bcc/tools: Replace bpf_probe_read with bpf_probe_read_kernel

It is recommended to use bpf_probe_read_kernel_{str} in the bpf tools.
See kernel commit 0ebeea8ca8a4 ("bpf: Restrict bpf_probe_read{, str}()
only to archs where they work")

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

src/cc/libbpf.c

@@ -385,8 +385,8 @@ static void bpf_print_hints(int ret, char *log)
   if (strstr(log, "invalid mem access 'inv'") != NULL) {
     fprintf(stderr, "HINT: The invalid mem access 'inv' error can happen "
       "if you try to dereference memory without first using "
-      "bpf_probe_read() to copy it to the BPF stack. Sometimes the "
-      "bpf_probe_read is automatic by the bcc rewriter, other times "
+      "bpf_probe_read_kernel() to copy it to the BPF stack. Sometimes the "
+      "bpf_probe_read_kernel() is automatic by the bcc rewriter, other times "
       "you'll need to be explicit.\n\n");
   }
 

tests/python/test_clang.py

@@ -80,7 +80,7 @@ def test_probe_read3(self):
         text = """
 #define KBUILD_MODNAME "foo"
 #include <net/tcp.h>
-#define _(P) ({typeof(P) val = 0; bpf_probe_read(&val, sizeof(val), &P); val;})
+#define _(P) ({typeof(P) val = 0; bpf_probe_read_kernel(&val, sizeof(val), &P); val;})
 int count_tcp(struct pt_regs *ctx, struct sk_buff *skb) {
     return _(TCP_SKB_CB(skb)->tcp_gso_size);
 }
@@ -92,7 +92,7 @@ def test_probe_read4(self):
         text = """
 #define KBUILD_MODNAME "foo"
 #include <net/tcp.h>
-#define _(P) ({typeof(P) val = 0; bpf_probe_read(&val, sizeof(val), &P); val;})
+#define _(P) ({typeof(P) val = 0; bpf_probe_read_kernel(&val, sizeof(val), &P); val;})
 int test(struct pt_regs *ctx, struct sk_buff *skb) {
     return _(TCP_SKB_CB(skb)->tcp_gso_size) + skb->protocol;
 }
@@ -111,7 +111,7 @@ def test_probe_read_whitelist1(self):
     // failing below statement
     // return TCP_SKB_CB(skb)->tcp_gso_size;
     u16 val = 0;
-    bpf_probe_read(&val, sizeof(val), &(TCP_SKB_CB(skb)->tcp_gso_size));
+    bpf_probe_read_kernel(&val, sizeof(val), &(TCP_SKB_CB(skb)->tcp_gso_size));
     return val;
 }
 """
@@ -129,7 +129,7 @@ def test_probe_read_whitelist2(self):
     // failing below statement
     // return TCP_SKB_CB(skb)->tcp_gso_size;
     u16 val = 0;
-    bpf_probe_read(&val, sizeof(val), &(TCP_SKB_CB(skb)->tcp_gso_size));
+    bpf_probe_read_kernel(&val, sizeof(val), &(TCP_SKB_CB(skb)->tcp_gso_size));
     return val + skb->protocol;
 }
 """
@@ -1144,7 +1144,7 @@ def test_no_probe_read_addrof(self):
 #include <net/inet_sock.h>
 static inline int test_help(__be16 *addr) {
     __be16 val = 0;
-    bpf_probe_read(&val, sizeof(val), addr);
+    bpf_probe_read_kernel(&val, sizeof(val), addr);
     return val;
 }
 int test(struct pt_regs *ctx) {

tools/argdist.py

@@ -42,7 +42,7 @@ def _parse_signature(self):
                         param_name = param[index + 1:].strip()
                         self.param_types[param_name] = param_type
                         # Maintain list of user params. Then later decide to
-                        # switch to bpf_probe_read or bpf_probe_read_user.
+                        # switch to bpf_probe_read_kernel or bpf_probe_read_user.
                         if "__user" in param_type.split():
                                 self.probe_user_list.add(param_name)
 
@@ -299,7 +299,7 @@ def _generate_field_assignment(self, i):
                             self.exprs[i] in self.probe_user_list:
                                 probe_readfunc = "bpf_probe_read_user"
                         else:
-                                probe_readfunc = "bpf_probe_read"
+                                probe_readfunc = "bpf_probe_read_kernel"
                         return (text + "        %s(&__key.v%d.s," +
                                 " sizeof(__key.v%d.s), (void *)%s);\n") % \
                                 (probe_readfunc, i, i, self.exprs[i])

tools/bindsnoop.py

@@ -215,7 +215,7 @@
     struct inet_sock *sockp = (struct inet_sock *)skp;
 
     u16 sport = 0;
-    bpf_probe_read(&sport, sizeof(sport), &sockp->inet_sport);
+    bpf_probe_read_kernel(&sport, sizeof(sport), &sockp->inet_sport);
     sport = ntohs(sport);
 
     FILTER_PORT
@@ -296,7 +296,7 @@
                struct ipv4_bind_data_t data4 = {.pid = pid, .ip = ipver};
                data4.uid = bpf_get_current_uid_gid();
                data4.ts_us = bpf_ktime_get_ns() / 1000;
-               bpf_probe_read(
+               bpf_probe_read_kernel(
                  &data4.saddr, sizeof(data4.saddr), &sockp->inet_saddr);
                data4.return_code = ret;
                data4.sport = sport;
@@ -309,15 +309,15 @@
     'ipv6': {
         'count': """
                struct ipv6_flow_key_t flow_key = {};
-               bpf_probe_read(&flow_key.saddr, sizeof(flow_key.saddr),
+               bpf_probe_read_kernel(&flow_key.saddr, sizeof(flow_key.saddr),
                    skp->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
                flow_key.sport = sport;
                ipv6_count.increment(flow_key);""",
         'trace': """
                struct ipv6_bind_data_t data6 = {.pid = pid, .ip = ipver};
                data6.uid = bpf_get_current_uid_gid();
                data6.ts_us = bpf_ktime_get_ns() / 1000;
-               bpf_probe_read(&data6.saddr, sizeof(data6.saddr),
+               bpf_probe_read_kernel(&data6.saddr, sizeof(data6.saddr),
                    skp->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
                data6.return_code = ret;
                data6.sport = sport;

tools/biolatency.py

@@ -112,7 +112,7 @@
     bpf_text = bpf_text.replace('STORE',
         'disk_key_t key = {.slot = bpf_log2l(delta)}; ' +
         'void *__tmp = (void *)req->rq_disk->disk_name; ' +
-        'bpf_probe_read(&key.disk, sizeof(key.disk), __tmp); ' +
+        'bpf_probe_read_kernel(&key.disk, sizeof(key.disk), __tmp); ' +
         'dist.increment(key);')
 elif args.flags:
     bpf_text = bpf_text.replace('STORAGE',

tools/biosnoop.lua

@@ -90,8 +90,8 @@ int trace_req_completion(struct pt_regs *ctx, struct request *req)
         data.pid = valp->pid;
         data.len = req->__data_len;
         data.sector = req->__sector;
-        bpf_probe_read(&data.name, sizeof(data.name), valp->name);
-        bpf_probe_read(&data.disk_name, sizeof(data.disk_name),
+        bpf_probe_read_kernel(&data.name, sizeof(data.name), valp->name);
+        bpf_probe_read_kernel(&data.disk_name, sizeof(data.disk_name),
                        req->rq_disk->disk_name);
     }
 

tools/biosnoop.py

@@ -117,9 +117,9 @@
         data.pid = valp->pid;
         data.len = req->__data_len;
         data.sector = req->__sector;
-        bpf_probe_read(&data.name, sizeof(data.name), valp->name);
+        bpf_probe_read_kernel(&data.name, sizeof(data.name), valp->name);
         struct gendisk *rq_disk = req->rq_disk;
-        bpf_probe_read(&data.disk_name, sizeof(data.disk_name),
+        bpf_probe_read_kernel(&data.disk_name, sizeof(data.disk_name),
                        rq_disk->disk_name);
     }
 

tools/bitesize.py

@@ -30,7 +30,7 @@
 TRACEPOINT_PROBE(block, block_rq_issue)
 {
     struct proc_key_t key = {.slot = bpf_log2l(args->bytes / 1024)};
-    bpf_probe_read(&key.name, sizeof(key.name), args->comm);
+    bpf_probe_read_kernel(&key.name, sizeof(key.name), args->comm);
     dist.increment(key);
     return 0;
 }

tools/btrfsslower.py

@@ -233,7 +233,7 @@
     qs = de->d_name;
     if (qs.len == 0)
         return 0;
-    bpf_probe_read(&data.file, sizeof(data.file), (void *)qs.name);
+    bpf_probe_read_kernel(&data.file, sizeof(data.file), (void *)qs.name);
 
     // output
     events.perf_submit(ctx, &data, sizeof(data));

tools/compactsnoop.py

@@ -108,7 +108,7 @@
 static inline int zone_to_nid_(struct zone *zone)
 {
     int node;
-    bpf_probe_read(&node, sizeof(node), &zone->node);
+    bpf_probe_read_kernel(&node, sizeof(node), &zone->node);
     return node;
 }
 #else
@@ -122,7 +122,7 @@
 static inline int zone_idx_(struct zone *zone)
 {
     struct pglist_data *zone_pgdat = NULL;
-    bpf_probe_read(&zone_pgdat, sizeof(zone_pgdat), &zone->zone_pgdat);
+    bpf_probe_read_kernel(&zone_pgdat, sizeof(zone_pgdat), &zone->zone_pgdat);
     return zone - zone_pgdat->node_zones;
 }
 
@@ -132,13 +132,13 @@
     u64 _watermark[NR_WMARK] = {};
     u64 watermark_boost = 0;
 
-    bpf_probe_read(&_watermark, sizeof(_watermark), &zone->_watermark);
-    bpf_probe_read(&watermark_boost, sizeof(watermark_boost),
+    bpf_probe_read_kernel(&_watermark, sizeof(_watermark), &zone->_watermark);
+    bpf_probe_read_kernel(&watermark_boost, sizeof(watermark_boost),
                     &zone->watermark_boost);
     valp->min = _watermark[WMARK_MIN] + watermark_boost;
     valp->low = _watermark[WMARK_LOW] + watermark_boost;
     valp->high = _watermark[WMARK_HIGH] + watermark_boost;
-    bpf_probe_read(&valp->free, sizeof(valp->free),
+    bpf_probe_read_kernel(&valp->free, sizeof(valp->free),
                     &zone->vm_stat[NR_FREE_PAGES]);
 }
 #endif

tools/dbslower.py

@@ -158,8 +158,8 @@
         data.timestamp = tempp->timestamp;
         data.duration = delta;
 #if defined(MYSQL56) || defined(MYSQL57)
-	// We already copied string to the bpf stack. Hence use bpf_probe_read()
-        bpf_probe_read(&data.query, sizeof(data.query), tempp->query);
+	// We already copied string to the bpf stack. Hence use bpf_probe_read_kernel()
+        bpf_probe_read_kernel(&data.query, sizeof(data.query), tempp->query);
 #else
 	// USDT - we didnt copy string to the bpf stack before.
         bpf_probe_read_user(&data.query, sizeof(data.query), tempp->query);

tools/dcsnoop.py

@@ -84,7 +84,7 @@
         .type = type,
     };
     bpf_get_current_comm(&data.comm, sizeof(data.comm));
-    bpf_probe_read(&data.filename, sizeof(data.filename), name);
+    bpf_probe_read_kernel(&data.filename, sizeof(data.filename), name);
     events.perf_submit(ctx, &data, sizeof(data));
 }
 
@@ -102,7 +102,7 @@
     struct entry_t entry = {};
     const char *fname = name->name;
     if (fname) {
-        bpf_probe_read(&entry.name, sizeof(entry.name), (void *)fname);
+        bpf_probe_read_kernel(&entry.name, sizeof(entry.name), (void *)fname);
     }
     entrybypid.update(&pid, &entry);
     return 0;

tools/deadlock.c

@@ -164,7 +164,7 @@ int trace_mutex_release(struct pt_regs *ctx, void *mutex_addr) {
   // invalid memory access on `leaf->held_mutexes[i]` below. On newer kernels,
   // we can avoid making this extra copy in `value` and use `leaf` directly.
   struct thread_to_held_mutex_leaf_t value = {};
-  bpf_probe_read(&value, sizeof(struct thread_to_held_mutex_leaf_t), leaf);
+  bpf_probe_read_user(&value, sizeof(struct thread_to_held_mutex_leaf_t), leaf);
 
   #pragma unroll
   for (int i = 0; i < MAX_HELD_MUTEXES; ++i) {

tools/drsnoop.py

@@ -128,7 +128,7 @@ def K(x):
     if (bpf_get_current_comm(&val.name, sizeof(val.name)) == 0) {
         val.id = id;
         val.ts = bpf_ktime_get_ns();
-        bpf_probe_read(&val.vm_stat, sizeof(val.vm_stat), (const void *)%s);
+        bpf_probe_read_kernel(&val.vm_stat, sizeof(val.vm_stat), (const void *)%s);
         start.update(&id, &val);
     }
     return 0;
@@ -150,8 +150,8 @@ def K(x):
     data.ts = ts / 1000;
     data.id = valp->id;
     data.uid = bpf_get_current_uid_gid();
-    bpf_probe_read(&data.name, sizeof(data.name), valp->name);
-    bpf_probe_read(&data.vm_stat, sizeof(data.vm_stat), valp->vm_stat);
+    bpf_probe_read_kernel(&data.name, sizeof(data.name), valp->name);
+    bpf_probe_read_kernel(&data.vm_stat, sizeof(data.vm_stat), valp->vm_stat);
     data.nr_reclaimed = args->nr_reclaimed;
 
     events.perf_submit(args, &data, sizeof(data));

tools/ext4slower.py

@@ -226,7 +226,7 @@
     qs = de->d_name;
     if (qs.len == 0)
         return 0;
-    bpf_probe_read(&data.file, sizeof(data.file), (void *)qs.name);
+    bpf_probe_read_kernel(&data.file, sizeof(data.file), (void *)qs.name);
 
     // output
     events.perf_submit(ctx, &data, sizeof(data));

tools/filelife.py

@@ -90,7 +90,7 @@
     if (bpf_get_current_comm(&data.comm, sizeof(data.comm)) == 0) {
         data.pid = pid;
         data.delta = delta;
-        bpf_probe_read(&data.fname, sizeof(data.fname), d_name.name);
+        bpf_probe_read_kernel(&data.fname, sizeof(data.fname), d_name.name);
     }
 
     events.perf_submit(ctx, &data, sizeof(data));

tools/fileslower.py

@@ -112,7 +112,7 @@
 
     struct qstr d_name = de->d_name;
     val.name_len = d_name.len;
-    bpf_probe_read(&val.name, sizeof(val.name), d_name.name);
+    bpf_probe_read_kernel(&val.name, sizeof(val.name), d_name.name);
     bpf_get_current_comm(&val.comm, sizeof(val.comm));
     entryinfo.update(&pid, &val);
 
@@ -159,8 +159,8 @@
     data.sz = valp->sz;
     data.delta_us = delta_us;
     data.name_len = valp->name_len;
-    bpf_probe_read(&data.name, sizeof(data.name), valp->name);
-    bpf_probe_read(&data.comm, sizeof(data.comm), valp->comm);
+    bpf_probe_read_kernel(&data.name, sizeof(data.name), valp->name);
+    bpf_probe_read_kernel(&data.comm, sizeof(data.comm), valp->comm);
     events.perf_submit(ctx, &data, sizeof(data));
 
     return 0;

tools/filetop.py

@@ -108,7 +108,7 @@ def signal_ignore(signal_value, frame):
     struct info_t info = {.pid = pid};
     bpf_get_current_comm(&info.comm, sizeof(info.comm));
     info.name_len = d_name.len;
-    bpf_probe_read(&info.name, sizeof(info.name), d_name.name);
+    bpf_probe_read_kernel(&info.name, sizeof(info.name), d_name.name);
     if (S_ISREG(mode)) {
         info.type = 'R';
     } else if (S_ISSOCK(mode)) {

tools/funcslower.py

@@ -206,7 +206,7 @@
 #endif
 
 #ifdef GRAB_ARGS
-    bpf_probe_read(&data.args[0], sizeof(data.args), entryp->args);
+    bpf_probe_read_kernel(&data.args[0], sizeof(data.args), entryp->args);
 #endif
     bpf_get_current_comm(&data.comm, sizeof(data.comm));
     events.perf_submit(ctx, &data, sizeof(data));

tools/gethostlatency.py

@@ -86,8 +86,8 @@
     if (valp == 0)
         return 0;       // missed start
 
-    bpf_probe_read(&data.comm, sizeof(data.comm), valp->comm);
-    bpf_probe_read(&data.host, sizeof(data.host), (void *)valp->host);
+    bpf_probe_read_kernel(&data.comm, sizeof(data.comm), valp->comm);
+    bpf_probe_read_kernel(&data.host, sizeof(data.host), (void *)valp->host);
     data.pid = valp->pid;
     data.delta = tsp - valp->ts;
     events.perf_submit(ctx, &data, sizeof(data));

tools/hardirqs.py

@@ -83,7 +83,7 @@
     char *name = (char *)action->name;
 
     irq_key_t key = {.slot = 0 /* ignore */};
-    bpf_probe_read(&key.name, sizeof(key.name), name);
+    bpf_probe_read_kernel(&key.name, sizeof(key.name), name);
     dist.increment(key);
 
     return 0;
@@ -129,12 +129,12 @@
 if args.dist:
     bpf_text = bpf_text.replace('STORE',
         'irq_key_t key = {.slot = bpf_log2l(delta / %d)};' % factor +
-        'bpf_probe_read(&key.name, sizeof(key.name), name);' +
+        'bpf_probe_read_kernel(&key.name, sizeof(key.name), name);' +
         'dist.increment(key);')
 else:
     bpf_text = bpf_text.replace('STORE',
         'irq_key_t key = {.slot = 0 /* ignore */};' +
-        'bpf_probe_read(&key.name, sizeof(key.name), name);' +
+        'bpf_probe_read_kernel(&key.name, sizeof(key.name), name);' +
         'dist.increment(key, delta);')
 if debug or args.ebpf:
     print(bpf_text)

tools/killsnoop.py

@@ -87,7 +87,7 @@
         return 0;
     }
 
-    bpf_probe_read(&data.comm, sizeof(data.comm), valp->comm);
+    bpf_probe_read_kernel(&data.comm, sizeof(data.comm), valp->comm);
     data.pid = pid;
     data.tpid = valp->tpid;
     data.ret = PT_REGS_RC(ctx);

tools/mdflush.py

@@ -47,7 +47,7 @@
 #else
     struct gendisk *bi_disk = bio->bi_bdev->bd_disk;
 #endif
-    bpf_probe_read(&data.disk, sizeof(data.disk), bi_disk->disk_name);
+    bpf_probe_read_kernel(&data.disk, sizeof(data.disk), bi_disk->disk_name);
     events.perf_submit(ctx, &data, sizeof(data));
     return 0;
 }

tools/memleak.py

@@ -287,7 +287,7 @@ def run_command_get_pid(command):
 
         memptrs.delete(&pid);
 
-        if (bpf_probe_read(&addr, sizeof(void*), (void*)(size_t)*memptr64))
+        if (bpf_probe_read_user(&addr, sizeof(void*), (void*)(size_t)*memptr64))
                 return 0;
 
         u64 addr64 = (u64)(size_t)addr;

tools/nfsslower.py

@@ -190,18 +190,18 @@
     struct qstr qs = {};
     if(type == TRACE_GETATTR)
     {
-        bpf_probe_read(&de,sizeof(de), &valp->d);
+        bpf_probe_read_kernel(&de,sizeof(de), &valp->d);
     }
     else
     {
-        bpf_probe_read(&de, sizeof(de), &valp->fp->f_path.dentry);
+        bpf_probe_read_kernel(&de, sizeof(de), &valp->fp->f_path.dentry);
     }
 
-    bpf_probe_read(&qs, sizeof(qs), (void *)&de->d_name);
+    bpf_probe_read_kernel(&qs, sizeof(qs), (void *)&de->d_name);
     if (qs.len == 0)
         return 0;
 
-    bpf_probe_read(&data.file, sizeof(data.file), (void *)qs.name);
+    bpf_probe_read_kernel(&data.file, sizeof(data.file), (void *)qs.name);
     // output
     events.perf_submit(ctx, &data, sizeof(data));
     return 0;