• Yonghong Song's avatar
    skip probe rewriter for bpf_probe_read() · 20fb64cd
    Yonghong Song authored
    bpf_probe_read() is often used to access pointees in bpf programs.
    Recent rewriter has become smarter so a lot of bpf_probe_read()
    can be replaced with simple pointer/member access.
    
    In certain cases, bpf_probe_read() is still preferred though.
    For example, kernel net/tcp.h defined TCP_SKB_CB as below
      #define TCP_SKB_CB(__skb)	((struct tcp_skb_cb *)&((__skb)->cb[0]))
    User can use below to access tcp_gso_size of a skb data structure.
      TCP_SKB_CB(skb)->tcp_gso_size
    The rewriter will fail as it attempts to rewrite (__skb)->cb[0].
    
    Instead of chasing down to prevent exactly the above pattern,
    this patch detects function bpf_probe_read() in ProbeVisitor and
    will skip it so bpf_probe_read()'s third parameter is a AddrOf.
    This can also help other cases where rewriter is not
    capable and user used bpf_probe_read() as the workaround.
    
    Also fixed tcptop.py to use direct assignment instead of
    bpf_probe_read. Otherwise, rewriter will actually rewrite
    src address reference inside the bpf_probe_read().
    Signed-off-by: default avatarYonghong Song <yhs@fb.com>
    20fb64cd
test_clang.py 24.1 KB