
,
255 BPF_REG_FP
, stack_offset
), pos
);
259 /* Final pass: read to registers */
260 for (i
= 0; i
< nargs
; i
++)
261 ins(BPF_LDX_MEM(BPF_DW
, BPF_PROLOGUE_START_ARG_REG
+ i
,
262 BPF_REG_FP
, -BPF_REG_SIZE
* (i
+ 1)), pos
);
264 ins(BPF_JMP_IMM(BPF_JA
, BPF_REG_0
, 0, JMP_TO_SUCCESS_CODE
), pos
);
266 return check_pos(pos
);
272 prologue_relocate(struct bpf_insn_pos
*pos
, struct bpf_insn
*error_code
,
273 struct bpf_insn
*success_code
, struct bpf_insn
*user_code
)
275 struct bpf_insn
*insn
;
278 return -BPF_LOADER_ERRNO__PROLOGUE2BIG
;
280 for (insn
= pos
->begin
; insn
< pos
->pos
; insn
++) {
281 struct bpf_insn
*target
;
282 u8
class = BPF_CLASS(insn
->code
);
285 if (class != BPF_JMP
)
287 opcode
= BPF_OP(insn
->code
);
288 if (opcode
== BPF_CALL
)
292 case JMP_TO_ERROR_CODE
:
295 case JMP_TO_SUCCESS_CODE
:
296 target
= success_code
;
298 case JMP_TO_USER_CODE
:
302 pr_err("bpf prologue: internal error: relocation failed\n");
303 return -BPF_LOADER_ERRNO__PROLOGUE
;
306 insn
->off
= target
- (insn
+ 1);
311 int bpf__gen_prologue(struct probe_trace_arg
*args
, int nargs
,
312 struct bpf_insn
*new_prog
, size_t *new_cnt
,
315 struct bpf_insn
*success_code
= NULL
;
316 struct bpf_insn
*error_code
= NULL
;
317 struct bpf_insn
*user_code
= NULL
;
318 struct bpf_insn_pos pos
;
319 bool fastpath
= true;
322 if (!new_prog
|| !new_cnt
)
325 if (cnt_space
> BPF_MAXINSNS
)
326 cnt_space
= BPF_MAXINSNS
;
328 pos
.begin
= new_prog
;
329 pos
.end
= new_prog
+ cnt_space
;
333 ins(BPF_ALU64_IMM(BPF_MOV
, BPF_PROLOGUE_FETCH_RESULT_REG
, 0),
339 *new_cnt
= pos_get_cnt(&pos
);
343 if (nargs
> BPF_PROLOGUE_MAX_ARGS
) {
344 pr_warning("bpf: prologue: %d arguments are dropped\n",
345 nargs
- BPF_PROLOGUE_MAX_ARGS
);
346 nargs
= BPF_PROLOGUE_MAX_ARGS
;
349 /* First pass: validation */
350 for (i
= 0; i
< nargs
; i
++) {
351 struct probe_trace_arg_ref
*ref
= args
[i
].ref
;
353 if (args
[i
].value
[0] == '@') {
354 /* TODO: fetch global variable */
355 pr_err("bpf: prologue: global %s%+ld not support\n",
356 args
[i
].value
, ref
? ref
->offset
: 0);
361 /* fastpath is true if all args has ref == NULL */
365 * Instruction encodes immediate value using
366 * s32, ref->offset is long. On systems which
367 * can't fill long in s32, refuse to process if
368 * ref->offset too large (or small).
371 #define OFFSET_MAX ((1LL << 31) - 1)
372 #define OFFSET_MIN ((1LL << 31) * -1)
373 if (ref
->offset
> OFFSET_MAX
||
374 ref
->offset
< OFFSET_MIN
) {
375 pr_err("bpf: prologue: offset out of bound: %ld\n",
377 return -BPF_LOADER_ERRNO__PROLOGUEOOB
;
383 pr_debug("prologue: pass validation\n");
386 /* If all variables are registers... */
387 pr_debug("prologue: fast path\n");
388 err
= gen_prologue_fastpath(&pos
, args
, nargs
);
392 pr_debug("prologue: slow path\n");
394 /* Initialization: move ctx to a callee saved register. */
395 ins(BPF_MOV64_REG(BPF_REG_CTX
, BPF_REG_ARG1
), &pos
);
397 err
= gen_prologue_slowpath(&pos
, args
, nargs
);
401 * start of ERROR_CODE (only slow pass needs error code)
402 * mov r2 <- 1 // r2 is error number
403 * mov r3 <- 0 // r3, r4... should be touched or
404 * // verifier would complain
409 error_code
= pos
.pos
;
410 ins(BPF_ALU64_IMM(BPF_MOV
, BPF_PROLOGUE_FETCH_RESULT_REG
, 1),
413 for (i
= 0; i
< nargs
; i
++)
414 ins(BPF_ALU64_IMM(BPF_MOV
,
415 BPF_PROLOGUE_START_ARG_REG
+ i
,
418 ins(BPF_JMP_IMM(BPF_JA
, BPF_REG_0
, 0, JMP_TO_USER_CODE
),
423 * start of SUCCESS_CODE:
425 * goto usercode // skip
427 success_code
= pos
.pos
;
428 ins(BPF_ALU64_IMM(BPF_MOV
, BPF_PROLOGUE_FETCH_RESULT_REG
, 0), &pos
);
431 * start of USER_CODE:
437 * Only slow path needs restoring of ctx. In fast path,
438 * register are loaded directly from r1.
440 ins(BPF_MOV64_REG(BPF_REG_ARG1
, BPF_REG_CTX
), &pos
);
441 err
= prologue_relocate(&pos
, error_code
, success_code
,
447 err
= check_pos(&pos
);
451 *new_cnt
= pos_get_cnt(&pos
);