120 lines · c
1/* instructions used to output a skb based software event, produced2 * from code snippet:3 * struct TMP {4 * uint64_t tmp;5 * } tt;6 * tt.tmp = 5;7 * bpf_perf_event_output(skb, &connection_tracking_event_map, 0,8 * &tt, sizeof(tt));9 * return 1;10 *11 * the bpf assembly from llvm is:12 * 0: b7 02 00 00 05 00 00 00 r2 = 513 * 1: 7b 2a f8 ff 00 00 00 00 *(u64 *)(r10 - 8) = r214 * 2: bf a4 00 00 00 00 00 00 r4 = r1015 * 3: 07 04 00 00 f8 ff ff ff r4 += -816 * 4: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0ll17 * 6: b7 03 00 00 00 00 00 00 r3 = 018 * 7: b7 05 00 00 08 00 00 00 r5 = 819 * 8: 85 00 00 00 19 00 00 00 call 2520 * 9: b7 00 00 00 01 00 00 00 r0 = 121 * 10: 95 00 00 00 00 00 00 00 exit22 *23 * The reason I put the code here instead of fill_helpers is that map fixup24 * is against the insns, instead of filled prog.25 */26 27#define __PERF_EVENT_INSNS__ \28 BPF_MOV64_IMM(BPF_REG_2, 5), \29 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8), \30 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), \31 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), \32 BPF_LD_MAP_FD(BPF_REG_2, 0), \33 BPF_MOV64_IMM(BPF_REG_3, 0), \34 BPF_MOV64_IMM(BPF_REG_5, 8), \35 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, \36 BPF_FUNC_perf_event_output), \37 BPF_MOV64_IMM(BPF_REG_0, 1), \38 BPF_EXIT_INSN(),39{40 "perfevent for sockops",41 .insns = { __PERF_EVENT_INSNS__ },42 .prog_type = BPF_PROG_TYPE_SOCK_OPS,43 .fixup_map_event_output = { 4 },44 .result = ACCEPT,45 .retval = 1,46},47{48 "perfevent for tc",49 .insns = { __PERF_EVENT_INSNS__ },50 .prog_type = BPF_PROG_TYPE_SCHED_CLS,51 .fixup_map_event_output = { 4 },52 .result = ACCEPT,53 .retval = 1,54},55{56 "perfevent for lwt out",57 .insns = { __PERF_EVENT_INSNS__ },58 .prog_type = BPF_PROG_TYPE_LWT_OUT,59 .fixup_map_event_output = { 4 },60 .result = ACCEPT,61 .retval = 1,62},63{64 "perfevent for xdp",65 .insns = { __PERF_EVENT_INSNS__ },66 .prog_type = BPF_PROG_TYPE_XDP,67 .fixup_map_event_output = { 4 },68 .result = ACCEPT,69 .retval = 1,70},71{72 "perfevent for socket filter",73 .insns = { __PERF_EVENT_INSNS__ },74 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,75 .fixup_map_event_output = { 4 },76 .result = ACCEPT,77 .retval = 1,78},79{80 "perfevent for sk_skb",81 .insns = { __PERF_EVENT_INSNS__ },82 .prog_type = BPF_PROG_TYPE_SK_SKB,83 .fixup_map_event_output = { 4 },84 .result = ACCEPT,85 .retval = 1,86},87{88 "perfevent for cgroup skb",89 .insns = { __PERF_EVENT_INSNS__ },90 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,91 .fixup_map_event_output = { 4 },92 .result = ACCEPT,93 .retval = 1,94},95{96 "perfevent for cgroup dev",97 .insns = { __PERF_EVENT_INSNS__ },98 .prog_type = BPF_PROG_TYPE_CGROUP_DEVICE,99 .fixup_map_event_output = { 4 },100 .result = ACCEPT,101 .retval = 1,102},103{104 "perfevent for cgroup sysctl",105 .insns = { __PERF_EVENT_INSNS__ },106 .prog_type = BPF_PROG_TYPE_CGROUP_SYSCTL,107 .fixup_map_event_output = { 4 },108 .result = ACCEPT,109 .retval = 1,110},111{112 "perfevent for cgroup sockopt",113 .insns = { __PERF_EVENT_INSNS__ },114 .prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT,115 .expected_attach_type = BPF_CGROUP_SETSOCKOPT,116 .fixup_map_event_output = { 4 },117 .result = ACCEPT,118 .retval = 1,119},120