bcc/tools: Replace bpf_probe_read with bpf_probe_read_kernel

It is recommended to use bpf_probe_read_kernel_{str} in the bpf tools.
See kernel commit 0ebeea8ca8a4 ("bpf: Restrict bpf_probe_read{, str}()
only to archs where they work")

Signed-off-by: Sumanth Korikkar <[email protected]>
Acked-by: Ilya Leoshkevich <[email protected]>

src/cc/libbpf.c

@@ -385,8 +385,8 @@ static void bpf_print_hints(int ret, char *log)
  if (strstr(log, "invalid mem access 'inv'") != NULL) {
  fprintf(stderr, "HINT: The invalid mem access 'inv' error can happen "
  "if you try to dereference memory without first using "
- "bpf_probe_read() to copy it to the BPF stack. Sometimes the "
- "bpf_probe_read is automatic by the bcc rewriter, other times "
+ "bpf_probe_read_kernel() to copy it to the BPF stack. Sometimes the "
+ "bpf_probe_read_kernel() is automatic by the bcc rewriter, other times "
  "you'll need to be explicit.\n\n");
  }
 

tests/python/test_clang.py

@@ -80,7 +80,7 @@ def test_probe_read3(self):
  text = """
 #define KBUILD_MODNAME "foo"
 #include <net/tcp.h>
-#define _(P) ({typeof(P) val = 0; bpf_probe_read(&val, sizeof(val), &P); val;})
+#define _(P) ({typeof(P) val = 0; bpf_probe_read_kernel(&val, sizeof(val), &P); val;})
 int count_tcp(struct pt_regs *ctx, struct sk_buff *skb) {
  return _(TCP_SKB_CB(skb)->tcp_gso_size);
 }
@@ -92,7 +92,7 @@ def test_probe_read4(self):
  text = """
 #define KBUILD_MODNAME "foo"
 #include <net/tcp.h>
-#define _(P) ({typeof(P) val = 0; bpf_probe_read(&val, sizeof(val), &P); val;})
+#define _(P) ({typeof(P) val = 0; bpf_probe_read_kernel(&val, sizeof(val), &P); val;})
 int test(struct pt_regs *ctx, struct sk_buff *skb) {
  return _(TCP_SKB_CB(skb)->tcp_gso_size) + skb->protocol;
 }
@@ -111,7 +111,7 @@ def test_probe_read_whitelist1(self):
  // failing below statement
  // return TCP_SKB_CB(skb)->tcp_gso_size;
  u16 val = 0;
- bpf_probe_read(&val, sizeof(val), &(TCP_SKB_CB(skb)->tcp_gso_size));
+ bpf_probe_read_kernel(&val, sizeof(val), &(TCP_SKB_CB(skb)->tcp_gso_size));
  return val;
 }
 """
@@ -129,7 +129,7 @@ def test_probe_read_whitelist2(self):
  // failing below statement
  // return TCP_SKB_CB(skb)->tcp_gso_size;
  u16 val = 0;
- bpf_probe_read(&val, sizeof(val), &(TCP_SKB_CB(skb)->tcp_gso_size));
+ bpf_probe_read_kernel(&val, sizeof(val), &(TCP_SKB_CB(skb)->tcp_gso_size));
  return val + skb->protocol;
 }
 """
@@ -1144,7 +1144,7 @@ def test_no_probe_read_addrof(self):
 #include <net/inet_sock.h>
 static inline int test_help(__be16 *addr) {
  __be16 val = 0;
- bpf_probe_read(&val, sizeof(val), addr);
+ bpf_probe_read_kernel(&val, sizeof(val), addr);
  return val;
 }
 int test(struct pt_regs *ctx) {

tools/argdist.py

@@ -42,7 +42,7 @@ def _parse_signature(self):
  param_name = param[index + 1:].strip()
  self.param_types[param_name] = param_type
  # Maintain list of user params. Then later decide to
- # switch to bpf_probe_read or bpf_probe_read_user.
+ # switch to bpf_probe_read_kernel or bpf_probe_read_user.
  if "__user" in param_type.split():
  self.probe_user_list.add(param_name)
 
@@ -299,7 +299,7 @@ def _generate_field_assignment(self, i):
  self.exprs[i] in self.probe_user_list:
  probe_readfunc = "bpf_probe_read_user"
  else:
- probe_readfunc = "bpf_probe_read"
+ probe_readfunc = "bpf_probe_read_kernel"
  return (text + " %s(&__key.v%d.s," +
  " sizeof(__key.v%d.s), (void *)%s);\n") % \
  (probe_readfunc, i, i, self.exprs[i])

tools/bindsnoop.py

@@ -215,7 +215,7 @@
  struct inet_sock *sockp = (struct inet_sock *)skp;
 
  u16 sport = 0;
- bpf_probe_read(&sport, sizeof(sport), &sockp->inet_sport);
+ bpf_probe_read_kernel(&sport, sizeof(sport), &sockp->inet_sport);
  sport = ntohs(sport);
 
  FILTER_PORT
@@ -296,7 +296,7 @@
  struct ipv4_bind_data_t data4 = {.pid = pid, .ip = ipver};
  data4.uid = bpf_get_current_uid_gid();
  data4.ts_us = bpf_ktime_get_ns() / 1000;
- bpf_probe_read(
+ bpf_probe_read_kernel(
  &data4.saddr, sizeof(data4.saddr), &sockp->inet_saddr);
  data4.return_code = ret;
  data4.sport = sport;
@@ -309,15 +309,15 @@
  'ipv6': {
  'count': """
  struct ipv6_flow_key_t flow_key = {};
- bpf_probe_read(&flow_key.saddr, sizeof(flow_key.saddr),
+ bpf_probe_read_kernel(&flow_key.saddr, sizeof(flow_key.saddr),
  skp->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
  flow_key.sport = sport;
  ipv6_count.increment(flow_key);""",
  'trace': """
  struct ipv6_bind_data_t data6 = {.pid = pid, .ip = ipver};
  data6.uid = bpf_get_current_uid_gid();
  data6.ts_us = bpf_ktime_get_ns() / 1000;
- bpf_probe_read(&data6.saddr, sizeof(data6.saddr),
+ bpf_probe_read_kernel(&data6.saddr, sizeof(data6.saddr),
  skp->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
  data6.return_code = ret;
  data6.sport = sport;

tools/biolatency.py

@@ -112,7 +112,7 @@
  bpf_text = bpf_text.replace('STORE',
  'disk_key_t key = {.slot = bpf_log2l(delta)}; ' +
  'void *__tmp = (void *)req->rq_disk->disk_name; ' +
- 'bpf_probe_read(&key.disk, sizeof(key.disk), __tmp); ' +
+ 'bpf_probe_read_kernel(&key.disk, sizeof(key.disk), __tmp); ' +
  'dist.increment(key);')
 elif args.flags:
  bpf_text = bpf_text.replace('STORAGE',

tools/biosnoop.lua

@@ -90,8 +90,8 @@ int trace_req_completion(struct pt_regs *ctx, struct request *req)
  data.pid = valp->pid;
  data.len = req->__data_len;
  data.sector = req->__sector;
- bpf_probe_read(&data.name, sizeof(data.name), valp->name);
- bpf_probe_read(&data.disk_name, sizeof(data.disk_name),
+ bpf_probe_read_kernel(&data.name, sizeof(data.name), valp->name);
+ bpf_probe_read_kernel(&data.disk_name, sizeof(data.disk_name),
  req->rq_disk->disk_name);
  }
 

tools/biosnoop.py

@@ -117,9 +117,9 @@
  data.pid = valp->pid;
  data.len = req->__data_len;
  data.sector = req->__sector;
- bpf_probe_read(&data.name, sizeof(data.name), valp->name);
+ bpf_probe_read_kernel(&data.name, sizeof(data.name), valp->name);
  struct gendisk *rq_disk = req->rq_disk;
- bpf_probe_read(&data.disk_name, sizeof(data.disk_name),
+ bpf_probe_read_kernel(&data.disk_name, sizeof(data.disk_name),
  rq_disk->disk_name);
  }
 

tools/bitesize.py

@@ -30,7 +30,7 @@
 TRACEPOINT_PROBE(block, block_rq_issue)
 {
  struct proc_key_t key = {.slot = bpf_log2l(args->bytes / 1024)};
- bpf_probe_read(&key.name, sizeof(key.name), args->comm);
+ bpf_probe_read_kernel(&key.name, sizeof(key.name), args->comm);
  dist.increment(key);
  return 0;
 }

tools/btrfsslower.py

@@ -233,7 +233,7 @@
  qs = de->d_name;
  if (qs.len == 0)
  return 0;
- bpf_probe_read(&data.file, sizeof(data.file), (void *)qs.name);
+ bpf_probe_read_kernel(&data.file, sizeof(data.file), (void *)qs.name);
 
  // output
  events.perf_submit(ctx, &data, sizeof(data));

tools/compactsnoop.py

@@ -108,7 +108,7 @@
 static inline int zone_to_nid_(struct zone *zone)
 {
  int node;
- bpf_probe_read(&node, sizeof(node), &zone->node);
+ bpf_probe_read_kernel(&node, sizeof(node), &zone->node);
  return node;
 }
 #else
@@ -122,7 +122,7 @@
 static inline int zone_idx_(struct zone *zone)
 {
  struct pglist_data *zone_pgdat = NULL;
- bpf_probe_read(&zone_pgdat, sizeof(zone_pgdat), &zone->zone_pgdat);
+ bpf_probe_read_kernel(&zone_pgdat, sizeof(zone_pgdat), &zone->zone_pgdat);
  return zone - zone_pgdat->node_zones;
 }
 
@@ -132,13 +132,13 @@
  u64 _watermark[NR_WMARK] = {};
  u64 watermark_boost = 0;
 
- bpf_probe_read(&_watermark, sizeof(_watermark), &zone->_watermark);
- bpf_probe_read(&watermark_boost, sizeof(watermark_boost),
+ bpf_probe_read_kernel(&_watermark, sizeof(_watermark), &zone->_watermark);
+ bpf_probe_read_kernel(&watermark_boost, sizeof(watermark_boost),
  &zone->watermark_boost);
  valp->min = _watermark[WMARK_MIN] + watermark_boost;
  valp->low = _watermark[WMARK_LOW] + watermark_boost;
  valp->high = _watermark[WMARK_HIGH] + watermark_boost;
- bpf_probe_read(&valp->free, sizeof(valp->free),
+ bpf_probe_read_kernel(&valp->free, sizeof(valp->free),
  &zone->vm_stat[NR_FREE_PAGES]);
 }
 #endif

tools/dbslower.py

@@ -158,8 +158,8 @@
  data.timestamp = tempp->timestamp;
  data.duration = delta;
 #if defined(MYSQL56) || defined(MYSQL57)
- // We already copied string to the bpf stack. Hence use bpf_probe_read()
- bpf_probe_read(&data.query, sizeof(data.query), tempp->query);
+ // We already copied string to the bpf stack. Hence use bpf_probe_read_kernel()
+ bpf_probe_read_kernel(&data.query, sizeof(data.query), tempp->query);
 #else
  // USDT - we didnt copy string to the bpf stack before.
  bpf_probe_read_user(&data.query, sizeof(data.query), tempp->query);

tools/dcsnoop.py

@@ -84,7 +84,7 @@
  .type = type,
  };
  bpf_get_current_comm(&data.comm, sizeof(data.comm));
- bpf_probe_read(&data.filename, sizeof(data.filename), name);
+ bpf_probe_read_kernel(&data.filename, sizeof(data.filename), name);
  events.perf_submit(ctx, &data, sizeof(data));
 }
 
@@ -102,7 +102,7 @@
  struct entry_t entry = {};
  const char *fname = name->name;
  if (fname) {
- bpf_probe_read(&entry.name, sizeof(entry.name), (void *)fname);
+ bpf_probe_read_kernel(&entry.name, sizeof(entry.name), (void *)fname);
  }
  entrybypid.update(&pid, &entry);
  return 0;

tools/deadlock.c

@@ -164,7 +164,7 @@ int trace_mutex_release(struct pt_regs *ctx, void *mutex_addr) {
  // invalid memory access on `leaf->held_mutexes[i]` below. On newer kernels,
  // we can avoid making this extra copy in `value` and use `leaf` directly.
  struct thread_to_held_mutex_leaf_t value = {};
- bpf_probe_read(&value, sizeof(struct thread_to_held_mutex_leaf_t), leaf);
+ bpf_probe_read_user(&value, sizeof(struct thread_to_held_mutex_leaf_t), leaf);
 
  #pragma unroll
  for (int i = 0; i < MAX_HELD_MUTEXES; ++i) {

tools/drsnoop.py

@@ -128,7 +128,7 @@ def K(x):
  if (bpf_get_current_comm(&val.name, sizeof(val.name)) == 0) {
  val.id = id;
  val.ts = bpf_ktime_get_ns();
- bpf_probe_read(&val.vm_stat, sizeof(val.vm_stat), (const void *)%s);
+ bpf_probe_read_kernel(&val.vm_stat, sizeof(val.vm_stat), (const void *)%s);
  start.update(&id, &val);
  }
  return 0;
@@ -150,8 +150,8 @@ def K(x):
  data.ts = ts / 1000;
  data.id = valp->id;
  data.uid = bpf_get_current_uid_gid();
- bpf_probe_read(&data.name, sizeof(data.name), valp->name);
- bpf_probe_read(&data.vm_stat, sizeof(data.vm_stat), valp->vm_stat);
+ bpf_probe_read_kernel(&data.name, sizeof(data.name), valp->name);
+ bpf_probe_read_kernel(&data.vm_stat, sizeof(data.vm_stat), valp->vm_stat);
  data.nr_reclaimed = args->nr_reclaimed;
 
  events.perf_submit(args, &data, sizeof(data));

tools/ext4slower.py

@@ -226,7 +226,7 @@
  qs = de->d_name;
  if (qs.len == 0)
  return 0;
- bpf_probe_read(&data.file, sizeof(data.file), (void *)qs.name);
+ bpf_probe_read_kernel(&data.file, sizeof(data.file), (void *)qs.name);
 
  // output
  events.perf_submit(ctx, &data, sizeof(data));

tools/filelife.py

@@ -90,7 +90,7 @@
  if (bpf_get_current_comm(&data.comm, sizeof(data.comm)) == 0) {
  data.pid = pid;
  data.delta = delta;
- bpf_probe_read(&data.fname, sizeof(data.fname), d_name.name);
+ bpf_probe_read_kernel(&data.fname, sizeof(data.fname), d_name.name);
  }
 
  events.perf_submit(ctx, &data, sizeof(data));

tools/fileslower.py

@@ -112,7 +112,7 @@
 
  struct qstr d_name = de->d_name;
  val.name_len = d_name.len;
- bpf_probe_read(&val.name, sizeof(val.name), d_name.name);
+ bpf_probe_read_kernel(&val.name, sizeof(val.name), d_name.name);
  bpf_get_current_comm(&val.comm, sizeof(val.comm));
  entryinfo.update(&pid, &val);
 
@@ -159,8 +159,8 @@
  data.sz = valp->sz;
  data.delta_us = delta_us;
  data.name_len = valp->name_len;
- bpf_probe_read(&data.name, sizeof(data.name), valp->name);
- bpf_probe_read(&data.comm, sizeof(data.comm), valp->comm);
+ bpf_probe_read_kernel(&data.name, sizeof(data.name), valp->name);
+ bpf_probe_read_kernel(&data.comm, sizeof(data.comm), valp->comm);
  events.perf_submit(ctx, &data, sizeof(data));
 
  return 0;

tools/filetop.py

@@ -108,7 +108,7 @@ def signal_ignore(signal_value, frame):
  struct info_t info = {.pid = pid};
  bpf_get_current_comm(&info.comm, sizeof(info.comm));
  info.name_len = d_name.len;
- bpf_probe_read(&info.name, sizeof(info.name), d_name.name);
+ bpf_probe_read_kernel(&info.name, sizeof(info.name), d_name.name);
  if (S_ISREG(mode)) {
  info.type = 'R';
  } else if (S_ISSOCK(mode)) {

tools/funcslower.py

@@ -206,7 +206,7 @@
 #endif
 
 #ifdef GRAB_ARGS
- bpf_probe_read(&data.args[0], sizeof(data.args), entryp->args);
+ bpf_probe_read_kernel(&data.args[0], sizeof(data.args), entryp->args);
 #endif
  bpf_get_current_comm(&data.comm, sizeof(data.comm));
  events.perf_submit(ctx, &data, sizeof(data));

tools/gethostlatency.py

@@ -86,8 +86,8 @@
  if (valp == 0)
  return 0; // missed start
 
- bpf_probe_read(&data.comm, sizeof(data.comm), valp->comm);
- bpf_probe_read(&data.host, sizeof(data.host), (void *)valp->host);
+ bpf_probe_read_kernel(&data.comm, sizeof(data.comm), valp->comm);
+ bpf_probe_read_kernel(&data.host, sizeof(data.host), (void *)valp->host);
  data.pid = valp->pid;
  data.delta = tsp - valp->ts;
  events.perf_submit(ctx, &data, sizeof(data));

tools/hardirqs.py

@@ -83,7 +83,7 @@
  char *name = (char *)action->name;
 
  irq_key_t key = {.slot = 0 /* ignore */};
- bpf_probe_read(&key.name, sizeof(key.name), name);
+ bpf_probe_read_kernel(&key.name, sizeof(key.name), name);
  dist.increment(key);
 
  return 0;
@@ -129,12 +129,12 @@
 if args.dist:
  bpf_text = bpf_text.replace('STORE',
  'irq_key_t key = {.slot = bpf_log2l(delta / %d)};' % factor +
- 'bpf_probe_read(&key.name, sizeof(key.name), name);' +
+ 'bpf_probe_read_kernel(&key.name, sizeof(key.name), name);' +
  'dist.increment(key);')
 else:
  bpf_text = bpf_text.replace('STORE',
  'irq_key_t key = {.slot = 0 /* ignore */};' +
- 'bpf_probe_read(&key.name, sizeof(key.name), name);' +
+ 'bpf_probe_read_kernel(&key.name, sizeof(key.name), name);' +
  'dist.increment(key, delta);')
 if debug or args.ebpf:
  print(bpf_text)

tools/killsnoop.py

@@ -87,7 +87,7 @@
  return 0;
  }
 
- bpf_probe_read(&data.comm, sizeof(data.comm), valp->comm);
+ bpf_probe_read_kernel(&data.comm, sizeof(data.comm), valp->comm);
  data.pid = pid;
  data.tpid = valp->tpid;
  data.ret = PT_REGS_RC(ctx);

tools/mdflush.py

@@ -47,7 +47,7 @@
 #else
  struct gendisk *bi_disk = bio->bi_bdev->bd_disk;
 #endif
- bpf_probe_read(&data.disk, sizeof(data.disk), bi_disk->disk_name);
+ bpf_probe_read_kernel(&data.disk, sizeof(data.disk), bi_disk->disk_name);
  events.perf_submit(ctx, &data, sizeof(data));
  return 0;
 }

tools/memleak.py

@@ -287,7 +287,7 @@ def run_command_get_pid(command):
 
  memptrs.delete(&pid);
 
- if (bpf_probe_read(&addr, sizeof(void*), (void*)(size_t)*memptr64))
+ if (bpf_probe_read_user(&addr, sizeof(void*), (void*)(size_t)*memptr64))
  return 0;
 
  u64 addr64 = (u64)(size_t)addr;

tools/nfsslower.py

@@ -190,18 +190,18 @@
  struct qstr qs = {};
  if(type == TRACE_GETATTR)
  {
- bpf_probe_read(&de,sizeof(de), &valp->d);
+ bpf_probe_read_kernel(&de,sizeof(de), &valp->d);
  }
  else
  {
- bpf_probe_read(&de, sizeof(de), &valp->fp->f_path.dentry);
+ bpf_probe_read_kernel(&de, sizeof(de), &valp->fp->f_path.dentry);
  }
 
- bpf_probe_read(&qs, sizeof(qs), (void *)&de->d_name);
+ bpf_probe_read_kernel(&qs, sizeof(qs), (void *)&de->d_name);
  if (qs.len == 0)
  return 0;
 
- bpf_probe_read(&data.file, sizeof(data.file), (void *)qs.name);
+ bpf_probe_read_kernel(&data.file, sizeof(data.file), (void *)qs.name);
  // output
  events.perf_submit(ctx, &data, sizeof(data));
  return 0;