1 /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ 2 #ifndef __BPF_TRACING_H__ 3 #define __BPF_TRACING_H__ 4 5 /* Scan the ARCH passed in from ARCH env variable (see Makefile) */ 6 #if defined(__TARGET_ARCH_x86) 7 #define bpf_target_x86 8 #define bpf_target_defined 9 #elif defined(__TARGET_ARCH_s390) 10 #define bpf_target_s390 11 #define bpf_target_defined 12 #elif defined(__TARGET_ARCH_arm) 13 #define bpf_target_arm 14 #define bpf_target_defined 15 #elif defined(__TARGET_ARCH_arm64) 16 #define bpf_target_arm64 17 #define bpf_target_defined 18 #elif defined(__TARGET_ARCH_mips) 19 #define bpf_target_mips 20 #define bpf_target_defined 21 #elif defined(__TARGET_ARCH_powerpc) 22 #define bpf_target_powerpc 23 #define bpf_target_defined 24 #elif defined(__TARGET_ARCH_sparc) 25 #define bpf_target_sparc 26 #define bpf_target_defined 27 #elif defined(__TARGET_ARCH_riscv) 28 #define bpf_target_riscv 29 #define bpf_target_defined 30 #else 31 32 /* Fall back to what the compiler says */ 33 #if defined(__x86_64__) 34 #define bpf_target_x86 35 #define bpf_target_defined 36 #elif defined(__s390__) 37 #define bpf_target_s390 38 #define bpf_target_defined 39 #elif defined(__arm__) 40 #define bpf_target_arm 41 #define bpf_target_defined 42 #elif defined(__aarch64__) 43 #define bpf_target_arm64 44 #define bpf_target_defined 45 #elif defined(__mips__) 46 #define bpf_target_mips 47 #define bpf_target_defined 48 #elif defined(__powerpc__) 49 #define bpf_target_powerpc 50 #define bpf_target_defined 51 #elif defined(__sparc__) 52 #define bpf_target_sparc 53 #define bpf_target_defined 54 #elif defined(__riscv) && __riscv_xlen == 64 55 #define bpf_target_riscv 56 #define bpf_target_defined 57 #endif /* no compiler target */ 58 59 #endif 60 61 #ifndef __BPF_TARGET_MISSING 62 #define __BPF_TARGET_MISSING "GCC error \"Must specify a BPF target arch via __TARGET_ARCH_xxx\"" 63 #endif 64 65 #if defined(bpf_target_x86) 66 67 #if defined(__KERNEL__) || defined(__VMLINUX_H__) 68 69 #define __PT_PARM1_REG di 70 #define __PT_PARM2_REG si 71 #define __PT_PARM3_REG dx 72 #define __PT_PARM4_REG cx 73 #define __PT_PARM5_REG r8 74 #define __PT_RET_REG sp 75 #define __PT_FP_REG bp 76 #define __PT_RC_REG ax 77 #define __PT_SP_REG sp 78 #define __PT_IP_REG ip 79 /* syscall uses r10 for PARM4 */ 80 #define PT_REGS_PARM4_SYSCALL(x) ((x)->r10) 81 #define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10) 82 83 #else 84 85 #ifdef __i386__ 86 87 #define __PT_PARM1_REG eax 88 #define __PT_PARM2_REG edx 89 #define __PT_PARM3_REG ecx 90 /* i386 kernel is built with -mregparm=3 */ 91 #define __PT_PARM4_REG __unsupported__ 92 #define __PT_PARM5_REG __unsupported__ 93 #define __PT_RET_REG esp 94 #define __PT_FP_REG ebp 95 #define __PT_RC_REG eax 96 #define __PT_SP_REG esp 97 #define __PT_IP_REG eip 98 99 #else /* __i386__ */ 100 101 #define __PT_PARM1_REG rdi 102 #define __PT_PARM2_REG rsi 103 #define __PT_PARM3_REG rdx 104 #define __PT_PARM4_REG rcx 105 #define __PT_PARM5_REG r8 106 #define __PT_RET_REG rsp 107 #define __PT_FP_REG rbp 108 #define __PT_RC_REG rax 109 #define __PT_SP_REG rsp 110 #define __PT_IP_REG rip 111 /* syscall uses r10 for PARM4 */ 112 #define PT_REGS_PARM4_SYSCALL(x) ((x)->r10) 113 #define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10) 114 115 #endif /* __i386__ */ 116 117 #endif /* __KERNEL__ || __VMLINUX_H__ */ 118 119 #elif defined(bpf_target_s390) 120 121 struct pt_regs___s390 { 122 unsigned long orig_gpr2; 123 }; 124 125 /* s390 provides user_pt_regs instead of struct pt_regs to userspace */ 126 #define __PT_REGS_CAST(x) ((const user_pt_regs *)(x)) 127 #define __PT_PARM1_REG gprs[2] 128 #define __PT_PARM2_REG gprs[3] 129 #define __PT_PARM3_REG gprs[4] 130 #define __PT_PARM4_REG gprs[5] 131 #define __PT_PARM5_REG gprs[6] 132 #define __PT_RET_REG grps[14] 133 #define __PT_FP_REG gprs[11] /* Works only with CONFIG_FRAME_POINTER */ 134 #define __PT_RC_REG gprs[2] 135 #define __PT_SP_REG gprs[15] 136 #define __PT_IP_REG psw.addr 137 #define PT_REGS_PARM1_SYSCALL(x) ({ _Pragma("GCC error \"use PT_REGS_PARM1_CORE_SYSCALL() instead\""); 0l; }) 138 #define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___s390 *)(x), orig_gpr2) 139 140 #elif defined(bpf_target_arm) 141 142 #define __PT_PARM1_REG uregs[0] 143 #define __PT_PARM2_REG uregs[1] 144 #define __PT_PARM3_REG uregs[2] 145 #define __PT_PARM4_REG uregs[3] 146 #define __PT_PARM5_REG uregs[4] 147 #define __PT_RET_REG uregs[14] 148 #define __PT_FP_REG uregs[11] /* Works only with CONFIG_FRAME_POINTER */ 149 #define __PT_RC_REG uregs[0] 150 #define __PT_SP_REG uregs[13] 151 #define __PT_IP_REG uregs[12] 152 153 #elif defined(bpf_target_arm64) 154 155 struct pt_regs___arm64 { 156 unsigned long orig_x0; 157 }; 158 159 /* arm64 provides struct user_pt_regs instead of struct pt_regs to userspace */ 160 #define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x)) 161 #define __PT_PARM1_REG regs[0] 162 #define __PT_PARM2_REG regs[1] 163 #define __PT_PARM3_REG regs[2] 164 #define __PT_PARM4_REG regs[3] 165 #define __PT_PARM5_REG regs[4] 166 #define __PT_RET_REG regs[30] 167 #define __PT_FP_REG regs[29] /* Works only with CONFIG_FRAME_POINTER */ 168 #define __PT_RC_REG regs[0] 169 #define __PT_SP_REG sp 170 #define __PT_IP_REG pc 171 #define PT_REGS_PARM1_SYSCALL(x) ({ _Pragma("GCC error \"use PT_REGS_PARM1_CORE_SYSCALL() instead\""); 0l; }) 172 #define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___arm64 *)(x), orig_x0) 173 174 #elif defined(bpf_target_mips) 175 176 #define __PT_PARM1_REG regs[4] 177 #define __PT_PARM2_REG regs[5] 178 #define __PT_PARM3_REG regs[6] 179 #define __PT_PARM4_REG regs[7] 180 #define __PT_PARM5_REG regs[8] 181 #define __PT_RET_REG regs[31] 182 #define __PT_FP_REG regs[30] /* Works only with CONFIG_FRAME_POINTER */ 183 #define __PT_RC_REG regs[2] 184 #define __PT_SP_REG regs[29] 185 #define __PT_IP_REG cp0_epc 186 187 #elif defined(bpf_target_powerpc) 188 189 #define __PT_PARM1_REG gpr[3] 190 #define __PT_PARM2_REG gpr[4] 191 #define __PT_PARM3_REG gpr[5] 192 #define __PT_PARM4_REG gpr[6] 193 #define __PT_PARM5_REG gpr[7] 194 #define __PT_RET_REG regs[31] 195 #define __PT_FP_REG __unsupported__ 196 #define __PT_RC_REG gpr[3] 197 #define __PT_SP_REG sp 198 #define __PT_IP_REG nip 199 /* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER. */ 200 #define PT_REGS_SYSCALL_REGS(ctx) ctx 201 202 #elif defined(bpf_target_sparc) 203 204 #define __PT_PARM1_REG u_regs[UREG_I0] 205 #define __PT_PARM2_REG u_regs[UREG_I1] 206 #define __PT_PARM3_REG u_regs[UREG_I2] 207 #define __PT_PARM4_REG u_regs[UREG_I3] 208 #define __PT_PARM5_REG u_regs[UREG_I4] 209 #define __PT_RET_REG u_regs[UREG_I7] 210 #define __PT_FP_REG __unsupported__ 211 #define __PT_RC_REG u_regs[UREG_I0] 212 #define __PT_SP_REG u_regs[UREG_FP] 213 /* Should this also be a bpf_target check for the sparc case? */ 214 #if defined(__arch64__) 215 #define __PT_IP_REG tpc 216 #else 217 #define __PT_IP_REG pc 218 #endif 219 220 #elif defined(bpf_target_riscv) 221 222 #define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x)) 223 #define __PT_PARM1_REG a0 224 #define __PT_PARM2_REG a1 225 #define __PT_PARM3_REG a2 226 #define __PT_PARM4_REG a3 227 #define __PT_PARM5_REG a4 228 #define __PT_RET_REG ra 229 #define __PT_FP_REG s0 230 #define __PT_RC_REG a5 231 #define __PT_SP_REG sp 232 #define __PT_IP_REG pc 233 /* riscv does not select ARCH_HAS_SYSCALL_WRAPPER. */ 234 #define PT_REGS_SYSCALL_REGS(ctx) ctx 235 236 #endif 237 238 #if defined(bpf_target_defined) 239 240 struct pt_regs; 241 242 /* allow some architecutres to override `struct pt_regs` */ 243 #ifndef __PT_REGS_CAST 244 #define __PT_REGS_CAST(x) (x) 245 #endif 246 247 #define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG) 248 #define PT_REGS_PARM2(x) (__PT_REGS_CAST(x)->__PT_PARM2_REG) 249 #define PT_REGS_PARM3(x) (__PT_REGS_CAST(x)->__PT_PARM3_REG) 250 #define PT_REGS_PARM4(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG) 251 #define PT_REGS_PARM5(x) (__PT_REGS_CAST(x)->__PT_PARM5_REG) 252 #define PT_REGS_RET(x) (__PT_REGS_CAST(x)->__PT_RET_REG) 253 #define PT_REGS_FP(x) (__PT_REGS_CAST(x)->__PT_FP_REG) 254 #define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG) 255 #define PT_REGS_SP(x) (__PT_REGS_CAST(x)->__PT_SP_REG) 256 #define PT_REGS_IP(x) (__PT_REGS_CAST(x)->__PT_IP_REG) 257 258 #define PT_REGS_PARM1_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_REG) 259 #define PT_REGS_PARM2_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_REG) 260 #define PT_REGS_PARM3_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_REG) 261 #define PT_REGS_PARM4_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_REG) 262 #define PT_REGS_PARM5_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_REG) 263 #define PT_REGS_RET_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RET_REG) 264 #define PT_REGS_FP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_FP_REG) 265 #define PT_REGS_RC_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RC_REG) 266 #define PT_REGS_SP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_SP_REG) 267 #define PT_REGS_IP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_IP_REG) 268 269 #if defined(bpf_target_powerpc) 270 271 #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = (ctx)->link; }) 272 #define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP 273 274 #elif defined(bpf_target_sparc) 275 276 #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = PT_REGS_RET(ctx); }) 277 #define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP 278 279 #else 280 281 #define BPF_KPROBE_READ_RET_IP(ip, ctx) \ 282 ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)PT_REGS_RET(ctx)); }) 283 #define BPF_KRETPROBE_READ_RET_IP(ip, ctx) \ 284 ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)(PT_REGS_FP(ctx) + sizeof(ip))); }) 285 286 #endif 287 288 #ifndef PT_REGS_PARM1_SYSCALL 289 #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1(x) 290 #endif 291 #define PT_REGS_PARM2_SYSCALL(x) PT_REGS_PARM2(x) 292 #define PT_REGS_PARM3_SYSCALL(x) PT_REGS_PARM3(x) 293 #ifndef PT_REGS_PARM4_SYSCALL 294 #define PT_REGS_PARM4_SYSCALL(x) PT_REGS_PARM4(x) 295 #endif 296 #define PT_REGS_PARM5_SYSCALL(x) PT_REGS_PARM5(x) 297 298 #ifndef PT_REGS_PARM1_CORE_SYSCALL 299 #define PT_REGS_PARM1_CORE_SYSCALL(x) PT_REGS_PARM1_CORE(x) 300 #endif 301 #define PT_REGS_PARM2_CORE_SYSCALL(x) PT_REGS_PARM2_CORE(x) 302 #define PT_REGS_PARM3_CORE_SYSCALL(x) PT_REGS_PARM3_CORE(x) 303 #ifndef PT_REGS_PARM4_CORE_SYSCALL 304 #define PT_REGS_PARM4_CORE_SYSCALL(x) PT_REGS_PARM4_CORE(x) 305 #endif 306 #define PT_REGS_PARM5_CORE_SYSCALL(x) PT_REGS_PARM5_CORE(x) 307 308 #else /* defined(bpf_target_defined) */ 309 310 #define PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 311 #define PT_REGS_PARM2(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 312 #define PT_REGS_PARM3(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 313 #define PT_REGS_PARM4(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 314 #define PT_REGS_PARM5(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 315 #define PT_REGS_RET(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 316 #define PT_REGS_FP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 317 #define PT_REGS_RC(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 318 #define PT_REGS_SP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 319 #define PT_REGS_IP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 320 321 #define PT_REGS_PARM1_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 322 #define PT_REGS_PARM2_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 323 #define PT_REGS_PARM3_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 324 #define PT_REGS_PARM4_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 325 #define PT_REGS_PARM5_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 326 #define PT_REGS_RET_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 327 #define PT_REGS_FP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 328 #define PT_REGS_RC_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 329 #define PT_REGS_SP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 330 #define PT_REGS_IP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 331 332 #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 333 #define BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 334 335 #define PT_REGS_PARM1_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 336 #define PT_REGS_PARM2_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 337 #define PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 338 #define PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 339 #define PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 340 341 #define PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 342 #define PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 343 #define PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 344 #define PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 345 #define PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; }) 346 347 #endif /* defined(bpf_target_defined) */ 348 349 /* 350 * When invoked from a syscall handler kprobe, returns a pointer to a 351 * struct pt_regs containing syscall arguments and suitable for passing to 352 * PT_REGS_PARMn_SYSCALL() and PT_REGS_PARMn_CORE_SYSCALL(). 353 */ 354 #ifndef PT_REGS_SYSCALL_REGS 355 /* By default, assume that the arch selects ARCH_HAS_SYSCALL_WRAPPER. */ 356 #define PT_REGS_SYSCALL_REGS(ctx) ((struct pt_regs *)PT_REGS_PARM1(ctx)) 357 #endif 358 359 #ifndef ___bpf_concat 360 #define ___bpf_concat(a, b) a ## b 361 #endif 362 #ifndef ___bpf_apply 363 #define ___bpf_apply(fn, n) ___bpf_concat(fn, n) 364 #endif 365 #ifndef ___bpf_nth 366 #define ___bpf_nth(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _a, _b, _c, N, ...) N 367 #endif 368 #ifndef ___bpf_narg 369 #define ___bpf_narg(...) ___bpf_nth(_, ##__VA_ARGS__, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0) 370 #endif 371 372 #define ___bpf_ctx_cast0() ctx 373 #define ___bpf_ctx_cast1(x) ___bpf_ctx_cast0(), (void *)ctx[0] 374 #define ___bpf_ctx_cast2(x, args...) ___bpf_ctx_cast1(args), (void *)ctx[1] 375 #define ___bpf_ctx_cast3(x, args...) ___bpf_ctx_cast2(args), (void *)ctx[2] 376 #define ___bpf_ctx_cast4(x, args...) ___bpf_ctx_cast3(args), (void *)ctx[3] 377 #define ___bpf_ctx_cast5(x, args...) ___bpf_ctx_cast4(args), (void *)ctx[4] 378 #define ___bpf_ctx_cast6(x, args...) ___bpf_ctx_cast5(args), (void *)ctx[5] 379 #define ___bpf_ctx_cast7(x, args...) ___bpf_ctx_cast6(args), (void *)ctx[6] 380 #define ___bpf_ctx_cast8(x, args...) ___bpf_ctx_cast7(args), (void *)ctx[7] 381 #define ___bpf_ctx_cast9(x, args...) ___bpf_ctx_cast8(args), (void *)ctx[8] 382 #define ___bpf_ctx_cast10(x, args...) ___bpf_ctx_cast9(args), (void *)ctx[9] 383 #define ___bpf_ctx_cast11(x, args...) ___bpf_ctx_cast10(args), (void *)ctx[10] 384 #define ___bpf_ctx_cast12(x, args...) ___bpf_ctx_cast11(args), (void *)ctx[11] 385 #define ___bpf_ctx_cast(args...) ___bpf_apply(___bpf_ctx_cast, ___bpf_narg(args))(args) 386 387 /* 388 * BPF_PROG is a convenience wrapper for generic tp_btf/fentry/fexit and 389 * similar kinds of BPF programs, that accept input arguments as a single 390 * pointer to untyped u64 array, where each u64 can actually be a typed 391 * pointer or integer of different size. Instead of requring user to write 392 * manual casts and work with array elements by index, BPF_PROG macro 393 * allows user to declare a list of named and typed input arguments in the 394 * same syntax as for normal C function. All the casting is hidden and 395 * performed transparently, while user code can just assume working with 396 * function arguments of specified type and name. 397 * 398 * Original raw context argument is preserved as well as 'ctx' argument. 399 * This is useful when using BPF helpers that expect original context 400 * as one of the parameters (e.g., for bpf_perf_event_output()). 401 */ 402 #define BPF_PROG(name, args...) \ 403 name(unsigned long long *ctx); \ 404 static __attribute__((always_inline)) typeof(name(0)) \ 405 ____##name(unsigned long long *ctx, ##args); \ 406 typeof(name(0)) name(unsigned long long *ctx) \ 407 { \ 408 _Pragma("GCC diagnostic push") \ 409 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ 410 return ____##name(___bpf_ctx_cast(args)); \ 411 _Pragma("GCC diagnostic pop") \ 412 } \ 413 static __attribute__((always_inline)) typeof(name(0)) \ 414 ____##name(unsigned long long *ctx, ##args) 415 416 struct pt_regs; 417 418 #define ___bpf_kprobe_args0() ctx 419 #define ___bpf_kprobe_args1(x) ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx) 420 #define ___bpf_kprobe_args2(x, args...) ___bpf_kprobe_args1(args), (void *)PT_REGS_PARM2(ctx) 421 #define ___bpf_kprobe_args3(x, args...) ___bpf_kprobe_args2(args), (void *)PT_REGS_PARM3(ctx) 422 #define ___bpf_kprobe_args4(x, args...) ___bpf_kprobe_args3(args), (void *)PT_REGS_PARM4(ctx) 423 #define ___bpf_kprobe_args5(x, args...) ___bpf_kprobe_args4(args), (void *)PT_REGS_PARM5(ctx) 424 #define ___bpf_kprobe_args(args...) ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args) 425 426 /* 427 * BPF_KPROBE serves the same purpose for kprobes as BPF_PROG for 428 * tp_btf/fentry/fexit BPF programs. It hides the underlying platform-specific 429 * low-level way of getting kprobe input arguments from struct pt_regs, and 430 * provides a familiar typed and named function arguments syntax and 431 * semantics of accessing kprobe input paremeters. 432 * 433 * Original struct pt_regs* context is preserved as 'ctx' argument. This might 434 * be necessary when using BPF helpers like bpf_perf_event_output(). 435 */ 436 #define BPF_KPROBE(name, args...) \ 437 name(struct pt_regs *ctx); \ 438 static __attribute__((always_inline)) typeof(name(0)) \ 439 ____##name(struct pt_regs *ctx, ##args); \ 440 typeof(name(0)) name(struct pt_regs *ctx) \ 441 { \ 442 _Pragma("GCC diagnostic push") \ 443 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ 444 return ____##name(___bpf_kprobe_args(args)); \ 445 _Pragma("GCC diagnostic pop") \ 446 } \ 447 static __attribute__((always_inline)) typeof(name(0)) \ 448 ____##name(struct pt_regs *ctx, ##args) 449 450 #define ___bpf_kretprobe_args0() ctx 451 #define ___bpf_kretprobe_args1(x) ___bpf_kretprobe_args0(), (void *)PT_REGS_RC(ctx) 452 #define ___bpf_kretprobe_args(args...) ___bpf_apply(___bpf_kretprobe_args, ___bpf_narg(args))(args) 453 454 /* 455 * BPF_KRETPROBE is similar to BPF_KPROBE, except, it only provides optional 456 * return value (in addition to `struct pt_regs *ctx`), but no input 457 * arguments, because they will be clobbered by the time probed function 458 * returns. 459 */ 460 #define BPF_KRETPROBE(name, args...) \ 461 name(struct pt_regs *ctx); \ 462 static __attribute__((always_inline)) typeof(name(0)) \ 463 ____##name(struct pt_regs *ctx, ##args); \ 464 typeof(name(0)) name(struct pt_regs *ctx) \ 465 { \ 466 _Pragma("GCC diagnostic push") \ 467 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ 468 return ____##name(___bpf_kretprobe_args(args)); \ 469 _Pragma("GCC diagnostic pop") \ 470 } \ 471 static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args) 472 473 #define ___bpf_syscall_args0() ctx 474 #define ___bpf_syscall_args1(x) ___bpf_syscall_args0(), (void *)PT_REGS_PARM1_CORE_SYSCALL(regs) 475 #define ___bpf_syscall_args2(x, args...) ___bpf_syscall_args1(args), (void *)PT_REGS_PARM2_CORE_SYSCALL(regs) 476 #define ___bpf_syscall_args3(x, args...) ___bpf_syscall_args2(args), (void *)PT_REGS_PARM3_CORE_SYSCALL(regs) 477 #define ___bpf_syscall_args4(x, args...) ___bpf_syscall_args3(args), (void *)PT_REGS_PARM4_CORE_SYSCALL(regs) 478 #define ___bpf_syscall_args5(x, args...) ___bpf_syscall_args4(args), (void *)PT_REGS_PARM5_CORE_SYSCALL(regs) 479 #define ___bpf_syscall_args(args...) ___bpf_apply(___bpf_syscall_args, ___bpf_narg(args))(args) 480 481 /* 482 * BPF_KPROBE_SYSCALL is a variant of BPF_KPROBE, which is intended for 483 * tracing syscall functions, like __x64_sys_close. It hides the underlying 484 * platform-specific low-level way of getting syscall input arguments from 485 * struct pt_regs, and provides a familiar typed and named function arguments 486 * syntax and semantics of accessing syscall input parameters. 487 * 488 * Original struct pt_regs* context is preserved as 'ctx' argument. This might 489 * be necessary when using BPF helpers like bpf_perf_event_output(). 490 * 491 * This macro relies on BPF CO-RE support. 492 */ 493 #define BPF_KPROBE_SYSCALL(name, args...) \ 494 name(struct pt_regs *ctx); \ 495 static __attribute__((always_inline)) typeof(name(0)) \ 496 ____##name(struct pt_regs *ctx, ##args); \ 497 typeof(name(0)) name(struct pt_regs *ctx) \ 498 { \ 499 struct pt_regs *regs = PT_REGS_SYSCALL_REGS(ctx); \ 500 _Pragma("GCC diagnostic push") \ 501 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ 502 return ____##name(___bpf_syscall_args(args)); \ 503 _Pragma("GCC diagnostic pop") \ 504 } \ 505 static __attribute__((always_inline)) typeof(name(0)) \ 506 ____##name(struct pt_regs *ctx, ##args) 507 508 #endif 509