A dynamic tracer for Linux

ir.c 11KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543
  1. #include <assert.h>
  2. #include <inttypes.h>
  3. #include <stdio.h>
  4. #include <string.h>
  5. #include <linux/bpf.h>
  6. #include "ir.h"
  7. #include "sym.h"
  8. #include "type.h"
  9. const uint16_t vreg_base = 0x8000;
  10. static const char *bpf_func_name(enum bpf_func_id id)
  11. {
  12. switch (id) {
  13. case BPF_FUNC_get_current_comm:
  14. return "get_current_comm";
  15. case BPF_FUNC_get_current_pid_tgid:
  16. return "get_current_pid_tgid";
  17. case BPF_FUNC_get_current_uid_gid:
  18. return "get_current_uid_gid";
  19. case BPF_FUNC_get_stackid:
  20. return "get_stackid";
  21. case BPF_FUNC_ktime_get_ns:
  22. return "ktime_get_ns";
  23. case BPF_FUNC_map_delete_elem:
  24. return "map_delete_elem";
  25. case BPF_FUNC_map_lookup_elem:
  26. return "map_lookup_elem";
  27. case BPF_FUNC_map_update_elem:
  28. return "map_update_elem";
  29. case BPF_FUNC_perf_event_output:
  30. return "perf_event_output";
  31. case BPF_FUNC_probe_read:
  32. return "probe_read";
  33. case BPF_FUNC_trace_printk:
  34. return "trace_printk";
  35. default:
  36. return NULL;
  37. }
  38. }
  39. static void reg_name(uint16_t reg, char *name)
  40. {
  41. if (reg & vreg_base) {
  42. sprintf(name, "v%u", reg & ~vreg_base);
  43. } else if (reg == BPF_REG_10) {
  44. strcpy(name, "bp");
  45. } else {
  46. sprintf(name, "r%u", reg);
  47. }
  48. }
  49. static void reg_dump(uint16_t reg, int16_t off, FILE *fp)
  50. {
  51. char name[8];
  52. reg_name(reg, name);
  53. if (off < 0)
  54. fprintf(fp, "[%s - 0x%x]", name, -off);
  55. else if (off > 0)
  56. fprintf(fp, "[%s + 0x%x]", name, off);
  57. else
  58. fprintf(fp, "%s", name);
  59. }
  60. static char size_name(uint8_t code)
  61. {
  62. switch (BPF_SIZE(code)) {
  63. case BPF_B: return 'b';
  64. case BPF_H: return 'h';
  65. case BPF_W: return 'w';
  66. case BPF_DW: return 'q';
  67. }
  68. return '?';
  69. }
  70. static void alu_dump(uint8_t code, FILE *fp)
  71. {
  72. switch (BPF_OP(code)) {
  73. case BPF_MOV: fputs("mov", fp); break;
  74. case BPF_ADD: fputs("add", fp); break;
  75. case BPF_SUB: fputs("sub", fp); break;
  76. case BPF_MUL: fputs("mul", fp); break;
  77. case BPF_DIV: fputs("div", fp); break;
  78. case BPF_OR : fputs("or", fp); break;
  79. case BPF_AND: fputs("and", fp); break;
  80. case BPF_LSH: fputs("lsh", fp); break;
  81. case BPF_RSH: fputs("rsh", fp); break;
  82. case BPF_NEG: fputs("neg", fp); break;
  83. case BPF_MOD: fputs("mod", fp); break;
  84. case BPF_XOR: fputs("xor", fp); break;
  85. }
  86. switch (BPF_CLASS(code)) {
  87. case BPF_ALU: fputc(size_name(BPF_W), fp);
  88. case BPF_ALU64: fputc(size_name(BPF_DW), fp);
  89. }
  90. }
  91. static void offset_dump(int16_t off, FILE *fp)
  92. {
  93. if (off < 0)
  94. fprintf(fp, "L%d", -off);
  95. else
  96. fprintf(fp, "+%d", off);
  97. }
  98. static void __insn_dump(const struct bpf_insn insn, uint16_t dst, uint16_t src,
  99. FILE *fp)
  100. {
  101. const char *name;
  102. enum {
  103. OFF_NONE,
  104. OFF_DST,
  105. OFF_SRC,
  106. OFF_EXP,
  107. } off = OFF_NONE;
  108. switch (BPF_CLASS(insn.code)) {
  109. case BPF_LD:
  110. case BPF_LDX:
  111. off = OFF_SRC;
  112. fprintf(fp, "ld%c", size_name(insn.code));
  113. break;
  114. case BPF_ST:
  115. case BPF_STX:
  116. off = OFF_DST;
  117. fprintf(fp, "st%c", size_name(insn.code));
  118. break;
  119. case BPF_ALU:
  120. case BPF_ALU64:
  121. alu_dump(insn.code, fp);
  122. break;
  123. case BPF_JMP:
  124. off = OFF_EXP;
  125. switch (BPF_OP(insn.code)) {
  126. case BPF_EXIT:
  127. fputs("exit", fp);
  128. return;
  129. case BPF_CALL:
  130. fputs("call\t", fp);
  131. name = bpf_func_name(insn.imm);
  132. if (name)
  133. fputs(name, fp);
  134. else
  135. fprintf(fp, "%d", insn.imm);
  136. return;
  137. case BPF_JA:
  138. fputs("ja\t", fp);
  139. offset_dump(insn.off, fp);
  140. return;
  141. case BPF_JEQ: fputs("jeq", fp); break;
  142. case BPF_JNE: fputs("jne", fp); break;
  143. case BPF_JGT: fputs("jgt", fp); break;
  144. case BPF_JGE: fputs("jge", fp); break;
  145. case BPF_JSGE: fputs("jsge", fp); break;
  146. case BPF_JSGT: fputs("jsgt", fp); break;
  147. default:
  148. goto unknown;
  149. }
  150. break;
  151. default:
  152. goto unknown;
  153. }
  154. fputc('\t', fp);
  155. reg_dump(dst, off == OFF_DST ? insn.off : 0, fp);
  156. fputs(", ", fp);
  157. if (BPF_CLASS(insn.code) == BPF_LDX || BPF_CLASS(insn.code) == BPF_STX)
  158. goto reg_src;
  159. else if (BPF_CLASS(insn.code) == BPF_ST)
  160. goto imm_src;
  161. switch (BPF_SRC(insn.code)) {
  162. case BPF_K:
  163. imm_src:
  164. fprintf(fp, "#%s0x%x", insn.imm < 0 ? "-" : "",
  165. insn.imm < 0 ? -insn.imm : insn.imm);
  166. break;
  167. case BPF_X:
  168. reg_src:
  169. reg_dump(src, off == OFF_SRC ? insn.off : 0, fp);
  170. break;
  171. }
  172. if (off == OFF_EXP) {
  173. fputs(", ", fp);
  174. offset_dump(insn.off, fp);
  175. }
  176. return;
  177. unknown:
  178. fprintf(fp, "data\t0x%16.16" PRIx64 "\n", *((uint64_t *)&insn));
  179. }
  180. void insn_dump(struct bpf_insn insn, FILE *fp)
  181. {
  182. __insn_dump(insn, insn.dst_reg, insn.src_reg, fp);
  183. }
  184. void vinsn_dump(struct vinsn *vi, FILE *fp)
  185. {
  186. switch (vi->vitype) {
  187. case VI_INSN:
  188. __insn_dump(vi->insn.bpf, vi->insn.dst, vi->insn.src, fp);
  189. return;
  190. case VI_LDMAP:
  191. fputs("ldmap\t", fp); reg_dump(vi->map.reg, 0, fp);
  192. fprintf(fp, ", %s", vi->map.sym->name);
  193. return;
  194. case VI_LABEL:
  195. offset_dump(vi->label, fp);
  196. fputc(':', fp);
  197. return;
  198. case VI_REG_GET:
  199. case VI_REG_PUT:
  200. fputs((vi->vitype == VI_REG_GET) ? "+ " : "- ", fp);
  201. reg_dump(vi->reg, 0, fp);
  202. return;
  203. }
  204. }
  205. void ir_dump(struct ir *ir, FILE *fp)
  206. {
  207. size_t i;
  208. for (i = 0; i < ir->len; i++) {
  209. struct vinsn *vi = &ir->vi[i];
  210. switch (vi->vitype) {
  211. case VI_INSN:
  212. case VI_LDMAP:
  213. fputc('\t', fp);
  214. break;
  215. case VI_REG_GET:
  216. case VI_REG_PUT:
  217. fputs("\e[2m", fp);
  218. case VI_LABEL:
  219. default:
  220. break;
  221. }
  222. vinsn_dump(vi, fp);
  223. /* print multiple gets/puts on one line */
  224. switch (vi->vitype) {
  225. case VI_REG_GET:
  226. for (; (vi + 1)->vitype == VI_REG_GET; vi++, i++) {
  227. fputs(", ", fp);
  228. reg_dump((vi + 1)->reg, 0, fp);
  229. }
  230. fputs("\e[0m", fp);
  231. break;
  232. case VI_REG_PUT:
  233. for (; (vi + 1)->vitype == VI_REG_PUT; vi++, i++) {
  234. fputs(", ", fp);
  235. reg_dump((vi + 1)->reg, 0, fp);
  236. }
  237. fputs("\e[0m", fp);
  238. break;
  239. default:
  240. break;
  241. }
  242. fputc('\n', fp);
  243. }
  244. }
  245. static void ir_emit(struct ir *ir, struct vinsn *vi)
  246. {
  247. ir->vi = realloc(ir->vi, (++ir->len)*sizeof(*vi));
  248. assert(ir->vi);
  249. ir->vi[ir->len - 1] = *vi;
  250. }
  251. void ir_emit_insn(struct ir *ir, struct bpf_insn bpf, uint16_t dst, uint16_t src)
  252. {
  253. struct vinsn vi;
  254. vi.vitype = VI_INSN;
  255. vi.insn.bpf = bpf;
  256. vi.insn.dst = dst;
  257. vi.insn.src = src;
  258. ir_emit(ir, &vi);
  259. }
  260. void ir_emit_ldmap(struct ir *ir, uint16_t dst, struct sym *map)
  261. {
  262. struct vinsn vi;
  263. vi.vitype = VI_LDMAP;
  264. vi.map.reg = dst;
  265. vi.map.sym = map;
  266. ir_emit(ir, &vi);
  267. }
  268. void ir_emit_label (struct ir *ir, int16_t label)
  269. {
  270. struct vinsn vi;
  271. vi.vitype = VI_LABEL;
  272. vi.label = label;
  273. ir_emit(ir, &vi);
  274. }
  275. void ir_emit_sym_to_reg(struct ir *ir, uint16_t dst, struct sym *src)
  276. {
  277. struct irstate *irs = &src->irs;
  278. switch (irs->loc) {
  279. case LOC_IMM:
  280. ir_emit_insn(ir, MOV_IMM(irs->imm), dst, 0);
  281. break;
  282. case LOC_REG:
  283. if (dst == irs->reg)
  284. break;
  285. if (irs->size == 8)
  286. ir_emit_insn(ir, MOV64, dst, irs->reg);
  287. else
  288. ir_emit_insn(ir, MOV, dst, irs->reg);
  289. break;
  290. case LOC_STACK:
  291. ir_emit_insn(ir, LDX(bpf_width(irs->size), irs->stack),
  292. dst, BPF_REG_BP);
  293. break;
  294. default:
  295. assert(0);
  296. }
  297. }
  298. void ir_emit_reg_to_sym(struct ir *ir, struct sym *dst, uint16_t src)
  299. {
  300. struct irstate *irs = &dst->irs;
  301. switch (irs->loc) {
  302. case LOC_REG:
  303. if (irs->reg == src)
  304. break;
  305. if (irs->size == 8)
  306. ir_emit_insn(ir, MOV64, irs->reg, src);
  307. else
  308. ir_emit_insn(ir, MOV, irs->reg, src);
  309. break;
  310. case LOC_STACK:
  311. ir_emit_insn(ir, STX(bpf_width(irs->size), irs->stack),
  312. BPF_REG_BP, src);
  313. break;
  314. default:
  315. assert(0);
  316. }
  317. }
  318. void ir_emit_sym_to_stack(struct ir *ir, ssize_t offset, struct sym *src)
  319. {
  320. struct irstate *irs = &src->irs;
  321. switch (irs->loc) {
  322. case LOC_IMM:
  323. ir_emit_insn(ir, ST_IMM(bpf_width(irs->size), offset, irs->imm),
  324. BPF_REG_BP, 0);
  325. break;
  326. case LOC_REG:
  327. ir_emit_insn(ir, STX(bpf_width(irs->size), offset),
  328. BPF_REG_BP, irs->reg);
  329. case LOC_STACK:
  330. ir_emit_memcpy(ir, offset, irs->stack, irs->size);
  331. break;
  332. default:
  333. assert(0);
  334. }
  335. }
  336. void ir_emit_sym_to_sym(struct ir *ir, struct sym *dst, struct sym *src)
  337. {
  338. switch (dst->irs.loc) {
  339. case LOC_REG:
  340. ir_emit_sym_to_reg(ir, dst->irs.reg, src);
  341. break;
  342. case LOC_STACK:
  343. ir_emit_sym_to_stack(ir, dst->irs.stack, src);
  344. break;
  345. default:
  346. assert(0);
  347. break;
  348. }
  349. }
  350. void ir_emit_read_to_sym(struct ir *ir, struct sym *dst, uint16_t src)
  351. {
  352. struct irstate *irs = &dst->irs;
  353. assert(irs->loc == LOC_STACK);
  354. ir_emit_insn(ir, MOV, BPF_REG_1, BPF_REG_BP);
  355. ir_emit_insn(ir, ALU_IMM(BPF_ADD, irs->stack), BPF_REG_1, 0);
  356. ir_emit_insn(ir, MOV_IMM((int32_t)irs->size), BPF_REG_2, 0);
  357. if (src != BPF_REG_3)
  358. ir_emit_insn(ir, MOV, BPF_REG_3, src);
  359. ir_emit_insn(ir, CALL(BPF_FUNC_probe_read), 0, 0);
  360. /* TODO if (r0) exit(r0); */
  361. }
  362. void ir_emit_memcpy(struct ir *ir, ssize_t dst, ssize_t src, size_t size)
  363. {
  364. if (dst == src)
  365. return;
  366. for (; size >= 8; size -= 8, dst += 8, src += 8) {
  367. ir_emit_insn(ir, LDX(BPF_DW, src), BPF_REG_0, BPF_REG_BP);
  368. ir_emit_insn(ir, STX(BPF_DW, dst), BPF_REG_BP, BPF_REG_0);
  369. }
  370. if (size >= 4) {
  371. ir_emit_insn(ir, LDX(BPF_W, src), BPF_REG_0, BPF_REG_BP);
  372. ir_emit_insn(ir, STX(BPF_W, dst), BPF_REG_BP, BPF_REG_0);
  373. size -= 4, dst += 4, src += 4;
  374. }
  375. if (size >= 2) {
  376. ir_emit_insn(ir, LDX(BPF_H, src), BPF_REG_0, BPF_REG_BP);
  377. ir_emit_insn(ir, STX(BPF_H, dst), BPF_REG_BP, BPF_REG_0);
  378. size -= 2, dst += 2, src += 2;
  379. }
  380. if (size >= 1) {
  381. ir_emit_insn(ir, LDX(BPF_B, src), BPF_REG_0, BPF_REG_BP);
  382. ir_emit_insn(ir, STX(BPF_B, dst), BPF_REG_BP, BPF_REG_0);
  383. size -= 1, dst += 1, src += 1;
  384. }
  385. assert(size == 0);
  386. }
  387. void ir_emit_bzero(struct ir *ir, ssize_t offset, size_t size)
  388. {
  389. for (; size >= 8; size -= 8)
  390. ir_emit_insn(ir, ST_IMM(BPF_DW, offset, 0), BPF_REG_BP, 0);
  391. if (size >= 4) {
  392. ir_emit_insn(ir, ST_IMM(BPF_W, offset, 0), BPF_REG_BP, 0);
  393. size -= 4;
  394. }
  395. if (size >= 2) {
  396. ir_emit_insn(ir, ST_IMM(BPF_H, offset, 0), BPF_REG_BP, 0);
  397. size -= 2;
  398. }
  399. if (size >= 1) {
  400. ir_emit_insn(ir, ST_IMM(BPF_B, offset, 0), BPF_REG_BP, 0);
  401. size -= 1;
  402. }
  403. assert(size == 0);
  404. }
  405. int16_t ir_alloc_label (struct ir *ir)
  406. {
  407. return ir->next_label--;
  408. }
  409. uint16_t ir_alloc_register(struct ir *ir)
  410. {
  411. return ir->next_reg++;
  412. }
  413. ssize_t ir_alloc_stack(struct ir *ir, size_t size, size_t align)
  414. {
  415. ir->sp -= size;
  416. if (ir->sp % align)
  417. ir->sp -= align - (ir->sp & align);
  418. assert(ir->sp > INT16_MIN);
  419. return ir->sp;
  420. }
  421. void ir_init_irs(struct ir *ir, struct irstate *irs, struct type *t)
  422. {
  423. t = type_base(t);
  424. if (irs->loc)
  425. return;
  426. irs->size = type_sizeof(t);
  427. if ((!irs->hint.stack)
  428. && ((t->ttype == T_SCALAR) || (t->ttype == T_POINTER))) {
  429. irs->loc = LOC_REG;
  430. irs->reg = ir_alloc_register(ir);
  431. return;
  432. }
  433. irs->loc = LOC_STACK;
  434. /* a parent may already have filled in a stack position.
  435. * usually this is when we're part of a map key. */
  436. if (!irs->stack)
  437. irs->stack = ir_alloc_stack(ir, irs->size, type_alignof(t));
  438. }
  439. void ir_init_sym(struct ir *ir, struct sym *sym)
  440. {
  441. return ir_init_irs(ir, &sym->irs, sym->type);
  442. }
  443. struct ir *ir_new(void)
  444. {
  445. struct ir *ir;
  446. ir = calloc(1, sizeof(*ir));
  447. assert(ir);
  448. ir->next_reg = vreg_base;
  449. ir->next_label = -1;
  450. return ir;
  451. }
  452. int ir_generate_bpf(struct ir *ir)
  453. {
  454. return 0;
  455. }