On Sat, Aug 23, 2025 at 12:19 AM Jiawei Zhao phoenix500526@163.com wrote:
On x86-64, USDT arguments can be specified using Scale-Index-Base (SIB) addressing, e.g. "1@-96(%rbp,%rax,8)". The current USDT implementation in libbpf cannot parse this format, causing `bpf_program__attach_usdt()` to fail with -ENOENT (unrecognized register).
This patch fixes this by implementing the necessary changes:
- add correct handling for SIB-addressed arguments in `bpf_usdt_arg`.
- add adaptive support to `__bpf_usdt_arg_type` and `__bpf_usdt_arg_spec` to represent SIB addressing parameters.
Signed-off-by: Jiawei Zhao phoenix500526@163.com
tools/lib/bpf/usdt.bpf.h | 44 +++++++++++++++++++++++++++++-- tools/lib/bpf/usdt.c | 57 ++++++++++++++++++++++++++++++++++++---- 2 files changed, 94 insertions(+), 7 deletions(-)
diff --git a/tools/lib/bpf/usdt.bpf.h b/tools/lib/bpf/usdt.bpf.h index 2a7865c8e3fe..2000b0aead75 100644 --- a/tools/lib/bpf/usdt.bpf.h +++ b/tools/lib/bpf/usdt.bpf.h @@ -34,13 +34,32 @@ enum __bpf_usdt_arg_type { BPF_USDT_ARG_CONST, BPF_USDT_ARG_REG, BPF_USDT_ARG_REG_DEREF,
BPF_USDT_ARG_SIB,};
+/*
- This struct layout is designed specifically to be backwards/forward
- compatible between libbpf versions for ARG_CONST, ARG_REG, and
- ARG_REG_DEREF modes. ARG_SIB requires libbpf v1.7+.
- */
struct __bpf_usdt_arg_spec { /* u64 scalar interpreted depending on arg_type, see below */ __u64 val_off; +#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ /* arg location case, see bpf_usdt_arg() for details */
enum __bpf_usdt_arg_type arg_type;
enum __bpf_usdt_arg_type arg_type: 8;/* index register offset within struct pt_regs */__u16 idx_reg_off: 12;/* scale factor for index register (1, 2, 4, or 8) */__u16 scale: 4;/* reserved for future use, keeps reg_off offset stable */__u8 __reserved: 8;+#else
__u8 __reserved: 8;__u16 idx_reg_off: 12;__u16 scale: 4;enum __bpf_usdt_arg_type arg_type: 8;+#endif /* offset of referenced register within struct pt_regs */ short reg_off; /* whether arg should be interpreted as signed value */ @@ -149,7 +168,7 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res) { struct __bpf_usdt_spec *spec; struct __bpf_usdt_arg_spec *arg_spec;
unsigned long val;
unsigned long val, idx; int err, spec_id; *res = 0;@@ -202,6 +221,27 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res) return err; #if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ val >>= arg_spec->arg_bitshift; +#endif
break;case BPF_USDT_ARG_SIB:/* Arg is in memory addressed by SIB (Scale-Index-Base) mode* (e.g., "-1@-96(%rbp,%rax,8)" in USDT arg spec). We first* fetch the base register contents and the index register* contents from pt_regs. Then we calculate the final address* as base + (index * scale) + offset, and do a user-space* probe read to fetch the argument value.*/err = bpf_probe_read_kernel(&val, sizeof(val), (void *)ctx + arg_spec->reg_off);if (err)return err;err = bpf_probe_read_kernel(&idx, sizeof(idx), (void *)ctx + arg_spec->idx_reg_off);if (err)return err;err = bpf_probe_read_user(&val, sizeof(val), (void *)(val + (idx * arg_spec->scale) + arg_spec->val_off));
I still have a mild preference for bitshift just because it's a tiny bit more efficient in terms of CPU cycles and needs one bit less in arg_spec representation. I just don't see why not stick to bit shift, that scale factor has to be a power of 2 always, so it's natural to use bit shift.
But overall looks good now, thanks.
if (err)return err;+#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
val >>= arg_spec->arg_bitshift;#endif break; default:
[...]