Skip to content

Instantly share code, notes, and snippets.

@soumyadipdm

soumyadipdm/verifier_disassembly.txt

Created June 4, 2020 07:18
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save soumyadipdm/736497c2fac752061f93d92c50ef136b to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save soumyadipdm/736497c2fac752061f93d92c50ef136b to your computer and use it in GitHub Desktop.
Download ZIP
Raw
verifier_disassembly.txt
Disassembly of section .bpf.fn.kprobe__tcp_cleanup_rbuf:
kprobe__tcp_cleanup_rbuf:
; { // Line 87
0: 79 17 68 00 00 00 00 00 r7 = *(u64 *)(r1 + 104)
; struct sock *sk = ctx->di; int copied = ctx->si; // Line 88
1: 79 19 70 00 00 00 00 00 r9 = *(u64 *)(r1 + 112)
; u32 pid = bpf_get_current_pid_tgid() >> 32; // Line 89
2: 85 00 00 00 0e 00 00 00 call 14
3: bf 06 00 00 00 00 00 00 r6 = r0
4: b7 08 00 00 00 00 00 00 r8 = 0
; u16 dport = 0, family = ({ typeof(unsigned short) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_family); _val; }); // Line 90
5: 6b 8a b0 ff 00 00 00 00 *(u16 *)(r10 - 80) = r8
6: 7b 9a 58 ff 00 00 00 00 *(u64 *)(r10 - 168) = r9
7: bf 93 00 00 00 00 00 00 r3 = r9
8: 07 03 00 00 10 00 00 00 r3 += 16
9: bf a1 00 00 00 00 00 00 r1 = r10
; int kprobe__tcp_cleanup_rbuf(struct pt_regs *ctx) // Line 86
10: 07 01 00 00 b0 ff ff ff r1 += -80
; u16 dport = 0, family = ({ typeof(unsigned short) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_family); _val; }); // Line 90
11: b7 02 00 00 02 00 00 00 r2 = 2
12: 85 00 00 00 04 00 00 00 call 4
13: 69 a9 b0 ff 00 00 00 00 r9 = *(u16 *)(r10 - 80)
; char cgpath[16] = "/"; // Line 92
14: 7b 8a f8 ff 00 00 00 00 *(u64 *)(r10 - 8) = r8
15: b7 01 00 00 2f 00 00 00 r1 = 47
16: 7b 1a f0 ff 00 00 00 00 *(u64 *)(r10 - 16) = r1
; t = (struct task_struct *)bpf_get_current_task(); // Line 94
17: 85 00 00 00 23 00 00 00 call 35
18: bf a2 00 00 00 00 00 00 r2 = r10
; int kprobe__tcp_cleanup_rbuf(struct pt_regs *ctx) // Line 86
19: 07 02 00 00 f0 ff ff ff r2 += -16
; task_cgroup_path(t, (char *) &cgpath, sizeof(cgpath)); // Line 95
20: bf 01 00 00 00 00 00 00 r1 = r0
21: b7 03 00 00 10 00 00 00 r3 = 16
22: 85 10 00 00 ff ff ff ff call -1
23: 7b 7a 60 ff 00 00 00 00 *(u64 *)(r10 - 160) = r7
; struct sock *sk = ctx->di; int copied = ctx->si; // Line 88
24: 67 07 00 00 20 00 00 00 r7 <<= 32
25: c7 07 00 00 20 00 00 00 r7 s>>= 32
26: b7 02 00 00 01 00 00 00 r2 = 1
; if (copied <= 0) { // Line 97
27: 6d 72 9b 00 00 00 00 00 if r2 s> r7 goto +155
28: 77 06 00 00 20 00 00 00 r6 >>= 32
; if (family == AF_INET) { // Line 101
29: 15 09 3d 00 0a 00 00 00 if r9 == 10 goto +61
30: 55 09 98 00 02 00 00 00 if r9 != 2 goto +152
31: b7 09 00 00 00 00 00 00 r9 = 0
; ipv4_key.saddr = ({ typeof(__be32) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_rcv_saddr); _val; }); // Line 103
32: 63 9a b0 ff 00 00 00 00 *(u32 *)(r10 - 80) = r9
33: 79 a7 58 ff 00 00 00 00 r7 = *(u64 *)(r10 - 168)
34: bf 73 00 00 00 00 00 00 r3 = r7
35: 07 03 00 00 04 00 00 00 r3 += 4
36: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv4_key_t ipv4_key = {.pid = pid}; // Line 102
37: 07 01 00 00 b0 ff ff ff r1 += -80
; ipv4_key.saddr = ({ typeof(__be32) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_rcv_saddr); _val; }); // Line 103
38: b7 02 00 00 04 00 00 00 r2 = 4
39: 85 00 00 00 04 00 00 00 call 4
40: 61 a1 b0 ff 00 00 00 00 r1 = *(u32 *)(r10 - 80)
; ipv4_key.daddr = ({ typeof(__be32) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_daddr); _val; }); // Line 104
41: 7b 1a 50 ff 00 00 00 00 *(u64 *)(r10 - 176) = r1
42: 63 9a b0 ff 00 00 00 00 *(u32 *)(r10 - 80) = r9
43: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv4_key_t ipv4_key = {.pid = pid}; // Line 102
44: 07 01 00 00 b0 ff ff ff r1 += -80
; ipv4_key.daddr = ({ typeof(__be32) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_daddr); _val; }); // Line 104
45: b7 02 00 00 04 00 00 00 r2 = 4
46: bf 73 00 00 00 00 00 00 r3 = r7
47: 85 00 00 00 04 00 00 00 call 4
48: 61 a1 b0 ff 00 00 00 00 r1 = *(u32 *)(r10 - 80)
; ipv4_key.lport = ({ typeof(__u16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_num); _val; }); // Line 105
49: 7b 1a 48 ff 00 00 00 00 *(u64 *)(r10 - 184) = r1
50: 6b 9a b0 ff 00 00 00 00 *(u16 *)(r10 - 80) = r9
51: bf 73 00 00 00 00 00 00 r3 = r7
52: 07 03 00 00 0e 00 00 00 r3 += 14
53: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv4_key_t ipv4_key = {.pid = pid}; // Line 102
54: 07 01 00 00 b0 ff ff ff r1 += -80
; ipv4_key.lport = ({ typeof(__u16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_num); _val; }); // Line 105
55: b7 02 00 00 02 00 00 00 r2 = 2
56: 85 00 00 00 04 00 00 00 call 4
57: 69 a8 b0 ff 00 00 00 00 r8 = *(u16 *)(r10 - 80)
; dport = ({ typeof(__be16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_dport); _val; }); // Line 106
58: 6b 9a b0 ff 00 00 00 00 *(u16 *)(r10 - 80) = r9
; ipv4_key.lport = ({ typeof(__u16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_num); _val; }); // Line 105
59: 07 07 00 00 0c 00 00 00 r7 += 12
60: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv4_key_t ipv4_key = {.pid = pid}; // Line 102
61: 07 01 00 00 b0 ff ff ff r1 += -80
; dport = ({ typeof(__be16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_dport); _val; }); // Line 106
62: b7 02 00 00 02 00 00 00 r2 = 2
63: bf 73 00 00 00 00 00 00 r3 = r7
64: 85 00 00 00 04 00 00 00 call 4
65: 69 a1 b0 ff 00 00 00 00 r1 = *(u16 *)(r10 - 80)
; ({ typeof(ipv4_recv_bytes.key) _key = ipv4_key; typeof(ipv4_recv_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -2), &_key); if (_leaf) (*_leaf) += copied;else { typeof(ipv4_recv_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += copied;bpf_map_update_elem_(bpf_pseudo_fd(1, -2), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 109
66: 79 a2 50 ff 00 00 00 00 r2 = *(u64 *)(r10 - 176)
67: 63 2a b4 ff 00 00 00 00 *(u32 *)(r10 - 76) = r2
68: 63 6a b0 ff 00 00 00 00 *(u32 *)(r10 - 80) = r6
69: 79 a2 48 ff 00 00 00 00 r2 = *(u64 *)(r10 - 184)
70: 63 2a b8 ff 00 00 00 00 *(u32 *)(r10 - 72) = r2
71: 6b 8a bc ff 00 00 00 00 *(u16 *)(r10 - 68) = r8
; ipv4_key.dport = ntohs(dport); // Line 107
72: dc 01 00 00 10 00 00 00 r1 = be16 r1
; ({ typeof(ipv4_recv_bytes.key) _key = ipv4_key; typeof(ipv4_recv_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -2), &_key); if (_leaf) (*_leaf) += copied;else { typeof(ipv4_recv_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += copied;bpf_map_update_elem_(bpf_pseudo_fd(1, -2), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 109
73: 6b 1a be ff 00 00 00 00 *(u16 *)(r10 - 66) = r1
74: 79 a1 f0 ff 00 00 00 00 r1 = *(u64 *)(r10 - 16)
75: 7b 1a c0 ff 00 00 00 00 *(u64 *)(r10 - 64) = r1
76: 79 a1 f8 ff 00 00 00 00 r1 = *(u64 *)(r10 - 8)
77: 7b 1a c8 ff 00 00 00 00 *(u64 *)(r10 - 56) = r1
78: 18 11 00 00 fe ff ff ff 00 00 00 00 00 00 00 00 ld_pseudo r1, 1, 4294967294
80: bf a2 00 00 00 00 00 00 r2 = r10
; struct ipv4_key_t ipv4_key = {.pid = pid}; // Line 102
81: 07 02 00 00 b0 ff ff ff r2 += -80
82: 85 00 00 00 01 00 00 00 call 1
; ({ typeof(ipv4_recv_bytes.key) _key = ipv4_key; typeof(ipv4_recv_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -2), &_key); if (_leaf) (*_leaf) += copied;else { typeof(ipv4_recv_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += copied;bpf_map_update_elem_(bpf_pseudo_fd(1, -2), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 109
83: 15 00 4c 00 00 00 00 00 if r0 == 0 goto +76
84: 79 a2 60 ff 00 00 00 00 r2 = *(u64 *)(r10 - 160)
85: 67 02 00 00 20 00 00 00 r2 <<= 32
86: c7 02 00 00 20 00 00 00 r2 s>>= 32
87: 79 01 00 00 00 00 00 00 r1 = *(u64 *)(r0 + 0)
88: 0f 21 00 00 00 00 00 00 r1 += r2
89: 7b 10 00 00 00 00 00 00 *(u64 *)(r0 + 0) = r1
90: 05 00 5c 00 00 00 00 00 goto +92
91: b7 09 00 00 00 00 00 00 r9 = 0
; struct ipv6_key_t ipv6_key = {.pid = pid}; // Line 112
92: 7b 9a d0 ff 00 00 00 00 *(u64 *)(r10 - 48) = r9
93: 63 6a d0 ff 00 00 00 00 *(u32 *)(r10 - 48) = r6
94: 7b 9a e8 ff 00 00 00 00 *(u64 *)(r10 - 24) = r9
95: 7b 9a e0 ff 00 00 00 00 *(u64 *)(r10 - 32) = r9
96: 7b 9a d8 ff 00 00 00 00 *(u64 *)(r10 - 40) = r9
97: 7b 9a c8 ff 00 00 00 00 *(u64 *)(r10 - 56) = r9
98: 7b 9a c0 ff 00 00 00 00 *(u64 *)(r10 - 64) = r9
99: 7b 9a b8 ff 00 00 00 00 *(u64 *)(r10 - 72) = r9
100: 7b 9a b0 ff 00 00 00 00 *(u64 *)(r10 - 80) = r9
101: 79 a6 58 ff 00 00 00 00 r6 = *(u64 *)(r10 - 168)
; &sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); // Line 114
102: bf 63 00 00 00 00 00 00 r3 = r6
103: 07 03 00 00 48 00 00 00 r3 += 72
104: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv6_key_t ipv6_key = {.pid = pid}; // Line 112
105: 07 01 00 00 b0 ff ff ff r1 += -80
; bpf_probe_read(&ipv6_key.saddr, sizeof(ipv6_key.saddr), // Line 113
106: b7 02 00 00 10 00 00 00 r2 = 16
107: 85 00 00 00 04 00 00 00 call 4
; &sk->__sk_common.skc_v6_daddr.in6_u.u6_addr32); // Line 116
108: bf 63 00 00 00 00 00 00 r3 = r6
109: 07 03 00 00 38 00 00 00 r3 += 56
; struct ipv6_key_t ipv6_key = {.pid = pid}; // Line 112
110: bf a1 00 00 00 00 00 00 r1 = r10
111: 07 01 00 00 c0 ff ff ff r1 += -64
; bpf_probe_read(&ipv6_key.daddr, sizeof(ipv6_key.daddr), // Line 115
112: b7 02 00 00 10 00 00 00 r2 = 16
113: 85 00 00 00 04 00 00 00 call 4
; ipv6_key.lport = ({ typeof(__u16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_num); _val; }); // Line 117
114: 6b 9a 70 ff 00 00 00 00 *(u16 *)(r10 - 144) = r9
115: bf 63 00 00 00 00 00 00 r3 = r6
116: 07 03 00 00 0e 00 00 00 r3 += 14
117: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv6_key_t ipv6_key = {.pid = pid}; // Line 112
118: 07 01 00 00 70 ff ff ff r1 += -144
; ipv6_key.lport = ({ typeof(__u16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_num); _val; }); // Line 117
119: b7 02 00 00 02 00 00 00 r2 = 2
120: 85 00 00 00 04 00 00 00 call 4
121: 69 a1 70 ff 00 00 00 00 r1 = *(u16 *)(r10 - 144)
122: 6b 1a d4 ff 00 00 00 00 *(u16 *)(r10 - 44) = r1
; dport = ({ typeof(__be16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_dport); _val; }); // Line 118
123: 6b 9a 70 ff 00 00 00 00 *(u16 *)(r10 - 144) = r9
; ipv6_key.lport = ({ typeof(__u16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_num); _val; }); // Line 117
124: 07 06 00 00 0c 00 00 00 r6 += 12
125: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv6_key_t ipv6_key = {.pid = pid}; // Line 112
126: 07 01 00 00 70 ff ff ff r1 += -144
; dport = ({ typeof(__be16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_dport); _val; }); // Line 118
127: b7 02 00 00 02 00 00 00 r2 = 2
128: bf 63 00 00 00 00 00 00 r3 = r6
129: 85 00 00 00 04 00 00 00 call 4
130: 69 a1 70 ff 00 00 00 00 r1 = *(u16 *)(r10 - 144)
; ipv6_key.dport = ntohs(dport); // Line 119
131: dc 01 00 00 10 00 00 00 r1 = be16 r1
132: 6b 1a d6 ff 00 00 00 00 *(u16 *)(r10 - 42) = r1
; __builtin_memcpy(&ipv6_key.cgrouppath, &cgpath, sizeof(ipv6_key.cgrouppath)); // Line 120
133: 79 a1 f0 ff 00 00 00 00 r1 = *(u64 *)(r10 - 16)
134: 7b 1a d8 ff 00 00 00 00 *(u64 *)(r10 - 40) = r1
135: 79 a1 f8 ff 00 00 00 00 r1 = *(u64 *)(r10 - 8)
136: 7b 1a e0 ff 00 00 00 00 *(u64 *)(r10 - 32) = r1
; ({ typeof(ipv6_recv_bytes.key) _key = ipv6_key; typeof(ipv6_recv_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -4), &_key); if (_leaf) (*_leaf) += copied;else { typeof(ipv6_recv_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += copied;bpf_map_update_elem_(bpf_pseudo_fd(1, -4), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 121
137: 79 a1 e8 ff 00 00 00 00 r1 = *(u64 *)(r10 - 24)
138: 7b 1a a8 ff 00 00 00 00 *(u64 *)(r10 - 88) = r1
139: 79 a1 e0 ff 00 00 00 00 r1 = *(u64 *)(r10 - 32)
140: 7b 1a a0 ff 00 00 00 00 *(u64 *)(r10 - 96) = r1
141: 79 a1 d8 ff 00 00 00 00 r1 = *(u64 *)(r10 - 40)
142: 7b 1a 98 ff 00 00 00 00 *(u64 *)(r10 - 104) = r1
143: 79 a1 d0 ff 00 00 00 00 r1 = *(u64 *)(r10 - 48)
144: 7b 1a 90 ff 00 00 00 00 *(u64 *)(r10 - 112) = r1
145: 79 a1 c8 ff 00 00 00 00 r1 = *(u64 *)(r10 - 56)
146: 7b 1a 88 ff 00 00 00 00 *(u64 *)(r10 - 120) = r1
147: 79 a1 c0 ff 00 00 00 00 r1 = *(u64 *)(r10 - 64)
148: 7b 1a 80 ff 00 00 00 00 *(u64 *)(r10 - 128) = r1
149: 79 a1 b8 ff 00 00 00 00 r1 = *(u64 *)(r10 - 72)
150: 7b 1a 78 ff 00 00 00 00 *(u64 *)(r10 - 136) = r1
151: 79 a1 b0 ff 00 00 00 00 r1 = *(u64 *)(r10 - 80)
152: 7b 1a 70 ff 00 00 00 00 *(u64 *)(r10 - 144) = r1
153: 18 11 00 00 fc ff ff ff 00 00 00 00 00 00 00 00 ld_pseudo r1, 1, 4294967292
155: bf a2 00 00 00 00 00 00 r2 = r10
; struct ipv6_key_t ipv6_key = {.pid = pid}; // Line 112
156: 07 02 00 00 70 ff ff ff r2 += -144
157: 85 00 00 00 01 00 00 00 call 1
; ({ typeof(ipv6_recv_bytes.key) _key = ipv6_key; typeof(ipv6_recv_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -4), &_key); if (_leaf) (*_leaf) += copied;else { typeof(ipv6_recv_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += copied;bpf_map_update_elem_(bpf_pseudo_fd(1, -4), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 121
158: 15 00 0c 00 00 00 00 00 if r0 == 0 goto +12
159: 05 00 b4 ff 00 00 00 00 goto -76
160: 79 a1 60 ff 00 00 00 00 r1 = *(u64 *)(r10 - 160)
; ({ typeof(ipv4_recv_bytes.key) _key = ipv4_key; typeof(ipv4_recv_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -2), &_key); if (_leaf) (*_leaf) += copied;else { typeof(ipv4_recv_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += copied;bpf_map_update_elem_(bpf_pseudo_fd(1, -2), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 109
161: 67 01 00 00 20 00 00 00 r1 <<= 32
162: c7 01 00 00 20 00 00 00 r1 s>>= 32
163: 7b 1a 70 ff 00 00 00 00 *(u64 *)(r10 - 144) = r1
164: 18 11 00 00 fe ff ff ff 00 00 00 00 00 00 00 00 ld_pseudo r1, 1, 4294967294
166: bf a2 00 00 00 00 00 00 r2 = r10
167: 07 02 00 00 b0 ff ff ff r2 += -80
168: bf a3 00 00 00 00 00 00 r3 = r10
169: 07 03 00 00 70 ff ff ff r3 += -144
170: 05 00 0a 00 00 00 00 00 goto +10
171: 79 a1 60 ff 00 00 00 00 r1 = *(u64 *)(r10 - 160)
; ({ typeof(ipv6_recv_bytes.key) _key = ipv6_key; typeof(ipv6_recv_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -4), &_key); if (_leaf) (*_leaf) += copied;else { typeof(ipv6_recv_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += copied;bpf_map_update_elem_(bpf_pseudo_fd(1, -4), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 121
172: 67 01 00 00 20 00 00 00 r1 <<= 32
173: c7 01 00 00 20 00 00 00 r1 s>>= 32
174: 7b 1a 68 ff 00 00 00 00 *(u64 *)(r10 - 152) = r1
175: 18 11 00 00 fc ff ff ff 00 00 00 00 00 00 00 00 ld_pseudo r1, 1, 4294967292
177: bf a2 00 00 00 00 00 00 r2 = r10
178: 07 02 00 00 70 ff ff ff r2 += -144
179: bf a3 00 00 00 00 00 00 r3 = r10
180: 07 03 00 00 68 ff ff ff r3 += -152
181: b7 04 00 00 01 00 00 00 r4 = 1
182: 85 00 00 00 02 00 00 00 call 2
; } // Line 126
183: b7 00 00 00 00 00 00 00 r0 = 0
184: 95 00 00 00 00 00 00 00 exit
Disassembly of section .bpf.fn.kprobe__tcp_sendmsg:
kprobe__tcp_sendmsg:
; { // Line 42
0: 79 12 60 00 00 00 00 00 r2 = *(u64 *)(r1 + 96)
; struct sock *sk = ctx->di; struct msghdr *msg = ctx->si; size_t size = ctx->dx; // Line 43
1: 7b 2a 60 ff 00 00 00 00 *(u64 *)(r10 - 160) = r2
2: 79 16 70 00 00 00 00 00 r6 = *(u64 *)(r1 + 112)
; u32 pid = bpf_get_current_pid_tgid() >> 32; // Line 44
3: 85 00 00 00 0e 00 00 00 call 14
4: bf 07 00 00 00 00 00 00 r7 = r0
5: b7 09 00 00 00 00 00 00 r9 = 0
; u16 dport = 0, family = ({ typeof(unsigned short) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_family); _val; }); // Line 45
6: 6b 9a b0 ff 00 00 00 00 *(u16 *)(r10 - 80) = r9
7: bf 63 00 00 00 00 00 00 r3 = r6
8: 07 03 00 00 10 00 00 00 r3 += 16
9: bf a1 00 00 00 00 00 00 r1 = r10
; int kprobe__tcp_sendmsg(struct pt_regs *ctx) // Line 41
10: 07 01 00 00 b0 ff ff ff r1 += -80
; u16 dport = 0, family = ({ typeof(unsigned short) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_family); _val; }); // Line 45
11: b7 02 00 00 02 00 00 00 r2 = 2
12: 85 00 00 00 04 00 00 00 call 4
13: 69 a8 b0 ff 00 00 00 00 r8 = *(u16 *)(r10 - 80)
; char cgpath[16] = "/"; // Line 47
14: 7b 9a f8 ff 00 00 00 00 *(u64 *)(r10 - 8) = r9
15: b7 01 00 00 2f 00 00 00 r1 = 47
16: 7b 1a f0 ff 00 00 00 00 *(u64 *)(r10 - 16) = r1
; t = (struct task_struct *)bpf_get_current_task(); // Line 49
17: 85 00 00 00 23 00 00 00 call 35
18: bf a2 00 00 00 00 00 00 r2 = r10
; int kprobe__tcp_sendmsg(struct pt_regs *ctx) // Line 41
19: 07 02 00 00 f0 ff ff ff r2 += -16
; task_cgroup_path(t, (char *) &cgpath, sizeof(cgpath)); // Line 50
20: bf 01 00 00 00 00 00 00 r1 = r0
21: b7 03 00 00 10 00 00 00 r3 = 16
22: 85 10 00 00 ff ff ff ff call -1
; u32 pid = bpf_get_current_pid_tgid() >> 32; // Line 44
23: 77 07 00 00 20 00 00 00 r7 >>= 32
; if (family == AF_INET) { // Line 52
24: 15 08 3a 00 0a 00 00 00 if r8 == 10 goto +58
25: 55 08 8f 00 02 00 00 00 if r8 != 2 goto +143
26: b7 09 00 00 00 00 00 00 r9 = 0
; ipv4_key.saddr = ({ typeof(__be32) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_rcv_saddr); _val; }); // Line 54
27: 63 9a b0 ff 00 00 00 00 *(u32 *)(r10 - 80) = r9
28: bf 63 00 00 00 00 00 00 r3 = r6
29: 07 03 00 00 04 00 00 00 r3 += 4
30: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv4_key_t ipv4_key = {.pid = pid}; // Line 53
31: 07 01 00 00 b0 ff ff ff r1 += -80
; ipv4_key.saddr = ({ typeof(__be32) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_rcv_saddr); _val; }); // Line 54
32: b7 02 00 00 04 00 00 00 r2 = 4
33: 85 00 00 00 04 00 00 00 call 4
34: 61 a1 b0 ff 00 00 00 00 r1 = *(u32 *)(r10 - 80)
; ipv4_key.daddr = ({ typeof(__be32) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_daddr); _val; }); // Line 55
35: 7b 1a 58 ff 00 00 00 00 *(u64 *)(r10 - 168) = r1
36: 63 9a b0 ff 00 00 00 00 *(u32 *)(r10 - 80) = r9
37: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv4_key_t ipv4_key = {.pid = pid}; // Line 53
38: 07 01 00 00 b0 ff ff ff r1 += -80
; ipv4_key.daddr = ({ typeof(__be32) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_daddr); _val; }); // Line 55
39: b7 02 00 00 04 00 00 00 r2 = 4
40: bf 63 00 00 00 00 00 00 r3 = r6
41: 85 00 00 00 04 00 00 00 call 4
42: 61 a1 b0 ff 00 00 00 00 r1 = *(u32 *)(r10 - 80)
; ipv4_key.lport = ({ typeof(__u16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_num); _val; }); // Line 56
43: 7b 1a 50 ff 00 00 00 00 *(u64 *)(r10 - 176) = r1
44: 6b 9a b0 ff 00 00 00 00 *(u16 *)(r10 - 80) = r9
45: bf 63 00 00 00 00 00 00 r3 = r6
46: 07 03 00 00 0e 00 00 00 r3 += 14
47: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv4_key_t ipv4_key = {.pid = pid}; // Line 53
48: 07 01 00 00 b0 ff ff ff r1 += -80
; ipv4_key.lport = ({ typeof(__u16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_num); _val; }); // Line 56
49: b7 02 00 00 02 00 00 00 r2 = 2
50: 85 00 00 00 04 00 00 00 call 4
51: 69 a8 b0 ff 00 00 00 00 r8 = *(u16 *)(r10 - 80)
; dport = ({ typeof(__be16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_dport); _val; }); // Line 57
52: 6b 9a b0 ff 00 00 00 00 *(u16 *)(r10 - 80) = r9
; ipv4_key.lport = ({ typeof(__u16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_num); _val; }); // Line 56
53: 07 06 00 00 0c 00 00 00 r6 += 12
54: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv4_key_t ipv4_key = {.pid = pid}; // Line 53
55: 07 01 00 00 b0 ff ff ff r1 += -80
; dport = ({ typeof(__be16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_dport); _val; }); // Line 57
56: b7 02 00 00 02 00 00 00 r2 = 2
57: bf 63 00 00 00 00 00 00 r3 = r6
58: 85 00 00 00 04 00 00 00 call 4
59: 69 a1 b0 ff 00 00 00 00 r1 = *(u16 *)(r10 - 80)
; ({ typeof(ipv4_send_bytes.key) _key = ipv4_key; typeof(ipv4_send_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -1), &_key); if (_leaf) (*_leaf) += size;else { typeof(ipv4_send_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += size;bpf_map_update_elem_(bpf_pseudo_fd(1, -1), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 60
60: 79 a2 58 ff 00 00 00 00 r2 = *(u64 *)(r10 - 168)
61: 63 2a b4 ff 00 00 00 00 *(u32 *)(r10 - 76) = r2
62: 63 7a b0 ff 00 00 00 00 *(u32 *)(r10 - 80) = r7
63: 79 a2 50 ff 00 00 00 00 r2 = *(u64 *)(r10 - 176)
64: 63 2a b8 ff 00 00 00 00 *(u32 *)(r10 - 72) = r2
65: 6b 8a bc ff 00 00 00 00 *(u16 *)(r10 - 68) = r8
; ipv4_key.dport = ntohs(dport); // Line 58
66: dc 01 00 00 10 00 00 00 r1 = be16 r1
; ({ typeof(ipv4_send_bytes.key) _key = ipv4_key; typeof(ipv4_send_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -1), &_key); if (_leaf) (*_leaf) += size;else { typeof(ipv4_send_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += size;bpf_map_update_elem_(bpf_pseudo_fd(1, -1), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 60
67: 6b 1a be ff 00 00 00 00 *(u16 *)(r10 - 66) = r1
68: 79 a1 f0 ff 00 00 00 00 r1 = *(u64 *)(r10 - 16)
69: 7b 1a c0 ff 00 00 00 00 *(u64 *)(r10 - 64) = r1
70: 79 a1 f8 ff 00 00 00 00 r1 = *(u64 *)(r10 - 8)
71: 7b 1a c8 ff 00 00 00 00 *(u64 *)(r10 - 56) = r1
72: 18 11 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 ld_pseudo r1, 1, 4294967295
74: bf a2 00 00 00 00 00 00 r2 = r10
; struct ipv4_key_t ipv4_key = {.pid = pid}; // Line 53
75: 07 02 00 00 b0 ff ff ff r2 += -80
76: 85 00 00 00 01 00 00 00 call 1
; ({ typeof(ipv4_send_bytes.key) _key = ipv4_key; typeof(ipv4_send_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -1), &_key); if (_leaf) (*_leaf) += size;else { typeof(ipv4_send_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += size;bpf_map_update_elem_(bpf_pseudo_fd(1, -1), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 60
77: 15 00 48 00 00 00 00 00 if r0 == 0 goto +72
78: 79 01 00 00 00 00 00 00 r1 = *(u64 *)(r0 + 0)
79: 79 a2 60 ff 00 00 00 00 r2 = *(u64 *)(r10 - 160)
80: 0f 21 00 00 00 00 00 00 r1 += r2
81: 7b 10 00 00 00 00 00 00 *(u64 *)(r0 + 0) = r1
82: 05 00 56 00 00 00 00 00 goto +86
; struct ipv6_key_t ipv6_key = {.pid = pid}; // Line 63
83: 7b 9a d0 ff 00 00 00 00 *(u64 *)(r10 - 48) = r9
84: 63 7a d0 ff 00 00 00 00 *(u32 *)(r10 - 48) = r7
85: 7b 9a e8 ff 00 00 00 00 *(u64 *)(r10 - 24) = r9
86: 7b 9a e0 ff 00 00 00 00 *(u64 *)(r10 - 32) = r9
87: 7b 9a d8 ff 00 00 00 00 *(u64 *)(r10 - 40) = r9
88: 7b 9a c8 ff 00 00 00 00 *(u64 *)(r10 - 56) = r9
89: 7b 9a c0 ff 00 00 00 00 *(u64 *)(r10 - 64) = r9
90: 7b 9a b8 ff 00 00 00 00 *(u64 *)(r10 - 72) = r9
91: 7b 9a b0 ff 00 00 00 00 *(u64 *)(r10 - 80) = r9
; &sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); // Line 65
92: bf 63 00 00 00 00 00 00 r3 = r6
93: 07 03 00 00 48 00 00 00 r3 += 72
94: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv6_key_t ipv6_key = {.pid = pid}; // Line 63
95: 07 01 00 00 b0 ff ff ff r1 += -80
; bpf_probe_read(&ipv6_key.saddr, sizeof(ipv6_key.saddr), // Line 64
96: b7 02 00 00 10 00 00 00 r2 = 16
97: 85 00 00 00 04 00 00 00 call 4
; &sk->__sk_common.skc_v6_daddr.in6_u.u6_addr32); // Line 67
98: bf 63 00 00 00 00 00 00 r3 = r6
99: 07 03 00 00 38 00 00 00 r3 += 56
; struct ipv6_key_t ipv6_key = {.pid = pid}; // Line 63
100: bf a1 00 00 00 00 00 00 r1 = r10
101: 07 01 00 00 c0 ff ff ff r1 += -64
; bpf_probe_read(&ipv6_key.daddr, sizeof(ipv6_key.daddr), // Line 66
102: b7 02 00 00 10 00 00 00 r2 = 16
103: 85 00 00 00 04 00 00 00 call 4
; ipv6_key.lport = ({ typeof(__u16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_num); _val; }); // Line 68
104: 6b 9a 70 ff 00 00 00 00 *(u16 *)(r10 - 144) = r9
105: bf 63 00 00 00 00 00 00 r3 = r6
106: 07 03 00 00 0e 00 00 00 r3 += 14
107: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv6_key_t ipv6_key = {.pid = pid}; // Line 63
108: 07 01 00 00 70 ff ff ff r1 += -144
; ipv6_key.lport = ({ typeof(__u16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_num); _val; }); // Line 68
109: b7 02 00 00 02 00 00 00 r2 = 2
110: 85 00 00 00 04 00 00 00 call 4
111: 69 a1 70 ff 00 00 00 00 r1 = *(u16 *)(r10 - 144)
112: 6b 1a d4 ff 00 00 00 00 *(u16 *)(r10 - 44) = r1
; dport = ({ typeof(__be16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_dport); _val; }); // Line 69
113: 6b 9a 70 ff 00 00 00 00 *(u16 *)(r10 - 144) = r9
; ipv6_key.lport = ({ typeof(__u16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_num); _val; }); // Line 68
114: 07 06 00 00 0c 00 00 00 r6 += 12
115: bf a1 00 00 00 00 00 00 r1 = r10
; struct ipv6_key_t ipv6_key = {.pid = pid}; // Line 63
116: 07 01 00 00 70 ff ff ff r1 += -144
; dport = ({ typeof(__be16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->__sk_common.skc_dport); _val; }); // Line 69
117: b7 02 00 00 02 00 00 00 r2 = 2
118: bf 63 00 00 00 00 00 00 r3 = r6
119: 85 00 00 00 04 00 00 00 call 4
120: 69 a1 70 ff 00 00 00 00 r1 = *(u16 *)(r10 - 144)
; ipv6_key.dport = ntohs(dport); // Line 70
121: dc 01 00 00 10 00 00 00 r1 = be16 r1
122: 6b 1a d6 ff 00 00 00 00 *(u16 *)(r10 - 42) = r1
; __builtin_memcpy(&ipv6_key.cgrouppath, &cgpath, sizeof(ipv6_key.cgrouppath)); // Line 71
123: 79 a1 f0 ff 00 00 00 00 r1 = *(u64 *)(r10 - 16)
124: 7b 1a d8 ff 00 00 00 00 *(u64 *)(r10 - 40) = r1
125: 79 a1 f8 ff 00 00 00 00 r1 = *(u64 *)(r10 - 8)
126: 7b 1a e0 ff 00 00 00 00 *(u64 *)(r10 - 32) = r1
; ({ typeof(ipv6_send_bytes.key) _key = ipv6_key; typeof(ipv6_send_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -3), &_key); if (_leaf) (*_leaf) += size;else { typeof(ipv6_send_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += size;bpf_map_update_elem_(bpf_pseudo_fd(1, -3), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 72
127: 79 a1 e8 ff 00 00 00 00 r1 = *(u64 *)(r10 - 24)
128: 7b 1a a8 ff 00 00 00 00 *(u64 *)(r10 - 88) = r1
129: 79 a1 e0 ff 00 00 00 00 r1 = *(u64 *)(r10 - 32)
130: 7b 1a a0 ff 00 00 00 00 *(u64 *)(r10 - 96) = r1
131: 79 a1 d8 ff 00 00 00 00 r1 = *(u64 *)(r10 - 40)
132: 7b 1a 98 ff 00 00 00 00 *(u64 *)(r10 - 104) = r1
133: 79 a1 d0 ff 00 00 00 00 r1 = *(u64 *)(r10 - 48)
134: 7b 1a 90 ff 00 00 00 00 *(u64 *)(r10 - 112) = r1
135: 79 a1 c8 ff 00 00 00 00 r1 = *(u64 *)(r10 - 56)
136: 7b 1a 88 ff 00 00 00 00 *(u64 *)(r10 - 120) = r1
137: 79 a1 c0 ff 00 00 00 00 r1 = *(u64 *)(r10 - 64)
138: 7b 1a 80 ff 00 00 00 00 *(u64 *)(r10 - 128) = r1
139: 79 a1 b8 ff 00 00 00 00 r1 = *(u64 *)(r10 - 72)
140: 7b 1a 78 ff 00 00 00 00 *(u64 *)(r10 - 136) = r1
141: 79 a1 b0 ff 00 00 00 00 r1 = *(u64 *)(r10 - 80)
142: 7b 1a 70 ff 00 00 00 00 *(u64 *)(r10 - 144) = r1
143: 18 11 00 00 fd ff ff ff 00 00 00 00 00 00 00 00 ld_pseudo r1, 1, 4294967293
145: bf a2 00 00 00 00 00 00 r2 = r10
; struct ipv6_key_t ipv6_key = {.pid = pid}; // Line 63
146: 07 02 00 00 70 ff ff ff r2 += -144
147: 85 00 00 00 01 00 00 00 call 1
; ({ typeof(ipv6_send_bytes.key) _key = ipv6_key; typeof(ipv6_send_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -3), &_key); if (_leaf) (*_leaf) += size;else { typeof(ipv6_send_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += size;bpf_map_update_elem_(bpf_pseudo_fd(1, -3), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 72
148: 15 00 0a 00 00 00 00 00 if r0 == 0 goto +10
149: 05 00 b8 ff 00 00 00 00 goto -72
; ({ typeof(ipv4_send_bytes.key) _key = ipv4_key; typeof(ipv4_send_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -1), &_key); if (_leaf) (*_leaf) += size;else { typeof(ipv4_send_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += size;bpf_map_update_elem_(bpf_pseudo_fd(1, -1), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 60
150: 79 a1 60 ff 00 00 00 00 r1 = *(u64 *)(r10 - 160)
151: 7b 1a 70 ff 00 00 00 00 *(u64 *)(r10 - 144) = r1
152: 18 11 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 ld_pseudo r1, 1, 4294967295
154: bf a2 00 00 00 00 00 00 r2 = r10
155: 07 02 00 00 b0 ff ff ff r2 += -80
156: bf a3 00 00 00 00 00 00 r3 = r10
157: 07 03 00 00 70 ff ff ff r3 += -144
158: 05 00 08 00 00 00 00 00 goto +8
; ({ typeof(ipv6_send_bytes.key) _key = ipv6_key; typeof(ipv6_send_bytes.leaf) *_leaf = bpf_map_lookup_elem_(bpf_pseudo_fd(1, -3), &_key); if (_leaf) (*_leaf) += size;else { typeof(ipv6_send_bytes.leaf) _zleaf; __builtin_memset(&_zleaf, 0, sizeof(_zleaf)); _zleaf += size;bpf_map_update_elem_(bpf_pseudo_fd(1, -3), &_key, &_zleaf, BPF_NOEXIST); } }); // Line 72
159: 79 a1 60 ff 00 00 00 00 r1 = *(u64 *)(r10 - 160)
160: 7b 1a 68 ff 00 00 00 00 *(u64 *)(r10 - 152) = r1
161: 18 11 00 00 fd ff ff ff 00 00 00 00 00 00 00 00 ld_pseudo r1, 1, 4294967293
163: bf a2 00 00 00 00 00 00 r2 = r10
164: 07 02 00 00 70 ff ff ff r2 += -144
165: bf a3 00 00 00 00 00 00 r3 = r10
166: 07 03 00 00 68 ff ff ff r3 += -152
167: b7 04 00 00 01 00 00 00 r4 = 1
168: 85 00 00 00 02 00 00 00 call 2
; return 0; // Line 76
169: b7 00 00 00 00 00 00 00 r0 = 0
170: 95 00 00 00 00 00 00 00 exit
bpf: Failed to load program: Invalid argument
last insn is not an exit or jmp
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment