Skip to content
  1. Nov 26, 2018
  2. Nov 24, 2018
    • David Calavera's avatar
      bpf: Add BPF_MAP_TYPE_QUEUE and BPF_MAP_TYPE_STACK to bpftool-map · 197c2dac
      David Calavera authored
      
      
      I noticed that these two new BPF Maps are not defined in bpftool.
      This patch defines those two maps and adds their names to the
      bpftool-map documentation.
      
      Signed-off-by: default avatarDavid Calavera <david.calavera@gmail.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      197c2dac
    • Daniel T. Lee's avatar
      samples: bpf: fix: error handling regarding kprobe_events · 5a863813
      Daniel T. Lee authored
      
      
      Currently, kprobe_events failure won't be handled properly.
      Due to calling system() indirectly to write to kprobe_events,
      it can't be identified whether an error is derived from kprobe or system.
      
          // buf = "echo '%c:%s %s' >> /s/k/d/t/kprobe_events"
          err = system(buf);
          if (err < 0) {
              printf("failed to create kprobe ..");
              return -1;
          }
      
      For example, running ./tracex7 sample in ext4 partition,
      "echo p:open_ctree open_ctree >> /s/k/d/t/kprobe_events"
      gets 256 error code system() failure.
      => The error comes from kprobe, but it's not handled correctly.
      
      According to man of system(3), it's return value
      just passes the termination status of the child shell
      rather than treating the error as -1. (don't care success)
      
      Which means, currently it's not working as desired.
      (According to the upper code snippet)
      
          ex) running ./tracex7 with ext4 env.
          # Current Output
          sh: echo: I/O error
          failed to open event open_ctree
      
          # Desired Output
          failed to create kprobe 'open_ctree' error 'No such file or directory'
      
      The problem is, error can't be verified whether from child ps
      or system. But using write() directly can verify the command
      failure, and it will treat all error as -1. So I suggest using
      write() directly to 'kprobe_events' rather than calling system().
      
      Signed-off-by: default avatarDaniel T. Lee <danieltimlee@gmail.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      5a863813
    • Nikita V. Shirokov's avatar
      libbpf: make bpf_object__open default to UNSPEC · 47ae7e3d
      Nikita V. Shirokov authored
      
      
      currently by default libbpf's bpf_object__open requires
      bpf's program to specify  version in a code because of two things:
      1) default prog type is set to KPROBE
      2) KPROBE requires (in kernel/bpf/syscall.c) version to be specified
      
      in this patch i'm changing default prog type to UNSPEC and also changing
      requirments for version's section to be present in object file.
      now it would reflect what we have today in kernel
      (only KPROBE prog type requires for version to be explicitly set).
      
      v1 -> v2:
       - RFC tag has been dropped
      
      Signed-off-by: default avatarNikita V. Shirokov <tehnerd@tehnerd.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      47ae7e3d
  3. Nov 23, 2018
  4. Nov 22, 2018
  5. Nov 21, 2018
    • Yonghong Song's avatar
      bpf: fix a compilation error when CONFIG_BPF_SYSCALL is not defined · f6161a8f
      Yonghong Song authored
      Kernel test robot (lkp@intel.com) reports a compilation error at
        https://www.spinics.net/lists/netdev/msg534913.html
      
      
      introduced by commit 838e9690 ("bpf: Introduce bpf_func_info").
      
      If CONFIG_BPF is defined and CONFIG_BPF_SYSCALL is not defined,
      the following error will appear:
        kernel/bpf/core.c:414: undefined reference to `btf_type_by_id'
        kernel/bpf/core.c:415: undefined reference to `btf_name_by_offset'
      
      When CONFIG_BPF_SYSCALL is not defined,
      let us define stub inline functions for btf_type_by_id()
      and btf_name_by_offset() in include/linux/btf.h.
      This way, the compilation failure can be avoided.
      
      Fixes: 838e9690 ("bpf: Introduce bpf_func_info")
      Reported-by: default avatarkbuild test robot <lkp@intel.com>
      Cc: Martin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      f6161a8f
    • Alexei Starovoitov's avatar
      Merge branch 'btf-func-info' · 740baecd
      Alexei Starovoitov authored
      Martin KaFai Lau says:
      
      ====================
      The BTF support was added to kernel by Commit 69b693f0
      ("bpf: btf: Introduce BPF Type Format (BTF)"), which introduced
      .BTF section into ELF file and is primarily
      used for map pretty print.
      pahole is used to convert dwarf to BTF for ELF files.
      
      This patch added func info support to the kernel so we can
      get better ksym's for bpf function calls. Basically,
      function call types are passed to kernel and the kernel
      extract function names from these types in order to contruct ksym
      for these functions.
      
      The llvm patch at https://reviews.llvm.org/D53736
      
      
      will generate .BTF section and one more section .BTF.ext.
      The .BTF.ext section encodes function type
      information. The following is a sample output for selftests
      test_btf with file test_btf_haskv.o for translated insns
      and jited insns respectively.
      
        $ bpftool prog dump xlated id 1
        int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
           0: (85) call pc+2#bpf_prog_2dcecc18072623fc_test_long_fname_1
           1: (b7) r0 = 0
           2: (95) exit
        int test_long_fname_1(struct dummy_tracepoint_args * arg):
           3: (85) call pc+1#bpf_prog_89d64e4abf0f0126_test_long_fname_2
           4: (95) exit
        int test_long_fname_2(struct dummy_tracepoint_args * arg):
           5: (b7) r2 = 0
           6: (63) *(u32 *)(r10 -4) = r2
           7: (79) r1 = *(u64 *)(r1 +8)
           ...
           22: (07) r1 += 1
           23: (63) *(u32 *)(r0 +4) = r1
           24: (95) exit
      
        $ bpftool prog dump jited id 1
        int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
        bpf_prog_b07ccb89267cf242__dummy_tracepoint:
           0:   push   %rbp
           1:   mov    %rsp,%rbp
          ......
          3c:   add    $0x28,%rbp
          40:   leaveq
          41:   retq
      
        int test_long_fname_1(struct dummy_tracepoint_args * arg):
        bpf_prog_2dcecc18072623fc_test_long_fname_1:
           0:   push   %rbp
           1:   mov    %rsp,%rbp
          ......
          3a:   add    $0x28,%rbp
          3e:   leaveq
          3f:   retq
      
        int test_long_fname_2(struct dummy_tracepoint_args * arg):
        bpf_prog_89d64e4abf0f0126_test_long_fname_2:
           0:   push   %rbp
           1:   mov    %rsp,%rbp
          ......
          80:   add    $0x28,%rbp
          84:   leaveq
          85:   retq
      
      Changelogs:
        v4 -> v5:
          . Add back BTF_KIND_FUNC_PROTO as v1 did.  The difference
            is BTF_KIND_FUNC_PROTO cannot have t->name_off now.
            All param metadata is defined in BTF_KIND_FUNC_PROTO.
            BTF_KIND_FUNC must have t->name_off != 0 and t->type
            refers to a BTF_KIND_FUNC_PROTO.
      
            The above is the conclusion after the discussion between
            Edward Cree, Alexei, Daniel, Yonghong and Martin.
        v3 -> v4:
          . Remove BTF_KIND_FUNC_PROTO. BTF_KIND_FUNC is used for
            both function pointer and subprogram. The name_off field
            is used to distinguish both.
          . The record size is added to the func_info subsection
            in .BTF.ext to enable future extension.
          . The bpf_prog_info interface change to make it similar
            bpf_prog_load.
          . Related kernel and libbpf changes to accommodate the
            new .BTF.ext and kernel interface changes.
        v2 -> v3:
          . Removed kernel btf extern functions btf_type_id_func()
            and btf_get_name_by_id(). Instead, exposing existing
            functions btf_type_by_id() and btf_name_by_offset().
          . Added comments about ELF section .BTF.ext layout.
          . Better codes in btftool as suggested by Edward Cree.
        v1 -> v2:
          . Added missing sign-off.
          . Limited the func_name/struct_member_name length for validity test.
          . Removed/changed several verifier messages.
          . Modified several commit messages to remove line_off reference.
      ====================
      
      Acked-by: default avatarEdward Cree <ecree@solarflare.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      740baecd
    • Yonghong Song's avatar
      tools/bpf: bpftool: add support for func types · 254471e5
      Yonghong Song authored
      
      
      This patch added support to print function signature
      if btf func_info is available. Note that ksym
      now uses function name instead of prog_name as
      prog_name has a limit of 16 bytes including
      ending '\0'.
      
      The following is a sample output for selftests
      test_btf with file test_btf_haskv.o for translated insns
      and jited insns respectively.
      
        $ bpftool prog dump xlated id 1
        int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
           0: (85) call pc+2#bpf_prog_2dcecc18072623fc_test_long_fname_1
           1: (b7) r0 = 0
           2: (95) exit
        int test_long_fname_1(struct dummy_tracepoint_args * arg):
           3: (85) call pc+1#bpf_prog_89d64e4abf0f0126_test_long_fname_2
           4: (95) exit
        int test_long_fname_2(struct dummy_tracepoint_args * arg):
           5: (b7) r2 = 0
           6: (63) *(u32 *)(r10 -4) = r2
           7: (79) r1 = *(u64 *)(r1 +8)
           ...
           22: (07) r1 += 1
           23: (63) *(u32 *)(r0 +4) = r1
           24: (95) exit
      
        $ bpftool prog dump jited id 1
        int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
        bpf_prog_b07ccb89267cf242__dummy_tracepoint:
           0:   push   %rbp
           1:   mov    %rsp,%rbp
          ......
          3c:   add    $0x28,%rbp
          40:   leaveq
          41:   retq
      
        int test_long_fname_1(struct dummy_tracepoint_args * arg):
        bpf_prog_2dcecc18072623fc_test_long_fname_1:
           0:   push   %rbp
           1:   mov    %rsp,%rbp
          ......
          3a:   add    $0x28,%rbp
          3e:   leaveq
          3f:   retq
      
        int test_long_fname_2(struct dummy_tracepoint_args * arg):
        bpf_prog_89d64e4abf0f0126_test_long_fname_2:
           0:   push   %rbp
           1:   mov    %rsp,%rbp
          ......
          80:   add    $0x28,%rbp
          84:   leaveq
          85:   retq
      
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      254471e5
    • Yonghong Song's avatar
      tools/bpf: enhance test_btf file testing to test func info · 999d82cb
      Yonghong Song authored
      
      
      Change the bpf programs test_btf_haskv.c and test_btf_nokv.c to
      have two sections, and enhance test_btf.c test_file feature
      to test btf func_info returned by the kernel.
      
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      999d82cb
    • Yonghong Song's avatar
      tools/bpf: refactor to implement btf_get_from_id() in lib/bpf · d7f5b5e0
      Yonghong Song authored
      
      
      The function get_btf() is implemented in tools/bpf/bpftool/map.c
      to get a btf structure given a map_info. This patch
      refactored this function to be function btf_get_from_id()
      in tools/lib/bpf so that it can be used later.
      
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      d7f5b5e0
    • Yonghong Song's avatar
      tools/bpf: do not use pahole if clang/llvm can generate BTF sections · 9ce6ae22
      Yonghong Song authored
      
      
      Add additional checks in tools/testing/selftests/bpf and
      samples/bpf such that if clang/llvm compiler can generate
      BTF sections, do not use pahole.
      
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      9ce6ae22
    • Yonghong Song's avatar
      tools/bpf: add support to read .BTF.ext sections · 2993e051
      Yonghong Song authored
      The .BTF section is already available to encode types.
      These types can be used for map
      pretty print. The whole .BTF will be passed to the
      kernel as well for which kernel can verify and return
      to the user space for pretty print etc.
      
      The llvm patch at https://reviews.llvm.org/D53736
      
      
      will generate .BTF section and one more section .BTF.ext.
      The .BTF.ext section encodes function type
      information and line information. Note that
      this patch set only supports function type info.
      The functionality is implemented in libbpf.
      
      The .BTF section can be directly loaded into the
      kernel, and the .BTF.ext section cannot. The loader
      may need to do some relocation and merging,
      similar to merging multiple code sections, before
      loading into the kernel.
      
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      2993e051
    • Yonghong Song's avatar
      tools/bpf: extends test_btf to test load/retrieve func_type info · 4798c4ba
      Yonghong Song authored
      
      
      A two function bpf program is loaded with btf and func_info.
      After successful prog load, the bpf_get_info syscall is called
      to retrieve prog info to ensure the types returned from the
      kernel matches the types passed to the kernel from the
      user space.
      
      Several negative tests are also added to test loading/retriving
      of func_type info.
      
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      4798c4ba
    • Yonghong Song's avatar
      tools/bpf: add new fields for program load in lib/bpf · 7e0d0fb5
      Yonghong Song authored
      
      
      The new fields are added for program load in lib/bpf so
      application uses api bpf_load_program_xattr() is able
      to load program with btf and func_info data.
      
      This functionality will be used in next patch
      by bpf selftest test_btf.
      
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      7e0d0fb5
    • Yonghong Song's avatar
      tools/bpf: sync kernel uapi bpf.h header to tools directory · cc19435c
      Yonghong Song authored
      
      
      The kernel uapi bpf.h is synced to tools directory.
      
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      cc19435c
    • Yonghong Song's avatar
      bpf: Introduce bpf_func_info · 838e9690
      Yonghong Song authored
      
      
      This patch added interface to load a program with the following
      additional information:
         . prog_btf_fd
         . func_info, func_info_rec_size and func_info_cnt
      where func_info will provide function range and type_id
      corresponding to each function.
      
      The func_info_rec_size is introduced in the UAPI to specify
      struct bpf_func_info size passed from user space. This
      intends to make bpf_func_info structure growable in the future.
      If the kernel gets a different bpf_func_info size from userspace,
      it will try to handle user request with part of bpf_func_info
      it can understand. In this patch, kernel can understand
        struct bpf_func_info {
             __u32   insn_offset;
             __u32   type_id;
        };
      If user passed a bpf func_info record size of 16 bytes, the
      kernel can still handle part of records with the above definition.
      
      If verifier agrees with function range provided by the user,
      the bpf_prog ksym for each function will use the func name
      provided in the type_id, which is supposed to provide better
      encoding as it is not limited by 16 bytes program name
      limitation and this is better for bpf program which contains
      multiple subprograms.
      
      The bpf_prog_info interface is also extended to
      return btf_id, func_info, func_info_rec_size and func_info_cnt
      to userspace, so userspace can print out the function prototype
      for each xlated function. The insn_offset in the returned
      func_info corresponds to the insn offset for xlated functions.
      With other jit related fields in bpf_prog_info, userspace can also
      print out function prototypes for each jited function.
      
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      838e9690
    • Martin KaFai Lau's avatar
      tools/bpf: Add tests for BTF_KIND_FUNC_PROTO and BTF_KIND_FUNC · 78a2540e
      Martin KaFai Lau authored
      
      
      This patch adds unit tests for BTF_KIND_FUNC_PROTO and
      BTF_KIND_FUNC to test_btf.
      
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      78a2540e
    • Martin KaFai Lau's avatar
      tools/bpf: Sync kernel btf.h header · 781e775e
      Martin KaFai Lau authored
      
      
      The kernel uapi btf.h is synced to the tools directory.
      
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      781e775e
    • Martin KaFai Lau's avatar
      bpf: btf: Add BTF_KIND_FUNC and BTF_KIND_FUNC_PROTO · 2667a262
      Martin KaFai Lau authored
      
      
      This patch adds BTF_KIND_FUNC and BTF_KIND_FUNC_PROTO
      to support the function debug info.
      
      BTF_KIND_FUNC_PROTO must not have a name (i.e. !t->name_off)
      and it is followed by >= 0 'struct bpf_param' objects to
      describe the function arguments.
      
      The BTF_KIND_FUNC must have a valid name and it must
      refer back to a BTF_KIND_FUNC_PROTO.
      
      The above is the conclusion after the discussion between
      Edward Cree, Alexei, Daniel, Yonghong and Martin.
      
      By combining BTF_KIND_FUNC and BTF_LIND_FUNC_PROTO,
      a complete function signature can be obtained.  It will be
      used in the later patches to learn the function signature of
      a running bpf program.
      
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      2667a262
    • Martin KaFai Lau's avatar
      bpf: btf: Break up btf_type_is_void() · b47a0bd2
      Martin KaFai Lau authored
      
      
      This patch breaks up btf_type_is_void() into
      btf_type_is_void() and btf_type_is_fwd().
      
      It also adds btf_type_nosize() to better describe it is
      testing a type has nosize info.
      
      Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      b47a0bd2
  6. Nov 20, 2018
  7. Nov 17, 2018