From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 687E22FB0AE; Thu, 9 Oct 2025 15:59:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760025590; cv=none; b=pVr38qnWHQMoIWUQuZEXVZVX0rVVtTK22fqMVwSSNGzUEJqxPNaMH/Dgpz+jWfwk/bQCCoPh0zObH/3aPvIfL4jnKexGIVXtTCMo3QsIYlF97m6cqOBDH2PzY/0eSEwL5eWMQSB05WIxS12hDbk3zW66VYVVMhLV4LAOIR8i4/A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760025590; c=relaxed/simple; bh=nd1wa/cp2/P1e0jXzTDqfpVAMUOzv7R/1WIlKHMuY2Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=o9QpKO4B3QuBSJbL/bAxG968jCE6MY5No1EOiXrR0vyf3JRTm2WCb6mYxygQp/Hch37/iCUjuXE9BLgXZ9E/4ZBcmdbsJ7GqCi/Mp87CCHVHjZmdKdBpq6XiLU+OtMzrecSvvLM85zE54sPTdVKEPGj8xPj9R0mUC8lbB683Ino= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=l5f8mYJi; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="l5f8mYJi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4ECF2C4CEFE; Thu, 9 Oct 2025 15:59:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760025590; bh=nd1wa/cp2/P1e0jXzTDqfpVAMUOzv7R/1WIlKHMuY2Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=l5f8mYJiTyAORYI74It40JL5jbQiQujWArucaFeh6V/6HNsiJlFw2YYh/IZUQltuV UGcEP9AyWuO1LoGV9di03jB/AdniEghcQCWHyzLeZy/dkR5SNgf8DPFM0PvFEn7fpB JQI8aPowgsR7zWLoxJ5400LeB8tliii9BEMpIoEG0JKUufBONHAZT/w3xs3D8fwKkz OPYGLsNm55LQ1YSU17FJmZTQ/dfMMQokA66Qx8Dha3+mI13FjOF50e6iMMWwsI+INa RVHxzSag2vz9gcMNL7f0qC3WQr3avg7z9P3J8nt675JMJIUqEG09uZRb2LX2XkoPio EC05cj2XM0QDA== From: Sasha Levin To: patches@lists.linux.dev, stable@vger.kernel.org Cc: Jiawei Zhao , Andrii Nakryiko , Sasha Levin , eddyz87@gmail.com, ast@kernel.org, daniel@iogearbox.net, bpf@vger.kernel.org Subject: [PATCH AUTOSEL 6.17-6.12] libbpf: Fix USDT SIB argument handling causing unrecognized register error Date: Thu, 9 Oct 2025 11:55:27 -0400 Message-ID: <20251009155752.773732-61-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20251009155752.773732-1-sashal@kernel.org> References: <20251009155752.773732-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.17.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Jiawei Zhao [ Upstream commit 758acb9ccfdbf854b55abaceaf1f3f229cde3d19 ] On x86-64, USDT arguments can be specified using Scale-Index-Base (SIB) addressing, e.g. "1@-96(%rbp,%rax,8)". The current USDT implementation in libbpf cannot parse this format, causing `bpf_program__attach_usdt()` to fail with -ENOENT (unrecognized register). This patch fixes this by implementing the necessary changes: - add correct handling for SIB-addressed arguments in `bpf_usdt_arg`. - add adaptive support to `__bpf_usdt_arg_type` and `__bpf_usdt_arg_spec` to represent SIB addressing parameters. Signed-off-by: Jiawei Zhao Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250827053128.1301287-2-phoenix500526@163.com Signed-off-by: Sasha Levin --- LLM Generated explanations, may be completely bogus: Based on my comprehensive analysis of this commit, here is my assessment: ## **Backport Status: YES** ### **Analysis Summary:** **1. Nature of the Fix:** This commit fixes a **longstanding bug** in libbpf's USDT (User Statically-Defined Tracing) implementation. The bug has existed since the original x86 USDT support was added in April 2022 (commit 4c59e584d1581). **2. User Impact:** - **High Impact:** When GCC compiles USDT programs with `-O1` or higher optimization, it generates SIB (Scale-Index-Base) addressing mode for global array access, e.g., `"1@-96(%rbp,%rax,8)"` - **Failure Mode:** `bpf_program__attach_usdt()` fails with `-ENOENT` (unrecognized register) when encountering SIB addressing - **Common Scenario:** This affects any optimized build using USDT probes with array access, which is a standard use case **3. Fix Quality:** - **Well-designed:** The struct changes are explicitly designed for backward/forward compatibility - **Tested:** Includes comprehensive test coverage (commit 69424097ee106 / 080e6de1c87ef) - **Contained:** Changes are confined to USDT subsystem in libbpf (tools/lib/bpf/) - **No regression risk:** Only affects USDT argument parsing; existing functionality preserved **4. Technical Details of Fix:** ``` tools/lib/bpf/usdt.bpf.h:17-38 - Adds BPF_USDT_ARG_SIB enum value tools/lib/bpf/usdt.bpf.h:42-66 - Modifies struct with bitfields for idx_reg_off and scale_bitshift tools/lib/bpf/usdt.bpf.h:204-244 - Implements SIB calculation: base + (index << scale) + offset tools/lib/bpf/usdt.c:1277-1326 - Adds sscanf patterns to parse SIB formats ``` **5. Stable Kernel Criteria:** ✅ **Fixes important bug affecting users** - Yes, prevents USDT attachment failures ✅ **Small and contained** - Changes isolated to USDT subsystem ✅ **Minimal regression risk** - Compatibility designed in, well-tested ✅ **No architectural changes** - Follows existing ARG_REG_DEREF pattern ✅ **Not a new feature** - Fixes missing support for standard x86 addressing mode **6. Compatibility Considerations:** - The comment states: "ARG_SIB requires libbpf v1.7+" - Struct layout uses bitfields with conditional compilation for endianness - Designed to maintain offset stability for `reg_off` field - Old code reading old specs continues to work - New spec type only used when SIB addressing is detected **Note:** This commit has already been backported to this tree as **b70c5bb3cd541**, confirming its suitability for stable kernels. tools/lib/bpf/usdt.bpf.h | 44 ++++++++++++++++++++++++++-- tools/lib/bpf/usdt.c | 62 ++++++++++++++++++++++++++++++++++++---- 2 files changed, 99 insertions(+), 7 deletions(-) diff --git a/tools/lib/bpf/usdt.bpf.h b/tools/lib/bpf/usdt.bpf.h index 2a7865c8e3fe3..43deb05a51970 100644 --- a/tools/lib/bpf/usdt.bpf.h +++ b/tools/lib/bpf/usdt.bpf.h @@ -34,13 +34,32 @@ enum __bpf_usdt_arg_type { BPF_USDT_ARG_CONST, BPF_USDT_ARG_REG, BPF_USDT_ARG_REG_DEREF, + BPF_USDT_ARG_SIB, }; +/* + * This struct layout is designed specifically to be backwards/forward + * compatible between libbpf versions for ARG_CONST, ARG_REG, and + * ARG_REG_DEREF modes. ARG_SIB requires libbpf v1.7+. + */ struct __bpf_usdt_arg_spec { /* u64 scalar interpreted depending on arg_type, see below */ __u64 val_off; +#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ /* arg location case, see bpf_usdt_arg() for details */ - enum __bpf_usdt_arg_type arg_type; + enum __bpf_usdt_arg_type arg_type: 8; + /* index register offset within struct pt_regs */ + __u16 idx_reg_off: 12; + /* scale factor for index register (1, 2, 4, or 8) */ + __u16 scale_bitshift: 4; + /* reserved for future use, keeps reg_off offset stable */ + __u8 __reserved: 8; +#else + __u8 __reserved: 8; + __u16 idx_reg_off: 12; + __u16 scale_bitshift: 4; + enum __bpf_usdt_arg_type arg_type: 8; +#endif /* offset of referenced register within struct pt_regs */ short reg_off; /* whether arg should be interpreted as signed value */ @@ -149,7 +168,7 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res) { struct __bpf_usdt_spec *spec; struct __bpf_usdt_arg_spec *arg_spec; - unsigned long val; + unsigned long val, idx; int err, spec_id; *res = 0; @@ -202,6 +221,27 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res) return err; #if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ val >>= arg_spec->arg_bitshift; +#endif + break; + case BPF_USDT_ARG_SIB: + /* Arg is in memory addressed by SIB (Scale-Index-Base) mode + * (e.g., "-1@-96(%rbp,%rax,8)" in USDT arg spec). We first + * fetch the base register contents and the index register + * contents from pt_regs. Then we calculate the final address + * as base + (index * scale) + offset, and do a user-space + * probe read to fetch the argument value. + */ + err = bpf_probe_read_kernel(&val, sizeof(val), (void *)ctx + arg_spec->reg_off); + if (err) + return err; + err = bpf_probe_read_kernel(&idx, sizeof(idx), (void *)ctx + arg_spec->idx_reg_off); + if (err) + return err; + err = bpf_probe_read_user(&val, sizeof(val), (void *)(val + (idx << arg_spec->scale_bitshift) + arg_spec->val_off)); + if (err) + return err; +#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ + val >>= arg_spec->arg_bitshift; #endif break; default: diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c index 3373b9d45ac44..867bff6b06990 100644 --- a/tools/lib/bpf/usdt.c +++ b/tools/lib/bpf/usdt.c @@ -200,12 +200,23 @@ enum usdt_arg_type { USDT_ARG_CONST, USDT_ARG_REG, USDT_ARG_REG_DEREF, + USDT_ARG_SIB, }; /* should match exactly struct __bpf_usdt_arg_spec from usdt.bpf.h */ struct usdt_arg_spec { __u64 val_off; - enum usdt_arg_type arg_type; +#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ + enum usdt_arg_type arg_type: 8; + __u16 idx_reg_off: 12; + __u16 scale_bitshift: 4; + __u8 __reserved: 8; /* keep reg_off offset stable */ +#else + __u8 __reserved: 8; /* keep reg_off offset stable */ + __u16 idx_reg_off: 12; + __u16 scale_bitshift: 4; + enum usdt_arg_type arg_type: 8; +#endif short reg_off; bool arg_signed; char arg_bitshift; @@ -1283,11 +1294,51 @@ static int calc_pt_regs_off(const char *reg_name) static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec *arg, int *arg_sz) { - char reg_name[16]; - int len, reg_off; - long off; + char reg_name[16] = {0}, idx_reg_name[16] = {0}; + int len, reg_off, idx_reg_off, scale = 1; + long off = 0; + + if (sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^,] , %d ) %n", + arg_sz, &off, reg_name, idx_reg_name, &scale, &len) == 5 || + sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^,] , %d ) %n", + arg_sz, reg_name, idx_reg_name, &scale, &len) == 4 || + sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^)] ) %n", + arg_sz, &off, reg_name, idx_reg_name, &len) == 4 || + sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^)] ) %n", + arg_sz, reg_name, idx_reg_name, &len) == 3 + ) { + /* + * Scale Index Base case: + * 1@-96(%rbp,%rax,8) + * 1@(%rbp,%rax,8) + * 1@-96(%rbp,%rax) + * 1@(%rbp,%rax) + */ + arg->arg_type = USDT_ARG_SIB; + arg->val_off = off; - if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n", arg_sz, &off, reg_name, &len) == 3) { + reg_off = calc_pt_regs_off(reg_name); + if (reg_off < 0) + return reg_off; + arg->reg_off = reg_off; + + idx_reg_off = calc_pt_regs_off(idx_reg_name); + if (idx_reg_off < 0) + return idx_reg_off; + arg->idx_reg_off = idx_reg_off; + + /* validate scale factor and set fields directly */ + switch (scale) { + case 1: arg->scale_bitshift = 0; break; + case 2: arg->scale_bitshift = 1; break; + case 4: arg->scale_bitshift = 2; break; + case 8: arg->scale_bitshift = 3; break; + default: + pr_warn("usdt: invalid SIB scale %d, expected 1, 2, 4, 8\n", scale); + return -EINVAL; + } + } else if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n", + arg_sz, &off, reg_name, &len) == 3) { /* Memory dereference case, e.g., -4@-20(%rbp) */ arg->arg_type = USDT_ARG_REG_DEREF; arg->val_off = off; @@ -1306,6 +1357,7 @@ static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec } else if (sscanf(arg_str, " %d @ %%%15s %n", arg_sz, reg_name, &len) == 2) { /* Register read case, e.g., -4@%eax */ arg->arg_type = USDT_ARG_REG; + /* register read has no memory offset */ arg->val_off = 0; reg_off = calc_pt_regs_off(reg_name); -- 2.51.0