On Sat, Aug 23, 2025 at 12:19 AM Jiawei Zhao <phoenix500...@163.com> wrote:
>
> On x86-64, USDT arguments can be specified using Scale-Index-Base (SIB)
> addressing, e.g. "1@-96(%rbp,%rax,8)". The current USDT implementation
> in libbpf cannot parse this format, causing `bpf_program__attach_usdt()`
> to fail with -ENOENT (unrecognized register).
>
> This patch fixes this by implementing the necessary changes:
> - add correct handling for SIB-addressed arguments in `bpf_usdt_arg`.
> - add adaptive support to `__bpf_usdt_arg_type` and
> `__bpf_usdt_arg_spec` to represent SIB addressing parameters.
>
> Signed-off-by: Jiawei Zhao <phoenix500...@163.com>
> ---
> tools/lib/bpf/usdt.bpf.h | 44 +++++++++++++++++++++++++++++--
> tools/lib/bpf/usdt.c | 57 ++++++++++++++++++++++++++++++++++++----
> 2 files changed, 94 insertions(+), 7 deletions(-)
>
> diff --git a/tools/lib/bpf/usdt.bpf.h b/tools/lib/bpf/usdt.bpf.h
> index 2a7865c8e3fe..2000b0aead75 100644
> --- a/tools/lib/bpf/usdt.bpf.h
> +++ b/tools/lib/bpf/usdt.bpf.h
> @@ -34,13 +34,32 @@ enum __bpf_usdt_arg_type {
> BPF_USDT_ARG_CONST,
> BPF_USDT_ARG_REG,
> BPF_USDT_ARG_REG_DEREF,
> + BPF_USDT_ARG_SIB,
> };
>
> +/*
> + * This struct layout is designed specifically to be backwards/forward
> + * compatible between libbpf versions for ARG_CONST, ARG_REG, and
> + * ARG_REG_DEREF modes. ARG_SIB requires libbpf v1.7+.
> + */
> struct __bpf_usdt_arg_spec {
> /* u64 scalar interpreted depending on arg_type, see below */
> __u64 val_off;
> +#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
> /* arg location case, see bpf_usdt_arg() for details */
> - enum __bpf_usdt_arg_type arg_type;
> + enum __bpf_usdt_arg_type arg_type: 8;
> + /* index register offset within struct pt_regs */
> + __u16 idx_reg_off: 12;
> + /* scale factor for index register (1, 2, 4, or 8) */
> + __u16 scale: 4;
> + /* reserved for future use, keeps reg_off offset stable */
> + __u8 __reserved: 8;
> +#else
> + __u8 __reserved: 8;
> + __u16 idx_reg_off: 12;
> + __u16 scale: 4;
> + enum __bpf_usdt_arg_type arg_type: 8;
> +#endif
> /* offset of referenced register within struct pt_regs */
> short reg_off;
> /* whether arg should be interpreted as signed value */
> @@ -149,7 +168,7 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long
> *res)
> {
> struct __bpf_usdt_spec *spec;
> struct __bpf_usdt_arg_spec *arg_spec;
> - unsigned long val;
> + unsigned long val, idx;
> int err, spec_id;
>
> *res = 0;
> @@ -202,6 +221,27 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num,
> long *res)
> return err;
> #if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
> val >>= arg_spec->arg_bitshift;
> +#endif
> + break;
> + case BPF_USDT_ARG_SIB:
> + /* Arg is in memory addressed by SIB (Scale-Index-Base) mode
> + * (e.g., "-1@-96(%rbp,%rax,8)" in USDT arg spec). We first
> + * fetch the base register contents and the index register
> + * contents from pt_regs. Then we calculate the final address
> + * as base + (index * scale) + offset, and do a user-space
> + * probe read to fetch the argument value.
> + */
> + err = bpf_probe_read_kernel(&val, sizeof(val), (void *)ctx +
> arg_spec->reg_off);
> + if (err)
> + return err;
> + err = bpf_probe_read_kernel(&idx, sizeof(idx), (void *)ctx +
> arg_spec->idx_reg_off);
> + if (err)
> + return err;
> + err = bpf_probe_read_user(&val, sizeof(val), (void *)(val +
> (idx * arg_spec->scale) + arg_spec->val_off));
I still have a mild preference for bitshift just because it's a tiny
bit more efficient in terms of CPU cycles and needs one bit less in
arg_spec representation. I just don't see why not stick to bit shift,
that scale factor has to be a power of 2 always, so it's natural to
use bit shift.
But overall looks good now, thanks.
> + if (err)
> + return err;
> +#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
> + val >>= arg_spec->arg_bitshift;
> #endif
> break;
> default:
[...]
