diff --git a/Makefile.am b/Makefile.am index 354da2a3..c22f872a 100644 --- a/Makefile.am +++ b/Makefile.am @@ -96,6 +96,7 @@ strace_SOURCES = \ bjm.c \ block.c \ bpf.c \ + bpf_attr.h \ bpf_filter.c \ bpf_filter.h \ bpf_fprog.h \ diff --git a/bpf.c b/bpf.c index ecb38d23..0a12f342 100644 --- a/bpf.c +++ b/bpf.c @@ -33,6 +33,8 @@ # include #endif +#include "bpf_attr.h" + #include "xlat/bpf_commands.h" #include "xlat/bpf_map_types.h" #include "xlat/bpf_map_flags.h" @@ -50,8 +52,23 @@ bpf_cmd_decoder(struct tcb *const tcp, \ void *const data) \ /* End of DECL_BPF_CMD_DECODER definition. */ -#define DEF_BPF_CMD_DECODER(bpf_cmd) \ - static DECL_BPF_CMD_DECODER(decode_ ## bpf_cmd) +#define BEGIN_BPF_CMD_DECODER(bpf_cmd) \ + static DECL_BPF_CMD_DECODER(decode_ ## bpf_cmd) \ + { \ + struct bpf_cmd ## _struct attr = {}; \ + const size_t attr_size = bpf_cmd ## _struct_size; \ + const unsigned int len = MIN(size, attr_size); \ + memcpy(&attr, data, len); \ + do { \ +/* End of BEGIN_BPF_CMD_DECODER definition. */ + +#define END_BPF_CMD_DECODER(rval) \ + decode_attr_extra_data(tcp, data, size, attr_size); \ + } while (0); \ + tprints("}"); \ + return (rval); \ + } \ +/* End of END_BPF_CMD_DECODER definition. */ #define BPF_CMD_ENTRY(bpf_cmd) \ [bpf_cmd] = decode_ ## bpf_cmd @@ -89,16 +106,8 @@ decode_attr_extra_data(struct tcb *const tcp, return 0; } -DEF_BPF_CMD_DECODER(BPF_MAP_CREATE) +BEGIN_BPF_CMD_DECODER(BPF_MAP_CREATE) { - struct { - uint32_t map_type, key_size, value_size, max_entries, - map_flags, inner_map_fd, numa_node; - } attr = {}; - const unsigned int len = size < sizeof(attr) ? size : sizeof(attr); - - memcpy(&attr, data, len); - PRINT_FIELD_XVAL("{", attr, map_type, bpf_map_types, "BPF_MAP_TYPE_???"); PRINT_FIELD_U(", ", attr, key_size); @@ -108,106 +117,44 @@ DEF_BPF_CMD_DECODER(BPF_MAP_CREATE) PRINT_FIELD_FD(", ", attr, inner_map_fd, tcp); if (attr.map_flags & BPF_F_NUMA_NODE) PRINT_FIELD_U(", ", attr, numa_node); - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - tprints("}"); - - return RVAL_DECODED | RVAL_FD; } +END_BPF_CMD_DECODER(RVAL_DECODED | RVAL_FD) -DEF_BPF_CMD_DECODER(BPF_MAP_LOOKUP_ELEM) +BEGIN_BPF_CMD_DECODER(BPF_MAP_LOOKUP_ELEM) { - struct bpf_io_elem_struct { - uint32_t map_fd; - uint64_t ATTRIBUTE_ALIGNED(8) key, value; - } attr = {}; - - const unsigned int len = size < sizeof(attr) ? size : sizeof(attr); - - memcpy(&attr, data, len); - PRINT_FIELD_FD("{", attr, map_fd, tcp); PRINT_FIELD_X(", ", attr, key); PRINT_FIELD_X(", ", attr, value); - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - tprints("}"); - - return RVAL_DECODED; } +END_BPF_CMD_DECODER(RVAL_DECODED) -DEF_BPF_CMD_DECODER(BPF_MAP_UPDATE_ELEM) +BEGIN_BPF_CMD_DECODER(BPF_MAP_UPDATE_ELEM) { - struct { - uint32_t map_fd; - uint64_t ATTRIBUTE_ALIGNED(8) key; - uint64_t ATTRIBUTE_ALIGNED(8) value; - uint64_t flags; - } attr = {}; - const unsigned int len = size < sizeof(attr) ? size : sizeof(attr); - - memcpy(&attr, data, len); - PRINT_FIELD_FD("{", attr, map_fd, tcp); PRINT_FIELD_X(", ", attr, key); PRINT_FIELD_X(", ", attr, value); PRINT_FIELD_XVAL(", ", attr, flags, bpf_map_update_elem_flags, "BPF_???"); - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - tprints("}"); - - return RVAL_DECODED; } +END_BPF_CMD_DECODER(RVAL_DECODED) -DEF_BPF_CMD_DECODER(BPF_MAP_DELETE_ELEM) +BEGIN_BPF_CMD_DECODER(BPF_MAP_DELETE_ELEM) { - struct { - uint32_t map_fd; - uint64_t ATTRIBUTE_ALIGNED(8) key; - } attr = {}; - const unsigned int len = size < sizeof(attr) ? size : sizeof(attr); - - memcpy(&attr, data, len); - PRINT_FIELD_FD("{", attr, map_fd, tcp); PRINT_FIELD_X(", ", attr, key); - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - tprints("}"); - - return RVAL_DECODED; } +END_BPF_CMD_DECODER(RVAL_DECODED) -DEF_BPF_CMD_DECODER(BPF_MAP_GET_NEXT_KEY) +BEGIN_BPF_CMD_DECODER(BPF_MAP_GET_NEXT_KEY) { - struct bpf_io_elem_struct { - uint32_t map_fd; - uint64_t ATTRIBUTE_ALIGNED(8) key, next_key; - } attr = {}; - - const unsigned int len = size < sizeof(attr) ? size : sizeof(attr); - - memcpy(&attr, data, len); - PRINT_FIELD_FD("{", attr, map_fd, tcp); PRINT_FIELD_X(", ", attr, key); PRINT_FIELD_X(", ", attr, next_key); - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - tprints("}"); - - return RVAL_DECODED; } +END_BPF_CMD_DECODER(RVAL_DECODED) -DEF_BPF_CMD_DECODER(BPF_PROG_LOAD) +BEGIN_BPF_CMD_DECODER(BPF_PROG_LOAD) { - struct bpf_prog_load { - uint32_t prog_type, insn_cnt; - uint64_t ATTRIBUTE_ALIGNED(8) insns, license; - uint32_t log_level, log_size; - uint64_t ATTRIBUTE_ALIGNED(8) log_buf; - uint32_t kern_version, prog_flags; - } attr = {}; - const unsigned int len = MIN(size, sizeof(attr)); - - memcpy(&attr, data, len); - PRINT_FIELD_XVAL("{", attr, prog_type, bpf_prog_types, "BPF_PROG_TYPE_???"); PRINT_FIELD_U(", ", attr, insn_cnt); @@ -215,103 +162,55 @@ DEF_BPF_CMD_DECODER(BPF_PROG_LOAD) PRINT_FIELD_STR(", ", attr, license, tcp); /* log_* fields were added in Linux commit v3.18-rc1~52^2~1^2~4. */ - if (len <= offsetof(struct bpf_prog_load, log_level)) - goto bpf_prog_load_end; + if (len <= offsetof(struct BPF_PROG_LOAD_struct, log_level)) + break; PRINT_FIELD_U(", ", attr, log_level); PRINT_FIELD_U(", ", attr, log_size); PRINT_FIELD_X(", ", attr, log_buf); /* kern_version field was added in Linux commit v4.1-rc1~84^2~50. */ - if (len <= offsetof(struct bpf_prog_load, kern_version)) - goto bpf_prog_load_end; + if (len <= offsetof(struct BPF_PROG_LOAD_struct, kern_version)) + break; tprintf(", kern_version=KERNEL_VERSION(%u, %u, %u)", attr.kern_version >> 16, (attr.kern_version >> 8) & 0xFF, attr.kern_version & 0xFF); /* prog_flags field was added in Linux commit v4.12-rc2~34^2~29^2~2. */ - if (len <= offsetof(struct bpf_prog_load, prog_flags)) - goto bpf_prog_load_end; + if (len <= offsetof(struct BPF_PROG_LOAD_struct, prog_flags)) + break; PRINT_FIELD_FLAGS(", ", attr, prog_flags, bpf_prog_flags, "BPF_F_???"); - - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - -bpf_prog_load_end: - tprints("}"); - - return RVAL_DECODED | RVAL_FD; } +END_BPF_CMD_DECODER(RVAL_DECODED | RVAL_FD) -DEF_BPF_CMD_DECODER(BPF_OBJ_PIN) +BEGIN_BPF_CMD_DECODER(BPF_OBJ_PIN) { - struct bpf_obj { - uint64_t ATTRIBUTE_ALIGNED(8) pathname; - uint32_t bpf_fd; - } attr = {}; - const size_t attr_size = - offsetofend(struct bpf_obj, bpf_fd); - const unsigned int len = size < attr_size ? size : attr_size; - - memcpy(&attr, data, len); - PRINT_FIELD_PATH("{", attr, pathname, tcp); PRINT_FIELD_FD(", ", attr, bpf_fd, tcp); - decode_attr_extra_data(tcp, data, size, attr_size); - tprints("}"); - - return RVAL_DECODED | RVAL_FD; } +END_BPF_CMD_DECODER(RVAL_DECODED | RVAL_FD) #define decode_BPF_OBJ_GET decode_BPF_OBJ_PIN -DEF_BPF_CMD_DECODER(BPF_PROG_ATTACH) +BEGIN_BPF_CMD_DECODER(BPF_PROG_ATTACH) { - struct { - uint32_t target_fd, attach_bpf_fd, attach_type, attach_flags; - } attr = {}; - const unsigned int len = size < sizeof(attr) ? size : sizeof(attr); - - memcpy(&attr, data, len); - PRINT_FIELD_FD("{", attr, target_fd, tcp); PRINT_FIELD_FD(", ", attr, attach_bpf_fd, tcp); PRINT_FIELD_XVAL(", ", attr, attach_type, bpf_attach_type, "BPF_???"); PRINT_FIELD_FLAGS(", ", attr, attach_flags, bpf_attach_flags, "BPF_F_???"); - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - tprints("}"); - - return RVAL_DECODED; } +END_BPF_CMD_DECODER(RVAL_DECODED) -DEF_BPF_CMD_DECODER(BPF_PROG_DETACH) +BEGIN_BPF_CMD_DECODER(BPF_PROG_DETACH) { - struct { - uint32_t target_fd, dummy, attach_type; - } attr = {}; - const unsigned int len = size < sizeof(attr) ? size : sizeof(attr); - - memcpy(&attr, data, len); - PRINT_FIELD_FD("{", attr, target_fd, tcp); PRINT_FIELD_XVAL(", ", attr, attach_type, bpf_attach_type, "BPF_???"); - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - tprints("}"); - - return RVAL_DECODED; } +END_BPF_CMD_DECODER(RVAL_DECODED) -DEF_BPF_CMD_DECODER(BPF_PROG_TEST_RUN) +BEGIN_BPF_CMD_DECODER(BPF_PROG_TEST_RUN) { - struct { - uint32_t prog_fd, retval, data_size_in, data_size_out; - uint64_t ATTRIBUTE_ALIGNED(8) data_in, data_out; - uint32_t repeat, duration; - } attr = {}; - const unsigned int len = size < sizeof(attr) ? size : sizeof(attr); - - memcpy(&attr, data, len); - PRINT_FIELD_FD("{test={", attr, prog_fd, tcp); PRINT_FIELD_U(", ", attr, retval); PRINT_FIELD_U(", ", attr, data_size_in); @@ -321,84 +220,40 @@ DEF_BPF_CMD_DECODER(BPF_PROG_TEST_RUN) PRINT_FIELD_U(", ", attr, repeat); PRINT_FIELD_U(", ", attr, duration); tprints("}"); - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - tprints("}"); - - return RVAL_DECODED; } +END_BPF_CMD_DECODER(RVAL_DECODED) -DEF_BPF_CMD_DECODER(BPF_PROG_GET_NEXT_ID) +BEGIN_BPF_CMD_DECODER(BPF_PROG_GET_NEXT_ID) { - struct { - uint32_t start_id, next_id; - } attr = {}; - const unsigned int len = size < sizeof(attr) ? size : sizeof(attr); - - memcpy(&attr, data, len); - PRINT_FIELD_U("{", attr, start_id); PRINT_FIELD_U(", ", attr, next_id); - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - tprints("}"); - - return RVAL_DECODED; } +END_BPF_CMD_DECODER(RVAL_DECODED) #define decode_BPF_MAP_GET_NEXT_ID decode_BPF_PROG_GET_NEXT_ID -DEF_BPF_CMD_DECODER(BPF_PROG_GET_FD_BY_ID) +BEGIN_BPF_CMD_DECODER(BPF_PROG_GET_FD_BY_ID) { - struct { - uint32_t prog_id, next_id; - } attr = {}; - const unsigned int len = size < sizeof(attr) ? size : sizeof(attr); - - memcpy(&attr, data, len); - PRINT_FIELD_U("{", attr, prog_id); PRINT_FIELD_U(", ", attr, next_id); - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - tprints("}"); - - return RVAL_DECODED; } +END_BPF_CMD_DECODER(RVAL_DECODED) -DEF_BPF_CMD_DECODER(BPF_MAP_GET_FD_BY_ID) +BEGIN_BPF_CMD_DECODER(BPF_MAP_GET_FD_BY_ID) { - struct { - uint32_t map_id, next_id; - } attr = {}; - const unsigned int len = size < sizeof(attr) ? size : sizeof(attr); - - memcpy(&attr, data, len); - PRINT_FIELD_U("{", attr, map_id); PRINT_FIELD_U(", ", attr, next_id); - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - tprints("}"); - - return RVAL_DECODED; } +END_BPF_CMD_DECODER(RVAL_DECODED) -DEF_BPF_CMD_DECODER(BPF_OBJ_GET_INFO_BY_FD) +BEGIN_BPF_CMD_DECODER(BPF_OBJ_GET_INFO_BY_FD) { - struct { - uint32_t bpf_fd, info_len; - uint64_t ATTRIBUTE_ALIGNED(8) info; - } attr = {}; - const unsigned int len = size < sizeof(attr) ? size : sizeof(attr); - - memcpy(&attr, data, len); - PRINT_FIELD_FD("{info={", attr, bpf_fd, tcp); PRINT_FIELD_U(", ", attr, info_len); PRINT_FIELD_X(", ", attr, info); tprints("}"); - decode_attr_extra_data(tcp, data, size, sizeof(attr)); - tprints("}"); - - return RVAL_DECODED | RVAL_FD; } +END_BPF_CMD_DECODER(RVAL_DECODED | RVAL_FD) SYS_FUNC(bpf) { diff --git a/bpf_attr.h b/bpf_attr.h new file mode 100644 index 00000000..8ecd6a3a --- /dev/null +++ b/bpf_attr.h @@ -0,0 +1,175 @@ +/* + * Copyright (c) 2015-2018 Dmitry V. Levin + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. The name of the author may not be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef STRACE_BPF_ATTR_H +#define STRACE_BPF_ATTR_H + +struct BPF_MAP_CREATE_struct { + uint32_t map_type; + uint32_t key_size; + uint32_t value_size; + uint32_t max_entries; + uint32_t map_flags; + uint32_t inner_map_fd; + uint32_t numa_node; +}; + +#define BPF_MAP_CREATE_struct_size \ + sizeof(struct BPF_MAP_CREATE_struct) + +struct BPF_MAP_LOOKUP_ELEM_struct { + uint32_t map_fd; + uint64_t ATTRIBUTE_ALIGNED(8) key; + uint64_t ATTRIBUTE_ALIGNED(8) value; +}; + +#define BPF_MAP_LOOKUP_ELEM_struct_size \ + sizeof(struct BPF_MAP_LOOKUP_ELEM_struct) + +struct BPF_MAP_UPDATE_ELEM_struct { + uint32_t map_fd; + uint64_t ATTRIBUTE_ALIGNED(8) key; + uint64_t ATTRIBUTE_ALIGNED(8) value; + uint64_t flags; +}; + +#define BPF_MAP_UPDATE_ELEM_struct_size \ + sizeof(struct BPF_MAP_UPDATE_ELEM_struct) + +struct BPF_MAP_DELETE_ELEM_struct { + uint32_t map_fd; + uint64_t ATTRIBUTE_ALIGNED(8) key; +}; + +#define BPF_MAP_DELETE_ELEM_struct_size \ + sizeof(struct BPF_MAP_DELETE_ELEM_struct) + +struct BPF_MAP_GET_NEXT_KEY_struct { + uint32_t map_fd; + uint64_t ATTRIBUTE_ALIGNED(8) key; + uint64_t ATTRIBUTE_ALIGNED(8) next_key; +}; + +#define BPF_MAP_GET_NEXT_KEY_struct_size \ + sizeof(struct BPF_MAP_GET_NEXT_KEY_struct) + +struct BPF_PROG_LOAD_struct { + uint32_t prog_type; + uint32_t insn_cnt; + uint64_t ATTRIBUTE_ALIGNED(8) insns; + uint64_t ATTRIBUTE_ALIGNED(8) license; + uint32_t log_level; + uint32_t log_size; + uint64_t ATTRIBUTE_ALIGNED(8) log_buf; + uint32_t kern_version; + uint32_t prog_flags; +}; + +#define BPF_PROG_LOAD_struct_size \ + sizeof(struct BPF_PROG_LOAD_struct) + +struct BPF_OBJ_PIN_struct { + uint64_t ATTRIBUTE_ALIGNED(8) pathname; + uint32_t bpf_fd; +}; + +#define BPF_OBJ_PIN_struct_size \ + offsetofend(struct BPF_OBJ_PIN_struct, bpf_fd) + +#define BPF_OBJ_GET_struct BPF_OBJ_PIN_struct +#define BPF_OBJ_GET_struct_size BPF_OBJ_PIN_struct_size + +struct BPF_PROG_ATTACH_struct { + uint32_t target_fd; + uint32_t attach_bpf_fd; + uint32_t attach_type; + uint32_t attach_flags; +}; + +#define BPF_PROG_ATTACH_struct_size \ + sizeof(struct BPF_PROG_ATTACH_struct) + +struct BPF_PROG_DETACH_struct { + uint32_t target_fd; + uint32_t dummy; + uint32_t attach_type; +}; + +#define BPF_PROG_DETACH_struct_size \ + sizeof(struct BPF_PROG_DETACH_struct) + +struct BPF_PROG_TEST_RUN_struct /* test */ { + uint32_t prog_fd; + uint32_t retval; + uint32_t data_size_in; + uint32_t data_size_out; + uint64_t ATTRIBUTE_ALIGNED(8) data_in; + uint64_t ATTRIBUTE_ALIGNED(8) data_out; + uint32_t repeat; + uint32_t duration; +}; + +#define BPF_PROG_TEST_RUN_struct_size \ + sizeof(struct BPF_PROG_TEST_RUN_struct) + +struct BPF_PROG_GET_NEXT_ID_struct { + uint32_t start_id; + uint32_t next_id; +}; + +#define BPF_PROG_GET_NEXT_ID_struct_size \ + sizeof(struct BPF_PROG_GET_NEXT_ID_struct) + +#define BPF_MAP_GET_NEXT_ID_struct BPF_PROG_GET_NEXT_ID_struct +#define BPF_MAP_GET_NEXT_ID_struct_size BPF_PROG_GET_NEXT_ID_struct_size + +struct BPF_PROG_GET_FD_BY_ID_struct { + uint32_t prog_id; + uint32_t next_id; +}; + +#define BPF_PROG_GET_FD_BY_ID_struct_size \ + sizeof(struct BPF_PROG_GET_FD_BY_ID_struct) + +struct BPF_MAP_GET_FD_BY_ID_struct { + uint32_t map_id; + uint32_t next_id; +}; + +#define BPF_MAP_GET_FD_BY_ID_struct_size \ + sizeof(struct BPF_MAP_GET_FD_BY_ID_struct) + +struct BPF_OBJ_GET_INFO_BY_FD_struct /* info */ { + uint32_t bpf_fd; + uint32_t info_len; + uint64_t ATTRIBUTE_ALIGNED(8) info; +}; + +#define BPF_OBJ_GET_INFO_BY_FD_struct_size \ + sizeof(struct BPF_OBJ_GET_INFO_BY_FD_struct) + +#endif /* !STRACE_BPF_ATTR_H */