A dynamic tracer for Linux

ir.c 6.5KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355
  1. #include <assert.h>
  2. #include <inttypes.h>
  3. #include <stdio.h>
  4. #include <string.h>
  5. #include <linux/bpf.h>
  6. #include "ir.h"
  7. #include "sym.h"
  8. const uint16_t vreg_base = 0x8000;
  9. static const char *bpf_func_name(enum bpf_func_id id)
  10. {
  11. switch (id) {
  12. case BPF_FUNC_get_current_comm:
  13. return "get_current_comm";
  14. case BPF_FUNC_get_current_pid_tgid:
  15. return "get_current_pid_tgid";
  16. case BPF_FUNC_get_current_uid_gid:
  17. return "get_current_uid_gid";
  18. case BPF_FUNC_get_stackid:
  19. return "get_stackid";
  20. case BPF_FUNC_ktime_get_ns:
  21. return "ktime_get_ns";
  22. case BPF_FUNC_map_delete_elem:
  23. return "map_delete_elem";
  24. case BPF_FUNC_map_lookup_elem:
  25. return "map_lookup_elem";
  26. case BPF_FUNC_map_update_elem:
  27. return "map_update_elem";
  28. case BPF_FUNC_perf_event_output:
  29. return "perf_event_output";
  30. case BPF_FUNC_probe_read:
  31. return "probe_read";
  32. case BPF_FUNC_trace_printk:
  33. return "trace_printk";
  34. default:
  35. return NULL;
  36. }
  37. }
  38. static void reg_name(uint16_t reg, char *name)
  39. {
  40. if (reg & vreg_base) {
  41. sprintf(name, "v%u", reg & ~vreg_base);
  42. } else if (reg == BPF_REG_10) {
  43. strcpy(name, "bp");
  44. } else {
  45. sprintf(name, "r%u", reg);
  46. }
  47. }
  48. static void reg_dump(uint16_t reg, int16_t off, FILE *fp)
  49. {
  50. char name[8];
  51. reg_name(reg, name);
  52. if (off < 0)
  53. fprintf(fp, "[%s - 0x%x]", name, -off);
  54. else if (off > 0)
  55. fprintf(fp, "[%s + 0x%x]", name, off);
  56. else
  57. fprintf(fp, "%s", name);
  58. }
  59. static char size_name(uint8_t code)
  60. {
  61. switch (BPF_SIZE(code)) {
  62. case BPF_B: return 'b';
  63. case BPF_H: return 'h';
  64. case BPF_W: return 'w';
  65. case BPF_DW: return 'q';
  66. }
  67. return '?';
  68. }
  69. static void alu_dump(uint8_t code, FILE *fp)
  70. {
  71. switch (BPF_OP(code)) {
  72. case BPF_MOV: fputs("mov", fp); break;
  73. case BPF_ADD: fputs("add", fp); break;
  74. case BPF_SUB: fputs("sub", fp); break;
  75. case BPF_MUL: fputs("mul", fp); break;
  76. case BPF_DIV: fputs("div", fp); break;
  77. case BPF_OR : fputs("or", fp); break;
  78. case BPF_AND: fputs("and", fp); break;
  79. case BPF_LSH: fputs("lsh", fp); break;
  80. case BPF_RSH: fputs("rsh", fp); break;
  81. case BPF_NEG: fputs("neg", fp); break;
  82. case BPF_MOD: fputs("mod", fp); break;
  83. case BPF_XOR: fputs("xor", fp); break;
  84. }
  85. switch (BPF_CLASS(code)) {
  86. case BPF_ALU: fputc(size_name(BPF_W), fp);
  87. case BPF_ALU64: fputc(size_name(BPF_DW), fp);
  88. }
  89. }
  90. static void offset_dump(int16_t off, FILE *fp)
  91. {
  92. if (off < 0)
  93. fprintf(fp, "L%d", -off);
  94. else
  95. fprintf(fp, "+%d", off);
  96. }
  97. static void __insn_dump(const struct bpf_insn insn, uint16_t dst, uint16_t src,
  98. FILE *fp)
  99. {
  100. const char *name;
  101. enum {
  102. OFF_NONE,
  103. OFF_DST,
  104. OFF_SRC,
  105. OFF_EXP,
  106. } off = OFF_NONE;
  107. switch (BPF_CLASS(insn.code)) {
  108. case BPF_LD:
  109. case BPF_LDX:
  110. off = OFF_SRC;
  111. fprintf(fp, "ld%c", size_name(insn.code));
  112. break;
  113. case BPF_ST:
  114. case BPF_STX:
  115. off = OFF_DST;
  116. fprintf(fp, "st%c", size_name(insn.code));
  117. break;
  118. case BPF_ALU:
  119. case BPF_ALU64:
  120. alu_dump(insn.code, fp);
  121. break;
  122. case BPF_JMP:
  123. off = OFF_EXP;
  124. switch (BPF_OP(insn.code)) {
  125. case BPF_EXIT:
  126. fputs("exit", fp);
  127. return;
  128. case BPF_CALL:
  129. fputs("call\t", fp);
  130. name = bpf_func_name(insn.imm);
  131. if (name)
  132. fputs(name, fp);
  133. else
  134. fprintf(fp, "%d", insn.imm);
  135. return;
  136. case BPF_JA:
  137. fputs("ja\t", fp);
  138. offset_dump(insn.off, fp);
  139. return;
  140. case BPF_JEQ: fputs("jeq", fp); break;
  141. case BPF_JNE: fputs("jne", fp); break;
  142. case BPF_JGT: fputs("jgt", fp); break;
  143. case BPF_JGE: fputs("jge", fp); break;
  144. case BPF_JSGE: fputs("jsge", fp); break;
  145. case BPF_JSGT: fputs("jsgt", fp); break;
  146. default:
  147. goto unknown;
  148. }
  149. break;
  150. default:
  151. goto unknown;
  152. }
  153. fputc('\t', fp);
  154. reg_dump(dst, off == OFF_DST ? insn.off : 0, fp);
  155. fputs(", ", fp);
  156. if (BPF_CLASS(insn.code) == BPF_LDX || BPF_CLASS(insn.code) == BPF_STX)
  157. goto reg_src;
  158. switch (BPF_SRC(insn.code)) {
  159. case BPF_K:
  160. fprintf(fp, "#%s0x%x", insn.imm < 0 ? "-" : "",
  161. insn.imm < 0 ? -insn.imm : insn.imm);
  162. break;
  163. case BPF_X:
  164. reg_src:
  165. reg_dump(src, off == OFF_SRC ? insn.off : 0, fp);
  166. break;
  167. }
  168. if (off == OFF_EXP) {
  169. fputs(", ", fp);
  170. offset_dump(insn.off, fp);
  171. }
  172. return;
  173. unknown:
  174. fprintf(fp, "data\t0x%16.16" PRIx64 "\n", *((uint64_t *)&insn));
  175. }
  176. void insn_dump(struct bpf_insn insn, FILE *fp)
  177. {
  178. __insn_dump(insn, insn.dst_reg, insn.src_reg, fp);
  179. }
  180. void vinsn_dump(vinsn_t *vi, FILE *fp)
  181. {
  182. switch (vi->vitype) {
  183. case VI_INSN:
  184. __insn_dump(vi->insn.bpf, vi->insn.dst, vi->insn.src, fp);
  185. return;
  186. case VI_LDMAP:
  187. fputs("ldmap\t", fp); reg_dump(vi->map.reg, 0, fp);
  188. fprintf(fp, ", %s", vi->map.sym->name);
  189. return;
  190. case VI_LABEL:
  191. offset_dump(vi->label, fp);
  192. fputc(':', fp);
  193. return;
  194. case VI_REG_GET:
  195. case VI_REG_PUT:
  196. fputs((vi->vitype == VI_REG_GET) ? "+ " : "- ", fp);
  197. reg_dump(vi->reg, 0, fp);
  198. return;
  199. }
  200. }
  201. void ir_dump(ir_t *ir, FILE *fp)
  202. {
  203. size_t i;
  204. for (i = 0; i < ir->len; i++) {
  205. vinsn_t *vi = &ir->vi[i];
  206. switch (vi->vitype) {
  207. case VI_INSN:
  208. case VI_LDMAP:
  209. fputc('\t', fp);
  210. break;
  211. case VI_REG_GET:
  212. case VI_REG_PUT:
  213. fputs("\e[2m", fp);
  214. case VI_LABEL:
  215. default:
  216. break;
  217. }
  218. vinsn_dump(vi, fp);
  219. /* print multiple gets/puts on one line */
  220. switch (vi->vitype) {
  221. case VI_REG_GET:
  222. for (; (vi + 1)->vitype == VI_REG_GET; vi++, i++) {
  223. fputs(", ", fp);
  224. reg_dump((vi + 1)->reg, 0, fp);
  225. }
  226. fputs("\e[0m", fp);
  227. break;
  228. case VI_REG_PUT:
  229. for (; (vi + 1)->vitype == VI_REG_PUT; vi++, i++) {
  230. fputs(", ", fp);
  231. reg_dump((vi + 1)->reg, 0, fp);
  232. }
  233. fputs("\e[0m", fp);
  234. break;
  235. default:
  236. break;
  237. }
  238. fputc('\n', fp);
  239. }
  240. }
  241. static void ir_emit(ir_t *ir, vinsn_t *vi)
  242. {
  243. ir->vi = realloc(ir->vi, (++ir->len)*sizeof(*vi));
  244. assert(ir->vi);
  245. ir->vi[ir->len - 1] = *vi;
  246. }
  247. void ir_emit_insn(ir_t *ir, struct bpf_insn bpf, uint16_t dst, uint16_t src)
  248. {
  249. vinsn_t vi;
  250. vi.vitype = VI_INSN;
  251. vi.insn.bpf = bpf;
  252. vi.insn.dst = dst;
  253. vi.insn.src = src;
  254. ir_emit(ir, &vi);
  255. }
  256. void ir_emit_ldmap(ir_t *ir, uint16_t dst, sym_t *map)
  257. {
  258. vinsn_t vi;
  259. vi.vitype = VI_LDMAP;
  260. vi.map.reg = dst;
  261. vi.map.sym = map;
  262. ir_emit(ir, &vi);
  263. }
  264. void ir_emit_label (ir_t *ir, int16_t label)
  265. {
  266. vinsn_t vi;
  267. vi.vitype = VI_LABEL;
  268. vi.label = label;
  269. ir_emit(ir, &vi);
  270. }
  271. void ir_emit_reg_get(ir_t *ir, uint16_t reg)
  272. {
  273. vinsn_t vi;
  274. vi.vitype = VI_REG_GET;
  275. vi.reg = reg;
  276. ir_emit(ir, &vi);
  277. }
  278. void ir_emit_reg_put(ir_t *ir, uint16_t reg)
  279. {
  280. vinsn_t vi;
  281. vi.vitype = VI_REG_PUT;
  282. vi.reg = reg;
  283. ir_emit(ir, &vi);
  284. }
  285. int16_t ir_alloc_label (ir_t *ir)
  286. {
  287. return ir->next_label--;
  288. }
  289. uint16_t ir_alloc_register(ir_t *ir)
  290. {
  291. return ir->next_reg++;
  292. }
  293. ir_t *ir_new(void)
  294. {
  295. ir_t *ir;
  296. ir = calloc(1, sizeof(*ir));
  297. assert(ir);
  298. ir->next_reg = vreg_base;
  299. ir->next_label = -1;
  300. return ir;
  301. }