event_output.c 3.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119
  1. /* instructions used to output a skb based software event, produced
  2. * from code snippet:
  3. * struct TMP {
  4. * uint64_t tmp;
  5. * } tt;
  6. * tt.tmp = 5;
  7. * bpf_perf_event_output(skb, &connection_tracking_event_map, 0,
  8. * &tt, sizeof(tt));
  9. * return 1;
  10. *
  11. * the bpf assembly from llvm is:
  12. * 0: b7 02 00 00 05 00 00 00 r2 = 5
  13. * 1: 7b 2a f8 ff 00 00 00 00 *(u64 *)(r10 - 8) = r2
  14. * 2: bf a4 00 00 00 00 00 00 r4 = r10
  15. * 3: 07 04 00 00 f8 ff ff ff r4 += -8
  16. * 4: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0ll
  17. * 6: b7 03 00 00 00 00 00 00 r3 = 0
  18. * 7: b7 05 00 00 08 00 00 00 r5 = 8
  19. * 8: 85 00 00 00 19 00 00 00 call 25
  20. * 9: b7 00 00 00 01 00 00 00 r0 = 1
  21. * 10: 95 00 00 00 00 00 00 00 exit
  22. *
  23. * The reason I put the code here instead of fill_helpers is that map fixup
  24. * is against the insns, instead of filled prog.
  25. */
  26. #define __PERF_EVENT_INSNS__ \
  27. BPF_MOV64_IMM(BPF_REG_2, 5), \
  28. BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8), \
  29. BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), \
  30. BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), \
  31. BPF_LD_MAP_FD(BPF_REG_2, 0), \
  32. BPF_MOV64_IMM(BPF_REG_3, 0), \
  33. BPF_MOV64_IMM(BPF_REG_5, 8), \
  34. BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, \
  35. BPF_FUNC_perf_event_output), \
  36. BPF_MOV64_IMM(BPF_REG_0, 1), \
  37. BPF_EXIT_INSN(),
  38. {
  39. "perfevent for sockops",
  40. .insns = { __PERF_EVENT_INSNS__ },
  41. .prog_type = BPF_PROG_TYPE_SOCK_OPS,
  42. .fixup_map_event_output = { 4 },
  43. .result = ACCEPT,
  44. .retval = 1,
  45. },
  46. {
  47. "perfevent for tc",
  48. .insns = { __PERF_EVENT_INSNS__ },
  49. .prog_type = BPF_PROG_TYPE_SCHED_CLS,
  50. .fixup_map_event_output = { 4 },
  51. .result = ACCEPT,
  52. .retval = 1,
  53. },
  54. {
  55. "perfevent for lwt out",
  56. .insns = { __PERF_EVENT_INSNS__ },
  57. .prog_type = BPF_PROG_TYPE_LWT_OUT,
  58. .fixup_map_event_output = { 4 },
  59. .result = ACCEPT,
  60. .retval = 1,
  61. },
  62. {
  63. "perfevent for xdp",
  64. .insns = { __PERF_EVENT_INSNS__ },
  65. .prog_type = BPF_PROG_TYPE_XDP,
  66. .fixup_map_event_output = { 4 },
  67. .result = ACCEPT,
  68. .retval = 1,
  69. },
  70. {
  71. "perfevent for socket filter",
  72. .insns = { __PERF_EVENT_INSNS__ },
  73. .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
  74. .fixup_map_event_output = { 4 },
  75. .result = ACCEPT,
  76. .retval = 1,
  77. },
  78. {
  79. "perfevent for sk_skb",
  80. .insns = { __PERF_EVENT_INSNS__ },
  81. .prog_type = BPF_PROG_TYPE_SK_SKB,
  82. .fixup_map_event_output = { 4 },
  83. .result = ACCEPT,
  84. .retval = 1,
  85. },
  86. {
  87. "perfevent for cgroup skb",
  88. .insns = { __PERF_EVENT_INSNS__ },
  89. .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
  90. .fixup_map_event_output = { 4 },
  91. .result = ACCEPT,
  92. .retval = 1,
  93. },
  94. {
  95. "perfevent for cgroup dev",
  96. .insns = { __PERF_EVENT_INSNS__ },
  97. .prog_type = BPF_PROG_TYPE_CGROUP_DEVICE,
  98. .fixup_map_event_output = { 4 },
  99. .result = ACCEPT,
  100. .retval = 1,
  101. },
  102. {
  103. "perfevent for cgroup sysctl",
  104. .insns = { __PERF_EVENT_INSNS__ },
  105. .prog_type = BPF_PROG_TYPE_CGROUP_SYSCTL,
  106. .fixup_map_event_output = { 4 },
  107. .result = ACCEPT,
  108. .retval = 1,
  109. },
  110. {
  111. "perfevent for cgroup sockopt",
  112. .insns = { __PERF_EVENT_INSNS__ },
  113. .prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT,
  114. .expected_attach_type = BPF_CGROUP_SETSOCKOPT,
  115. .fixup_map_event_output = { 4 },
  116. .result = ACCEPT,
  117. .retval = 1,
  118. },