1 /* instructions used to output a skb based software event, produced 2 * from code snippet: 3 * struct TMP { 4 * uint64_t tmp; 5 * } tt; 6 * tt.tmp = 5; 7 * bpf_perf_event_output(skb, &connection_tracking_event_map, 0, 8 * &tt, sizeof(tt)); 9 * return 1; 10 * 11 * the bpf assembly from llvm is: 12 * 0: b7 02 00 00 05 00 00 00 r2 = 5 13 * 1: 7b 2a f8 ff 00 00 00 00 *(u64 *)(r10 - 8) = r2 14 * 2: bf a4 00 00 00 00 00 00 r4 = r10 15 * 3: 07 04 00 00 f8 ff ff ff r4 += -8 16 * 4: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0ll 17 * 6: b7 03 00 00 00 00 00 00 r3 = 0 18 * 7: b7 05 00 00 08 00 00 00 r5 = 8 19 * 8: 85 00 00 00 19 00 00 00 call 25 20 * 9: b7 00 00 00 01 00 00 00 r0 = 1 21 * 10: 95 00 00 00 00 00 00 00 exit 22 * 23 * The reason I put the code here instead of fill_helpers is that map fixup 24 * is against the insns, instead of filled prog. 25 */ 26 27 #define __PERF_EVENT_INSNS__ \ 28 BPF_MOV64_IMM(BPF_REG_2, 5), \ 29 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8), \ 30 BPF_MOV64_REG(BPF_REG_4, BPF_REG_10), \ 31 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8), \ 32 BPF_LD_MAP_FD(BPF_REG_2, 0), \ 33 BPF_MOV64_IMM(BPF_REG_3, 0), \ 34 BPF_MOV64_IMM(BPF_REG_5, 8), \ 35 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, \ 36 BPF_FUNC_perf_event_output), \ 37 BPF_MOV64_IMM(BPF_REG_0, 1), \ 38 BPF_EXIT_INSN(), 39 { 40 "perfevent for sockops", 41 .insns = { __PERF_EVENT_INSNS__ }, 42 .prog_type = BPF_PROG_TYPE_SOCK_OPS, 43 .fixup_map_event_output = { 4 }, 44 .result = ACCEPT, 45 .retval = 1, 46 }, 47 { 48 "perfevent for tc", 49 .insns = { __PERF_EVENT_INSNS__ }, 50 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 51 .fixup_map_event_output = { 4 }, 52 .result = ACCEPT, 53 .retval = 1, 54 }, 55 { 56 "perfevent for lwt out", 57 .insns = { __PERF_EVENT_INSNS__ }, 58 .prog_type = BPF_PROG_TYPE_LWT_OUT, 59 .fixup_map_event_output = { 4 }, 60 .result = ACCEPT, 61 .retval = 1, 62 }, 63 { 64 "perfevent for xdp", 65 .insns = { __PERF_EVENT_INSNS__ }, 66 .prog_type = BPF_PROG_TYPE_XDP, 67 .fixup_map_event_output = { 4 }, 68 .result = ACCEPT, 69 .retval = 1, 70 }, 71 { 72 "perfevent for socket filter", 73 .insns = { __PERF_EVENT_INSNS__ }, 74 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, 75 .fixup_map_event_output = { 4 }, 76 .result = ACCEPT, 77 .retval = 1, 78 }, 79 { 80 "perfevent for sk_skb", 81 .insns = { __PERF_EVENT_INSNS__ }, 82 .prog_type = BPF_PROG_TYPE_SK_SKB, 83 .fixup_map_event_output = { 4 }, 84 .result = ACCEPT, 85 .retval = 1, 86 }, 87 { 88 "perfevent for cgroup skb", 89 .insns = { __PERF_EVENT_INSNS__ }, 90 .prog_type = BPF_PROG_TYPE_CGROUP_SKB, 91 .fixup_map_event_output = { 4 }, 92 .result = ACCEPT, 93 .retval = 1, 94 }, 95 { 96 "perfevent for cgroup dev", 97 .insns = { __PERF_EVENT_INSNS__ }, 98 .prog_type = BPF_PROG_TYPE_CGROUP_DEVICE, 99 .fixup_map_event_output = { 4 }, 100 .result = ACCEPT, 101 .retval = 1, 102 }, 103 { 104 "perfevent for cgroup sysctl", 105 .insns = { __PERF_EVENT_INSNS__ }, 106 .prog_type = BPF_PROG_TYPE_CGROUP_SYSCTL, 107 .fixup_map_event_output = { 4 }, 108 .result = ACCEPT, 109 .retval = 1, 110 }, 111 { 112 "perfevent for cgroup sockopt", 113 .insns = { __PERF_EVENT_INSNS__ }, 114 .prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT, 115 .fixup_map_event_output = { 4 }, 116 .result = ACCEPT, 117 .retval = 1, 118 }, 119