• Daniel T. Lee's avatar
    samples: bpf: Fix bpf programs with kprobe/sys_connect event · af9bd3e3
    Daniel T. Lee authored
    Currently, BPF programs with kprobe/sys_connect does not work properly.
    
    Commit 34745aed ("samples/bpf: fix kprobe attachment issue on x64")
    This commit modifies the bpf_load behavior of kprobe events in the x64
    architecture. If the current kprobe event target starts with "sys_*",
    add the prefix "__x64_" to the front of the event.
    
    Appending "__x64_" prefix with kprobe/sys_* event was appropriate as a
    solution to most of the problems caused by the commit below.
    
        commit d5a00528 ("syscalls/core, syscalls/x86: Rename struct
        pt_regs-based sys_*() to __x64_sys_*()")
    
    However, there is a problem with the sys_connect kprobe event that does
    not work properly. For __sys_connect event, parameters can be fetched
    normally, but for __x64_sys_connect, parameters cannot be fetched.
    
        ffffffff818d3520 <__x64_sys_connect>:
        ffffffff818d3520: e8 fb df 32 00        callq   0xffffffff81c01520
        <__fentry__>
        ffffffff818d3525: 48 8b 57 60           movq    96(%rdi), %rdx
        ffffffff818d3529: 48 8b 77 68           movq    104(%rdi), %rsi
        ffffffff818d352d: 48 8b 7f 70           movq    112(%rdi), %rdi
        ffffffff818d3531: e8 1a ff ff ff        callq   0xffffffff818d3450
        <__sys_connect>
        ffffffff818d3536: 48 98                 cltq
        ffffffff818d3538: c3                    retq
        ffffffff818d3539: 0f 1f 80 00 00 00 00  nopl    (%rax)
    
    As the assembly code for __x64_sys_connect shows, parameters should be
    fetched and set into rdi, rsi, rdx registers prior to calling
    __sys_connect.
    
    Because of this problem, this commit fixes the sys_connect event by
    first getting the value of the rdi register and then the value of the
    rdi, rsi, and rdx register through an offset based on that value.
    
    Fixes: 34745aed ("samples/bpf: fix kprobe attachment issue on x64")
    Signed-off-by: default avatarDaniel T. Lee <danieltimlee@gmail.com>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Acked-by: default avatarAndrii Nakryiko <andriin@fb.com>
    Link: https://lore.kernel.org/bpf/20200707184855.30968-2-danieltimlee@gmail.com
    af9bd3e3
test_map_in_map_kern.c 4.07 KB