1/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ 2#ifndef __BPF_TRACING_H__ 3#define __BPF_TRACING_H__ 4 5#include "bpf_helpers.h" 6 7/* Scan the ARCH passed in from ARCH env variable (see Makefile) */ 8#if defined(__TARGET_ARCH_x86) 9 #define bpf_target_x86 10 #define bpf_target_defined 11#elif defined(__TARGET_ARCH_s390) 12 #define bpf_target_s390 13 #define bpf_target_defined 14#elif defined(__TARGET_ARCH_arm) 15 #define bpf_target_arm 16 #define bpf_target_defined 17#elif defined(__TARGET_ARCH_arm64) 18 #define bpf_target_arm64 19 #define bpf_target_defined 20#elif defined(__TARGET_ARCH_mips) 21 #define bpf_target_mips 22 #define bpf_target_defined 23#elif defined(__TARGET_ARCH_powerpc) 24 #define bpf_target_powerpc 25 #define bpf_target_defined 26#elif defined(__TARGET_ARCH_sparc) 27 #define bpf_target_sparc 28 #define bpf_target_defined 29#elif defined(__TARGET_ARCH_riscv) 30 #define bpf_target_riscv 31 #define bpf_target_defined 32#elif defined(__TARGET_ARCH_arc) 33 #define bpf_target_arc 34 #define bpf_target_defined 35#elif defined(__TARGET_ARCH_loongarch) 36 #define bpf_target_loongarch 37 #define bpf_target_defined 38#else 39 40/* Fall back to what the compiler says */ 41#if defined(__x86_64__) 42 #define bpf_target_x86 43 #define bpf_target_defined 44#elif defined(__s390__) 45 #define bpf_target_s390 46 #define bpf_target_defined 47#elif defined(__arm__) 48 #define bpf_target_arm 49 #define bpf_target_defined 50#elif defined(__aarch64__) 51 #define bpf_target_arm64 52 #define bpf_target_defined 53#elif defined(__mips__) 54 #define bpf_target_mips 55 #define bpf_target_defined 56#elif defined(__powerpc__) 57 #define bpf_target_powerpc 58 #define bpf_target_defined 59#elif defined(__sparc__) 60 #define bpf_target_sparc 61 #define bpf_target_defined 62#elif defined(__riscv) && __riscv_xlen == 64 63 #define bpf_target_riscv 64 #define bpf_target_defined 65#elif defined(__arc__) 66 #define bpf_target_arc 67 #define bpf_target_defined 68#elif defined(__loongarch__) 69 #define bpf_target_loongarch 70 #define bpf_target_defined 71#endif /* no compiler target */ 72 73#endif 74 75#ifndef __BPF_TARGET_MISSING 76#define __BPF_TARGET_MISSING "GCC error \"Must specify a BPF target arch via __TARGET_ARCH_xxx\"" 77#endif 78 79#if defined(bpf_target_x86) 80 81/* 82 * https://en.wikipedia.org/wiki/X86_calling_conventions#System_V_AMD64_ABI 83 */ 84 85#if defined(__KERNEL__) || defined(__VMLINUX_H__) 86 87#define __PT_PARM1_REG di 88#define __PT_PARM2_REG si 89#define __PT_PARM3_REG dx 90#define __PT_PARM4_REG cx 91#define __PT_PARM5_REG r8 92#define __PT_PARM6_REG r9 93/* 94 * Syscall uses r10 for PARM4. See arch/x86/entry/entry_64.S:entry_SYSCALL_64 95 * comments in Linux sources. And refer to syscall(2) manpage. 96 */ 97#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG 98#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG 99#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG 100#define __PT_PARM4_SYSCALL_REG r10 101#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG 102#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG 103 104#define __PT_RET_REG sp 105#define __PT_FP_REG bp 106#define __PT_RC_REG ax 107#define __PT_SP_REG sp 108#define __PT_IP_REG ip 109 110#else 111 112#ifdef __i386__ 113 114/* i386 kernel is built with -mregparm=3 */ 115#define __PT_PARM1_REG eax 116#define __PT_PARM2_REG edx 117#define __PT_PARM3_REG ecx 118/* i386 syscall ABI is very different, refer to syscall(2) manpage */ 119#define __PT_PARM1_SYSCALL_REG ebx 120#define __PT_PARM2_SYSCALL_REG ecx 121#define __PT_PARM3_SYSCALL_REG edx 122#define __PT_PARM4_SYSCALL_REG esi 123#define __PT_PARM5_SYSCALL_REG edi 124#define __PT_PARM6_SYSCALL_REG ebp 125 126#define __PT_RET_REG esp 127#define __PT_FP_REG ebp 128#define __PT_RC_REG eax 129#define __PT_SP_REG esp 130#define __PT_IP_REG eip 131 132#else /* __i386__ */ 133 134#define __PT_PARM1_REG rdi 135#define __PT_PARM2_REG rsi 136#define __PT_PARM3_REG rdx 137#define __PT_PARM4_REG rcx 138#define __PT_PARM5_REG r8 139#define __PT_PARM6_REG r9 140 141#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG 142#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG 143#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG 144#define __PT_PARM4_SYSCALL_REG r10 145#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG 146#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG 147 148#define __PT_RET_REG rsp 149#define __PT_FP_REG rbp 150#define __PT_RC_REG rax 151#define __PT_SP_REG rsp 152#define __PT_IP_REG rip 153 154#endif /* __i386__ */ 155 156#endif /* __KERNEL__ || __VMLINUX_H__ */ 157 158#elif defined(bpf_target_s390) 159 160/* 161 * https://github.com/IBM/s390x-abi/releases/download/v1.6/lzsabi_s390x.pdf 162 */ 163 164struct pt_regs___s390 { 165 unsigned long orig_gpr2; 166}; 167 168/* s390 provides user_pt_regs instead of struct pt_regs to userspace */ 169#define __PT_REGS_CAST(x) ((const user_pt_regs *)(x)) 170#define __PT_PARM1_REG gprs[2] 171#define __PT_PARM2_REG gprs[3] 172#define __PT_PARM3_REG gprs[4] 173#define __PT_PARM4_REG gprs[5] 174#define __PT_PARM5_REG gprs[6] 175 176#define __PT_PARM1_SYSCALL_REG orig_gpr2 177#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG 178#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG 179#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG 180#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG 181#define __PT_PARM6_SYSCALL_REG gprs[7] 182#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x) 183#define PT_REGS_PARM1_CORE_SYSCALL(x) \ 184 BPF_CORE_READ((const struct pt_regs___s390 *)(x), __PT_PARM1_SYSCALL_REG) 185 186#define __PT_RET_REG gprs[14] 187#define __PT_FP_REG gprs[11] /* Works only with CONFIG_FRAME_POINTER */ 188#define __PT_RC_REG gprs[2] 189#define __PT_SP_REG gprs[15] 190#define __PT_IP_REG psw.addr 191 192#elif defined(bpf_target_arm) 193 194/* 195 * https://github.com/ARM-software/abi-aa/blob/main/aapcs32/aapcs32.rst#machine-registers 196 */ 197 198#define __PT_PARM1_REG uregs[0] 199#define __PT_PARM2_REG uregs[1] 200#define __PT_PARM3_REG uregs[2] 201#define __PT_PARM4_REG uregs[3] 202 203#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG 204#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG 205#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG 206#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG 207#define __PT_PARM5_SYSCALL_REG uregs[4] 208#define __PT_PARM6_SYSCALL_REG uregs[5] 209#define __PT_PARM7_SYSCALL_REG uregs[6] 210 211#define __PT_RET_REG uregs[14] 212#define __PT_FP_REG uregs[11] /* Works only with CONFIG_FRAME_POINTER */ 213#define __PT_RC_REG uregs[0] 214#define __PT_SP_REG uregs[13] 215#define __PT_IP_REG uregs[12] 216 217#elif defined(bpf_target_arm64) 218 219/* 220 * https://github.com/ARM-software/abi-aa/blob/main/aapcs64/aapcs64.rst#machine-registers 221 */ 222 223struct pt_regs___arm64 { 224 unsigned long orig_x0; 225}; 226 227/* arm64 provides struct user_pt_regs instead of struct pt_regs to userspace */ 228#define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x)) 229#define __PT_PARM1_REG regs[0] 230#define __PT_PARM2_REG regs[1] 231#define __PT_PARM3_REG regs[2] 232#define __PT_PARM4_REG regs[3] 233#define __PT_PARM5_REG regs[4] 234#define __PT_PARM6_REG regs[5] 235#define __PT_PARM7_REG regs[6] 236#define __PT_PARM8_REG regs[7] 237 238#define __PT_PARM1_SYSCALL_REG orig_x0 239#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG 240#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG 241#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG 242#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG 243#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG 244#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x) 245#define PT_REGS_PARM1_CORE_SYSCALL(x) \ 246 BPF_CORE_READ((const struct pt_regs___arm64 *)(x), __PT_PARM1_SYSCALL_REG) 247 248#define __PT_RET_REG regs[30] 249#define __PT_FP_REG regs[29] /* Works only with CONFIG_FRAME_POINTER */ 250#define __PT_RC_REG regs[0] 251#define __PT_SP_REG sp 252#define __PT_IP_REG pc 253 254#elif defined(bpf_target_mips) 255 256/* 257 * N64 ABI is assumed right now. 258 * https://en.wikipedia.org/wiki/MIPS_architecture#Calling_conventions 259 */ 260 261#define __PT_PARM1_REG regs[4] 262#define __PT_PARM2_REG regs[5] 263#define __PT_PARM3_REG regs[6] 264#define __PT_PARM4_REG regs[7] 265#define __PT_PARM5_REG regs[8] 266#define __PT_PARM6_REG regs[9] 267#define __PT_PARM7_REG regs[10] 268#define __PT_PARM8_REG regs[11] 269 270#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG 271#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG 272#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG 273#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG 274#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG /* only N32/N64 */ 275#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG /* only N32/N64 */ 276 277#define __PT_RET_REG regs[31] 278#define __PT_FP_REG regs[30] /* Works only with CONFIG_FRAME_POINTER */ 279#define __PT_RC_REG regs[2] 280#define __PT_SP_REG regs[29] 281#define __PT_IP_REG cp0_epc 282 283#elif defined(bpf_target_powerpc) 284 285/* 286 * http://refspecs.linux-foundation.org/elf/elfspec_ppc.pdf (page 3-14, 287 * section "Function Calling Sequence") 288 */ 289 290#define __PT_PARM1_REG gpr[3] 291#define __PT_PARM2_REG gpr[4] 292#define __PT_PARM3_REG gpr[5] 293#define __PT_PARM4_REG gpr[6] 294#define __PT_PARM5_REG gpr[7] 295#define __PT_PARM6_REG gpr[8] 296#define __PT_PARM7_REG gpr[9] 297#define __PT_PARM8_REG gpr[10] 298 299/* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER. */ 300#define PT_REGS_SYSCALL_REGS(ctx) ctx 301#define __PT_PARM1_SYSCALL_REG orig_gpr3 302#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG 303#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG 304#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG 305#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG 306#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG 307#if !defined(__arch64__) 308#define __PT_PARM7_SYSCALL_REG __PT_PARM7_REG /* only powerpc (not powerpc64) */ 309#endif 310 311#define __PT_RET_REG regs[31] 312#define __PT_FP_REG __unsupported__ 313#define __PT_RC_REG gpr[3] 314#define __PT_SP_REG sp 315#define __PT_IP_REG nip 316 317#elif defined(bpf_target_sparc) 318 319/* 320 * https://en.wikipedia.org/wiki/Calling_convention#SPARC 321 */ 322 323#define __PT_PARM1_REG u_regs[UREG_I0] 324#define __PT_PARM2_REG u_regs[UREG_I1] 325#define __PT_PARM3_REG u_regs[UREG_I2] 326#define __PT_PARM4_REG u_regs[UREG_I3] 327#define __PT_PARM5_REG u_regs[UREG_I4] 328#define __PT_PARM6_REG u_regs[UREG_I5] 329 330#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG 331#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG 332#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG 333#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG 334#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG 335#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG 336 337#define __PT_RET_REG u_regs[UREG_I7] 338#define __PT_FP_REG __unsupported__ 339#define __PT_RC_REG u_regs[UREG_I0] 340#define __PT_SP_REG u_regs[UREG_FP] 341/* Should this also be a bpf_target check for the sparc case? */ 342#if defined(__arch64__) 343#define __PT_IP_REG tpc 344#else 345#define __PT_IP_REG pc 346#endif 347 348#elif defined(bpf_target_riscv) 349 350/* 351 * https://github.com/riscv-non-isa/riscv-elf-psabi-doc/blob/master/riscv-cc.adoc#risc-v-calling-conventions 352 */ 353 354/* riscv provides struct user_regs_struct instead of struct pt_regs to userspace */ 355#define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x)) 356#define __PT_PARM1_REG a0 357#define __PT_PARM2_REG a1 358#define __PT_PARM3_REG a2 359#define __PT_PARM4_REG a3 360#define __PT_PARM5_REG a4 361#define __PT_PARM6_REG a5 362#define __PT_PARM7_REG a6 363#define __PT_PARM8_REG a7 364 365#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG 366#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG 367#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG 368#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG 369#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG 370#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG 371 372#define __PT_RET_REG ra 373#define __PT_FP_REG s0 374#define __PT_RC_REG a0 375#define __PT_SP_REG sp 376#define __PT_IP_REG pc 377 378#elif defined(bpf_target_arc) 379 380/* 381 * Section "Function Calling Sequence" (page 24): 382 * https://raw.githubusercontent.com/wiki/foss-for-synopsys-dwc-arc-processors/toolchain/files/ARCv2_ABI.pdf 383 */ 384 385/* arc provides struct user_regs_struct instead of struct pt_regs to userspace */ 386#define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x)) 387#define __PT_PARM1_REG scratch.r0 388#define __PT_PARM2_REG scratch.r1 389#define __PT_PARM3_REG scratch.r2 390#define __PT_PARM4_REG scratch.r3 391#define __PT_PARM5_REG scratch.r4 392#define __PT_PARM6_REG scratch.r5 393#define __PT_PARM7_REG scratch.r6 394#define __PT_PARM8_REG scratch.r7 395 396/* arc does not select ARCH_HAS_SYSCALL_WRAPPER. */ 397#define PT_REGS_SYSCALL_REGS(ctx) ctx 398#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG 399#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG 400#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG 401#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG 402#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG 403#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG 404 405#define __PT_RET_REG scratch.blink 406#define __PT_FP_REG scratch.fp 407#define __PT_RC_REG scratch.r0 408#define __PT_SP_REG scratch.sp 409#define __PT_IP_REG scratch.ret 410 411#elif defined(bpf_target_loongarch) 412 413/* 414 * https://docs.kernel.org/loongarch/introduction.html 415 * https://loongson.github.io/LoongArch-Documentation/LoongArch-ELF-ABI-EN.html 416 */ 417 418/* loongarch provides struct user_pt_regs instead of struct pt_regs to userspace */ 419#define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x)) 420#define __PT_PARM1_REG regs[4] 421#define __PT_PARM2_REG regs[5] 422#define __PT_PARM3_REG regs[6] 423#define __PT_PARM4_REG regs[7] 424#define __PT_PARM5_REG regs[8] 425#define __PT_PARM6_REG regs[9] 426#define __PT_PARM7_REG regs[10] 427#define __PT_PARM8_REG regs[11] 428 429/* loongarch does not select ARCH_HAS_SYSCALL_WRAPPER. */ 430#define PT_REGS_SYSCALL_REGS(ctx) ctx 431#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG 432#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG 433#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG 434#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG 435#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG 436#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG 437 438#define __PT_RET_REG regs[1] 439#define __PT_FP_REG regs[22] 440#define __PT_RC_REG regs[4] 441#define __PT_SP_REG regs[3] 442#define __PT_IP_REG csr_era 443 444#endif 445 446#if defined(bpf_target_defined) 447 448struct pt_regs; 449 450/* allow some architectures to override `struct pt_regs` */ 451#ifndef __PT_REGS_CAST 452#define __PT_REGS_CAST(x) (x) 453#endif 454 455/* 456 * Different architectures support different number of arguments passed 457 * through registers. i386 supports just 3, some arches support up to 8. 458 */ 459#ifndef __PT_PARM4_REG 460#define __PT_PARM4_REG __unsupported__ 461#endif 462#ifndef __PT_PARM5_REG 463#define __PT_PARM5_REG __unsupported__ 464#endif 465#ifndef __PT_PARM6_REG 466#define __PT_PARM6_REG __unsupported__ 467#endif 468#ifndef __PT_PARM7_REG 469#define __PT_PARM7_REG __unsupported__ 470#endif 471#ifndef __PT_PARM8_REG 472#define __PT_PARM8_REG __unsupported__ 473#endif 474/* 475 * Similarly, syscall-specific conventions might differ between function call 476 * conventions within each architecutre. All supported architectures pass 477 * either 6 or 7 syscall arguments in registers. 478 * 479 * See syscall(2) manpage for succinct table with information on each arch. 480 */ 481#ifndef __PT_PARM7_SYSCALL_REG 482#define __PT_PARM7_SYSCALL_REG __unsupported__ 483#endif 484 485#define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG) 486#define PT_REGS_PARM2(x) (__PT_REGS_CAST(x)->__PT_PARM2_REG) 487#define PT_REGS_PARM3(x) (__PT_REGS_CAST(x)->__PT_PARM3_REG) 488#define PT_REGS_PARM4(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG) 489#define PT_REGS_PARM5(x) (__PT_REGS_CAST(x)->__PT_PARM5_REG) 490#define PT_REGS_PARM6(x) (__PT_REGS_CAST(x)->__PT_PARM6_REG) 491#define PT_REGS_PARM7(x) (__PT_REGS_CAST(x)->__PT_PARM7_REG) 492#define PT_REGS_PARM8(x) (__PT_REGS_CAST(x)->__PT_PARM8_REG) 493#define PT_REGS_RET(x) (__PT_REGS_CAST(x)->__PT_RET_REG) 494#define PT_REGS_FP(x) (__PT_REGS_CAST(x)->__PT_FP_REG) 495#define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG) 496#define PT_REGS_SP(x) (__PT_REGS_CAST(x)->__PT_SP_REG) 497#define PT_REGS_IP(x) (__PT_REGS_CAST(x)->__PT_IP_REG) 498 499#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_REG) 500#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_REG) 501#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_REG) 502#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_REG) 503#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_REG) 504#define PT_REGS_PARM6_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM6_REG) 505#define PT_REGS_PARM7_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM7_REG) 506#define PT_REGS_PARM8_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM8_REG) 507#define PT_REGS_RET_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RET_REG) 508#define PT_REGS_FP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_FP_REG) 509#define PT_REGS_RC_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RC_REG) 510#define PT_REGS_SP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_SP_REG) 511#define PT_REGS_IP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_IP_REG) 512 513#if defined(bpf_target_powerpc) 514 515#define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = (ctx)->link; }) 516#define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP 517 518#elif defined(bpf_target_sparc) 519 520#define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = PT_REGS_RET(ctx); }) 521#define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP 522 523#else 524 525#define BPF_KPROBE_READ_RET_IP(ip, ctx) \ 526 ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)PT_REGS_RET(ctx)); }) 527#define BPF_KRETPROBE_READ_RET_IP(ip, ctx) \ 528 ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)(PT_REGS_FP(ctx) + sizeof(ip))); }) 529 530#endif 531 532#ifndef PT_REGS_PARM1_SYSCALL 533#define PT_REGS_PARM1_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM1_SYSCALL_REG) 534#define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_SYSCALL_REG) 535#endif 536#ifndef PT_REGS_PARM2_SYSCALL 537#define PT_REGS_PARM2_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM2_SYSCALL_REG) 538#define PT_REGS_PARM2_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_SYSCALL_REG) 539#endif 540#ifndef PT_REGS_PARM3_SYSCALL 541#define PT_REGS_PARM3_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM3_SYSCALL_REG) 542#define PT_REGS_PARM3_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_SYSCALL_REG) 543#endif 544#ifndef PT_REGS_PARM4_SYSCALL 545#define PT_REGS_PARM4_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM4_SYSCALL_REG) 546#define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_SYSCALL_REG) 547#endif 548#ifndef PT_REGS_PARM5_SYSCALL 549#define PT_REGS_PARM5_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM5_SYSCALL_REG) 550#define PT_REGS_PARM5_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_SYSCALL_REG) 551#endif 552#ifndef PT_REGS_PARM6_SYSCALL 553#define PT_REGS_PARM6_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM6_SYSCALL_REG) 554#define PT_REGS_PARM6_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM6_SYSCALL_REG) 555#endif 556#ifndef PT_REGS_PARM7_SYSCALL 557#define PT_REGS_PARM7_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM7_SYSCALL_REG) 558#define PT_REGS_PARM7_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM7_SYSCALL_REG) 559#endif 560 561#else /* defined(bpf_target_defined) */ 562 563#define PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 564#define PT_REGS_PARM2(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 565#define PT_REGS_PARM3(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 566#define PT_REGS_PARM4(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 567#define PT_REGS_PARM5(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 568#define PT_REGS_PARM6(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 569#define PT_REGS_PARM7(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 570#define PT_REGS_PARM8(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 571#define PT_REGS_RET(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 572#define PT_REGS_FP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 573#define PT_REGS_RC(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 574#define PT_REGS_SP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 575#define PT_REGS_IP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 576 577#define PT_REGS_PARM1_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 578#define PT_REGS_PARM2_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 579#define PT_REGS_PARM3_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 580#define PT_REGS_PARM4_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 581#define PT_REGS_PARM5_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 582#define PT_REGS_PARM6_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 583#define PT_REGS_PARM7_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 584#define PT_REGS_PARM8_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 585#define PT_REGS_RET_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 586#define PT_REGS_FP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 587#define PT_REGS_RC_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 588#define PT_REGS_SP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 589#define PT_REGS_IP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 590 591#define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 592#define BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 593 594#define PT_REGS_PARM1_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 595#define PT_REGS_PARM2_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 596#define PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 597#define PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 598#define PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 599#define PT_REGS_PARM6_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 600#define PT_REGS_PARM7_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 601 602#define PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 603#define PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 604#define PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 605#define PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 606#define PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 607#define PT_REGS_PARM6_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 608#define PT_REGS_PARM7_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 609 610#endif /* defined(bpf_target_defined) */ 611 612/* 613 * When invoked from a syscall handler kprobe, returns a pointer to a 614 * struct pt_regs containing syscall arguments and suitable for passing to 615 * PT_REGS_PARMn_SYSCALL() and PT_REGS_PARMn_CORE_SYSCALL(). 616 */ 617#ifndef PT_REGS_SYSCALL_REGS 618/* By default, assume that the arch selects ARCH_HAS_SYSCALL_WRAPPER. */ 619#define PT_REGS_SYSCALL_REGS(ctx) ((struct pt_regs *)PT_REGS_PARM1(ctx)) 620#endif 621 622#ifndef ___bpf_concat 623#define ___bpf_concat(a, b) a ## b 624#endif 625#ifndef ___bpf_apply 626#define ___bpf_apply(fn, n) ___bpf_concat(fn, n) 627#endif 628#ifndef ___bpf_nth 629#define ___bpf_nth(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _a, _b, _c, N, ...) N 630#endif 631#ifndef ___bpf_narg 632#define ___bpf_narg(...) ___bpf_nth(_, ##__VA_ARGS__, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) 633#endif 634 635#define ___bpf_ctx_cast0() ctx 636#define ___bpf_ctx_cast1(x) ___bpf_ctx_cast0(), (void *)ctx[0] 637#define ___bpf_ctx_cast2(x, args...) ___bpf_ctx_cast1(args), (void *)ctx[1] 638#define ___bpf_ctx_cast3(x, args...) ___bpf_ctx_cast2(args), (void *)ctx[2] 639#define ___bpf_ctx_cast4(x, args...) ___bpf_ctx_cast3(args), (void *)ctx[3] 640#define ___bpf_ctx_cast5(x, args...) ___bpf_ctx_cast4(args), (void *)ctx[4] 641#define ___bpf_ctx_cast6(x, args...) ___bpf_ctx_cast5(args), (void *)ctx[5] 642#define ___bpf_ctx_cast7(x, args...) ___bpf_ctx_cast6(args), (void *)ctx[6] 643#define ___bpf_ctx_cast8(x, args...) ___bpf_ctx_cast7(args), (void *)ctx[7] 644#define ___bpf_ctx_cast9(x, args...) ___bpf_ctx_cast8(args), (void *)ctx[8] 645#define ___bpf_ctx_cast10(x, args...) ___bpf_ctx_cast9(args), (void *)ctx[9] 646#define ___bpf_ctx_cast11(x, args...) ___bpf_ctx_cast10(args), (void *)ctx[10] 647#define ___bpf_ctx_cast12(x, args...) ___bpf_ctx_cast11(args), (void *)ctx[11] 648#define ___bpf_ctx_cast(args...) ___bpf_apply(___bpf_ctx_cast, ___bpf_narg(args))(args) 649 650/* 651 * BPF_PROG is a convenience wrapper for generic tp_btf/fentry/fexit and 652 * similar kinds of BPF programs, that accept input arguments as a single 653 * pointer to untyped u64 array, where each u64 can actually be a typed 654 * pointer or integer of different size. Instead of requring user to write 655 * manual casts and work with array elements by index, BPF_PROG macro 656 * allows user to declare a list of named and typed input arguments in the 657 * same syntax as for normal C function. All the casting is hidden and 658 * performed transparently, while user code can just assume working with 659 * function arguments of specified type and name. 660 * 661 * Original raw context argument is preserved as well as 'ctx' argument. 662 * This is useful when using BPF helpers that expect original context 663 * as one of the parameters (e.g., for bpf_perf_event_output()). 664 */ 665#define BPF_PROG(name, args...) \ 666name(unsigned long long *ctx); \ 667static __always_inline typeof(name(0)) \ 668____##name(unsigned long long *ctx, ##args); \ 669typeof(name(0)) name(unsigned long long *ctx) \ 670{ \ 671 _Pragma("GCC diagnostic push") \ 672 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ 673 return ____##name(___bpf_ctx_cast(args)); \ 674 _Pragma("GCC diagnostic pop") \ 675} \ 676static __always_inline typeof(name(0)) \ 677____##name(unsigned long long *ctx, ##args) 678 679#ifndef ___bpf_nth2 680#define ___bpf_nth2(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, \ 681 _14, _15, _16, _17, _18, _19, _20, _21, _22, _23, _24, N, ...) N 682#endif 683#ifndef ___bpf_narg2 684#define ___bpf_narg2(...) \ 685 ___bpf_nth2(_, ##__VA_ARGS__, 12, 12, 11, 11, 10, 10, 9, 9, 8, 8, 7, 7, \ 686 6, 6, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 0) 687#endif 688 689#define ___bpf_treg_cnt(t) \ 690 __builtin_choose_expr(sizeof(t) == 1, 1, \ 691 __builtin_choose_expr(sizeof(t) == 2, 1, \ 692 __builtin_choose_expr(sizeof(t) == 4, 1, \ 693 __builtin_choose_expr(sizeof(t) == 8, 1, \ 694 __builtin_choose_expr(sizeof(t) == 16, 2, \ 695 (void)0))))) 696 697#define ___bpf_reg_cnt0() (0) 698#define ___bpf_reg_cnt1(t, x) (___bpf_reg_cnt0() + ___bpf_treg_cnt(t)) 699#define ___bpf_reg_cnt2(t, x, args...) (___bpf_reg_cnt1(args) + ___bpf_treg_cnt(t)) 700#define ___bpf_reg_cnt3(t, x, args...) (___bpf_reg_cnt2(args) + ___bpf_treg_cnt(t)) 701#define ___bpf_reg_cnt4(t, x, args...) (___bpf_reg_cnt3(args) + ___bpf_treg_cnt(t)) 702#define ___bpf_reg_cnt5(t, x, args...) (___bpf_reg_cnt4(args) + ___bpf_treg_cnt(t)) 703#define ___bpf_reg_cnt6(t, x, args...) (___bpf_reg_cnt5(args) + ___bpf_treg_cnt(t)) 704#define ___bpf_reg_cnt7(t, x, args...) (___bpf_reg_cnt6(args) + ___bpf_treg_cnt(t)) 705#define ___bpf_reg_cnt8(t, x, args...) (___bpf_reg_cnt7(args) + ___bpf_treg_cnt(t)) 706#define ___bpf_reg_cnt9(t, x, args...) (___bpf_reg_cnt8(args) + ___bpf_treg_cnt(t)) 707#define ___bpf_reg_cnt10(t, x, args...) (___bpf_reg_cnt9(args) + ___bpf_treg_cnt(t)) 708#define ___bpf_reg_cnt11(t, x, args...) (___bpf_reg_cnt10(args) + ___bpf_treg_cnt(t)) 709#define ___bpf_reg_cnt12(t, x, args...) (___bpf_reg_cnt11(args) + ___bpf_treg_cnt(t)) 710#define ___bpf_reg_cnt(args...) ___bpf_apply(___bpf_reg_cnt, ___bpf_narg2(args))(args) 711 712#define ___bpf_union_arg(t, x, n) \ 713 __builtin_choose_expr(sizeof(t) == 1, ({ union { __u8 z[1]; t x; } ___t = { .z = {ctx[n]}}; ___t.x; }), \ 714 __builtin_choose_expr(sizeof(t) == 2, ({ union { __u16 z[1]; t x; } ___t = { .z = {ctx[n]} }; ___t.x; }), \ 715 __builtin_choose_expr(sizeof(t) == 4, ({ union { __u32 z[1]; t x; } ___t = { .z = {ctx[n]} }; ___t.x; }), \ 716 __builtin_choose_expr(sizeof(t) == 8, ({ union { __u64 z[1]; t x; } ___t = {.z = {ctx[n]} }; ___t.x; }), \ 717 __builtin_choose_expr(sizeof(t) == 16, ({ union { __u64 z[2]; t x; } ___t = {.z = {ctx[n], ctx[n + 1]} }; ___t.x; }), \ 718 (void)0))))) 719 720#define ___bpf_ctx_arg0(n, args...) 721#define ___bpf_ctx_arg1(n, t, x) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt1(t, x)) 722#define ___bpf_ctx_arg2(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt2(t, x, args)) ___bpf_ctx_arg1(n, args) 723#define ___bpf_ctx_arg3(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt3(t, x, args)) ___bpf_ctx_arg2(n, args) 724#define ___bpf_ctx_arg4(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt4(t, x, args)) ___bpf_ctx_arg3(n, args) 725#define ___bpf_ctx_arg5(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt5(t, x, args)) ___bpf_ctx_arg4(n, args) 726#define ___bpf_ctx_arg6(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt6(t, x, args)) ___bpf_ctx_arg5(n, args) 727#define ___bpf_ctx_arg7(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt7(t, x, args)) ___bpf_ctx_arg6(n, args) 728#define ___bpf_ctx_arg8(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt8(t, x, args)) ___bpf_ctx_arg7(n, args) 729#define ___bpf_ctx_arg9(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt9(t, x, args)) ___bpf_ctx_arg8(n, args) 730#define ___bpf_ctx_arg10(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt10(t, x, args)) ___bpf_ctx_arg9(n, args) 731#define ___bpf_ctx_arg11(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt11(t, x, args)) ___bpf_ctx_arg10(n, args) 732#define ___bpf_ctx_arg12(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt12(t, x, args)) ___bpf_ctx_arg11(n, args) 733#define ___bpf_ctx_arg(args...) ___bpf_apply(___bpf_ctx_arg, ___bpf_narg2(args))(___bpf_reg_cnt(args), args) 734 735#define ___bpf_ctx_decl0() 736#define ___bpf_ctx_decl1(t, x) , t x 737#define ___bpf_ctx_decl2(t, x, args...) , t x ___bpf_ctx_decl1(args) 738#define ___bpf_ctx_decl3(t, x, args...) , t x ___bpf_ctx_decl2(args) 739#define ___bpf_ctx_decl4(t, x, args...) , t x ___bpf_ctx_decl3(args) 740#define ___bpf_ctx_decl5(t, x, args...) , t x ___bpf_ctx_decl4(args) 741#define ___bpf_ctx_decl6(t, x, args...) , t x ___bpf_ctx_decl5(args) 742#define ___bpf_ctx_decl7(t, x, args...) , t x ___bpf_ctx_decl6(args) 743#define ___bpf_ctx_decl8(t, x, args...) , t x ___bpf_ctx_decl7(args) 744#define ___bpf_ctx_decl9(t, x, args...) , t x ___bpf_ctx_decl8(args) 745#define ___bpf_ctx_decl10(t, x, args...) , t x ___bpf_ctx_decl9(args) 746#define ___bpf_ctx_decl11(t, x, args...) , t x ___bpf_ctx_decl10(args) 747#define ___bpf_ctx_decl12(t, x, args...) , t x ___bpf_ctx_decl11(args) 748#define ___bpf_ctx_decl(args...) ___bpf_apply(___bpf_ctx_decl, ___bpf_narg2(args))(args) 749 750/* 751 * BPF_PROG2 is an enhanced version of BPF_PROG in order to handle struct 752 * arguments. Since each struct argument might take one or two u64 values 753 * in the trampoline stack, argument type size is needed to place proper number 754 * of u64 values for each argument. Therefore, BPF_PROG2 has different 755 * syntax from BPF_PROG. For example, for the following BPF_PROG syntax: 756 * 757 * int BPF_PROG(test2, int a, int b) { ... } 758 * 759 * the corresponding BPF_PROG2 syntax is: 760 * 761 * int BPF_PROG2(test2, int, a, int, b) { ... } 762 * 763 * where type and the corresponding argument name are separated by comma. 764 * 765 * Use BPF_PROG2 macro if one of the arguments might be a struct/union larger 766 * than 8 bytes: 767 * 768 * int BPF_PROG2(test_struct_arg, struct bpf_testmod_struct_arg_1, a, int, b, 769 * int, c, int, d, struct bpf_testmod_struct_arg_2, e, int, ret) 770 * { 771 * // access a, b, c, d, e, and ret directly 772 * ... 773 * } 774 */ 775#define BPF_PROG2(name, args...) \ 776name(unsigned long long *ctx); \ 777static __always_inline typeof(name(0)) \ 778____##name(unsigned long long *ctx ___bpf_ctx_decl(args)); \ 779typeof(name(0)) name(unsigned long long *ctx) \ 780{ \ 781 return ____##name(ctx ___bpf_ctx_arg(args)); \ 782} \ 783static __always_inline typeof(name(0)) \ 784____##name(unsigned long long *ctx ___bpf_ctx_decl(args)) 785 786struct pt_regs; 787 788#define ___bpf_kprobe_args0() ctx 789#define ___bpf_kprobe_args1(x) ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx) 790#define ___bpf_kprobe_args2(x, args...) ___bpf_kprobe_args1(args), (void *)PT_REGS_PARM2(ctx) 791#define ___bpf_kprobe_args3(x, args...) ___bpf_kprobe_args2(args), (void *)PT_REGS_PARM3(ctx) 792#define ___bpf_kprobe_args4(x, args...) ___bpf_kprobe_args3(args), (void *)PT_REGS_PARM4(ctx) 793#define ___bpf_kprobe_args5(x, args...) ___bpf_kprobe_args4(args), (void *)PT_REGS_PARM5(ctx) 794#define ___bpf_kprobe_args6(x, args...) ___bpf_kprobe_args5(args), (void *)PT_REGS_PARM6(ctx) 795#define ___bpf_kprobe_args7(x, args...) ___bpf_kprobe_args6(args), (void *)PT_REGS_PARM7(ctx) 796#define ___bpf_kprobe_args8(x, args...) ___bpf_kprobe_args7(args), (void *)PT_REGS_PARM8(ctx) 797#define ___bpf_kprobe_args(args...) ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args) 798 799/* 800 * BPF_KPROBE serves the same purpose for kprobes as BPF_PROG for 801 * tp_btf/fentry/fexit BPF programs. It hides the underlying platform-specific 802 * low-level way of getting kprobe input arguments from struct pt_regs, and 803 * provides a familiar typed and named function arguments syntax and 804 * semantics of accessing kprobe input paremeters. 805 * 806 * Original struct pt_regs* context is preserved as 'ctx' argument. This might 807 * be necessary when using BPF helpers like bpf_perf_event_output(). 808 */ 809#define BPF_KPROBE(name, args...) \ 810name(struct pt_regs *ctx); \ 811static __always_inline typeof(name(0)) \ 812____##name(struct pt_regs *ctx, ##args); \ 813typeof(name(0)) name(struct pt_regs *ctx) \ 814{ \ 815 _Pragma("GCC diagnostic push") \ 816 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ 817 return ____##name(___bpf_kprobe_args(args)); \ 818 _Pragma("GCC diagnostic pop") \ 819} \ 820static __always_inline typeof(name(0)) \ 821____##name(struct pt_regs *ctx, ##args) 822 823#define ___bpf_kretprobe_args0() ctx 824#define ___bpf_kretprobe_args1(x) ___bpf_kretprobe_args0(), (void *)PT_REGS_RC(ctx) 825#define ___bpf_kretprobe_args(args...) ___bpf_apply(___bpf_kretprobe_args, ___bpf_narg(args))(args) 826 827/* 828 * BPF_KRETPROBE is similar to BPF_KPROBE, except, it only provides optional 829 * return value (in addition to `struct pt_regs *ctx`), but no input 830 * arguments, because they will be clobbered by the time probed function 831 * returns. 832 */ 833#define BPF_KRETPROBE(name, args...) \ 834name(struct pt_regs *ctx); \ 835static __always_inline typeof(name(0)) \ 836____##name(struct pt_regs *ctx, ##args); \ 837typeof(name(0)) name(struct pt_regs *ctx) \ 838{ \ 839 _Pragma("GCC diagnostic push") \ 840 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ 841 return ____##name(___bpf_kretprobe_args(args)); \ 842 _Pragma("GCC diagnostic pop") \ 843} \ 844static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args) 845 846/* If kernel has CONFIG_ARCH_HAS_SYSCALL_WRAPPER, read pt_regs directly */ 847#define ___bpf_syscall_args0() ctx 848#define ___bpf_syscall_args1(x) ___bpf_syscall_args0(), (void *)PT_REGS_PARM1_SYSCALL(regs) 849#define ___bpf_syscall_args2(x, args...) ___bpf_syscall_args1(args), (void *)PT_REGS_PARM2_SYSCALL(regs) 850#define ___bpf_syscall_args3(x, args...) ___bpf_syscall_args2(args), (void *)PT_REGS_PARM3_SYSCALL(regs) 851#define ___bpf_syscall_args4(x, args...) ___bpf_syscall_args3(args), (void *)PT_REGS_PARM4_SYSCALL(regs) 852#define ___bpf_syscall_args5(x, args...) ___bpf_syscall_args4(args), (void *)PT_REGS_PARM5_SYSCALL(regs) 853#define ___bpf_syscall_args6(x, args...) ___bpf_syscall_args5(args), (void *)PT_REGS_PARM6_SYSCALL(regs) 854#define ___bpf_syscall_args7(x, args...) ___bpf_syscall_args6(args), (void *)PT_REGS_PARM7_SYSCALL(regs) 855#define ___bpf_syscall_args(args...) ___bpf_apply(___bpf_syscall_args, ___bpf_narg(args))(args) 856 857/* If kernel doesn't have CONFIG_ARCH_HAS_SYSCALL_WRAPPER, we have to BPF_CORE_READ from pt_regs */ 858#define ___bpf_syswrap_args0() ctx 859#define ___bpf_syswrap_args1(x) ___bpf_syswrap_args0(), (void *)PT_REGS_PARM1_CORE_SYSCALL(regs) 860#define ___bpf_syswrap_args2(x, args...) ___bpf_syswrap_args1(args), (void *)PT_REGS_PARM2_CORE_SYSCALL(regs) 861#define ___bpf_syswrap_args3(x, args...) ___bpf_syswrap_args2(args), (void *)PT_REGS_PARM3_CORE_SYSCALL(regs) 862#define ___bpf_syswrap_args4(x, args...) ___bpf_syswrap_args3(args), (void *)PT_REGS_PARM4_CORE_SYSCALL(regs) 863#define ___bpf_syswrap_args5(x, args...) ___bpf_syswrap_args4(args), (void *)PT_REGS_PARM5_CORE_SYSCALL(regs) 864#define ___bpf_syswrap_args6(x, args...) ___bpf_syswrap_args5(args), (void *)PT_REGS_PARM6_CORE_SYSCALL(regs) 865#define ___bpf_syswrap_args7(x, args...) ___bpf_syswrap_args6(args), (void *)PT_REGS_PARM7_CORE_SYSCALL(regs) 866#define ___bpf_syswrap_args(args...) ___bpf_apply(___bpf_syswrap_args, ___bpf_narg(args))(args) 867 868/* 869 * BPF_KSYSCALL is a variant of BPF_KPROBE, which is intended for 870 * tracing syscall functions, like __x64_sys_close. It hides the underlying 871 * platform-specific low-level way of getting syscall input arguments from 872 * struct pt_regs, and provides a familiar typed and named function arguments 873 * syntax and semantics of accessing syscall input parameters. 874 * 875 * Original struct pt_regs * context is preserved as 'ctx' argument. This might 876 * be necessary when using BPF helpers like bpf_perf_event_output(). 877 * 878 * At the moment BPF_KSYSCALL does not transparently handle all the calling 879 * convention quirks for the following syscalls: 880 * 881 * - mmap(): __ARCH_WANT_SYS_OLD_MMAP. 882 * - clone(): CONFIG_CLONE_BACKWARDS, CONFIG_CLONE_BACKWARDS2 and 883 * CONFIG_CLONE_BACKWARDS3. 884 * - socket-related syscalls: __ARCH_WANT_SYS_SOCKETCALL. 885 * - compat syscalls. 886 * 887 * This may or may not change in the future. User needs to take extra measures 888 * to handle such quirks explicitly, if necessary. 889 * 890 * This macro relies on BPF CO-RE support and virtual __kconfig externs. 891 */ 892#define BPF_KSYSCALL(name, args...) \ 893name(struct pt_regs *ctx); \ 894extern _Bool LINUX_HAS_SYSCALL_WRAPPER __kconfig; \ 895static __always_inline typeof(name(0)) \ 896____##name(struct pt_regs *ctx, ##args); \ 897typeof(name(0)) name(struct pt_regs *ctx) \ 898{ \ 899 struct pt_regs *regs = LINUX_HAS_SYSCALL_WRAPPER \ 900 ? (struct pt_regs *)PT_REGS_PARM1(ctx) \ 901 : ctx; \ 902 _Pragma("GCC diagnostic push") \ 903 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ 904 if (LINUX_HAS_SYSCALL_WRAPPER) \ 905 return ____##name(___bpf_syswrap_args(args)); \ 906 else \ 907 return ____##name(___bpf_syscall_args(args)); \ 908 _Pragma("GCC diagnostic pop") \ 909} \ 910static __always_inline typeof(name(0)) \ 911____##name(struct pt_regs *ctx, ##args) 912 913#define BPF_KPROBE_SYSCALL BPF_KSYSCALL 914 915/* BPF_UPROBE and BPF_URETPROBE are identical to BPF_KPROBE and BPF_KRETPROBE, 916 * but are named way less confusingly for SEC("uprobe") and SEC("uretprobe") 917 * use cases. 918 */ 919#define BPF_UPROBE(name, args...) BPF_KPROBE(name, ##args) 920#define BPF_URETPROBE(name, args...) BPF_KRETPROBE(name, ##args) 921 922#endif 923