1 /* instructions used to output a skb based software event, produced
2 * from code snippet:
3 * struct TMP {
4 * uint64_t tmp;
5 * } tt;
6 * tt.tmp = 5;
7 * bpf_perf_event_output(skb, &connection_tracking_event_map, 0,
8 * &tt, sizeof(tt));
9 * return 1;
10 *
11 * the bpf assembly from llvm is:
12 * 0: b7 02 00 00 05 00 00 00 r2 = 5
13 * 1: 7b 2a f8 ff 00 00 00 00 *(u64 *)(r10 - 8) = r2
14 * 2: bf a4 00 00 00 00 00 00 r4 = r10
15 * 3: 07 04 00 00 f8 ff ff ff r4 += -8
16 * 4: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0ll
17 * 6: b7 03 00 00 00 00 00 00 r3 = 0
18 * 7: b7 05 00 00 08 00 00 00 r5 = 8
19 * 8: 85 00 00 00 19 00 00 00 call 25
20 * 9: b7 00 00 00 01 00 00 00 r0 = 1
21 * 10: 95 00 00 00 00 00 00 00 exit
22 *
23 * The reason I put the code here instead of fill_helpers is that map fixup
24 * is against the insns, instead of filled prog.
25 */
26
27 #define __PERF_EVENT_INSNS__ \
28 BPF_MOV64_IMM(BPF_REG_2, 5), \
29 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8), \
30 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), \
31 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), \
32 BPF_LD_MAP_FD(BPF_REG_2, 0), \
33 BPF_MOV64_IMM(BPF_REG_3, 0), \
34 BPF_MOV64_IMM(BPF_REG_5, 8), \
35 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, \
36 BPF_FUNC_perf_event_output), \
37 BPF_MOV64_IMM(BPF_REG_0, 1), \
38 BPF_EXIT_INSN(),
39 {
40 "perfevent for sockops",
41 .insns = { __PERF_EVENT_INSNS__ },
42 .prog_type = BPF_PROG_TYPE_SOCK_OPS,
43 .fixup_map_event_output = { 4 },
44 .result = ACCEPT,
45 .retval = 1,
46 },
47 {
48 "perfevent for tc",
49 .insns = { __PERF_EVENT_INSNS__ },
50 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
51 .fixup_map_event_output = { 4 },
52 .result = ACCEPT,
53 .retval = 1,
54 },
55 {
56 "perfevent for lwt out",
57 .insns = { __PERF_EVENT_INSNS__ },
58 .prog_type = BPF_PROG_TYPE_LWT_OUT,
59 .fixup_map_event_output = { 4 },
60 .result = ACCEPT,
61 .retval = 1,
62 },
63 {
64 "perfevent for xdp",
65 .insns = { __PERF_EVENT_INSNS__ },
66 .prog_type = BPF_PROG_TYPE_XDP,
67 .fixup_map_event_output = { 4 },
68 .result = ACCEPT,
69 .retval = 1,
70 },
71 {
72 "perfevent for socket filter",
73 .insns = { __PERF_EVENT_INSNS__ },
74 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
75 .fixup_map_event_output = { 4 },
76 .result = ACCEPT,
77 .retval = 1,
78 },
79 {
80 "perfevent for sk_skb",
81 .insns = { __PERF_EVENT_INSNS__ },
82 .prog_type = BPF_PROG_TYPE_SK_SKB,
83 .fixup_map_event_output = { 4 },
84 .result = ACCEPT,
85 .retval = 1,
86 },
87 {
88 "perfevent for cgroup skb",
89 .insns = { __PERF_EVENT_INSNS__ },
90 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
91 .fixup_map_event_output = { 4 },
92 .result = ACCEPT,
93 .retval = 1,
94 },
95 {
96 "perfevent for cgroup dev",
97 .insns = { __PERF_EVENT_INSNS__ },
98 .prog_type = BPF_PROG_TYPE_CGROUP_DEVICE,
99 .fixup_map_event_output = { 4 },
100 .result = ACCEPT,
101 .retval = 1,
102 },
103 {
104 "perfevent for cgroup sysctl",
105 .insns = { __PERF_EVENT_INSNS__ },
106 .prog_type = BPF_PROG_TYPE_CGROUP_SYSCTL,
107 .fixup_map_event_output = { 4 },
108 .result = ACCEPT,
109 .retval = 1,
110 },
111 {
112 "perfevent for cgroup sockopt",
113 .insns = { __PERF_EVENT_INSNS__ },
114 .prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT,
115 .expected_attach_type = BPF_CGROUP_SETSOCKOPT,
116 .fixup_map_event_output = { 4 },
117 .result = ACCEPT,
118 .retval = 1,
119 },
120
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.