Loading...
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 | /* instructions used to output a skb based software event, produced * from code snippet: * struct TMP { * uint64_t tmp; * } tt; * tt.tmp = 5; * bpf_perf_event_output(skb, &connection_tracking_event_map, 0, * &tt, sizeof(tt)); * return 1; * * the bpf assembly from llvm is: * 0: b7 02 00 00 05 00 00 00 r2 = 5 * 1: 7b 2a f8 ff 00 00 00 00 *(u64 *)(r10 - 8) = r2 * 2: bf a4 00 00 00 00 00 00 r4 = r10 * 3: 07 04 00 00 f8 ff ff ff r4 += -8 * 4: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0ll * 6: b7 03 00 00 00 00 00 00 r3 = 0 * 7: b7 05 00 00 08 00 00 00 r5 = 8 * 8: 85 00 00 00 19 00 00 00 call 25 * 9: b7 00 00 00 01 00 00 00 r0 = 1 * 10: 95 00 00 00 00 00 00 00 exit * * The reason I put the code here instead of fill_helpers is that map fixup * is against the insns, instead of filled prog. */ #define __PERF_EVENT_INSNS__ \ BPF_MOV64_IMM(BPF_REG_2, 5), \ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8), \ BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), \ BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), \ BPF_LD_MAP_FD(BPF_REG_2, 0), \ BPF_MOV64_IMM(BPF_REG_3, 0), \ BPF_MOV64_IMM(BPF_REG_5, 8), \ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, \ BPF_FUNC_perf_event_output), \ BPF_MOV64_IMM(BPF_REG_0, 1), \ BPF_EXIT_INSN(), { "perfevent for sockops", .insns = { __PERF_EVENT_INSNS__ }, .prog_type = BPF_PROG_TYPE_SOCK_OPS, .fixup_map_event_output = { 4 }, .result = ACCEPT, .retval = 1, }, { "perfevent for tc", .insns = { __PERF_EVENT_INSNS__ }, .prog_type = BPF_PROG_TYPE_SCHED_CLS, .fixup_map_event_output = { 4 }, .result = ACCEPT, .retval = 1, }, { "perfevent for lwt out", .insns = { __PERF_EVENT_INSNS__ }, .prog_type = BPF_PROG_TYPE_LWT_OUT, .fixup_map_event_output = { 4 }, .result = ACCEPT, .retval = 1, }, { "perfevent for xdp", .insns = { __PERF_EVENT_INSNS__ }, .prog_type = BPF_PROG_TYPE_XDP, .fixup_map_event_output = { 4 }, .result = ACCEPT, .retval = 1, }, { "perfevent for socket filter", .insns = { __PERF_EVENT_INSNS__ }, .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, .fixup_map_event_output = { 4 }, .result = ACCEPT, .retval = 1, }, { "perfevent for sk_skb", .insns = { __PERF_EVENT_INSNS__ }, .prog_type = BPF_PROG_TYPE_SK_SKB, .fixup_map_event_output = { 4 }, .result = ACCEPT, .retval = 1, }, { "perfevent for cgroup skb", .insns = { __PERF_EVENT_INSNS__ }, .prog_type = BPF_PROG_TYPE_CGROUP_SKB, .fixup_map_event_output = { 4 }, .result = ACCEPT, .retval = 1, }, { "perfevent for cgroup dev", .insns = { __PERF_EVENT_INSNS__ }, .prog_type = BPF_PROG_TYPE_CGROUP_DEVICE, .fixup_map_event_output = { 4 }, .result = ACCEPT, .retval = 1, }, { "perfevent for cgroup sysctl", .insns = { __PERF_EVENT_INSNS__ }, .prog_type = BPF_PROG_TYPE_CGROUP_SYSCTL, .fixup_map_event_output = { 4 }, .result = ACCEPT, .retval = 1, }, { "perfevent for cgroup sockopt", .insns = { __PERF_EVENT_INSNS__ }, .prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT, .expected_attach_type = BPF_CGROUP_SETSOCKOPT, .fixup_map_event_output = { 4 }, .result = ACCEPT, .retval = 1, }, |