bpf_tracing.h 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670
  1. /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
  2. #ifndef __BPF_TRACING_H__
  3. #define __BPF_TRACING_H__
  4. #include <bpf/bpf_helpers.h>
  5. /* Scan the ARCH passed in from ARCH env variable (see Makefile) */
  6. #if defined(__TARGET_ARCH_x86)
  7. #define bpf_target_x86
  8. #define bpf_target_defined
  9. #elif defined(__TARGET_ARCH_s390)
  10. #define bpf_target_s390
  11. #define bpf_target_defined
  12. #elif defined(__TARGET_ARCH_arm)
  13. #define bpf_target_arm
  14. #define bpf_target_defined
  15. #elif defined(__TARGET_ARCH_arm64)
  16. #define bpf_target_arm64
  17. #define bpf_target_defined
  18. #elif defined(__TARGET_ARCH_mips)
  19. #define bpf_target_mips
  20. #define bpf_target_defined
  21. #elif defined(__TARGET_ARCH_powerpc)
  22. #define bpf_target_powerpc
  23. #define bpf_target_defined
  24. #elif defined(__TARGET_ARCH_sparc)
  25. #define bpf_target_sparc
  26. #define bpf_target_defined
  27. #elif defined(__TARGET_ARCH_riscv)
  28. #define bpf_target_riscv
  29. #define bpf_target_defined
  30. #elif defined(__TARGET_ARCH_arc)
  31. #define bpf_target_arc
  32. #define bpf_target_defined
  33. #else
  34. /* Fall back to what the compiler says */
  35. #if defined(__x86_64__)
  36. #define bpf_target_x86
  37. #define bpf_target_defined
  38. #elif defined(__s390__)
  39. #define bpf_target_s390
  40. #define bpf_target_defined
  41. #elif defined(__arm__)
  42. #define bpf_target_arm
  43. #define bpf_target_defined
  44. #elif defined(__aarch64__)
  45. #define bpf_target_arm64
  46. #define bpf_target_defined
  47. #elif defined(__mips__)
  48. #define bpf_target_mips
  49. #define bpf_target_defined
  50. #elif defined(__powerpc__)
  51. #define bpf_target_powerpc
  52. #define bpf_target_defined
  53. #elif defined(__sparc__)
  54. #define bpf_target_sparc
  55. #define bpf_target_defined
  56. #elif defined(__riscv) && __riscv_xlen == 64
  57. #define bpf_target_riscv
  58. #define bpf_target_defined
  59. #elif defined(__arc__)
  60. #define bpf_target_arc
  61. #define bpf_target_defined
  62. #endif /* no compiler target */
  63. #endif
  64. #ifndef __BPF_TARGET_MISSING
  65. #define __BPF_TARGET_MISSING "GCC error \"Must specify a BPF target arch via __TARGET_ARCH_xxx\""
  66. #endif
  67. #if defined(bpf_target_x86)
  68. #if defined(__KERNEL__) || defined(__VMLINUX_H__)
  69. #define __PT_PARM1_REG di
  70. #define __PT_PARM2_REG si
  71. #define __PT_PARM3_REG dx
  72. #define __PT_PARM4_REG cx
  73. #define __PT_PARM5_REG r8
  74. #define __PT_RET_REG sp
  75. #define __PT_FP_REG bp
  76. #define __PT_RC_REG ax
  77. #define __PT_SP_REG sp
  78. #define __PT_IP_REG ip
  79. /* syscall uses r10 for PARM4 */
  80. #define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)
  81. #define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)
  82. #else
  83. #ifdef __i386__
  84. #define __PT_PARM1_REG eax
  85. #define __PT_PARM2_REG edx
  86. #define __PT_PARM3_REG ecx
  87. /* i386 kernel is built with -mregparm=3 */
  88. #define __PT_PARM4_REG __unsupported__
  89. #define __PT_PARM5_REG __unsupported__
  90. #define __PT_RET_REG esp
  91. #define __PT_FP_REG ebp
  92. #define __PT_RC_REG eax
  93. #define __PT_SP_REG esp
  94. #define __PT_IP_REG eip
  95. #else /* __i386__ */
  96. #define __PT_PARM1_REG rdi
  97. #define __PT_PARM2_REG rsi
  98. #define __PT_PARM3_REG rdx
  99. #define __PT_PARM4_REG rcx
  100. #define __PT_PARM5_REG r8
  101. #define __PT_RET_REG rsp
  102. #define __PT_FP_REG rbp
  103. #define __PT_RC_REG rax
  104. #define __PT_SP_REG rsp
  105. #define __PT_IP_REG rip
  106. /* syscall uses r10 for PARM4 */
  107. #define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)
  108. #define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)
  109. #endif /* __i386__ */
  110. #endif /* __KERNEL__ || __VMLINUX_H__ */
  111. #elif defined(bpf_target_s390)
  112. struct pt_regs___s390 {
  113. unsigned long orig_gpr2;
  114. };
  115. /* s390 provides user_pt_regs instead of struct pt_regs to userspace */
  116. #define __PT_REGS_CAST(x) ((const user_pt_regs *)(x))
  117. #define __PT_PARM1_REG gprs[2]
  118. #define __PT_PARM2_REG gprs[3]
  119. #define __PT_PARM3_REG gprs[4]
  120. #define __PT_PARM4_REG gprs[5]
  121. #define __PT_PARM5_REG gprs[6]
  122. #define __PT_RET_REG gprs[14]
  123. #define __PT_FP_REG gprs[11] /* Works only with CONFIG_FRAME_POINTER */
  124. #define __PT_RC_REG gprs[2]
  125. #define __PT_SP_REG gprs[15]
  126. #define __PT_IP_REG psw.addr
  127. #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)
  128. #define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___s390 *)(x), orig_gpr2)
  129. #elif defined(bpf_target_arm)
  130. #define __PT_PARM1_REG uregs[0]
  131. #define __PT_PARM2_REG uregs[1]
  132. #define __PT_PARM3_REG uregs[2]
  133. #define __PT_PARM4_REG uregs[3]
  134. #define __PT_PARM5_REG uregs[4]
  135. #define __PT_RET_REG uregs[14]
  136. #define __PT_FP_REG uregs[11] /* Works only with CONFIG_FRAME_POINTER */
  137. #define __PT_RC_REG uregs[0]
  138. #define __PT_SP_REG uregs[13]
  139. #define __PT_IP_REG uregs[12]
  140. #elif defined(bpf_target_arm64)
  141. struct pt_regs___arm64 {
  142. unsigned long orig_x0;
  143. };
  144. /* arm64 provides struct user_pt_regs instead of struct pt_regs to userspace */
  145. #define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x))
  146. #define __PT_PARM1_REG regs[0]
  147. #define __PT_PARM2_REG regs[1]
  148. #define __PT_PARM3_REG regs[2]
  149. #define __PT_PARM4_REG regs[3]
  150. #define __PT_PARM5_REG regs[4]
  151. #define __PT_RET_REG regs[30]
  152. #define __PT_FP_REG regs[29] /* Works only with CONFIG_FRAME_POINTER */
  153. #define __PT_RC_REG regs[0]
  154. #define __PT_SP_REG sp
  155. #define __PT_IP_REG pc
  156. #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)
  157. #define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___arm64 *)(x), orig_x0)
  158. #elif defined(bpf_target_mips)
  159. #define __PT_PARM1_REG regs[4]
  160. #define __PT_PARM2_REG regs[5]
  161. #define __PT_PARM3_REG regs[6]
  162. #define __PT_PARM4_REG regs[7]
  163. #define __PT_PARM5_REG regs[8]
  164. #define __PT_RET_REG regs[31]
  165. #define __PT_FP_REG regs[30] /* Works only with CONFIG_FRAME_POINTER */
  166. #define __PT_RC_REG regs[2]
  167. #define __PT_SP_REG regs[29]
  168. #define __PT_IP_REG cp0_epc
  169. #elif defined(bpf_target_powerpc)
  170. #define __PT_PARM1_REG gpr[3]
  171. #define __PT_PARM2_REG gpr[4]
  172. #define __PT_PARM3_REG gpr[5]
  173. #define __PT_PARM4_REG gpr[6]
  174. #define __PT_PARM5_REG gpr[7]
  175. #define __PT_RET_REG regs[31]
  176. #define __PT_FP_REG __unsupported__
  177. #define __PT_RC_REG gpr[3]
  178. #define __PT_SP_REG sp
  179. #define __PT_IP_REG nip
  180. /* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER. */
  181. #define PT_REGS_SYSCALL_REGS(ctx) ctx
  182. #elif defined(bpf_target_sparc)
  183. #define __PT_PARM1_REG u_regs[UREG_I0]
  184. #define __PT_PARM2_REG u_regs[UREG_I1]
  185. #define __PT_PARM3_REG u_regs[UREG_I2]
  186. #define __PT_PARM4_REG u_regs[UREG_I3]
  187. #define __PT_PARM5_REG u_regs[UREG_I4]
  188. #define __PT_RET_REG u_regs[UREG_I7]
  189. #define __PT_FP_REG __unsupported__
  190. #define __PT_RC_REG u_regs[UREG_I0]
  191. #define __PT_SP_REG u_regs[UREG_FP]
  192. /* Should this also be a bpf_target check for the sparc case? */
  193. #if defined(__arch64__)
  194. #define __PT_IP_REG tpc
  195. #else
  196. #define __PT_IP_REG pc
  197. #endif
  198. #elif defined(bpf_target_riscv)
  199. #define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))
  200. #define __PT_PARM1_REG a0
  201. #define __PT_PARM2_REG a1
  202. #define __PT_PARM3_REG a2
  203. #define __PT_PARM4_REG a3
  204. #define __PT_PARM5_REG a4
  205. #define __PT_RET_REG ra
  206. #define __PT_FP_REG s0
  207. #define __PT_RC_REG a0
  208. #define __PT_SP_REG sp
  209. #define __PT_IP_REG pc
  210. /* riscv does not select ARCH_HAS_SYSCALL_WRAPPER. */
  211. #define PT_REGS_SYSCALL_REGS(ctx) ctx
  212. #elif defined(bpf_target_arc)
  213. /* arc provides struct user_pt_regs instead of struct pt_regs to userspace */
  214. #define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))
  215. #define __PT_PARM1_REG scratch.r0
  216. #define __PT_PARM2_REG scratch.r1
  217. #define __PT_PARM3_REG scratch.r2
  218. #define __PT_PARM4_REG scratch.r3
  219. #define __PT_PARM5_REG scratch.r4
  220. #define __PT_RET_REG scratch.blink
  221. #define __PT_FP_REG __unsupported__
  222. #define __PT_RC_REG scratch.r0
  223. #define __PT_SP_REG scratch.sp
  224. #define __PT_IP_REG scratch.ret
  225. /* arc does not select ARCH_HAS_SYSCALL_WRAPPER. */
  226. #define PT_REGS_SYSCALL_REGS(ctx) ctx
  227. #endif
  228. #if defined(bpf_target_defined)
  229. struct pt_regs;
  230. /* allow some architecutres to override `struct pt_regs` */
  231. #ifndef __PT_REGS_CAST
  232. #define __PT_REGS_CAST(x) (x)
  233. #endif
  234. #define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)
  235. #define PT_REGS_PARM2(x) (__PT_REGS_CAST(x)->__PT_PARM2_REG)
  236. #define PT_REGS_PARM3(x) (__PT_REGS_CAST(x)->__PT_PARM3_REG)
  237. #define PT_REGS_PARM4(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG)
  238. #define PT_REGS_PARM5(x) (__PT_REGS_CAST(x)->__PT_PARM5_REG)
  239. #define PT_REGS_RET(x) (__PT_REGS_CAST(x)->__PT_RET_REG)
  240. #define PT_REGS_FP(x) (__PT_REGS_CAST(x)->__PT_FP_REG)
  241. #define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG)
  242. #define PT_REGS_SP(x) (__PT_REGS_CAST(x)->__PT_SP_REG)
  243. #define PT_REGS_IP(x) (__PT_REGS_CAST(x)->__PT_IP_REG)
  244. #define PT_REGS_PARM1_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_REG)
  245. #define PT_REGS_PARM2_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_REG)
  246. #define PT_REGS_PARM3_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_REG)
  247. #define PT_REGS_PARM4_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_REG)
  248. #define PT_REGS_PARM5_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_REG)
  249. #define PT_REGS_RET_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RET_REG)
  250. #define PT_REGS_FP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_FP_REG)
  251. #define PT_REGS_RC_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RC_REG)
  252. #define PT_REGS_SP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_SP_REG)
  253. #define PT_REGS_IP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_IP_REG)
  254. #if defined(bpf_target_powerpc)
  255. #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = (ctx)->link; })
  256. #define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP
  257. #elif defined(bpf_target_sparc)
  258. #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = PT_REGS_RET(ctx); })
  259. #define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP
  260. #else
  261. #define BPF_KPROBE_READ_RET_IP(ip, ctx) \
  262. ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)PT_REGS_RET(ctx)); })
  263. #define BPF_KRETPROBE_READ_RET_IP(ip, ctx) \
  264. ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)(PT_REGS_FP(ctx) + sizeof(ip))); })
  265. #endif
  266. #ifndef PT_REGS_PARM1_SYSCALL
  267. #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1(x)
  268. #endif
  269. #define PT_REGS_PARM2_SYSCALL(x) PT_REGS_PARM2(x)
  270. #define PT_REGS_PARM3_SYSCALL(x) PT_REGS_PARM3(x)
  271. #ifndef PT_REGS_PARM4_SYSCALL
  272. #define PT_REGS_PARM4_SYSCALL(x) PT_REGS_PARM4(x)
  273. #endif
  274. #define PT_REGS_PARM5_SYSCALL(x) PT_REGS_PARM5(x)
  275. #ifndef PT_REGS_PARM1_CORE_SYSCALL
  276. #define PT_REGS_PARM1_CORE_SYSCALL(x) PT_REGS_PARM1_CORE(x)
  277. #endif
  278. #define PT_REGS_PARM2_CORE_SYSCALL(x) PT_REGS_PARM2_CORE(x)
  279. #define PT_REGS_PARM3_CORE_SYSCALL(x) PT_REGS_PARM3_CORE(x)
  280. #ifndef PT_REGS_PARM4_CORE_SYSCALL
  281. #define PT_REGS_PARM4_CORE_SYSCALL(x) PT_REGS_PARM4_CORE(x)
  282. #endif
  283. #define PT_REGS_PARM5_CORE_SYSCALL(x) PT_REGS_PARM5_CORE(x)
  284. #else /* defined(bpf_target_defined) */
  285. #define PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  286. #define PT_REGS_PARM2(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  287. #define PT_REGS_PARM3(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  288. #define PT_REGS_PARM4(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  289. #define PT_REGS_PARM5(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  290. #define PT_REGS_RET(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  291. #define PT_REGS_FP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  292. #define PT_REGS_RC(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  293. #define PT_REGS_SP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  294. #define PT_REGS_IP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  295. #define PT_REGS_PARM1_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  296. #define PT_REGS_PARM2_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  297. #define PT_REGS_PARM3_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  298. #define PT_REGS_PARM4_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  299. #define PT_REGS_PARM5_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  300. #define PT_REGS_RET_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  301. #define PT_REGS_FP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  302. #define PT_REGS_RC_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  303. #define PT_REGS_SP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  304. #define PT_REGS_IP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  305. #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  306. #define BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  307. #define PT_REGS_PARM1_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  308. #define PT_REGS_PARM2_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  309. #define PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  310. #define PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  311. #define PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  312. #define PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  313. #define PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  314. #define PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  315. #define PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  316. #define PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
  317. #endif /* defined(bpf_target_defined) */
  318. /*
  319. * When invoked from a syscall handler kprobe, returns a pointer to a
  320. * struct pt_regs containing syscall arguments and suitable for passing to
  321. * PT_REGS_PARMn_SYSCALL() and PT_REGS_PARMn_CORE_SYSCALL().
  322. */
  323. #ifndef PT_REGS_SYSCALL_REGS
  324. /* By default, assume that the arch selects ARCH_HAS_SYSCALL_WRAPPER. */
  325. #define PT_REGS_SYSCALL_REGS(ctx) ((struct pt_regs *)PT_REGS_PARM1(ctx))
  326. #endif
  327. #ifndef ___bpf_concat
  328. #define ___bpf_concat(a, b) a ## b
  329. #endif
  330. #ifndef ___bpf_apply
  331. #define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
  332. #endif
  333. #ifndef ___bpf_nth
  334. #define ___bpf_nth(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _a, _b, _c, N, ...) N
  335. #endif
  336. #ifndef ___bpf_narg
  337. #define ___bpf_narg(...) ___bpf_nth(_, ##__VA_ARGS__, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0)
  338. #endif
  339. #define ___bpf_ctx_cast0() ctx
  340. #define ___bpf_ctx_cast1(x) ___bpf_ctx_cast0(), (void *)ctx[0]
  341. #define ___bpf_ctx_cast2(x, args...) ___bpf_ctx_cast1(args), (void *)ctx[1]
  342. #define ___bpf_ctx_cast3(x, args...) ___bpf_ctx_cast2(args), (void *)ctx[2]
  343. #define ___bpf_ctx_cast4(x, args...) ___bpf_ctx_cast3(args), (void *)ctx[3]
  344. #define ___bpf_ctx_cast5(x, args...) ___bpf_ctx_cast4(args), (void *)ctx[4]
  345. #define ___bpf_ctx_cast6(x, args...) ___bpf_ctx_cast5(args), (void *)ctx[5]
  346. #define ___bpf_ctx_cast7(x, args...) ___bpf_ctx_cast6(args), (void *)ctx[6]
  347. #define ___bpf_ctx_cast8(x, args...) ___bpf_ctx_cast7(args), (void *)ctx[7]
  348. #define ___bpf_ctx_cast9(x, args...) ___bpf_ctx_cast8(args), (void *)ctx[8]
  349. #define ___bpf_ctx_cast10(x, args...) ___bpf_ctx_cast9(args), (void *)ctx[9]
  350. #define ___bpf_ctx_cast11(x, args...) ___bpf_ctx_cast10(args), (void *)ctx[10]
  351. #define ___bpf_ctx_cast12(x, args...) ___bpf_ctx_cast11(args), (void *)ctx[11]
  352. #define ___bpf_ctx_cast(args...) ___bpf_apply(___bpf_ctx_cast, ___bpf_narg(args))(args)
  353. /*
  354. * BPF_PROG is a convenience wrapper for generic tp_btf/fentry/fexit and
  355. * similar kinds of BPF programs, that accept input arguments as a single
  356. * pointer to untyped u64 array, where each u64 can actually be a typed
  357. * pointer or integer of different size. Instead of requring user to write
  358. * manual casts and work with array elements by index, BPF_PROG macro
  359. * allows user to declare a list of named and typed input arguments in the
  360. * same syntax as for normal C function. All the casting is hidden and
  361. * performed transparently, while user code can just assume working with
  362. * function arguments of specified type and name.
  363. *
  364. * Original raw context argument is preserved as well as 'ctx' argument.
  365. * This is useful when using BPF helpers that expect original context
  366. * as one of the parameters (e.g., for bpf_perf_event_output()).
  367. */
  368. #define BPF_PROG(name, args...) \
  369. name(unsigned long long *ctx); \
  370. static __always_inline typeof(name(0)) \
  371. ____##name(unsigned long long *ctx, ##args); \
  372. typeof(name(0)) name(unsigned long long *ctx) \
  373. { \
  374. _Pragma("GCC diagnostic push") \
  375. _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
  376. return ____##name(___bpf_ctx_cast(args)); \
  377. _Pragma("GCC diagnostic pop") \
  378. } \
  379. static __always_inline typeof(name(0)) \
  380. ____##name(unsigned long long *ctx, ##args)
  381. #ifndef ___bpf_nth2
  382. #define ___bpf_nth2(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, \
  383. _14, _15, _16, _17, _18, _19, _20, _21, _22, _23, _24, N, ...) N
  384. #endif
  385. #ifndef ___bpf_narg2
  386. #define ___bpf_narg2(...) \
  387. ___bpf_nth2(_, ##__VA_ARGS__, 12, 12, 11, 11, 10, 10, 9, 9, 8, 8, 7, 7, \
  388. 6, 6, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 0)
  389. #endif
  390. #define ___bpf_treg_cnt(t) \
  391. __builtin_choose_expr(sizeof(t) == 1, 1, \
  392. __builtin_choose_expr(sizeof(t) == 2, 1, \
  393. __builtin_choose_expr(sizeof(t) == 4, 1, \
  394. __builtin_choose_expr(sizeof(t) == 8, 1, \
  395. __builtin_choose_expr(sizeof(t) == 16, 2, \
  396. (void)0)))))
  397. #define ___bpf_reg_cnt0() (0)
  398. #define ___bpf_reg_cnt1(t, x) (___bpf_reg_cnt0() + ___bpf_treg_cnt(t))
  399. #define ___bpf_reg_cnt2(t, x, args...) (___bpf_reg_cnt1(args) + ___bpf_treg_cnt(t))
  400. #define ___bpf_reg_cnt3(t, x, args...) (___bpf_reg_cnt2(args) + ___bpf_treg_cnt(t))
  401. #define ___bpf_reg_cnt4(t, x, args...) (___bpf_reg_cnt3(args) + ___bpf_treg_cnt(t))
  402. #define ___bpf_reg_cnt5(t, x, args...) (___bpf_reg_cnt4(args) + ___bpf_treg_cnt(t))
  403. #define ___bpf_reg_cnt6(t, x, args...) (___bpf_reg_cnt5(args) + ___bpf_treg_cnt(t))
  404. #define ___bpf_reg_cnt7(t, x, args...) (___bpf_reg_cnt6(args) + ___bpf_treg_cnt(t))
  405. #define ___bpf_reg_cnt8(t, x, args...) (___bpf_reg_cnt7(args) + ___bpf_treg_cnt(t))
  406. #define ___bpf_reg_cnt9(t, x, args...) (___bpf_reg_cnt8(args) + ___bpf_treg_cnt(t))
  407. #define ___bpf_reg_cnt10(t, x, args...) (___bpf_reg_cnt9(args) + ___bpf_treg_cnt(t))
  408. #define ___bpf_reg_cnt11(t, x, args...) (___bpf_reg_cnt10(args) + ___bpf_treg_cnt(t))
  409. #define ___bpf_reg_cnt12(t, x, args...) (___bpf_reg_cnt11(args) + ___bpf_treg_cnt(t))
  410. #define ___bpf_reg_cnt(args...) ___bpf_apply(___bpf_reg_cnt, ___bpf_narg2(args))(args)
  411. #define ___bpf_union_arg(t, x, n) \
  412. __builtin_choose_expr(sizeof(t) == 1, ({ union { __u8 z[1]; t x; } ___t = { .z = {ctx[n]}}; ___t.x; }), \
  413. __builtin_choose_expr(sizeof(t) == 2, ({ union { __u16 z[1]; t x; } ___t = { .z = {ctx[n]} }; ___t.x; }), \
  414. __builtin_choose_expr(sizeof(t) == 4, ({ union { __u32 z[1]; t x; } ___t = { .z = {ctx[n]} }; ___t.x; }), \
  415. __builtin_choose_expr(sizeof(t) == 8, ({ union { __u64 z[1]; t x; } ___t = {.z = {ctx[n]} }; ___t.x; }), \
  416. __builtin_choose_expr(sizeof(t) == 16, ({ union { __u64 z[2]; t x; } ___t = {.z = {ctx[n], ctx[n + 1]} }; ___t.x; }), \
  417. (void)0)))))
  418. #define ___bpf_ctx_arg0(n, args...)
  419. #define ___bpf_ctx_arg1(n, t, x) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt1(t, x))
  420. #define ___bpf_ctx_arg2(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt2(t, x, args)) ___bpf_ctx_arg1(n, args)
  421. #define ___bpf_ctx_arg3(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt3(t, x, args)) ___bpf_ctx_arg2(n, args)
  422. #define ___bpf_ctx_arg4(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt4(t, x, args)) ___bpf_ctx_arg3(n, args)
  423. #define ___bpf_ctx_arg5(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt5(t, x, args)) ___bpf_ctx_arg4(n, args)
  424. #define ___bpf_ctx_arg6(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt6(t, x, args)) ___bpf_ctx_arg5(n, args)
  425. #define ___bpf_ctx_arg7(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt7(t, x, args)) ___bpf_ctx_arg6(n, args)
  426. #define ___bpf_ctx_arg8(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt8(t, x, args)) ___bpf_ctx_arg7(n, args)
  427. #define ___bpf_ctx_arg9(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt9(t, x, args)) ___bpf_ctx_arg8(n, args)
  428. #define ___bpf_ctx_arg10(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt10(t, x, args)) ___bpf_ctx_arg9(n, args)
  429. #define ___bpf_ctx_arg11(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt11(t, x, args)) ___bpf_ctx_arg10(n, args)
  430. #define ___bpf_ctx_arg12(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt12(t, x, args)) ___bpf_ctx_arg11(n, args)
  431. #define ___bpf_ctx_arg(args...) ___bpf_apply(___bpf_ctx_arg, ___bpf_narg2(args))(___bpf_reg_cnt(args), args)
  432. #define ___bpf_ctx_decl0()
  433. #define ___bpf_ctx_decl1(t, x) , t x
  434. #define ___bpf_ctx_decl2(t, x, args...) , t x ___bpf_ctx_decl1(args)
  435. #define ___bpf_ctx_decl3(t, x, args...) , t x ___bpf_ctx_decl2(args)
  436. #define ___bpf_ctx_decl4(t, x, args...) , t x ___bpf_ctx_decl3(args)
  437. #define ___bpf_ctx_decl5(t, x, args...) , t x ___bpf_ctx_decl4(args)
  438. #define ___bpf_ctx_decl6(t, x, args...) , t x ___bpf_ctx_decl5(args)
  439. #define ___bpf_ctx_decl7(t, x, args...) , t x ___bpf_ctx_decl6(args)
  440. #define ___bpf_ctx_decl8(t, x, args...) , t x ___bpf_ctx_decl7(args)
  441. #define ___bpf_ctx_decl9(t, x, args...) , t x ___bpf_ctx_decl8(args)
  442. #define ___bpf_ctx_decl10(t, x, args...) , t x ___bpf_ctx_decl9(args)
  443. #define ___bpf_ctx_decl11(t, x, args...) , t x ___bpf_ctx_decl10(args)
  444. #define ___bpf_ctx_decl12(t, x, args...) , t x ___bpf_ctx_decl11(args)
  445. #define ___bpf_ctx_decl(args...) ___bpf_apply(___bpf_ctx_decl, ___bpf_narg2(args))(args)
  446. /*
  447. * BPF_PROG2 is an enhanced version of BPF_PROG in order to handle struct
  448. * arguments. Since each struct argument might take one or two u64 values
  449. * in the trampoline stack, argument type size is needed to place proper number
  450. * of u64 values for each argument. Therefore, BPF_PROG2 has different
  451. * syntax from BPF_PROG. For example, for the following BPF_PROG syntax:
  452. *
  453. * int BPF_PROG(test2, int a, int b) { ... }
  454. *
  455. * the corresponding BPF_PROG2 syntax is:
  456. *
  457. * int BPF_PROG2(test2, int, a, int, b) { ... }
  458. *
  459. * where type and the corresponding argument name are separated by comma.
  460. *
  461. * Use BPF_PROG2 macro if one of the arguments might be a struct/union larger
  462. * than 8 bytes:
  463. *
  464. * int BPF_PROG2(test_struct_arg, struct bpf_testmod_struct_arg_1, a, int, b,
  465. * int, c, int, d, struct bpf_testmod_struct_arg_2, e, int, ret)
  466. * {
  467. * // access a, b, c, d, e, and ret directly
  468. * ...
  469. * }
  470. */
  471. #define BPF_PROG2(name, args...) \
  472. name(unsigned long long *ctx); \
  473. static __always_inline typeof(name(0)) \
  474. ____##name(unsigned long long *ctx ___bpf_ctx_decl(args)); \
  475. typeof(name(0)) name(unsigned long long *ctx) \
  476. { \
  477. return ____##name(ctx ___bpf_ctx_arg(args)); \
  478. } \
  479. static __always_inline typeof(name(0)) \
  480. ____##name(unsigned long long *ctx ___bpf_ctx_decl(args))
  481. struct pt_regs;
  482. #define ___bpf_kprobe_args0() ctx
  483. #define ___bpf_kprobe_args1(x) ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx)
  484. #define ___bpf_kprobe_args2(x, args...) ___bpf_kprobe_args1(args), (void *)PT_REGS_PARM2(ctx)
  485. #define ___bpf_kprobe_args3(x, args...) ___bpf_kprobe_args2(args), (void *)PT_REGS_PARM3(ctx)
  486. #define ___bpf_kprobe_args4(x, args...) ___bpf_kprobe_args3(args), (void *)PT_REGS_PARM4(ctx)
  487. #define ___bpf_kprobe_args5(x, args...) ___bpf_kprobe_args4(args), (void *)PT_REGS_PARM5(ctx)
  488. #define ___bpf_kprobe_args(args...) ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)
  489. /*
  490. * BPF_KPROBE serves the same purpose for kprobes as BPF_PROG for
  491. * tp_btf/fentry/fexit BPF programs. It hides the underlying platform-specific
  492. * low-level way of getting kprobe input arguments from struct pt_regs, and
  493. * provides a familiar typed and named function arguments syntax and
  494. * semantics of accessing kprobe input paremeters.
  495. *
  496. * Original struct pt_regs* context is preserved as 'ctx' argument. This might
  497. * be necessary when using BPF helpers like bpf_perf_event_output().
  498. */
  499. #define BPF_KPROBE(name, args...) \
  500. name(struct pt_regs *ctx); \
  501. static __always_inline typeof(name(0)) \
  502. ____##name(struct pt_regs *ctx, ##args); \
  503. typeof(name(0)) name(struct pt_regs *ctx) \
  504. { \
  505. _Pragma("GCC diagnostic push") \
  506. _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
  507. return ____##name(___bpf_kprobe_args(args)); \
  508. _Pragma("GCC diagnostic pop") \
  509. } \
  510. static __always_inline typeof(name(0)) \
  511. ____##name(struct pt_regs *ctx, ##args)
  512. #define ___bpf_kretprobe_args0() ctx
  513. #define ___bpf_kretprobe_args1(x) ___bpf_kretprobe_args0(), (void *)PT_REGS_RC(ctx)
  514. #define ___bpf_kretprobe_args(args...) ___bpf_apply(___bpf_kretprobe_args, ___bpf_narg(args))(args)
  515. /*
  516. * BPF_KRETPROBE is similar to BPF_KPROBE, except, it only provides optional
  517. * return value (in addition to `struct pt_regs *ctx`), but no input
  518. * arguments, because they will be clobbered by the time probed function
  519. * returns.
  520. */
  521. #define BPF_KRETPROBE(name, args...) \
  522. name(struct pt_regs *ctx); \
  523. static __always_inline typeof(name(0)) \
  524. ____##name(struct pt_regs *ctx, ##args); \
  525. typeof(name(0)) name(struct pt_regs *ctx) \
  526. { \
  527. _Pragma("GCC diagnostic push") \
  528. _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
  529. return ____##name(___bpf_kretprobe_args(args)); \
  530. _Pragma("GCC diagnostic pop") \
  531. } \
  532. static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args)
  533. /* If kernel has CONFIG_ARCH_HAS_SYSCALL_WRAPPER, read pt_regs directly */
  534. #define ___bpf_syscall_args0() ctx
  535. #define ___bpf_syscall_args1(x) ___bpf_syscall_args0(), (void *)PT_REGS_PARM1_SYSCALL(regs)
  536. #define ___bpf_syscall_args2(x, args...) ___bpf_syscall_args1(args), (void *)PT_REGS_PARM2_SYSCALL(regs)
  537. #define ___bpf_syscall_args3(x, args...) ___bpf_syscall_args2(args), (void *)PT_REGS_PARM3_SYSCALL(regs)
  538. #define ___bpf_syscall_args4(x, args...) ___bpf_syscall_args3(args), (void *)PT_REGS_PARM4_SYSCALL(regs)
  539. #define ___bpf_syscall_args5(x, args...) ___bpf_syscall_args4(args), (void *)PT_REGS_PARM5_SYSCALL(regs)
  540. #define ___bpf_syscall_args(args...) ___bpf_apply(___bpf_syscall_args, ___bpf_narg(args))(args)
  541. /* If kernel doesn't have CONFIG_ARCH_HAS_SYSCALL_WRAPPER, we have to BPF_CORE_READ from pt_regs */
  542. #define ___bpf_syswrap_args0() ctx
  543. #define ___bpf_syswrap_args1(x) ___bpf_syswrap_args0(), (void *)PT_REGS_PARM1_CORE_SYSCALL(regs)
  544. #define ___bpf_syswrap_args2(x, args...) ___bpf_syswrap_args1(args), (void *)PT_REGS_PARM2_CORE_SYSCALL(regs)
  545. #define ___bpf_syswrap_args3(x, args...) ___bpf_syswrap_args2(args), (void *)PT_REGS_PARM3_CORE_SYSCALL(regs)
  546. #define ___bpf_syswrap_args4(x, args...) ___bpf_syswrap_args3(args), (void *)PT_REGS_PARM4_CORE_SYSCALL(regs)
  547. #define ___bpf_syswrap_args5(x, args...) ___bpf_syswrap_args4(args), (void *)PT_REGS_PARM5_CORE_SYSCALL(regs)
  548. #define ___bpf_syswrap_args(args...) ___bpf_apply(___bpf_syswrap_args, ___bpf_narg(args))(args)
  549. /*
  550. * BPF_KSYSCALL is a variant of BPF_KPROBE, which is intended for
  551. * tracing syscall functions, like __x64_sys_close. It hides the underlying
  552. * platform-specific low-level way of getting syscall input arguments from
  553. * struct pt_regs, and provides a familiar typed and named function arguments
  554. * syntax and semantics of accessing syscall input parameters.
  555. *
  556. * Original struct pt_regs * context is preserved as 'ctx' argument. This might
  557. * be necessary when using BPF helpers like bpf_perf_event_output().
  558. *
  559. * At the moment BPF_KSYSCALL does not transparently handle all the calling
  560. * convention quirks for the following syscalls:
  561. *
  562. * - mmap(): __ARCH_WANT_SYS_OLD_MMAP.
  563. * - clone(): CONFIG_CLONE_BACKWARDS, CONFIG_CLONE_BACKWARDS2 and
  564. * CONFIG_CLONE_BACKWARDS3.
  565. * - socket-related syscalls: __ARCH_WANT_SYS_SOCKETCALL.
  566. * - compat syscalls.
  567. *
  568. * This may or may not change in the future. User needs to take extra measures
  569. * to handle such quirks explicitly, if necessary.
  570. *
  571. * This macro relies on BPF CO-RE support and virtual __kconfig externs.
  572. */
  573. #define BPF_KSYSCALL(name, args...) \
  574. name(struct pt_regs *ctx); \
  575. extern _Bool LINUX_HAS_SYSCALL_WRAPPER __kconfig; \
  576. static __always_inline typeof(name(0)) \
  577. ____##name(struct pt_regs *ctx, ##args); \
  578. typeof(name(0)) name(struct pt_regs *ctx) \
  579. { \
  580. struct pt_regs *regs = LINUX_HAS_SYSCALL_WRAPPER \
  581. ? (struct pt_regs *)PT_REGS_PARM1(ctx) \
  582. : ctx; \
  583. _Pragma("GCC diagnostic push") \
  584. _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
  585. if (LINUX_HAS_SYSCALL_WRAPPER) \
  586. return ____##name(___bpf_syswrap_args(args)); \
  587. else \
  588. return ____##name(___bpf_syscall_args(args)); \
  589. _Pragma("GCC diagnostic pop") \
  590. } \
  591. static __always_inline typeof(name(0)) \
  592. ____##name(struct pt_regs *ctx, ##args)
  593. #define BPF_KPROBE_SYSCALL BPF_KSYSCALL
  594. #endif