Mirror of strace – the linux syscall tracer
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

bpf.c 20KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739
  1. /*
  2. * Copyright (c) 2015-2017 Dmitry V. Levin <ldv@altlinux.org>
  3. * Copyright (c) 2017 Quentin Monnet <quentin.monnet@6wind.com>
  4. * Copyright (c) 2015-2018 The strace developers.
  5. * All rights reserved.
  6. *
  7. * SPDX-License-Identifier: LGPL-2.1-or-later
  8. */
  9. #include "defs.h"
  10. #include "print_fields.h"
  11. #ifdef HAVE_LINUX_BPF_H
  12. # include <linux/bpf.h>
  13. #endif
  14. #include <linux/filter.h>
  15. #include "bpf_attr.h"
  16. #include "xlat/bpf_commands.h"
  17. #include "xlat/bpf_file_mode_flags.h"
  18. #include "xlat/bpf_map_types.h"
  19. #include "xlat/bpf_map_flags.h"
  20. #include "xlat/bpf_prog_types.h"
  21. #include "xlat/bpf_prog_flags.h"
  22. #include "xlat/bpf_map_update_elem_flags.h"
  23. #include "xlat/bpf_attach_type.h"
  24. #include "xlat/bpf_attach_flags.h"
  25. #include "xlat/bpf_query_flags.h"
  26. #include "xlat/ebpf_regs.h"
  27. #include "xlat/numa_node.h"
  28. #define DECL_BPF_CMD_DECODER(bpf_cmd_decoder) \
  29. int \
  30. bpf_cmd_decoder(struct tcb *const tcp, \
  31. const kernel_ulong_t addr, \
  32. const unsigned int size, \
  33. void *const data) \
  34. /* End of DECL_BPF_CMD_DECODER definition. */
  35. #define BEGIN_BPF_CMD_DECODER(bpf_cmd) \
  36. static DECL_BPF_CMD_DECODER(decode_ ## bpf_cmd) \
  37. { \
  38. struct bpf_cmd ## _struct attr = {}; \
  39. const size_t attr_size = bpf_cmd ## _struct_size; \
  40. const unsigned int len = MIN(size, attr_size); \
  41. memcpy(&attr, data, len); \
  42. do { \
  43. /* End of BEGIN_BPF_CMD_DECODER definition. */
  44. #define END_BPF_CMD_DECODER(rval) \
  45. decode_attr_extra_data(tcp, data, size, attr_size); \
  46. } while (0); \
  47. tprints("}"); \
  48. return (rval); \
  49. } \
  50. /* End of END_BPF_CMD_DECODER definition. */
  51. #define BPF_CMD_ENTRY(bpf_cmd) \
  52. [bpf_cmd] = decode_ ## bpf_cmd
  53. typedef DECL_BPF_CMD_DECODER((*bpf_cmd_decoder_t));
  54. /*
  55. * A note about bpf syscall decoder: it doesn't perform any size sanity checks,
  56. * so even if it leads to partial copying of one of the fields, the command
  57. * handler will still use the (partially-copied-from-userspace, partially
  58. * zeroed) field value. That's why we stop decoding and check for known sizes
  59. * that correspond to released versions of the structure used by the specific
  60. * command - it looks like the most sensible way to parse this insanity.
  61. */
  62. static int
  63. decode_attr_extra_data(struct tcb *const tcp,
  64. const char *data,
  65. unsigned int size,
  66. const size_t attr_size)
  67. {
  68. if (size <= attr_size)
  69. return 0;
  70. data += attr_size;
  71. size -= attr_size;
  72. unsigned int i;
  73. for (i = 0; i < size; ++i) {
  74. if (data[i]) {
  75. tprints(", ");
  76. if (abbrev(tcp)) {
  77. tprints("...");
  78. } else {
  79. tprintf("/* bytes %zu..%zu */ ",
  80. attr_size, attr_size + size - 1);
  81. print_quoted_string(data, size,
  82. QUOTE_FORCE_HEX);
  83. }
  84. return RVAL_DECODED;
  85. }
  86. }
  87. return 0;
  88. }
  89. struct ebpf_insn {
  90. uint8_t code;
  91. uint8_t dst_reg:4;
  92. uint8_t src_reg:4;
  93. int16_t off;
  94. int32_t imm;
  95. };
  96. struct ebpf_insns_data {
  97. unsigned int count;
  98. };
  99. static bool
  100. print_ebpf_insn(struct tcb * const tcp, void * const elem_buf,
  101. const size_t elem_size, void * const data)
  102. {
  103. struct ebpf_insns_data *eid = data;
  104. struct ebpf_insn *insn = elem_buf;
  105. if (eid->count++ >= BPF_MAXINSNS) {
  106. tprints("...");
  107. return false;
  108. }
  109. tprints("{code=");
  110. print_bpf_filter_code(insn->code, true);
  111. /* We can't use PRINT_FIELD_XVAL on bit fields */
  112. tprints(", dst_reg=");
  113. printxval_index(ebpf_regs, insn->dst_reg, "BPF_REG_???");
  114. tprints(", src_reg=");
  115. printxval_index(ebpf_regs, insn->src_reg, "BPF_REG_???");
  116. PRINT_FIELD_D(", ", *insn, off);
  117. PRINT_FIELD_X(", ", *insn, imm);
  118. tprints("}");
  119. return true;
  120. }
  121. static void
  122. print_ebpf_prog(struct tcb *const tcp, const uint64_t addr, const uint32_t len)
  123. {
  124. print_big_u64_addr(addr);
  125. if (abbrev(tcp)) {
  126. printaddr(addr);
  127. } else {
  128. struct ebpf_insns_data eid = {};
  129. struct ebpf_insn insn;
  130. print_array(tcp, addr, len, &insn, sizeof(insn),
  131. tfetch_mem, print_ebpf_insn, &eid);
  132. }
  133. }
  134. BEGIN_BPF_CMD_DECODER(BPF_MAP_CREATE)
  135. {
  136. PRINT_FIELD_XVAL_INDEX("{", attr, map_type, bpf_map_types,
  137. "BPF_MAP_TYPE_???");
  138. PRINT_FIELD_U(", ", attr, key_size);
  139. PRINT_FIELD_U(", ", attr, value_size);
  140. PRINT_FIELD_U(", ", attr, max_entries);
  141. /* map_flags field was added in Linux commit v4.6-rc1~91^2~108^2~6. */
  142. if (len <= offsetof(struct BPF_MAP_CREATE_struct, map_flags))
  143. break;
  144. PRINT_FIELD_FLAGS(", ", attr, map_flags, bpf_map_flags, "BPF_F_???");
  145. /*
  146. * inner_map_fd field was added in Linux commit
  147. * v4.12-rc1~64^3~373^2~2.
  148. */
  149. if (len <= offsetof(struct BPF_MAP_CREATE_struct, inner_map_fd))
  150. break;
  151. PRINT_FIELD_FD(", ", attr, inner_map_fd, tcp);
  152. /* numa_node field was added in Linux commit v4.14-rc1~130^2~196^2~1. */
  153. if (len <= offsetof(struct BPF_MAP_CREATE_struct, numa_node))
  154. break;
  155. if (attr.map_flags & BPF_F_NUMA_NODE) {
  156. /*
  157. * Kernel uses the value of -1 as a designation for "no NUMA
  158. * node specified", and even uses NUMA_NO_NODE constant;
  159. * however, the constant definition is not a part of UAPI
  160. * headers, thus we can't simply print this named constant
  161. * instead of the value. Let's force verbose xlat style instead
  162. * in order to provide the information for the user while
  163. * not hampering the availability to derive the actual value
  164. * without the access to the kernel headers.
  165. */
  166. tprints(", numa_node=");
  167. printxvals_ex(attr.numa_node, NULL,
  168. XLAT_STYLE_FMT_U | XLAT_STYLE_VERBOSE,
  169. numa_node, NULL);
  170. }
  171. /* map_name field was added in Linux commit v4.15-rc1~84^2~605^2~3. */
  172. if (len <= offsetof(struct BPF_MAP_CREATE_struct, map_name))
  173. break;
  174. PRINT_FIELD_CSTRING_SZ(", ", attr, map_name,
  175. MIN(sizeof(attr.map_name),
  176. len - offsetof(struct BPF_MAP_CREATE_struct,
  177. map_name)));
  178. /*
  179. * map_ifindex field was added in Linux commit
  180. * v4.16-rc1~123^2~145^2~5^2~8.
  181. */
  182. if (len <= offsetof(struct BPF_MAP_CREATE_struct, map_ifindex))
  183. break;
  184. PRINT_FIELD_IFINDEX(", ", attr, map_ifindex);
  185. }
  186. END_BPF_CMD_DECODER(RVAL_DECODED | RVAL_FD)
  187. BEGIN_BPF_CMD_DECODER(BPF_MAP_LOOKUP_ELEM)
  188. {
  189. PRINT_FIELD_FD("{", attr, map_fd, tcp);
  190. PRINT_FIELD_ADDR64(", ", attr, key);
  191. PRINT_FIELD_ADDR64(", ", attr, value);
  192. }
  193. END_BPF_CMD_DECODER(RVAL_DECODED)
  194. BEGIN_BPF_CMD_DECODER(BPF_MAP_UPDATE_ELEM)
  195. {
  196. PRINT_FIELD_FD("{", attr, map_fd, tcp);
  197. PRINT_FIELD_ADDR64(", ", attr, key);
  198. PRINT_FIELD_ADDR64(", ", attr, value);
  199. PRINT_FIELD_XVAL_INDEX(", ", attr, flags, bpf_map_update_elem_flags,
  200. "BPF_???");
  201. }
  202. END_BPF_CMD_DECODER(RVAL_DECODED)
  203. BEGIN_BPF_CMD_DECODER(BPF_MAP_DELETE_ELEM)
  204. {
  205. PRINT_FIELD_FD("{", attr, map_fd, tcp);
  206. PRINT_FIELD_ADDR64(", ", attr, key);
  207. }
  208. END_BPF_CMD_DECODER(RVAL_DECODED)
  209. BEGIN_BPF_CMD_DECODER(BPF_MAP_GET_NEXT_KEY)
  210. {
  211. PRINT_FIELD_FD("{", attr, map_fd, tcp);
  212. PRINT_FIELD_ADDR64(", ", attr, key);
  213. PRINT_FIELD_ADDR64(", ", attr, next_key);
  214. }
  215. END_BPF_CMD_DECODER(RVAL_DECODED)
  216. BEGIN_BPF_CMD_DECODER(BPF_PROG_LOAD)
  217. {
  218. PRINT_FIELD_XVAL_INDEX("{", attr, prog_type, bpf_prog_types,
  219. "BPF_PROG_TYPE_???");
  220. PRINT_FIELD_U(", ", attr, insn_cnt);
  221. tprints(", insns=");
  222. print_ebpf_prog(tcp, attr.insns, attr.insn_cnt);
  223. tprintf(", license=");
  224. print_big_u64_addr(attr.license);
  225. printstr(tcp, attr.license);
  226. /* log_* fields were added in Linux commit v3.18-rc1~52^2~1^2~4. */
  227. if (len <= offsetof(struct BPF_PROG_LOAD_struct, log_level))
  228. break;
  229. PRINT_FIELD_U(", ", attr, log_level);
  230. PRINT_FIELD_U(", ", attr, log_size);
  231. tprintf(", log_buf=");
  232. print_big_u64_addr(attr.log_buf);
  233. printstr_ex(tcp, attr.log_buf, attr.log_size, QUOTE_0_TERMINATED);
  234. /* kern_version field was added in Linux commit v4.1-rc1~84^2~50. */
  235. if (len <= offsetof(struct BPF_PROG_LOAD_struct, kern_version))
  236. break;
  237. tprints(", kern_version=");
  238. print_kernel_version(attr.kern_version);
  239. /* prog_flags field was added in Linux commit v4.12-rc2~34^2~29^2~2. */
  240. if (len <= offsetof(struct BPF_PROG_LOAD_struct, prog_flags))
  241. break;
  242. PRINT_FIELD_FLAGS(", ", attr, prog_flags, bpf_prog_flags, "BPF_F_???");
  243. /* prog_name field was added in Linux commit v4.15-rc1~84^2~605^2~4. */
  244. if (len <= offsetof(struct BPF_PROG_LOAD_struct, prog_name))
  245. break;
  246. PRINT_FIELD_CSTRING_SZ(", ", attr, prog_name,
  247. MIN(sizeof(attr.prog_name),
  248. len - offsetof(struct BPF_PROG_LOAD_struct,
  249. prog_name)));
  250. /*
  251. * prog_ifindex field was added as prog_target_ifindex in Linux commit
  252. * v4.15-rc1~84^2~127^2~13 and renamed to its current name in
  253. * v4.15-rc1~15^2~5^2~3^2~7.
  254. */
  255. if (len <= offsetof(struct BPF_PROG_LOAD_struct, prog_ifindex))
  256. break;
  257. PRINT_FIELD_IFINDEX(", ", attr, prog_ifindex);
  258. /*
  259. * expected_attach_type was added in Linux commit
  260. * v4.17-rc1~148^2~19^2^2~8.
  261. */
  262. if (len <= offsetof(struct BPF_PROG_LOAD_struct, expected_attach_type))
  263. break;
  264. PRINT_FIELD_XVAL(", ", attr, expected_attach_type, bpf_attach_type,
  265. "BPF_???");
  266. }
  267. END_BPF_CMD_DECODER(RVAL_DECODED | RVAL_FD)
  268. BEGIN_BPF_CMD_DECODER(BPF_OBJ_PIN)
  269. {
  270. tprintf("{pathname=");
  271. print_big_u64_addr(attr.pathname);
  272. printpath(tcp, attr.pathname);
  273. PRINT_FIELD_FD(", ", attr, bpf_fd, tcp);
  274. /* file_flags field was added in Linux v4.15-rc1~84^2~384^2~4 */
  275. if (len <= offsetof(struct BPF_OBJ_PIN_struct, file_flags))
  276. break;
  277. PRINT_FIELD_FLAGS(", ", attr, file_flags, bpf_file_mode_flags,
  278. "BPF_F_???");
  279. }
  280. END_BPF_CMD_DECODER(RVAL_DECODED | RVAL_FD)
  281. #define decode_BPF_OBJ_GET decode_BPF_OBJ_PIN
  282. BEGIN_BPF_CMD_DECODER(BPF_PROG_ATTACH)
  283. {
  284. PRINT_FIELD_FD("{", attr, target_fd, tcp);
  285. PRINT_FIELD_FD(", ", attr, attach_bpf_fd, tcp);
  286. PRINT_FIELD_XVAL_INDEX(", ", attr, attach_type, bpf_attach_type,
  287. "BPF_???");
  288. PRINT_FIELD_FLAGS(", ", attr, attach_flags, bpf_attach_flags,
  289. "BPF_F_???");
  290. }
  291. END_BPF_CMD_DECODER(RVAL_DECODED)
  292. BEGIN_BPF_CMD_DECODER(BPF_PROG_DETACH)
  293. {
  294. PRINT_FIELD_FD("{", attr, target_fd, tcp);
  295. PRINT_FIELD_XVAL_INDEX(", ", attr, attach_type, bpf_attach_type,
  296. "BPF_???");
  297. }
  298. END_BPF_CMD_DECODER(RVAL_DECODED)
  299. BEGIN_BPF_CMD_DECODER(BPF_PROG_TEST_RUN)
  300. {
  301. PRINT_FIELD_FD("{test={", attr, prog_fd, tcp);
  302. PRINT_FIELD_U(", ", attr, retval);
  303. PRINT_FIELD_U(", ", attr, data_size_in);
  304. PRINT_FIELD_U(", ", attr, data_size_out);
  305. PRINT_FIELD_ADDR64(", ", attr, data_in);
  306. PRINT_FIELD_ADDR64(", ", attr, data_out);
  307. PRINT_FIELD_U(", ", attr, repeat);
  308. PRINT_FIELD_U(", ", attr, duration);
  309. tprints("}");
  310. }
  311. END_BPF_CMD_DECODER(RVAL_DECODED)
  312. BEGIN_BPF_CMD_DECODER(BPF_PROG_GET_NEXT_ID)
  313. {
  314. PRINT_FIELD_U("{", attr, start_id);
  315. PRINT_FIELD_U(", ", attr, next_id);
  316. /* open_flags field has been added in Linux v4.15-rc1~84^2~384^2~4 */
  317. if (len <= offsetof(struct BPF_PROG_GET_NEXT_ID_struct, open_flags))
  318. break;
  319. PRINT_FIELD_FLAGS(", ", attr, open_flags, bpf_file_mode_flags,
  320. "BPF_F_???");
  321. }
  322. END_BPF_CMD_DECODER(RVAL_DECODED)
  323. #define decode_BPF_MAP_GET_NEXT_ID decode_BPF_PROG_GET_NEXT_ID
  324. BEGIN_BPF_CMD_DECODER(BPF_PROG_GET_FD_BY_ID)
  325. {
  326. PRINT_FIELD_U("{", attr, prog_id);
  327. PRINT_FIELD_U(", ", attr, next_id);
  328. /* open_flags field has been added in Linux v4.15-rc1~84^2~384^2~4 */
  329. if (len <= offsetof(struct BPF_PROG_GET_FD_BY_ID_struct, open_flags))
  330. break;
  331. PRINT_FIELD_FLAGS(", ", attr, open_flags, bpf_file_mode_flags,
  332. "BPF_F_???");
  333. }
  334. END_BPF_CMD_DECODER(RVAL_DECODED)
  335. BEGIN_BPF_CMD_DECODER(BPF_MAP_GET_FD_BY_ID)
  336. {
  337. PRINT_FIELD_U("{", attr, map_id);
  338. PRINT_FIELD_U(", ", attr, next_id);
  339. /* open_flags field has been added in Linux v4.15-rc1~84^2~384^2~4 */
  340. if (len <= offsetof(struct BPF_MAP_GET_FD_BY_ID_struct, open_flags))
  341. break;
  342. PRINT_FIELD_FLAGS(", ", attr, open_flags, bpf_file_mode_flags,
  343. "BPF_F_???");
  344. }
  345. END_BPF_CMD_DECODER(RVAL_DECODED)
  346. struct obj_get_info_saved;
  347. typedef void (*print_bpf_obj_info_fn)(struct tcb *,
  348. uint32_t bpf_fd,
  349. const char *info_buf,
  350. uint32_t size,
  351. struct obj_get_info_saved *saved);
  352. struct obj_get_info_saved {
  353. print_bpf_obj_info_fn print_fn;
  354. uint32_t info_len;
  355. uint32_t jited_prog_len;
  356. uint32_t xlated_prog_len;
  357. uint32_t nr_map_ids;
  358. };
  359. static void
  360. print_bpf_map_info(struct tcb * const tcp, uint32_t bpf_fd,
  361. const char *info_buf, uint32_t size,
  362. struct obj_get_info_saved *saved)
  363. {
  364. if (entering(tcp))
  365. return;
  366. struct bpf_map_info_struct info = { 0 };
  367. const unsigned int len = MIN(size, bpf_map_info_struct_size);
  368. memcpy(&info, info_buf, len);
  369. PRINT_FIELD_XVAL("{", info, type, bpf_map_types, "BPF_MAP_TYPE_???");
  370. PRINT_FIELD_U(", ", info, id);
  371. PRINT_FIELD_U(", ", info, key_size);
  372. PRINT_FIELD_U(", ", info, value_size);
  373. PRINT_FIELD_U(", ", info, max_entries);
  374. PRINT_FIELD_FLAGS(", ", info, map_flags, bpf_map_flags, "BPF_F_???");
  375. /*
  376. * "name" field was introduced by Linux commit v4.15-rc1~84^2~605^2~3.
  377. */
  378. if (len <= offsetof(struct bpf_map_info_struct, name))
  379. goto print_bpf_map_info_end;
  380. PRINT_FIELD_CSTRING(", ", info, name);
  381. /*
  382. * ifindex, netns_dev, and netns_ino fields were introduced
  383. * by Linux commit v4.16-rc1~123^2~109^2~5^2~4.
  384. */
  385. if (len <= offsetof(struct bpf_map_info_struct, ifindex))
  386. goto print_bpf_map_info_end;
  387. PRINT_FIELD_IFINDEX(", ", info, ifindex);
  388. PRINT_FIELD_DEV(", ", info, netns_dev);
  389. PRINT_FIELD_U(", ", info, netns_ino);
  390. decode_attr_extra_data(tcp, info_buf, size, bpf_map_info_struct_size);
  391. print_bpf_map_info_end:
  392. tprints("}");
  393. }
  394. static void
  395. print_bpf_prog_info(struct tcb * const tcp, uint32_t bpf_fd,
  396. const char *info_buf, uint32_t size,
  397. struct obj_get_info_saved *saved)
  398. {
  399. struct bpf_prog_info_struct info = { 0 };
  400. const unsigned int len = MIN(size, bpf_prog_info_struct_size);
  401. uint64_t map_id_buf;
  402. memcpy(&info, info_buf, len);
  403. if (entering(tcp)) {
  404. saved->jited_prog_len = info.jited_prog_len;
  405. saved->xlated_prog_len = info.xlated_prog_len;
  406. saved->nr_map_ids = info.nr_map_ids;
  407. return;
  408. }
  409. PRINT_FIELD_XVAL("{", info, type, bpf_prog_types, "BPF_PROG_TYPE_???");
  410. PRINT_FIELD_U(", ", info, id);
  411. PRINT_FIELD_HEX_ARRAY(", ", info, tag);
  412. tprints(", jited_prog_len=");
  413. if (saved->jited_prog_len != info.jited_prog_len)
  414. tprintf("%" PRIu32 " => ", saved->jited_prog_len);
  415. tprintf("%" PRIu32, info.jited_prog_len);
  416. tprints(", jited_prog_insns=");
  417. print_big_u64_addr(info.jited_prog_insns);
  418. printstr_ex(tcp, info.jited_prog_insns, info.jited_prog_len,
  419. QUOTE_FORCE_HEX);
  420. tprints(", xlated_prog_len=");
  421. if (saved->xlated_prog_len != info.xlated_prog_len)
  422. tprintf("%" PRIu32 " => ", saved->xlated_prog_len);
  423. tprintf("%" PRIu32, info.xlated_prog_len);
  424. tprints(", xlated_prog_insns=");
  425. print_ebpf_prog(tcp, info.xlated_prog_insns,
  426. MIN(saved->xlated_prog_len, info.xlated_prog_len) / 8);
  427. /*
  428. * load_time, created_by_uid, nr_map_ids, map_ids, and name fields
  429. * were introduced by Linux commit v4.15-rc1~84^2~605^2~4.
  430. */
  431. if (len <= offsetof(struct bpf_prog_info_struct, load_time))
  432. goto print_bpf_prog_info_end;
  433. PRINT_FIELD_U(", ", info, load_time);
  434. PRINT_FIELD_UID(", ", info, created_by_uid);
  435. tprints(", nr_map_ids=");
  436. if (saved->nr_map_ids != info.nr_map_ids)
  437. tprintf("%" PRIu32 " => ", saved->nr_map_ids);
  438. tprintf("%" PRIu32, info.nr_map_ids);
  439. tprints(", map_ids=");
  440. print_big_u64_addr(info.map_ids);
  441. print_array(tcp, info.map_ids, MIN(saved->nr_map_ids, info.nr_map_ids),
  442. &map_id_buf, sizeof(map_id_buf),
  443. tfetch_mem, print_uint32_array_member, 0);
  444. PRINT_FIELD_CSTRING(", ", info, name);
  445. /*
  446. * ifindex, netns_dev, and netns_ino fields were introduced
  447. * by Linux commit v4.16-rc1~123^2~227^2~5^2~2.
  448. */
  449. if (len <= offsetof(struct bpf_prog_info_struct, ifindex))
  450. goto print_bpf_prog_info_end;
  451. PRINT_FIELD_IFINDEX(", ", info, ifindex);
  452. PRINT_FIELD_DEV(", ", info, netns_dev);
  453. PRINT_FIELD_U(", ", info, netns_ino);
  454. decode_attr_extra_data(tcp, info_buf, size, bpf_prog_info_struct_size);
  455. print_bpf_prog_info_end:
  456. tprints("}");
  457. }
  458. static const char *
  459. fetch_bpf_obj_info(struct tcb * const tcp, uint64_t info, uint32_t size)
  460. {
  461. static char *info_buf;
  462. if (!info_buf)
  463. info_buf = xmalloc(get_pagesize());
  464. memset(info_buf, 0, get_pagesize());
  465. if (size > 0 && size <= get_pagesize()
  466. && !umoven(tcp, info, size, info_buf))
  467. return info_buf;
  468. return NULL;
  469. }
  470. static void
  471. print_bpf_obj_info_addr(struct tcb * const tcp, uint64_t addr)
  472. {
  473. if (exiting(tcp))
  474. printaddr64(addr);
  475. }
  476. static void
  477. print_bpf_obj_info(struct tcb * const tcp, uint32_t bpf_fd, uint64_t info,
  478. uint32_t size, struct obj_get_info_saved *saved)
  479. {
  480. if (abbrev(tcp)) {
  481. print_bpf_obj_info_addr(tcp, info);
  482. return;
  483. }
  484. static struct {
  485. const char *id;
  486. print_bpf_obj_info_fn print_fn;
  487. } obj_printers[] = {
  488. { "anon_inode:bpf-map", print_bpf_map_info },
  489. { "anon_inode:bpf-prog", print_bpf_prog_info }
  490. };
  491. if (entering(tcp)) {
  492. char path[PATH_MAX + 1];
  493. if (getfdpath(tcp, bpf_fd, path, sizeof(path)) > 0) {
  494. for (size_t i = 0; i < ARRAY_SIZE(obj_printers); ++i) {
  495. if (!strcmp(path, obj_printers[i].id)) {
  496. saved->print_fn =
  497. obj_printers[i].print_fn;
  498. break;
  499. }
  500. }
  501. }
  502. }
  503. if (!saved || !saved->print_fn) {
  504. print_bpf_obj_info_addr(tcp, info);
  505. return;
  506. }
  507. const char *info_buf = fetch_bpf_obj_info(tcp, info, size);
  508. if (info_buf)
  509. saved->print_fn(tcp, bpf_fd, info_buf, size, saved);
  510. else
  511. print_bpf_obj_info_addr(tcp, info);
  512. }
  513. BEGIN_BPF_CMD_DECODER(BPF_OBJ_GET_INFO_BY_FD)
  514. {
  515. struct obj_get_info_saved *saved;
  516. if (entering(tcp)) {
  517. saved = xzalloc(sizeof(*saved));
  518. saved->info_len = attr.info_len;
  519. set_tcb_priv_data(tcp, saved, free);
  520. PRINT_FIELD_FD("{info={", attr, bpf_fd, tcp);
  521. PRINT_FIELD_U(", ", attr, info_len);
  522. } else {
  523. saved = get_tcb_priv_data(tcp);
  524. if (saved && (saved->info_len != attr.info_len))
  525. tprintf(" => %u", attr.info_len);
  526. tprintf(", info=");
  527. }
  528. print_bpf_obj_info(tcp, attr.bpf_fd, attr.info, attr.info_len, saved);
  529. if (entering(tcp))
  530. return 0;
  531. tprints("}");
  532. }
  533. END_BPF_CMD_DECODER(RVAL_DECODED)
  534. BEGIN_BPF_CMD_DECODER(BPF_PROG_QUERY)
  535. {
  536. uint32_t prog_id_buf;
  537. if (entering(tcp)) {
  538. PRINT_FIELD_FD("{query={", attr, target_fd, tcp);
  539. PRINT_FIELD_XVAL_INDEX(", ", attr, attach_type, bpf_attach_type,
  540. "BPF_???");
  541. PRINT_FIELD_FLAGS(", ", attr, query_flags, bpf_query_flags,
  542. "BPF_F_QUERY_???");
  543. PRINT_FIELD_FLAGS(", ", attr, attach_flags, bpf_attach_flags,
  544. "BPF_F_???");
  545. tprints(", prog_ids=");
  546. set_tcb_priv_ulong(tcp, attr.prog_cnt);
  547. return 0;
  548. }
  549. print_big_u64_addr(attr.prog_ids);
  550. print_array(tcp, attr.prog_ids, attr.prog_cnt, &prog_id_buf,
  551. sizeof(prog_id_buf), tfetch_mem,
  552. print_uint32_array_member, 0);
  553. tprints(", prog_cnt=");
  554. const uint32_t prog_cnt_entering = get_tcb_priv_ulong(tcp);
  555. if (prog_cnt_entering != attr.prog_cnt)
  556. tprintf("%" PRIu32 " => ", prog_cnt_entering);
  557. tprintf("%" PRIu32, attr.prog_cnt);
  558. tprints("}");
  559. }
  560. END_BPF_CMD_DECODER(RVAL_DECODED)
  561. BEGIN_BPF_CMD_DECODER(BPF_RAW_TRACEPOINT_OPEN)
  562. {
  563. enum { TP_NAME_SIZE = 128 };
  564. tprintf("{raw_tracepoint={name=");
  565. print_big_u64_addr(attr.name);
  566. printstr_ex(tcp, attr.name, TP_NAME_SIZE, QUOTE_0_TERMINATED);
  567. PRINT_FIELD_FD(", ", attr, prog_fd, tcp);
  568. tprints("}");
  569. }
  570. END_BPF_CMD_DECODER(RVAL_DECODED)
  571. SYS_FUNC(bpf)
  572. {
  573. static const bpf_cmd_decoder_t bpf_cmd_decoders[] = {
  574. BPF_CMD_ENTRY(BPF_MAP_CREATE),
  575. BPF_CMD_ENTRY(BPF_MAP_LOOKUP_ELEM),
  576. BPF_CMD_ENTRY(BPF_MAP_UPDATE_ELEM),
  577. BPF_CMD_ENTRY(BPF_MAP_DELETE_ELEM),
  578. BPF_CMD_ENTRY(BPF_MAP_GET_NEXT_KEY),
  579. BPF_CMD_ENTRY(BPF_PROG_LOAD),
  580. BPF_CMD_ENTRY(BPF_OBJ_PIN),
  581. BPF_CMD_ENTRY(BPF_OBJ_GET),
  582. BPF_CMD_ENTRY(BPF_PROG_ATTACH),
  583. BPF_CMD_ENTRY(BPF_PROG_DETACH),
  584. BPF_CMD_ENTRY(BPF_PROG_TEST_RUN),
  585. BPF_CMD_ENTRY(BPF_PROG_GET_NEXT_ID),
  586. BPF_CMD_ENTRY(BPF_MAP_GET_NEXT_ID),
  587. BPF_CMD_ENTRY(BPF_PROG_GET_FD_BY_ID),
  588. BPF_CMD_ENTRY(BPF_MAP_GET_FD_BY_ID),
  589. BPF_CMD_ENTRY(BPF_OBJ_GET_INFO_BY_FD),
  590. BPF_CMD_ENTRY(BPF_PROG_QUERY),
  591. BPF_CMD_ENTRY(BPF_RAW_TRACEPOINT_OPEN),
  592. };
  593. const unsigned int cmd = tcp->u_arg[0];
  594. const kernel_ulong_t addr = tcp->u_arg[1];
  595. const unsigned int size = tcp->u_arg[2];
  596. int rc = RVAL_DECODED;
  597. if (entering(tcp)) {
  598. printxval_index(bpf_commands, cmd, "BPF_???");
  599. tprints(", ");
  600. }
  601. if (size > 0
  602. && size <= get_pagesize()
  603. && cmd < ARRAY_SIZE(bpf_cmd_decoders)
  604. && bpf_cmd_decoders[cmd]) {
  605. static char *buf;
  606. if (!buf)
  607. buf = xmalloc(get_pagesize());
  608. if (!umoven_or_printaddr_ignore_syserror(tcp, addr, size, buf))
  609. rc = bpf_cmd_decoders[cmd](tcp, addr, size, buf);
  610. } else {
  611. printaddr(addr);
  612. }
  613. if (exiting(tcp) || (rc & RVAL_DECODED))
  614. tprintf(", %u", size);
  615. return rc;
  616. }