* [PATCH v4 0/3] Fix the incorrect register read for syscalls on x86_64 @ 2022-01-19 13:12 Kenta Tada 2022-01-19 13:12 ` [PATCH v4 1/3] libbpf: Extract syscall wrapper Kenta Tada ` (2 more replies) 0 siblings, 3 replies; 10+ messages in thread From: Kenta Tada @ 2022-01-19 13:12 UTC (permalink / raw) To: andrii, bpf Cc: ast, daniel, kafai, songliubraving, yhs, john.fastabend, kpsingh, Kenta Tada Currently, rcx is read as the fourth parameter of syscall on x86_64. But x86_64 Linux System Call convention uses r10 actually. This commit adds the wrapper for users who want to access to syscall params to analyze the user space. Changelog: ---------- v1 -> v2: - Rebase to current bpf-next https://lore.kernel.org/bpf/20211222213924.1869758-1-andrii@kernel.org/ v2 -> v3: - Modify the definition of SYSCALL macros for only targeted archs. - Define __BPF_TARGET_MISSING variants for completeness. - Remove CORE variants. These macros will not be used. - Add a selftest. v3 -> v4: - Modify a selftest not to use serial tests. - Modify a selftest to use ASSERT_EQ(). - Extract syscall wrapper for all the other tests. - Add CORE variants. Kenta Tada (3): libbpf: Extract syscall wrapper libbpf: Fix the incorrect register read for syscalls on x86_64 libbpf: Add a test to confirm PT_REGS_PARM4_SYSCALL tools/lib/bpf/bpf_tracing.h | 34 +++++++++++++ .../bpf/prog_tests/test_bpf_syscall_macro.c | 49 ++++++++++++++++++ tools/testing/selftests/bpf/progs/bpf_misc.h | 19 +++++++ .../selftests/bpf/progs/bpf_syscall_macro.c | 51 +++++++++++++++++++ .../selftests/bpf/progs/test_probe_user.c | 15 +----- 5 files changed, 154 insertions(+), 14 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c create mode 100644 tools/testing/selftests/bpf/progs/bpf_misc.h create mode 100644 tools/testing/selftests/bpf/progs/bpf_syscall_macro.c -- 2.32.0 ^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v4 1/3] libbpf: Extract syscall wrapper 2022-01-19 13:12 [PATCH v4 0/3] Fix the incorrect register read for syscalls on x86_64 Kenta Tada @ 2022-01-19 13:12 ` Kenta Tada 2022-01-19 13:12 ` [PATCH v4 2/3] libbpf: Fix the incorrect register read for syscalls on x86_64 Kenta Tada 2022-01-19 13:12 ` [PATCH v4 3/3] libbpf: Add a test to confirm PT_REGS_PARM4_SYSCALL Kenta Tada 2 siblings, 0 replies; 10+ messages in thread From: Kenta Tada @ 2022-01-19 13:12 UTC (permalink / raw) To: andrii, bpf Cc: ast, daniel, kafai, songliubraving, yhs, john.fastabend, kpsingh, Kenta Tada Extract the helper to set up SYS_PREFIX for fentry and kprobe selftests that use __x86_sys_* attach functions. Signed-off-by: Kenta Tada <Kenta.Tada@sony.com> Suggested-by: Andrii Nakryiko <andrii@kernel.org> --- tools/testing/selftests/bpf/progs/bpf_misc.h | 19 +++++++++++++++++++ .../selftests/bpf/progs/test_probe_user.c | 15 +-------------- 2 files changed, 20 insertions(+), 14 deletions(-) create mode 100644 tools/testing/selftests/bpf/progs/bpf_misc.h diff --git a/tools/testing/selftests/bpf/progs/bpf_misc.h b/tools/testing/selftests/bpf/progs/bpf_misc.h new file mode 100644 index 000000000000..0b78bc9b1b4c --- /dev/null +++ b/tools/testing/selftests/bpf/progs/bpf_misc.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __BPF_MISC_H__ +#define __BPF_MISC_H__ + +#if defined(__TARGET_ARCH_x86) +#define SYSCALL_WRAPPER 1 +#define SYS_PREFIX "__x64_" +#elif defined(__TARGET_ARCH_s390) +#define SYSCALL_WRAPPER 1 +#define SYS_PREFIX "__s390x_" +#elif defined(__TARGET_ARCH_arm64) +#define SYSCALL_WRAPPER 1 +#define SYS_PREFIX "__arm64_" +#else +#define SYSCALL_WRAPPER 0 +#define SYS_PREFIX "" +#endif + +#endif diff --git a/tools/testing/selftests/bpf/progs/test_probe_user.c b/tools/testing/selftests/bpf/progs/test_probe_user.c index 8812a90da4eb..702578a5e496 100644 --- a/tools/testing/selftests/bpf/progs/test_probe_user.c +++ b/tools/testing/selftests/bpf/progs/test_probe_user.c @@ -7,20 +7,7 @@ #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> - -#if defined(__TARGET_ARCH_x86) -#define SYSCALL_WRAPPER 1 -#define SYS_PREFIX "__x64_" -#elif defined(__TARGET_ARCH_s390) -#define SYSCALL_WRAPPER 1 -#define SYS_PREFIX "__s390x_" -#elif defined(__TARGET_ARCH_arm64) -#define SYSCALL_WRAPPER 1 -#define SYS_PREFIX "__arm64_" -#else -#define SYSCALL_WRAPPER 0 -#define SYS_PREFIX "" -#endif +#include "bpf_misc.h" static struct sockaddr_in old; -- 2.32.0 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH v4 2/3] libbpf: Fix the incorrect register read for syscalls on x86_64 2022-01-19 13:12 [PATCH v4 0/3] Fix the incorrect register read for syscalls on x86_64 Kenta Tada 2022-01-19 13:12 ` [PATCH v4 1/3] libbpf: Extract syscall wrapper Kenta Tada @ 2022-01-19 13:12 ` Kenta Tada 2022-01-19 18:33 ` Andrii Nakryiko 2022-01-19 13:12 ` [PATCH v4 3/3] libbpf: Add a test to confirm PT_REGS_PARM4_SYSCALL Kenta Tada 2 siblings, 1 reply; 10+ messages in thread From: Kenta Tada @ 2022-01-19 13:12 UTC (permalink / raw) To: andrii, bpf Cc: ast, daniel, kafai, songliubraving, yhs, john.fastabend, kpsingh, Kenta Tada Currently, rcx is read as the fourth parameter of syscall on x86_64. But x86_64 Linux System Call convention uses r10 actually. This commit adds the wrapper for users who want to access to syscall params to analyze the user space. Signed-off-by: Kenta Tada <Kenta.Tada@sony.com> --- tools/lib/bpf/bpf_tracing.h | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/tools/lib/bpf/bpf_tracing.h b/tools/lib/bpf/bpf_tracing.h index 90f56b0f585f..81673a24973e 100644 --- a/tools/lib/bpf/bpf_tracing.h +++ b/tools/lib/bpf/bpf_tracing.h @@ -70,6 +70,7 @@ #define __PT_PARM2_REG si #define __PT_PARM3_REG dx #define __PT_PARM4_REG cx +#define __PT_PARM4_REG_SYSCALL r10 /* syscall uses r10 */ #define __PT_PARM5_REG r8 #define __PT_RET_REG sp #define __PT_FP_REG bp @@ -99,6 +100,7 @@ #define __PT_PARM2_REG rsi #define __PT_PARM3_REG rdx #define __PT_PARM4_REG rcx +#define __PT_PARM4_REG_SYSCALL r10 /* syscall uses r10 */ #define __PT_PARM5_REG r8 #define __PT_RET_REG rsp #define __PT_FP_REG rbp @@ -263,6 +265,26 @@ struct pt_regs; #endif +#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1(x) +#define PT_REGS_PARM2_SYSCALL(x) PT_REGS_PARM2(x) +#define PT_REGS_PARM3_SYSCALL(x) PT_REGS_PARM3(x) +#ifdef __PT_PARM4_REG_SYSCALL +#define PT_REGS_PARM4_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG_SYSCALL) +#else /* __PT_PARM4_REG_SYSCALL */ +#define PT_REGS_PARM4_SYSCALL(x) PT_REGS_PARM4(x) +#endif +#define PT_REGS_PARM5_SYSCALL(x) PT_REGS_PARM5(x) + +#define PT_REGS_PARM1_CORE_SYSCALL(x) PT_REGS_PARM1_CORE(x) +#define PT_REGS_PARM2_CORE_SYSCALL(x) PT_REGS_PARM2_CORE(x) +#define PT_REGS_PARM3_CORE_SYSCALL(x) PT_REGS_PARM3_CORE(x) +#ifdef __PT_PARM4_REG_SYSCALL +#define PT_REGS_PARM4_CORE_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG_SYSCALL) +#else /* __PT_PARM4_REG_SYSCALL */ +#define PT_REGS_PARM4_CORE_SYSCALL(x) PT_REGS_PARM4_CORE(x) +#endif +#define PT_REGS_PARM5_CORE_SYSCALL(x) PT_REGS_PARM5_CORE(x) + #else /* defined(bpf_target_defined) */ #define PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) @@ -290,6 +312,18 @@ struct pt_regs; #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) #define BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM1_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM2_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) + +#define PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) +#define PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) + #endif /* defined(bpf_target_defined) */ #ifndef ___bpf_concat -- 2.32.0 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH v4 2/3] libbpf: Fix the incorrect register read for syscalls on x86_64 2022-01-19 13:12 ` [PATCH v4 2/3] libbpf: Fix the incorrect register read for syscalls on x86_64 Kenta Tada @ 2022-01-19 18:33 ` Andrii Nakryiko 2022-01-20 22:56 ` Kenta.Tada 0 siblings, 1 reply; 10+ messages in thread From: Andrii Nakryiko @ 2022-01-19 18:33 UTC (permalink / raw) To: Kenta Tada Cc: Andrii Nakryiko, bpf, Alexei Starovoitov, Daniel Borkmann, Martin Lau, Song Liu, Yonghong Song, john fastabend, KP Singh On Wed, Jan 19, 2022 at 5:13 AM Kenta Tada <Kenta.Tada@sony.com> wrote: > > Currently, rcx is read as the fourth parameter of syscall on x86_64. > But x86_64 Linux System Call convention uses r10 actually. > This commit adds the wrapper for users who want to access to > syscall params to analyze the user space. > > Signed-off-by: Kenta Tada <Kenta.Tada@sony.com> > --- > tools/lib/bpf/bpf_tracing.h | 34 ++++++++++++++++++++++++++++++++++ > 1 file changed, 34 insertions(+) > > diff --git a/tools/lib/bpf/bpf_tracing.h b/tools/lib/bpf/bpf_tracing.h > index 90f56b0f585f..81673a24973e 100644 > --- a/tools/lib/bpf/bpf_tracing.h > +++ b/tools/lib/bpf/bpf_tracing.h > @@ -70,6 +70,7 @@ > #define __PT_PARM2_REG si > #define __PT_PARM3_REG dx > #define __PT_PARM4_REG cx > +#define __PT_PARM4_REG_SYSCALL r10 /* syscall uses r10 */ > #define __PT_PARM5_REG r8 > #define __PT_RET_REG sp > #define __PT_FP_REG bp > @@ -99,6 +100,7 @@ > #define __PT_PARM2_REG rsi > #define __PT_PARM3_REG rdx > #define __PT_PARM4_REG rcx > +#define __PT_PARM4_REG_SYSCALL r10 /* syscall uses r10 */ > #define __PT_PARM5_REG r8 > #define __PT_RET_REG rsp > #define __PT_FP_REG rbp > @@ -263,6 +265,26 @@ struct pt_regs; > > #endif > > +#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1(x) > +#define PT_REGS_PARM2_SYSCALL(x) PT_REGS_PARM2(x) > +#define PT_REGS_PARM3_SYSCALL(x) PT_REGS_PARM3(x) > +#ifdef __PT_PARM4_REG_SYSCALL > +#define PT_REGS_PARM4_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG_SYSCALL) > +#else /* __PT_PARM4_REG_SYSCALL */ > +#define PT_REGS_PARM4_SYSCALL(x) PT_REGS_PARM4(x) > +#endif > +#define PT_REGS_PARM5_SYSCALL(x) PT_REGS_PARM5(x) > + > +#define PT_REGS_PARM1_CORE_SYSCALL(x) PT_REGS_PARM1_CORE(x) > +#define PT_REGS_PARM2_CORE_SYSCALL(x) PT_REGS_PARM2_CORE(x) > +#define PT_REGS_PARM3_CORE_SYSCALL(x) PT_REGS_PARM3_CORE(x) > +#ifdef __PT_PARM4_REG_SYSCALL > +#define PT_REGS_PARM4_CORE_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG_SYSCALL) did you check PT_REGS_PARM4_CORE() definition? This should be BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_REG_SYSCALL) > +#else /* __PT_PARM4_REG_SYSCALL */ > +#define PT_REGS_PARM4_CORE_SYSCALL(x) PT_REGS_PARM4_CORE(x) > +#endif > +#define PT_REGS_PARM5_CORE_SYSCALL(x) PT_REGS_PARM5_CORE(x) > + > #else /* defined(bpf_target_defined) */ > > #define PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > @@ -290,6 +312,18 @@ struct pt_regs; > #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > #define BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > > +#define PT_REGS_PARM1_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > +#define PT_REGS_PARM2_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > +#define PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > +#define PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > +#define PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > + > +#define PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > +#define PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > +#define PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > +#define PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > +#define PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) > + > #endif /* defined(bpf_target_defined) */ > > #ifndef ___bpf_concat > -- > 2.32.0 > ^ permalink raw reply [flat|nested] 10+ messages in thread
* RE: [PATCH v4 2/3] libbpf: Fix the incorrect register read for syscalls on x86_64 2022-01-19 18:33 ` Andrii Nakryiko @ 2022-01-20 22:56 ` Kenta.Tada 2022-01-20 23:01 ` Andrii Nakryiko 0 siblings, 1 reply; 10+ messages in thread From: Kenta.Tada @ 2022-01-20 22:56 UTC (permalink / raw) To: andrii.nakryiko Cc: andrii, bpf, ast, daniel, kafai, songliubraving, yhs, john.fastabend, kpsingh >did you check PT_REGS_PARM4_CORE() definition? This should be In my local test, this wrong code can pass the correct arg4 because the test just checks the value. Anyway I should attach the test for CORE variants at first. Sorry. I'll fix the issues and add tests for CORE variants this weekend. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v4 2/3] libbpf: Fix the incorrect register read for syscalls on x86_64 2022-01-20 22:56 ` Kenta.Tada @ 2022-01-20 23:01 ` Andrii Nakryiko 2022-01-20 23:34 ` Kenta.Tada 0 siblings, 1 reply; 10+ messages in thread From: Andrii Nakryiko @ 2022-01-20 23:01 UTC (permalink / raw) To: Kenta Tada Cc: Andrii Nakryiko, bpf, Alexei Starovoitov, Daniel Borkmann, Martin Lau, Song Liu, Yonghong Song, john fastabend, KP Singh On Thu, Jan 20, 2022 at 2:57 PM <Kenta.Tada@sony.com> wrote: > > >did you check PT_REGS_PARM4_CORE() definition? This should be > > In my local test, this wrong code can pass the correct arg4 because the test just checks the value. The biggest problem is the lack of bpf_probe_read_kernel(). Your definition does direct memory read which won't work if pt_regs is not an input context to the BPF program. Which is exactly the case for syscalls. > Anyway I should attach the test for CORE variants at first. > Sorry. I'll fix the issues and add tests for CORE variants this weekend. ^ permalink raw reply [flat|nested] 10+ messages in thread
* RE: [PATCH v4 2/3] libbpf: Fix the incorrect register read for syscalls on x86_64 2022-01-20 23:01 ` Andrii Nakryiko @ 2022-01-20 23:34 ` Kenta.Tada 2022-01-20 23:38 ` Kenta.Tada 0 siblings, 1 reply; 10+ messages in thread From: Kenta.Tada @ 2022-01-20 23:34 UTC (permalink / raw) To: andrii.nakryiko Cc: andrii, bpf, ast, daniel, kafai, songliubraving, yhs, john.fastabend, kpsingh >> >> >did you check PT_REGS_PARM4_CORE() definition? This should be >> >> In my local test, this wrong code can pass the correct arg4 because the test just checks the value. > >The biggest problem is the lack of bpf_probe_read_kernel(). Your definition does direct memory read which won't work if pt_regs is not an input context to the BPF program. Which is exactly the case for syscalls. Yes. I'll use BPF_CORE_READ() for PT_REGS_PARM4_CORE() not to read direct memory. ^ permalink raw reply [flat|nested] 10+ messages in thread
* RE: [PATCH v4 2/3] libbpf: Fix the incorrect register read for syscalls on x86_64 2022-01-20 23:34 ` Kenta.Tada @ 2022-01-20 23:38 ` Kenta.Tada 0 siblings, 0 replies; 10+ messages in thread From: Kenta.Tada @ 2022-01-20 23:38 UTC (permalink / raw) To: andrii.nakryiko Cc: andrii, bpf, ast, daniel, kafai, songliubraving, yhs, john.fastabend, kpsingh >>> >>> >did you check PT_REGS_PARM4_CORE() definition? This should be >>> >>> In my local test, this wrong code can pass the correct arg4 because the test just checks the value. >> >>The biggest problem is the lack of bpf_probe_read_kernel(). Your definition does direct memory read which won't work if pt_regs is not an input context to the BPF program. Which is exactly the case for syscalls. > >Yes. >I'll use BPF_CORE_READ() for PT_REGS_PARM4_CORE() not to read direct memory. Sorry, Not PT_REGS_PARM4_CORE() but PT_REGS_PARM4_CORE_SYSCALL(). And I cofirmed the definition of PT_REGS_PARM4_CORE() and BPF_CORE_READ(). I'll use BPF_CORE_READ() for PT_REGS_PARM4_CORE_SYSCALL(). ^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v4 3/3] libbpf: Add a test to confirm PT_REGS_PARM4_SYSCALL 2022-01-19 13:12 [PATCH v4 0/3] Fix the incorrect register read for syscalls on x86_64 Kenta Tada 2022-01-19 13:12 ` [PATCH v4 1/3] libbpf: Extract syscall wrapper Kenta Tada 2022-01-19 13:12 ` [PATCH v4 2/3] libbpf: Fix the incorrect register read for syscalls on x86_64 Kenta Tada @ 2022-01-19 13:12 ` Kenta Tada 2022-01-19 18:37 ` Andrii Nakryiko 2 siblings, 1 reply; 10+ messages in thread From: Kenta Tada @ 2022-01-19 13:12 UTC (permalink / raw) To: andrii, bpf Cc: ast, daniel, kafai, songliubraving, yhs, john.fastabend, kpsingh, Kenta Tada Add a selftest to verify the behavior of PT_REGS_xxx. Signed-off-by: Kenta Tada <Kenta.Tada@sony.com> --- .../bpf/prog_tests/test_bpf_syscall_macro.c | 49 ++++++++++++++++++ .../selftests/bpf/progs/bpf_syscall_macro.c | 51 +++++++++++++++++++ 2 files changed, 100 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c create mode 100644 tools/testing/selftests/bpf/progs/bpf_syscall_macro.c diff --git a/tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c b/tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c new file mode 100644 index 000000000000..2f725393195b --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c @@ -0,0 +1,49 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright 2022 Sony Group Corporation */ +#include <sys/prctl.h> +#include <test_progs.h> +#include "bpf_syscall_macro.skel.h" + +//void serial_bpf_syscall_macro(void) +void test_bpf_syscall_macro(void) +{ + struct bpf_syscall_macro *skel = NULL; + int err; + int exp_arg1 = 1001; + unsigned long exp_arg2 = 12; + unsigned long exp_arg3 = 13; + unsigned long exp_arg4 = 14; + unsigned long exp_arg5 = 15; + + /* check whether it can open program */ + skel = bpf_syscall_macro__open(); + if (!ASSERT_OK_PTR(skel, "bpf_syscall_macro__open")) + return; + + skel->rodata->filter_pid = getpid(); + + /* check whether it can load program */ + err = bpf_syscall_macro__load(skel); + if (!ASSERT_OK(err, "bpf_syscall_macro__load")) + goto cleanup; + + /* check whether it can attach kprobe */ + err = bpf_syscall_macro__attach(skel); + if (!ASSERT_OK(err, "bpf_syscall_macro__attach")) + goto cleanup; + + /* check whether args of syscall are copied correctly */ + prctl(exp_arg1, exp_arg2, exp_arg3, exp_arg4, exp_arg5); + ASSERT_EQ(skel->bss->arg1, exp_arg1, "syscall_arg1"); + ASSERT_EQ(skel->bss->arg2, exp_arg2, "syscall_arg2"); + ASSERT_EQ(skel->bss->arg3, exp_arg3, "syscall_arg3"); + /* it cannot copy arg4 when uses PT_REGS_PARM4 on x86_64 */ +#ifdef __x86_64__ + ASSERT_NEQ(skel->bss->arg4_cx, exp_arg4, "syscall_arg4_from_cx"); +#endif + ASSERT_EQ(skel->bss->arg4, exp_arg4, "syscall_arg4"); + ASSERT_EQ(skel->bss->arg5, exp_arg5, "syscall_arg5"); + +cleanup: + bpf_syscall_macro__destroy(skel); +} diff --git a/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c b/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c new file mode 100644 index 000000000000..5a7063de27c3 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c @@ -0,0 +1,51 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright 2022 Sony Group Corporation */ +#include <linux/bpf.h> +#include <linux/ptrace.h> +#include <sys/types.h> +#include <unistd.h> + +#include <bpf/bpf_helpers.h> +#include <bpf/bpf_tracing.h> +#include "bpf_misc.h" + +int arg1 = 0; +unsigned long arg2 = 0; +unsigned long arg3 = 0; +unsigned long arg4_cx = 0; +unsigned long arg4 = 0; +unsigned long arg5 = 0; + +const volatile pid_t filter_pid = 0; + +SEC("kprobe/" SYS_PREFIX "sys_prctl") +int BPF_KPROBE(handle_sys_prctl) +{ + struct pt_regs *real_regs; + int orig_arg1; + unsigned long orig_arg2, orig_arg3, orig_arg4_cx, orig_arg4, orig_arg5; + pid_t pid = bpf_get_current_pid_tgid() >> 32; + + if (pid != filter_pid) + return 0; + + real_regs = (struct pt_regs *)PT_REGS_PARM1(ctx); + bpf_probe_read_kernel(&orig_arg1, sizeof(orig_arg1), &PT_REGS_PARM1_SYSCALL(real_regs)); + bpf_probe_read_kernel(&orig_arg2, sizeof(orig_arg2), &PT_REGS_PARM2_SYSCALL(real_regs)); + bpf_probe_read_kernel(&orig_arg3, sizeof(orig_arg3), &PT_REGS_PARM3_SYSCALL(real_regs)); + bpf_probe_read_kernel(&orig_arg4_cx, sizeof(orig_arg4_cx), &PT_REGS_PARM4(real_regs)); + bpf_probe_read_kernel(&orig_arg4, sizeof(orig_arg4), &PT_REGS_PARM4_SYSCALL(real_regs)); + bpf_probe_read_kernel(&orig_arg5, sizeof(orig_arg5), &PT_REGS_PARM5_SYSCALL(real_regs)); + + /* copy all actual args and the wrong arg4 on x86_64 */ + arg1 = orig_arg1; + arg2 = orig_arg2; + arg3 = orig_arg3; + arg4_cx = orig_arg4_cx; + arg4 = orig_arg4; + arg5 = orig_arg5; + + return 0; +} + +char _license[] SEC("license") = "GPL"; -- 2.32.0 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH v4 3/3] libbpf: Add a test to confirm PT_REGS_PARM4_SYSCALL 2022-01-19 13:12 ` [PATCH v4 3/3] libbpf: Add a test to confirm PT_REGS_PARM4_SYSCALL Kenta Tada @ 2022-01-19 18:37 ` Andrii Nakryiko 0 siblings, 0 replies; 10+ messages in thread From: Andrii Nakryiko @ 2022-01-19 18:37 UTC (permalink / raw) To: Kenta Tada Cc: Andrii Nakryiko, bpf, Alexei Starovoitov, Daniel Borkmann, Martin Lau, Song Liu, Yonghong Song, john fastabend, KP Singh On Wed, Jan 19, 2022 at 5:14 AM Kenta Tada <Kenta.Tada@sony.com> wrote: > > Add a selftest to verify the behavior of PT_REGS_xxx. > > Signed-off-by: Kenta Tada <Kenta.Tada@sony.com> > --- > .../bpf/prog_tests/test_bpf_syscall_macro.c | 49 ++++++++++++++++++ > .../selftests/bpf/progs/bpf_syscall_macro.c | 51 +++++++++++++++++++ > 2 files changed, 100 insertions(+) > create mode 100644 tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c > create mode 100644 tools/testing/selftests/bpf/progs/bpf_syscall_macro.c > > diff --git a/tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c b/tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c > new file mode 100644 > index 000000000000..2f725393195b > --- /dev/null > +++ b/tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c > @@ -0,0 +1,49 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* Copyright 2022 Sony Group Corporation */ > +#include <sys/prctl.h> > +#include <test_progs.h> > +#include "bpf_syscall_macro.skel.h" > + > +//void serial_bpf_syscall_macro(void) leftover > +void test_bpf_syscall_macro(void) > +{ > + struct bpf_syscall_macro *skel = NULL; > + int err; > + int exp_arg1 = 1001; > + unsigned long exp_arg2 = 12; > + unsigned long exp_arg3 = 13; > + unsigned long exp_arg4 = 14; > + unsigned long exp_arg5 = 15; > + > + /* check whether it can open program */ > + skel = bpf_syscall_macro__open(); > + if (!ASSERT_OK_PTR(skel, "bpf_syscall_macro__open")) > + return; > + > + skel->rodata->filter_pid = getpid(); > + > + /* check whether it can load program */ > + err = bpf_syscall_macro__load(skel); > + if (!ASSERT_OK(err, "bpf_syscall_macro__load")) > + goto cleanup; > + > + /* check whether it can attach kprobe */ > + err = bpf_syscall_macro__attach(skel); > + if (!ASSERT_OK(err, "bpf_syscall_macro__attach")) > + goto cleanup; > + > + /* check whether args of syscall are copied correctly */ > + prctl(exp_arg1, exp_arg2, exp_arg3, exp_arg4, exp_arg5); > + ASSERT_EQ(skel->bss->arg1, exp_arg1, "syscall_arg1"); > + ASSERT_EQ(skel->bss->arg2, exp_arg2, "syscall_arg2"); > + ASSERT_EQ(skel->bss->arg3, exp_arg3, "syscall_arg3"); > + /* it cannot copy arg4 when uses PT_REGS_PARM4 on x86_64 */ > +#ifdef __x86_64__ > + ASSERT_NEQ(skel->bss->arg4_cx, exp_arg4, "syscall_arg4_from_cx"); > +#endif else ASSERT_EQ(arg4_cx and exp_arg4) ? > + ASSERT_EQ(skel->bss->arg4, exp_arg4, "syscall_arg4"); > + ASSERT_EQ(skel->bss->arg5, exp_arg5, "syscall_arg5"); > + > +cleanup: > + bpf_syscall_macro__destroy(skel); > +} > diff --git a/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c b/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c > new file mode 100644 > index 000000000000..5a7063de27c3 > --- /dev/null > +++ b/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c > @@ -0,0 +1,51 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* Copyright 2022 Sony Group Corporation */ > +#include <linux/bpf.h> > +#include <linux/ptrace.h> > +#include <sys/types.h> > +#include <unistd.h> Use #include <vmlinux.h> instead, please > + > +#include <bpf/bpf_helpers.h> > +#include <bpf/bpf_tracing.h> > +#include "bpf_misc.h" > + > +int arg1 = 0; > +unsigned long arg2 = 0; > +unsigned long arg3 = 0; > +unsigned long arg4_cx = 0; > +unsigned long arg4 = 0; > +unsigned long arg5 = 0; > + > +const volatile pid_t filter_pid = 0; > + > +SEC("kprobe/" SYS_PREFIX "sys_prctl") > +int BPF_KPROBE(handle_sys_prctl) > +{ > + struct pt_regs *real_regs; > + int orig_arg1; > + unsigned long orig_arg2, orig_arg3, orig_arg4_cx, orig_arg4, orig_arg5; > + pid_t pid = bpf_get_current_pid_tgid() >> 32; > + > + if (pid != filter_pid) > + return 0; > + > + real_regs = (struct pt_regs *)PT_REGS_PARM1(ctx); > + bpf_probe_read_kernel(&orig_arg1, sizeof(orig_arg1), &PT_REGS_PARM1_SYSCALL(real_regs)); orig_arg1 = PT_REGS_PARM1_CORE_SYSCALL(real_regs); and same for others (the whole point of _CORE_SYSCALL macros!) > + bpf_probe_read_kernel(&orig_arg2, sizeof(orig_arg2), &PT_REGS_PARM2_SYSCALL(real_regs)); > + bpf_probe_read_kernel(&orig_arg3, sizeof(orig_arg3), &PT_REGS_PARM3_SYSCALL(real_regs)); > + bpf_probe_read_kernel(&orig_arg4_cx, sizeof(orig_arg4_cx), &PT_REGS_PARM4(real_regs)); > + bpf_probe_read_kernel(&orig_arg4, sizeof(orig_arg4), &PT_REGS_PARM4_SYSCALL(real_regs)); > + bpf_probe_read_kernel(&orig_arg5, sizeof(orig_arg5), &PT_REGS_PARM5_SYSCALL(real_regs)); > + > + /* copy all actual args and the wrong arg4 on x86_64 */ > + arg1 = orig_arg1; > + arg2 = orig_arg2; > + arg3 = orig_arg3; > + arg4_cx = orig_arg4_cx; > + arg4 = orig_arg4; > + arg5 = orig_arg5; > + > + return 0; > +} > + > +char _license[] SEC("license") = "GPL"; > -- > 2.32.0 > ^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2022-01-20 23:39 UTC | newest] Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2022-01-19 13:12 [PATCH v4 0/3] Fix the incorrect register read for syscalls on x86_64 Kenta Tada 2022-01-19 13:12 ` [PATCH v4 1/3] libbpf: Extract syscall wrapper Kenta Tada 2022-01-19 13:12 ` [PATCH v4 2/3] libbpf: Fix the incorrect register read for syscalls on x86_64 Kenta Tada 2022-01-19 18:33 ` Andrii Nakryiko 2022-01-20 22:56 ` Kenta.Tada 2022-01-20 23:01 ` Andrii Nakryiko 2022-01-20 23:34 ` Kenta.Tada 2022-01-20 23:38 ` Kenta.Tada 2022-01-19 13:12 ` [PATCH v4 3/3] libbpf: Add a test to confirm PT_REGS_PARM4_SYSCALL Kenta Tada 2022-01-19 18:37 ` Andrii Nakryiko
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.