Back to home page

OSCL-LXR

 
 

    


0001 /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
0002 #ifndef __BPF_TRACING_H__
0003 #define __BPF_TRACING_H__
0004 
0005 #include <bpf/bpf_helpers.h>
0006 
0007 /* Scan the ARCH passed in from ARCH env variable (see Makefile) */
0008 #if defined(__TARGET_ARCH_x86)
0009     #define bpf_target_x86
0010     #define bpf_target_defined
0011 #elif defined(__TARGET_ARCH_s390)
0012     #define bpf_target_s390
0013     #define bpf_target_defined
0014 #elif defined(__TARGET_ARCH_arm)
0015     #define bpf_target_arm
0016     #define bpf_target_defined
0017 #elif defined(__TARGET_ARCH_arm64)
0018     #define bpf_target_arm64
0019     #define bpf_target_defined
0020 #elif defined(__TARGET_ARCH_mips)
0021     #define bpf_target_mips
0022     #define bpf_target_defined
0023 #elif defined(__TARGET_ARCH_powerpc)
0024     #define bpf_target_powerpc
0025     #define bpf_target_defined
0026 #elif defined(__TARGET_ARCH_sparc)
0027     #define bpf_target_sparc
0028     #define bpf_target_defined
0029 #elif defined(__TARGET_ARCH_riscv)
0030     #define bpf_target_riscv
0031     #define bpf_target_defined
0032 #elif defined(__TARGET_ARCH_arc)
0033     #define bpf_target_arc
0034     #define bpf_target_defined
0035 #else
0036 
0037 /* Fall back to what the compiler says */
0038 #if defined(__x86_64__)
0039     #define bpf_target_x86
0040     #define bpf_target_defined
0041 #elif defined(__s390__)
0042     #define bpf_target_s390
0043     #define bpf_target_defined
0044 #elif defined(__arm__)
0045     #define bpf_target_arm
0046     #define bpf_target_defined
0047 #elif defined(__aarch64__)
0048     #define bpf_target_arm64
0049     #define bpf_target_defined
0050 #elif defined(__mips__)
0051     #define bpf_target_mips
0052     #define bpf_target_defined
0053 #elif defined(__powerpc__)
0054     #define bpf_target_powerpc
0055     #define bpf_target_defined
0056 #elif defined(__sparc__)
0057     #define bpf_target_sparc
0058     #define bpf_target_defined
0059 #elif defined(__riscv) && __riscv_xlen == 64
0060     #define bpf_target_riscv
0061     #define bpf_target_defined
0062 #elif defined(__arc__)
0063     #define bpf_target_arc
0064     #define bpf_target_defined
0065 #endif /* no compiler target */
0066 
0067 #endif
0068 
0069 #ifndef __BPF_TARGET_MISSING
0070 #define __BPF_TARGET_MISSING "GCC error \"Must specify a BPF target arch via __TARGET_ARCH_xxx\""
0071 #endif
0072 
0073 #if defined(bpf_target_x86)
0074 
0075 #if defined(__KERNEL__) || defined(__VMLINUX_H__)
0076 
0077 #define __PT_PARM1_REG di
0078 #define __PT_PARM2_REG si
0079 #define __PT_PARM3_REG dx
0080 #define __PT_PARM4_REG cx
0081 #define __PT_PARM5_REG r8
0082 #define __PT_RET_REG sp
0083 #define __PT_FP_REG bp
0084 #define __PT_RC_REG ax
0085 #define __PT_SP_REG sp
0086 #define __PT_IP_REG ip
0087 /* syscall uses r10 for PARM4 */
0088 #define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)
0089 #define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)
0090 
0091 #else
0092 
0093 #ifdef __i386__
0094 
0095 #define __PT_PARM1_REG eax
0096 #define __PT_PARM2_REG edx
0097 #define __PT_PARM3_REG ecx
0098 /* i386 kernel is built with -mregparm=3 */
0099 #define __PT_PARM4_REG __unsupported__
0100 #define __PT_PARM5_REG __unsupported__
0101 #define __PT_RET_REG esp
0102 #define __PT_FP_REG ebp
0103 #define __PT_RC_REG eax
0104 #define __PT_SP_REG esp
0105 #define __PT_IP_REG eip
0106 
0107 #else /* __i386__ */
0108 
0109 #define __PT_PARM1_REG rdi
0110 #define __PT_PARM2_REG rsi
0111 #define __PT_PARM3_REG rdx
0112 #define __PT_PARM4_REG rcx
0113 #define __PT_PARM5_REG r8
0114 #define __PT_RET_REG rsp
0115 #define __PT_FP_REG rbp
0116 #define __PT_RC_REG rax
0117 #define __PT_SP_REG rsp
0118 #define __PT_IP_REG rip
0119 /* syscall uses r10 for PARM4 */
0120 #define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)
0121 #define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)
0122 
0123 #endif /* __i386__ */
0124 
0125 #endif /* __KERNEL__ || __VMLINUX_H__ */
0126 
0127 #elif defined(bpf_target_s390)
0128 
0129 struct pt_regs___s390 {
0130     unsigned long orig_gpr2;
0131 };
0132 
0133 /* s390 provides user_pt_regs instead of struct pt_regs to userspace */
0134 #define __PT_REGS_CAST(x) ((const user_pt_regs *)(x))
0135 #define __PT_PARM1_REG gprs[2]
0136 #define __PT_PARM2_REG gprs[3]
0137 #define __PT_PARM3_REG gprs[4]
0138 #define __PT_PARM4_REG gprs[5]
0139 #define __PT_PARM5_REG gprs[6]
0140 #define __PT_RET_REG grps[14]
0141 #define __PT_FP_REG gprs[11]    /* Works only with CONFIG_FRAME_POINTER */
0142 #define __PT_RC_REG gprs[2]
0143 #define __PT_SP_REG gprs[15]
0144 #define __PT_IP_REG psw.addr
0145 #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)
0146 #define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___s390 *)(x), orig_gpr2)
0147 
0148 #elif defined(bpf_target_arm)
0149 
0150 #define __PT_PARM1_REG uregs[0]
0151 #define __PT_PARM2_REG uregs[1]
0152 #define __PT_PARM3_REG uregs[2]
0153 #define __PT_PARM4_REG uregs[3]
0154 #define __PT_PARM5_REG uregs[4]
0155 #define __PT_RET_REG uregs[14]
0156 #define __PT_FP_REG uregs[11]   /* Works only with CONFIG_FRAME_POINTER */
0157 #define __PT_RC_REG uregs[0]
0158 #define __PT_SP_REG uregs[13]
0159 #define __PT_IP_REG uregs[12]
0160 
0161 #elif defined(bpf_target_arm64)
0162 
0163 struct pt_regs___arm64 {
0164     unsigned long orig_x0;
0165 };
0166 
0167 /* arm64 provides struct user_pt_regs instead of struct pt_regs to userspace */
0168 #define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x))
0169 #define __PT_PARM1_REG regs[0]
0170 #define __PT_PARM2_REG regs[1]
0171 #define __PT_PARM3_REG regs[2]
0172 #define __PT_PARM4_REG regs[3]
0173 #define __PT_PARM5_REG regs[4]
0174 #define __PT_RET_REG regs[30]
0175 #define __PT_FP_REG regs[29]    /* Works only with CONFIG_FRAME_POINTER */
0176 #define __PT_RC_REG regs[0]
0177 #define __PT_SP_REG sp
0178 #define __PT_IP_REG pc
0179 #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)
0180 #define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___arm64 *)(x), orig_x0)
0181 
0182 #elif defined(bpf_target_mips)
0183 
0184 #define __PT_PARM1_REG regs[4]
0185 #define __PT_PARM2_REG regs[5]
0186 #define __PT_PARM3_REG regs[6]
0187 #define __PT_PARM4_REG regs[7]
0188 #define __PT_PARM5_REG regs[8]
0189 #define __PT_RET_REG regs[31]
0190 #define __PT_FP_REG regs[30]    /* Works only with CONFIG_FRAME_POINTER */
0191 #define __PT_RC_REG regs[2]
0192 #define __PT_SP_REG regs[29]
0193 #define __PT_IP_REG cp0_epc
0194 
0195 #elif defined(bpf_target_powerpc)
0196 
0197 #define __PT_PARM1_REG gpr[3]
0198 #define __PT_PARM2_REG gpr[4]
0199 #define __PT_PARM3_REG gpr[5]
0200 #define __PT_PARM4_REG gpr[6]
0201 #define __PT_PARM5_REG gpr[7]
0202 #define __PT_RET_REG regs[31]
0203 #define __PT_FP_REG __unsupported__
0204 #define __PT_RC_REG gpr[3]
0205 #define __PT_SP_REG sp
0206 #define __PT_IP_REG nip
0207 /* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER. */
0208 #define PT_REGS_SYSCALL_REGS(ctx) ctx
0209 
0210 #elif defined(bpf_target_sparc)
0211 
0212 #define __PT_PARM1_REG u_regs[UREG_I0]
0213 #define __PT_PARM2_REG u_regs[UREG_I1]
0214 #define __PT_PARM3_REG u_regs[UREG_I2]
0215 #define __PT_PARM4_REG u_regs[UREG_I3]
0216 #define __PT_PARM5_REG u_regs[UREG_I4]
0217 #define __PT_RET_REG u_regs[UREG_I7]
0218 #define __PT_FP_REG __unsupported__
0219 #define __PT_RC_REG u_regs[UREG_I0]
0220 #define __PT_SP_REG u_regs[UREG_FP]
0221 /* Should this also be a bpf_target check for the sparc case? */
0222 #if defined(__arch64__)
0223 #define __PT_IP_REG tpc
0224 #else
0225 #define __PT_IP_REG pc
0226 #endif
0227 
0228 #elif defined(bpf_target_riscv)
0229 
0230 #define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))
0231 #define __PT_PARM1_REG a0
0232 #define __PT_PARM2_REG a1
0233 #define __PT_PARM3_REG a2
0234 #define __PT_PARM4_REG a3
0235 #define __PT_PARM5_REG a4
0236 #define __PT_RET_REG ra
0237 #define __PT_FP_REG s0
0238 #define __PT_RC_REG a0
0239 #define __PT_SP_REG sp
0240 #define __PT_IP_REG pc
0241 /* riscv does not select ARCH_HAS_SYSCALL_WRAPPER. */
0242 #define PT_REGS_SYSCALL_REGS(ctx) ctx
0243 
0244 #elif defined(bpf_target_arc)
0245 
0246 /* arc provides struct user_pt_regs instead of struct pt_regs to userspace */
0247 #define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))
0248 #define __PT_PARM1_REG scratch.r0
0249 #define __PT_PARM2_REG scratch.r1
0250 #define __PT_PARM3_REG scratch.r2
0251 #define __PT_PARM4_REG scratch.r3
0252 #define __PT_PARM5_REG scratch.r4
0253 #define __PT_RET_REG scratch.blink
0254 #define __PT_FP_REG __unsupported__
0255 #define __PT_RC_REG scratch.r0
0256 #define __PT_SP_REG scratch.sp
0257 #define __PT_IP_REG scratch.ret
0258 /* arc does not select ARCH_HAS_SYSCALL_WRAPPER. */
0259 #define PT_REGS_SYSCALL_REGS(ctx) ctx
0260 
0261 #endif
0262 
0263 #if defined(bpf_target_defined)
0264 
0265 struct pt_regs;
0266 
0267 /* allow some architecutres to override `struct pt_regs` */
0268 #ifndef __PT_REGS_CAST
0269 #define __PT_REGS_CAST(x) (x)
0270 #endif
0271 
0272 #define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)
0273 #define PT_REGS_PARM2(x) (__PT_REGS_CAST(x)->__PT_PARM2_REG)
0274 #define PT_REGS_PARM3(x) (__PT_REGS_CAST(x)->__PT_PARM3_REG)
0275 #define PT_REGS_PARM4(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG)
0276 #define PT_REGS_PARM5(x) (__PT_REGS_CAST(x)->__PT_PARM5_REG)
0277 #define PT_REGS_RET(x) (__PT_REGS_CAST(x)->__PT_RET_REG)
0278 #define PT_REGS_FP(x) (__PT_REGS_CAST(x)->__PT_FP_REG)
0279 #define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG)
0280 #define PT_REGS_SP(x) (__PT_REGS_CAST(x)->__PT_SP_REG)
0281 #define PT_REGS_IP(x) (__PT_REGS_CAST(x)->__PT_IP_REG)
0282 
0283 #define PT_REGS_PARM1_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_REG)
0284 #define PT_REGS_PARM2_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_REG)
0285 #define PT_REGS_PARM3_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_REG)
0286 #define PT_REGS_PARM4_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_REG)
0287 #define PT_REGS_PARM5_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_REG)
0288 #define PT_REGS_RET_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RET_REG)
0289 #define PT_REGS_FP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_FP_REG)
0290 #define PT_REGS_RC_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RC_REG)
0291 #define PT_REGS_SP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_SP_REG)
0292 #define PT_REGS_IP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_IP_REG)
0293 
0294 #if defined(bpf_target_powerpc)
0295 
0296 #define BPF_KPROBE_READ_RET_IP(ip, ctx)     ({ (ip) = (ctx)->link; })
0297 #define BPF_KRETPROBE_READ_RET_IP       BPF_KPROBE_READ_RET_IP
0298 
0299 #elif defined(bpf_target_sparc)
0300 
0301 #define BPF_KPROBE_READ_RET_IP(ip, ctx)     ({ (ip) = PT_REGS_RET(ctx); })
0302 #define BPF_KRETPROBE_READ_RET_IP       BPF_KPROBE_READ_RET_IP
0303 
0304 #else
0305 
0306 #define BPF_KPROBE_READ_RET_IP(ip, ctx)                     \
0307     ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)PT_REGS_RET(ctx)); })
0308 #define BPF_KRETPROBE_READ_RET_IP(ip, ctx)                  \
0309     ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)(PT_REGS_FP(ctx) + sizeof(ip))); })
0310 
0311 #endif
0312 
0313 #ifndef PT_REGS_PARM1_SYSCALL
0314 #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1(x)
0315 #endif
0316 #define PT_REGS_PARM2_SYSCALL(x) PT_REGS_PARM2(x)
0317 #define PT_REGS_PARM3_SYSCALL(x) PT_REGS_PARM3(x)
0318 #ifndef PT_REGS_PARM4_SYSCALL
0319 #define PT_REGS_PARM4_SYSCALL(x) PT_REGS_PARM4(x)
0320 #endif
0321 #define PT_REGS_PARM5_SYSCALL(x) PT_REGS_PARM5(x)
0322 
0323 #ifndef PT_REGS_PARM1_CORE_SYSCALL
0324 #define PT_REGS_PARM1_CORE_SYSCALL(x) PT_REGS_PARM1_CORE(x)
0325 #endif
0326 #define PT_REGS_PARM2_CORE_SYSCALL(x) PT_REGS_PARM2_CORE(x)
0327 #define PT_REGS_PARM3_CORE_SYSCALL(x) PT_REGS_PARM3_CORE(x)
0328 #ifndef PT_REGS_PARM4_CORE_SYSCALL
0329 #define PT_REGS_PARM4_CORE_SYSCALL(x) PT_REGS_PARM4_CORE(x)
0330 #endif
0331 #define PT_REGS_PARM5_CORE_SYSCALL(x) PT_REGS_PARM5_CORE(x)
0332 
0333 #else /* defined(bpf_target_defined) */
0334 
0335 #define PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0336 #define PT_REGS_PARM2(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0337 #define PT_REGS_PARM3(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0338 #define PT_REGS_PARM4(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0339 #define PT_REGS_PARM5(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0340 #define PT_REGS_RET(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0341 #define PT_REGS_FP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0342 #define PT_REGS_RC(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0343 #define PT_REGS_SP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0344 #define PT_REGS_IP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0345 
0346 #define PT_REGS_PARM1_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0347 #define PT_REGS_PARM2_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0348 #define PT_REGS_PARM3_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0349 #define PT_REGS_PARM4_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0350 #define PT_REGS_PARM5_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0351 #define PT_REGS_RET_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0352 #define PT_REGS_FP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0353 #define PT_REGS_RC_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0354 #define PT_REGS_SP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0355 #define PT_REGS_IP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0356 
0357 #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0358 #define BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0359 
0360 #define PT_REGS_PARM1_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0361 #define PT_REGS_PARM2_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0362 #define PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0363 #define PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0364 #define PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0365 
0366 #define PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0367 #define PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0368 #define PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0369 #define PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0370 #define PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
0371 
0372 #endif /* defined(bpf_target_defined) */
0373 
0374 /*
0375  * When invoked from a syscall handler kprobe, returns a pointer to a
0376  * struct pt_regs containing syscall arguments and suitable for passing to
0377  * PT_REGS_PARMn_SYSCALL() and PT_REGS_PARMn_CORE_SYSCALL().
0378  */
0379 #ifndef PT_REGS_SYSCALL_REGS
0380 /* By default, assume that the arch selects ARCH_HAS_SYSCALL_WRAPPER. */
0381 #define PT_REGS_SYSCALL_REGS(ctx) ((struct pt_regs *)PT_REGS_PARM1(ctx))
0382 #endif
0383 
0384 #ifndef ___bpf_concat
0385 #define ___bpf_concat(a, b) a ## b
0386 #endif
0387 #ifndef ___bpf_apply
0388 #define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
0389 #endif
0390 #ifndef ___bpf_nth
0391 #define ___bpf_nth(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _a, _b, _c, N, ...) N
0392 #endif
0393 #ifndef ___bpf_narg
0394 #define ___bpf_narg(...) ___bpf_nth(_, ##__VA_ARGS__, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0)
0395 #endif
0396 
0397 #define ___bpf_ctx_cast0()            ctx
0398 #define ___bpf_ctx_cast1(x)           ___bpf_ctx_cast0(), (void *)ctx[0]
0399 #define ___bpf_ctx_cast2(x, args...)  ___bpf_ctx_cast1(args), (void *)ctx[1]
0400 #define ___bpf_ctx_cast3(x, args...)  ___bpf_ctx_cast2(args), (void *)ctx[2]
0401 #define ___bpf_ctx_cast4(x, args...)  ___bpf_ctx_cast3(args), (void *)ctx[3]
0402 #define ___bpf_ctx_cast5(x, args...)  ___bpf_ctx_cast4(args), (void *)ctx[4]
0403 #define ___bpf_ctx_cast6(x, args...)  ___bpf_ctx_cast5(args), (void *)ctx[5]
0404 #define ___bpf_ctx_cast7(x, args...)  ___bpf_ctx_cast6(args), (void *)ctx[6]
0405 #define ___bpf_ctx_cast8(x, args...)  ___bpf_ctx_cast7(args), (void *)ctx[7]
0406 #define ___bpf_ctx_cast9(x, args...)  ___bpf_ctx_cast8(args), (void *)ctx[8]
0407 #define ___bpf_ctx_cast10(x, args...) ___bpf_ctx_cast9(args), (void *)ctx[9]
0408 #define ___bpf_ctx_cast11(x, args...) ___bpf_ctx_cast10(args), (void *)ctx[10]
0409 #define ___bpf_ctx_cast12(x, args...) ___bpf_ctx_cast11(args), (void *)ctx[11]
0410 #define ___bpf_ctx_cast(args...)      ___bpf_apply(___bpf_ctx_cast, ___bpf_narg(args))(args)
0411 
0412 /*
0413  * BPF_PROG is a convenience wrapper for generic tp_btf/fentry/fexit and
0414  * similar kinds of BPF programs, that accept input arguments as a single
0415  * pointer to untyped u64 array, where each u64 can actually be a typed
0416  * pointer or integer of different size. Instead of requring user to write
0417  * manual casts and work with array elements by index, BPF_PROG macro
0418  * allows user to declare a list of named and typed input arguments in the
0419  * same syntax as for normal C function. All the casting is hidden and
0420  * performed transparently, while user code can just assume working with
0421  * function arguments of specified type and name.
0422  *
0423  * Original raw context argument is preserved as well as 'ctx' argument.
0424  * This is useful when using BPF helpers that expect original context
0425  * as one of the parameters (e.g., for bpf_perf_event_output()).
0426  */
0427 #define BPF_PROG(name, args...)                         \
0428 name(unsigned long long *ctx);                          \
0429 static __attribute__((always_inline)) typeof(name(0))               \
0430 ____##name(unsigned long long *ctx, ##args);                    \
0431 typeof(name(0)) name(unsigned long long *ctx)                   \
0432 {                                       \
0433     _Pragma("GCC diagnostic push")                      \
0434     _Pragma("GCC diagnostic ignored \"-Wint-conversion\"")          \
0435     return ____##name(___bpf_ctx_cast(args));               \
0436     _Pragma("GCC diagnostic pop")                       \
0437 }                                       \
0438 static __attribute__((always_inline)) typeof(name(0))               \
0439 ____##name(unsigned long long *ctx, ##args)
0440 
0441 struct pt_regs;
0442 
0443 #define ___bpf_kprobe_args0()           ctx
0444 #define ___bpf_kprobe_args1(x)          ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx)
0445 #define ___bpf_kprobe_args2(x, args...) ___bpf_kprobe_args1(args), (void *)PT_REGS_PARM2(ctx)
0446 #define ___bpf_kprobe_args3(x, args...) ___bpf_kprobe_args2(args), (void *)PT_REGS_PARM3(ctx)
0447 #define ___bpf_kprobe_args4(x, args...) ___bpf_kprobe_args3(args), (void *)PT_REGS_PARM4(ctx)
0448 #define ___bpf_kprobe_args5(x, args...) ___bpf_kprobe_args4(args), (void *)PT_REGS_PARM5(ctx)
0449 #define ___bpf_kprobe_args(args...)     ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)
0450 
0451 /*
0452  * BPF_KPROBE serves the same purpose for kprobes as BPF_PROG for
0453  * tp_btf/fentry/fexit BPF programs. It hides the underlying platform-specific
0454  * low-level way of getting kprobe input arguments from struct pt_regs, and
0455  * provides a familiar typed and named function arguments syntax and
0456  * semantics of accessing kprobe input paremeters.
0457  *
0458  * Original struct pt_regs* context is preserved as 'ctx' argument. This might
0459  * be necessary when using BPF helpers like bpf_perf_event_output().
0460  */
0461 #define BPF_KPROBE(name, args...)                       \
0462 name(struct pt_regs *ctx);                          \
0463 static __attribute__((always_inline)) typeof(name(0))               \
0464 ____##name(struct pt_regs *ctx, ##args);                    \
0465 typeof(name(0)) name(struct pt_regs *ctx)                   \
0466 {                                       \
0467     _Pragma("GCC diagnostic push")                      \
0468     _Pragma("GCC diagnostic ignored \"-Wint-conversion\"")          \
0469     return ____##name(___bpf_kprobe_args(args));                \
0470     _Pragma("GCC diagnostic pop")                       \
0471 }                                       \
0472 static __attribute__((always_inline)) typeof(name(0))               \
0473 ____##name(struct pt_regs *ctx, ##args)
0474 
0475 #define ___bpf_kretprobe_args0()       ctx
0476 #define ___bpf_kretprobe_args1(x)      ___bpf_kretprobe_args0(), (void *)PT_REGS_RC(ctx)
0477 #define ___bpf_kretprobe_args(args...) ___bpf_apply(___bpf_kretprobe_args, ___bpf_narg(args))(args)
0478 
0479 /*
0480  * BPF_KRETPROBE is similar to BPF_KPROBE, except, it only provides optional
0481  * return value (in addition to `struct pt_regs *ctx`), but no input
0482  * arguments, because they will be clobbered by the time probed function
0483  * returns.
0484  */
0485 #define BPF_KRETPROBE(name, args...)                        \
0486 name(struct pt_regs *ctx);                          \
0487 static __attribute__((always_inline)) typeof(name(0))               \
0488 ____##name(struct pt_regs *ctx, ##args);                    \
0489 typeof(name(0)) name(struct pt_regs *ctx)                   \
0490 {                                       \
0491     _Pragma("GCC diagnostic push")                      \
0492     _Pragma("GCC diagnostic ignored \"-Wint-conversion\"")          \
0493     return ____##name(___bpf_kretprobe_args(args));             \
0494     _Pragma("GCC diagnostic pop")                       \
0495 }                                       \
0496 static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args)
0497 
0498 /* If kernel has CONFIG_ARCH_HAS_SYSCALL_WRAPPER, read pt_regs directly */
0499 #define ___bpf_syscall_args0()           ctx
0500 #define ___bpf_syscall_args1(x)          ___bpf_syscall_args0(), (void *)PT_REGS_PARM1_SYSCALL(regs)
0501 #define ___bpf_syscall_args2(x, args...) ___bpf_syscall_args1(args), (void *)PT_REGS_PARM2_SYSCALL(regs)
0502 #define ___bpf_syscall_args3(x, args...) ___bpf_syscall_args2(args), (void *)PT_REGS_PARM3_SYSCALL(regs)
0503 #define ___bpf_syscall_args4(x, args...) ___bpf_syscall_args3(args), (void *)PT_REGS_PARM4_SYSCALL(regs)
0504 #define ___bpf_syscall_args5(x, args...) ___bpf_syscall_args4(args), (void *)PT_REGS_PARM5_SYSCALL(regs)
0505 #define ___bpf_syscall_args(args...)     ___bpf_apply(___bpf_syscall_args, ___bpf_narg(args))(args)
0506 
0507 /* If kernel doesn't have CONFIG_ARCH_HAS_SYSCALL_WRAPPER, we have to BPF_CORE_READ from pt_regs */
0508 #define ___bpf_syswrap_args0()           ctx
0509 #define ___bpf_syswrap_args1(x)          ___bpf_syswrap_args0(), (void *)PT_REGS_PARM1_CORE_SYSCALL(regs)
0510 #define ___bpf_syswrap_args2(x, args...) ___bpf_syswrap_args1(args), (void *)PT_REGS_PARM2_CORE_SYSCALL(regs)
0511 #define ___bpf_syswrap_args3(x, args...) ___bpf_syswrap_args2(args), (void *)PT_REGS_PARM3_CORE_SYSCALL(regs)
0512 #define ___bpf_syswrap_args4(x, args...) ___bpf_syswrap_args3(args), (void *)PT_REGS_PARM4_CORE_SYSCALL(regs)
0513 #define ___bpf_syswrap_args5(x, args...) ___bpf_syswrap_args4(args), (void *)PT_REGS_PARM5_CORE_SYSCALL(regs)
0514 #define ___bpf_syswrap_args(args...)     ___bpf_apply(___bpf_syswrap_args, ___bpf_narg(args))(args)
0515 
0516 /*
0517  * BPF_KSYSCALL is a variant of BPF_KPROBE, which is intended for
0518  * tracing syscall functions, like __x64_sys_close. It hides the underlying
0519  * platform-specific low-level way of getting syscall input arguments from
0520  * struct pt_regs, and provides a familiar typed and named function arguments
0521  * syntax and semantics of accessing syscall input parameters.
0522  *
0523  * Original struct pt_regs * context is preserved as 'ctx' argument. This might
0524  * be necessary when using BPF helpers like bpf_perf_event_output().
0525  *
0526  * At the moment BPF_KSYSCALL does not transparently handle all the calling
0527  * convention quirks for the following syscalls:
0528  *
0529  * - mmap(): __ARCH_WANT_SYS_OLD_MMAP.
0530  * - clone(): CONFIG_CLONE_BACKWARDS, CONFIG_CLONE_BACKWARDS2 and
0531  *            CONFIG_CLONE_BACKWARDS3.
0532  * - socket-related syscalls: __ARCH_WANT_SYS_SOCKETCALL.
0533  * - compat syscalls.
0534  *
0535  * This may or may not change in the future. User needs to take extra measures
0536  * to handle such quirks explicitly, if necessary.
0537  *
0538  * This macro relies on BPF CO-RE support and virtual __kconfig externs.
0539  */
0540 #define BPF_KSYSCALL(name, args...)                     \
0541 name(struct pt_regs *ctx);                          \
0542 extern _Bool LINUX_HAS_SYSCALL_WRAPPER __kconfig;               \
0543 static __attribute__((always_inline)) typeof(name(0))               \
0544 ____##name(struct pt_regs *ctx, ##args);                    \
0545 typeof(name(0)) name(struct pt_regs *ctx)                   \
0546 {                                       \
0547     struct pt_regs *regs = LINUX_HAS_SYSCALL_WRAPPER            \
0548                    ? (struct pt_regs *)PT_REGS_PARM1(ctx)       \
0549                    : ctx;                       \
0550     _Pragma("GCC diagnostic push")                      \
0551     _Pragma("GCC diagnostic ignored \"-Wint-conversion\"")          \
0552     if (LINUX_HAS_SYSCALL_WRAPPER)                      \
0553         return ____##name(___bpf_syswrap_args(args));           \
0554     else                                    \
0555         return ____##name(___bpf_syscall_args(args));           \
0556     _Pragma("GCC diagnostic pop")                       \
0557 }                                       \
0558 static __attribute__((always_inline)) typeof(name(0))               \
0559 ____##name(struct pt_regs *ctx, ##args)
0560 
0561 #define BPF_KPROBE_SYSCALL BPF_KSYSCALL
0562 
0563 #endif