Loading...
1/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
2#ifndef __BPF_TRACING_H__
3#define __BPF_TRACING_H__
4
5#include "bpf_helpers.h"
6
7/* Scan the ARCH passed in from ARCH env variable (see Makefile) */
8#if defined(__TARGET_ARCH_x86)
9 #define bpf_target_x86
10 #define bpf_target_defined
11#elif defined(__TARGET_ARCH_s390)
12 #define bpf_target_s390
13 #define bpf_target_defined
14#elif defined(__TARGET_ARCH_arm)
15 #define bpf_target_arm
16 #define bpf_target_defined
17#elif defined(__TARGET_ARCH_arm64)
18 #define bpf_target_arm64
19 #define bpf_target_defined
20#elif defined(__TARGET_ARCH_mips)
21 #define bpf_target_mips
22 #define bpf_target_defined
23#elif defined(__TARGET_ARCH_powerpc)
24 #define bpf_target_powerpc
25 #define bpf_target_defined
26#elif defined(__TARGET_ARCH_sparc)
27 #define bpf_target_sparc
28 #define bpf_target_defined
29#elif defined(__TARGET_ARCH_riscv)
30 #define bpf_target_riscv
31 #define bpf_target_defined
32#elif defined(__TARGET_ARCH_arc)
33 #define bpf_target_arc
34 #define bpf_target_defined
35#elif defined(__TARGET_ARCH_loongarch)
36 #define bpf_target_loongarch
37 #define bpf_target_defined
38#else
39
40/* Fall back to what the compiler says */
41#if defined(__x86_64__)
42 #define bpf_target_x86
43 #define bpf_target_defined
44#elif defined(__s390__)
45 #define bpf_target_s390
46 #define bpf_target_defined
47#elif defined(__arm__)
48 #define bpf_target_arm
49 #define bpf_target_defined
50#elif defined(__aarch64__)
51 #define bpf_target_arm64
52 #define bpf_target_defined
53#elif defined(__mips__)
54 #define bpf_target_mips
55 #define bpf_target_defined
56#elif defined(__powerpc__)
57 #define bpf_target_powerpc
58 #define bpf_target_defined
59#elif defined(__sparc__)
60 #define bpf_target_sparc
61 #define bpf_target_defined
62#elif defined(__riscv) && __riscv_xlen == 64
63 #define bpf_target_riscv
64 #define bpf_target_defined
65#elif defined(__arc__)
66 #define bpf_target_arc
67 #define bpf_target_defined
68#elif defined(__loongarch__)
69 #define bpf_target_loongarch
70 #define bpf_target_defined
71#endif /* no compiler target */
72
73#endif
74
75#ifndef __BPF_TARGET_MISSING
76#define __BPF_TARGET_MISSING "GCC error \"Must specify a BPF target arch via __TARGET_ARCH_xxx\""
77#endif
78
79#if defined(bpf_target_x86)
80
81/*
82 * https://en.wikipedia.org/wiki/X86_calling_conventions#System_V_AMD64_ABI
83 */
84
85#if defined(__KERNEL__) || defined(__VMLINUX_H__)
86
87#define __PT_PARM1_REG di
88#define __PT_PARM2_REG si
89#define __PT_PARM3_REG dx
90#define __PT_PARM4_REG cx
91#define __PT_PARM5_REG r8
92#define __PT_PARM6_REG r9
93/*
94 * Syscall uses r10 for PARM4. See arch/x86/entry/entry_64.S:entry_SYSCALL_64
95 * comments in Linux sources. And refer to syscall(2) manpage.
96 */
97#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG
98#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG
99#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG
100#define __PT_PARM4_SYSCALL_REG r10
101#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG
102#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG
103
104#define __PT_RET_REG sp
105#define __PT_FP_REG bp
106#define __PT_RC_REG ax
107#define __PT_SP_REG sp
108#define __PT_IP_REG ip
109
110#else
111
112#ifdef __i386__
113
114/* i386 kernel is built with -mregparm=3 */
115#define __PT_PARM1_REG eax
116#define __PT_PARM2_REG edx
117#define __PT_PARM3_REG ecx
118/* i386 syscall ABI is very different, refer to syscall(2) manpage */
119#define __PT_PARM1_SYSCALL_REG ebx
120#define __PT_PARM2_SYSCALL_REG ecx
121#define __PT_PARM3_SYSCALL_REG edx
122#define __PT_PARM4_SYSCALL_REG esi
123#define __PT_PARM5_SYSCALL_REG edi
124#define __PT_PARM6_SYSCALL_REG ebp
125
126#define __PT_RET_REG esp
127#define __PT_FP_REG ebp
128#define __PT_RC_REG eax
129#define __PT_SP_REG esp
130#define __PT_IP_REG eip
131
132#else /* __i386__ */
133
134#define __PT_PARM1_REG rdi
135#define __PT_PARM2_REG rsi
136#define __PT_PARM3_REG rdx
137#define __PT_PARM4_REG rcx
138#define __PT_PARM5_REG r8
139#define __PT_PARM6_REG r9
140
141#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG
142#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG
143#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG
144#define __PT_PARM4_SYSCALL_REG r10
145#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG
146#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG
147
148#define __PT_RET_REG rsp
149#define __PT_FP_REG rbp
150#define __PT_RC_REG rax
151#define __PT_SP_REG rsp
152#define __PT_IP_REG rip
153
154#endif /* __i386__ */
155
156#endif /* __KERNEL__ || __VMLINUX_H__ */
157
158#elif defined(bpf_target_s390)
159
160/*
161 * https://github.com/IBM/s390x-abi/releases/download/v1.6/lzsabi_s390x.pdf
162 */
163
164struct pt_regs___s390 {
165 unsigned long orig_gpr2;
166};
167
168/* s390 provides user_pt_regs instead of struct pt_regs to userspace */
169#define __PT_REGS_CAST(x) ((const user_pt_regs *)(x))
170#define __PT_PARM1_REG gprs[2]
171#define __PT_PARM2_REG gprs[3]
172#define __PT_PARM3_REG gprs[4]
173#define __PT_PARM4_REG gprs[5]
174#define __PT_PARM5_REG gprs[6]
175
176#define __PT_PARM1_SYSCALL_REG orig_gpr2
177#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG
178#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG
179#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG
180#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG
181#define __PT_PARM6_SYSCALL_REG gprs[7]
182#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)
183#define PT_REGS_PARM1_CORE_SYSCALL(x) \
184 BPF_CORE_READ((const struct pt_regs___s390 *)(x), __PT_PARM1_SYSCALL_REG)
185
186#define __PT_RET_REG gprs[14]
187#define __PT_FP_REG gprs[11] /* Works only with CONFIG_FRAME_POINTER */
188#define __PT_RC_REG gprs[2]
189#define __PT_SP_REG gprs[15]
190#define __PT_IP_REG psw.addr
191
192#elif defined(bpf_target_arm)
193
194/*
195 * https://github.com/ARM-software/abi-aa/blob/main/aapcs32/aapcs32.rst#machine-registers
196 */
197
198#define __PT_PARM1_REG uregs[0]
199#define __PT_PARM2_REG uregs[1]
200#define __PT_PARM3_REG uregs[2]
201#define __PT_PARM4_REG uregs[3]
202
203#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG
204#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG
205#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG
206#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG
207#define __PT_PARM5_SYSCALL_REG uregs[4]
208#define __PT_PARM6_SYSCALL_REG uregs[5]
209#define __PT_PARM7_SYSCALL_REG uregs[6]
210
211#define __PT_RET_REG uregs[14]
212#define __PT_FP_REG uregs[11] /* Works only with CONFIG_FRAME_POINTER */
213#define __PT_RC_REG uregs[0]
214#define __PT_SP_REG uregs[13]
215#define __PT_IP_REG uregs[12]
216
217#elif defined(bpf_target_arm64)
218
219/*
220 * https://github.com/ARM-software/abi-aa/blob/main/aapcs64/aapcs64.rst#machine-registers
221 */
222
223struct pt_regs___arm64 {
224 unsigned long orig_x0;
225};
226
227/* arm64 provides struct user_pt_regs instead of struct pt_regs to userspace */
228#define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x))
229#define __PT_PARM1_REG regs[0]
230#define __PT_PARM2_REG regs[1]
231#define __PT_PARM3_REG regs[2]
232#define __PT_PARM4_REG regs[3]
233#define __PT_PARM5_REG regs[4]
234#define __PT_PARM6_REG regs[5]
235#define __PT_PARM7_REG regs[6]
236#define __PT_PARM8_REG regs[7]
237
238#define __PT_PARM1_SYSCALL_REG orig_x0
239#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG
240#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG
241#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG
242#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG
243#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG
244#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)
245#define PT_REGS_PARM1_CORE_SYSCALL(x) \
246 BPF_CORE_READ((const struct pt_regs___arm64 *)(x), __PT_PARM1_SYSCALL_REG)
247
248#define __PT_RET_REG regs[30]
249#define __PT_FP_REG regs[29] /* Works only with CONFIG_FRAME_POINTER */
250#define __PT_RC_REG regs[0]
251#define __PT_SP_REG sp
252#define __PT_IP_REG pc
253
254#elif defined(bpf_target_mips)
255
256/*
257 * N64 ABI is assumed right now.
258 * https://en.wikipedia.org/wiki/MIPS_architecture#Calling_conventions
259 */
260
261#define __PT_PARM1_REG regs[4]
262#define __PT_PARM2_REG regs[5]
263#define __PT_PARM3_REG regs[6]
264#define __PT_PARM4_REG regs[7]
265#define __PT_PARM5_REG regs[8]
266#define __PT_PARM6_REG regs[9]
267#define __PT_PARM7_REG regs[10]
268#define __PT_PARM8_REG regs[11]
269
270#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG
271#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG
272#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG
273#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG
274#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG /* only N32/N64 */
275#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG /* only N32/N64 */
276
277#define __PT_RET_REG regs[31]
278#define __PT_FP_REG regs[30] /* Works only with CONFIG_FRAME_POINTER */
279#define __PT_RC_REG regs[2]
280#define __PT_SP_REG regs[29]
281#define __PT_IP_REG cp0_epc
282
283#elif defined(bpf_target_powerpc)
284
285/*
286 * http://refspecs.linux-foundation.org/elf/elfspec_ppc.pdf (page 3-14,
287 * section "Function Calling Sequence")
288 */
289
290#define __PT_PARM1_REG gpr[3]
291#define __PT_PARM2_REG gpr[4]
292#define __PT_PARM3_REG gpr[5]
293#define __PT_PARM4_REG gpr[6]
294#define __PT_PARM5_REG gpr[7]
295#define __PT_PARM6_REG gpr[8]
296#define __PT_PARM7_REG gpr[9]
297#define __PT_PARM8_REG gpr[10]
298
299/* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER. */
300#define PT_REGS_SYSCALL_REGS(ctx) ctx
301#define __PT_PARM1_SYSCALL_REG orig_gpr3
302#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG
303#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG
304#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG
305#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG
306#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG
307#if !defined(__arch64__)
308#define __PT_PARM7_SYSCALL_REG __PT_PARM7_REG /* only powerpc (not powerpc64) */
309#endif
310
311#define __PT_RET_REG regs[31]
312#define __PT_FP_REG __unsupported__
313#define __PT_RC_REG gpr[3]
314#define __PT_SP_REG sp
315#define __PT_IP_REG nip
316
317#elif defined(bpf_target_sparc)
318
319/*
320 * https://en.wikipedia.org/wiki/Calling_convention#SPARC
321 */
322
323#define __PT_PARM1_REG u_regs[UREG_I0]
324#define __PT_PARM2_REG u_regs[UREG_I1]
325#define __PT_PARM3_REG u_regs[UREG_I2]
326#define __PT_PARM4_REG u_regs[UREG_I3]
327#define __PT_PARM5_REG u_regs[UREG_I4]
328#define __PT_PARM6_REG u_regs[UREG_I5]
329
330#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG
331#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG
332#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG
333#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG
334#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG
335#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG
336
337#define __PT_RET_REG u_regs[UREG_I7]
338#define __PT_FP_REG __unsupported__
339#define __PT_RC_REG u_regs[UREG_I0]
340#define __PT_SP_REG u_regs[UREG_FP]
341/* Should this also be a bpf_target check for the sparc case? */
342#if defined(__arch64__)
343#define __PT_IP_REG tpc
344#else
345#define __PT_IP_REG pc
346#endif
347
348#elif defined(bpf_target_riscv)
349
350/*
351 * https://github.com/riscv-non-isa/riscv-elf-psabi-doc/blob/master/riscv-cc.adoc#risc-v-calling-conventions
352 */
353
354/* riscv provides struct user_regs_struct instead of struct pt_regs to userspace */
355#define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))
356#define __PT_PARM1_REG a0
357#define __PT_PARM2_REG a1
358#define __PT_PARM3_REG a2
359#define __PT_PARM4_REG a3
360#define __PT_PARM5_REG a4
361#define __PT_PARM6_REG a5
362#define __PT_PARM7_REG a6
363#define __PT_PARM8_REG a7
364
365#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG
366#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG
367#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG
368#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG
369#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG
370#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG
371
372#define __PT_RET_REG ra
373#define __PT_FP_REG s0
374#define __PT_RC_REG a0
375#define __PT_SP_REG sp
376#define __PT_IP_REG pc
377
378#elif defined(bpf_target_arc)
379
380/*
381 * Section "Function Calling Sequence" (page 24):
382 * https://raw.githubusercontent.com/wiki/foss-for-synopsys-dwc-arc-processors/toolchain/files/ARCv2_ABI.pdf
383 */
384
385/* arc provides struct user_regs_struct instead of struct pt_regs to userspace */
386#define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))
387#define __PT_PARM1_REG scratch.r0
388#define __PT_PARM2_REG scratch.r1
389#define __PT_PARM3_REG scratch.r2
390#define __PT_PARM4_REG scratch.r3
391#define __PT_PARM5_REG scratch.r4
392#define __PT_PARM6_REG scratch.r5
393#define __PT_PARM7_REG scratch.r6
394#define __PT_PARM8_REG scratch.r7
395
396/* arc does not select ARCH_HAS_SYSCALL_WRAPPER. */
397#define PT_REGS_SYSCALL_REGS(ctx) ctx
398#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG
399#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG
400#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG
401#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG
402#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG
403#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG
404
405#define __PT_RET_REG scratch.blink
406#define __PT_FP_REG scratch.fp
407#define __PT_RC_REG scratch.r0
408#define __PT_SP_REG scratch.sp
409#define __PT_IP_REG scratch.ret
410
411#elif defined(bpf_target_loongarch)
412
413/*
414 * https://docs.kernel.org/loongarch/introduction.html
415 * https://loongson.github.io/LoongArch-Documentation/LoongArch-ELF-ABI-EN.html
416 */
417
418/* loongarch provides struct user_pt_regs instead of struct pt_regs to userspace */
419#define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x))
420#define __PT_PARM1_REG regs[4]
421#define __PT_PARM2_REG regs[5]
422#define __PT_PARM3_REG regs[6]
423#define __PT_PARM4_REG regs[7]
424#define __PT_PARM5_REG regs[8]
425#define __PT_PARM6_REG regs[9]
426#define __PT_PARM7_REG regs[10]
427#define __PT_PARM8_REG regs[11]
428
429/* loongarch does not select ARCH_HAS_SYSCALL_WRAPPER. */
430#define PT_REGS_SYSCALL_REGS(ctx) ctx
431#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG
432#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG
433#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG
434#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG
435#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG
436#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG
437
438#define __PT_RET_REG regs[1]
439#define __PT_FP_REG regs[22]
440#define __PT_RC_REG regs[4]
441#define __PT_SP_REG regs[3]
442#define __PT_IP_REG csr_era
443
444#endif
445
446#if defined(bpf_target_defined)
447
448struct pt_regs;
449
450/* allow some architectures to override `struct pt_regs` */
451#ifndef __PT_REGS_CAST
452#define __PT_REGS_CAST(x) (x)
453#endif
454
455/*
456 * Different architectures support different number of arguments passed
457 * through registers. i386 supports just 3, some arches support up to 8.
458 */
459#ifndef __PT_PARM4_REG
460#define __PT_PARM4_REG __unsupported__
461#endif
462#ifndef __PT_PARM5_REG
463#define __PT_PARM5_REG __unsupported__
464#endif
465#ifndef __PT_PARM6_REG
466#define __PT_PARM6_REG __unsupported__
467#endif
468#ifndef __PT_PARM7_REG
469#define __PT_PARM7_REG __unsupported__
470#endif
471#ifndef __PT_PARM8_REG
472#define __PT_PARM8_REG __unsupported__
473#endif
474/*
475 * Similarly, syscall-specific conventions might differ between function call
476 * conventions within each architecutre. All supported architectures pass
477 * either 6 or 7 syscall arguments in registers.
478 *
479 * See syscall(2) manpage for succinct table with information on each arch.
480 */
481#ifndef __PT_PARM7_SYSCALL_REG
482#define __PT_PARM7_SYSCALL_REG __unsupported__
483#endif
484
485#define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)
486#define PT_REGS_PARM2(x) (__PT_REGS_CAST(x)->__PT_PARM2_REG)
487#define PT_REGS_PARM3(x) (__PT_REGS_CAST(x)->__PT_PARM3_REG)
488#define PT_REGS_PARM4(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG)
489#define PT_REGS_PARM5(x) (__PT_REGS_CAST(x)->__PT_PARM5_REG)
490#define PT_REGS_PARM6(x) (__PT_REGS_CAST(x)->__PT_PARM6_REG)
491#define PT_REGS_PARM7(x) (__PT_REGS_CAST(x)->__PT_PARM7_REG)
492#define PT_REGS_PARM8(x) (__PT_REGS_CAST(x)->__PT_PARM8_REG)
493#define PT_REGS_RET(x) (__PT_REGS_CAST(x)->__PT_RET_REG)
494#define PT_REGS_FP(x) (__PT_REGS_CAST(x)->__PT_FP_REG)
495#define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG)
496#define PT_REGS_SP(x) (__PT_REGS_CAST(x)->__PT_SP_REG)
497#define PT_REGS_IP(x) (__PT_REGS_CAST(x)->__PT_IP_REG)
498
499#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_REG)
500#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_REG)
501#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_REG)
502#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_REG)
503#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_REG)
504#define PT_REGS_PARM6_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM6_REG)
505#define PT_REGS_PARM7_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM7_REG)
506#define PT_REGS_PARM8_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM8_REG)
507#define PT_REGS_RET_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RET_REG)
508#define PT_REGS_FP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_FP_REG)
509#define PT_REGS_RC_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RC_REG)
510#define PT_REGS_SP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_SP_REG)
511#define PT_REGS_IP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_IP_REG)
512
513#if defined(bpf_target_powerpc)
514
515#define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = (ctx)->link; })
516#define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP
517
518#elif defined(bpf_target_sparc)
519
520#define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = PT_REGS_RET(ctx); })
521#define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP
522
523#else
524
525#define BPF_KPROBE_READ_RET_IP(ip, ctx) \
526 ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)PT_REGS_RET(ctx)); })
527#define BPF_KRETPROBE_READ_RET_IP(ip, ctx) \
528 ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)(PT_REGS_FP(ctx) + sizeof(ip))); })
529
530#endif
531
532#ifndef PT_REGS_PARM1_SYSCALL
533#define PT_REGS_PARM1_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM1_SYSCALL_REG)
534#define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_SYSCALL_REG)
535#endif
536#ifndef PT_REGS_PARM2_SYSCALL
537#define PT_REGS_PARM2_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM2_SYSCALL_REG)
538#define PT_REGS_PARM2_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_SYSCALL_REG)
539#endif
540#ifndef PT_REGS_PARM3_SYSCALL
541#define PT_REGS_PARM3_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM3_SYSCALL_REG)
542#define PT_REGS_PARM3_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_SYSCALL_REG)
543#endif
544#ifndef PT_REGS_PARM4_SYSCALL
545#define PT_REGS_PARM4_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM4_SYSCALL_REG)
546#define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_SYSCALL_REG)
547#endif
548#ifndef PT_REGS_PARM5_SYSCALL
549#define PT_REGS_PARM5_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM5_SYSCALL_REG)
550#define PT_REGS_PARM5_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_SYSCALL_REG)
551#endif
552#ifndef PT_REGS_PARM6_SYSCALL
553#define PT_REGS_PARM6_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM6_SYSCALL_REG)
554#define PT_REGS_PARM6_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM6_SYSCALL_REG)
555#endif
556#ifndef PT_REGS_PARM7_SYSCALL
557#define PT_REGS_PARM7_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM7_SYSCALL_REG)
558#define PT_REGS_PARM7_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM7_SYSCALL_REG)
559#endif
560
561#else /* defined(bpf_target_defined) */
562
563#define PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
564#define PT_REGS_PARM2(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
565#define PT_REGS_PARM3(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
566#define PT_REGS_PARM4(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
567#define PT_REGS_PARM5(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
568#define PT_REGS_PARM6(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
569#define PT_REGS_PARM7(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
570#define PT_REGS_PARM8(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
571#define PT_REGS_RET(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
572#define PT_REGS_FP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
573#define PT_REGS_RC(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
574#define PT_REGS_SP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
575#define PT_REGS_IP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
576
577#define PT_REGS_PARM1_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
578#define PT_REGS_PARM2_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
579#define PT_REGS_PARM3_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
580#define PT_REGS_PARM4_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
581#define PT_REGS_PARM5_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
582#define PT_REGS_PARM6_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
583#define PT_REGS_PARM7_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
584#define PT_REGS_PARM8_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
585#define PT_REGS_RET_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
586#define PT_REGS_FP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
587#define PT_REGS_RC_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
588#define PT_REGS_SP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
589#define PT_REGS_IP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
590
591#define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
592#define BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
593
594#define PT_REGS_PARM1_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
595#define PT_REGS_PARM2_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
596#define PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
597#define PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
598#define PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
599#define PT_REGS_PARM6_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
600#define PT_REGS_PARM7_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
601
602#define PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
603#define PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
604#define PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
605#define PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
606#define PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
607#define PT_REGS_PARM6_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
608#define PT_REGS_PARM7_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
609
610#endif /* defined(bpf_target_defined) */
611
612/*
613 * When invoked from a syscall handler kprobe, returns a pointer to a
614 * struct pt_regs containing syscall arguments and suitable for passing to
615 * PT_REGS_PARMn_SYSCALL() and PT_REGS_PARMn_CORE_SYSCALL().
616 */
617#ifndef PT_REGS_SYSCALL_REGS
618/* By default, assume that the arch selects ARCH_HAS_SYSCALL_WRAPPER. */
619#define PT_REGS_SYSCALL_REGS(ctx) ((struct pt_regs *)PT_REGS_PARM1(ctx))
620#endif
621
622#ifndef ___bpf_concat
623#define ___bpf_concat(a, b) a ## b
624#endif
625#ifndef ___bpf_apply
626#define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
627#endif
628#ifndef ___bpf_nth
629#define ___bpf_nth(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _a, _b, _c, N, ...) N
630#endif
631#ifndef ___bpf_narg
632#define ___bpf_narg(...) ___bpf_nth(_, ##__VA_ARGS__, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0)
633#endif
634
635#define ___bpf_ctx_cast0() ctx
636#define ___bpf_ctx_cast1(x) ___bpf_ctx_cast0(), (void *)ctx[0]
637#define ___bpf_ctx_cast2(x, args...) ___bpf_ctx_cast1(args), (void *)ctx[1]
638#define ___bpf_ctx_cast3(x, args...) ___bpf_ctx_cast2(args), (void *)ctx[2]
639#define ___bpf_ctx_cast4(x, args...) ___bpf_ctx_cast3(args), (void *)ctx[3]
640#define ___bpf_ctx_cast5(x, args...) ___bpf_ctx_cast4(args), (void *)ctx[4]
641#define ___bpf_ctx_cast6(x, args...) ___bpf_ctx_cast5(args), (void *)ctx[5]
642#define ___bpf_ctx_cast7(x, args...) ___bpf_ctx_cast6(args), (void *)ctx[6]
643#define ___bpf_ctx_cast8(x, args...) ___bpf_ctx_cast7(args), (void *)ctx[7]
644#define ___bpf_ctx_cast9(x, args...) ___bpf_ctx_cast8(args), (void *)ctx[8]
645#define ___bpf_ctx_cast10(x, args...) ___bpf_ctx_cast9(args), (void *)ctx[9]
646#define ___bpf_ctx_cast11(x, args...) ___bpf_ctx_cast10(args), (void *)ctx[10]
647#define ___bpf_ctx_cast12(x, args...) ___bpf_ctx_cast11(args), (void *)ctx[11]
648#define ___bpf_ctx_cast(args...) ___bpf_apply(___bpf_ctx_cast, ___bpf_narg(args))(args)
649
650/*
651 * BPF_PROG is a convenience wrapper for generic tp_btf/fentry/fexit and
652 * similar kinds of BPF programs, that accept input arguments as a single
653 * pointer to untyped u64 array, where each u64 can actually be a typed
654 * pointer or integer of different size. Instead of requring user to write
655 * manual casts and work with array elements by index, BPF_PROG macro
656 * allows user to declare a list of named and typed input arguments in the
657 * same syntax as for normal C function. All the casting is hidden and
658 * performed transparently, while user code can just assume working with
659 * function arguments of specified type and name.
660 *
661 * Original raw context argument is preserved as well as 'ctx' argument.
662 * This is useful when using BPF helpers that expect original context
663 * as one of the parameters (e.g., for bpf_perf_event_output()).
664 */
665#define BPF_PROG(name, args...) \
666name(unsigned long long *ctx); \
667static __always_inline typeof(name(0)) \
668____##name(unsigned long long *ctx, ##args); \
669typeof(name(0)) name(unsigned long long *ctx) \
670{ \
671 _Pragma("GCC diagnostic push") \
672 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
673 return ____##name(___bpf_ctx_cast(args)); \
674 _Pragma("GCC diagnostic pop") \
675} \
676static __always_inline typeof(name(0)) \
677____##name(unsigned long long *ctx, ##args)
678
679#ifndef ___bpf_nth2
680#define ___bpf_nth2(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, \
681 _14, _15, _16, _17, _18, _19, _20, _21, _22, _23, _24, N, ...) N
682#endif
683#ifndef ___bpf_narg2
684#define ___bpf_narg2(...) \
685 ___bpf_nth2(_, ##__VA_ARGS__, 12, 12, 11, 11, 10, 10, 9, 9, 8, 8, 7, 7, \
686 6, 6, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 0)
687#endif
688
689#define ___bpf_treg_cnt(t) \
690 __builtin_choose_expr(sizeof(t) == 1, 1, \
691 __builtin_choose_expr(sizeof(t) == 2, 1, \
692 __builtin_choose_expr(sizeof(t) == 4, 1, \
693 __builtin_choose_expr(sizeof(t) == 8, 1, \
694 __builtin_choose_expr(sizeof(t) == 16, 2, \
695 (void)0)))))
696
697#define ___bpf_reg_cnt0() (0)
698#define ___bpf_reg_cnt1(t, x) (___bpf_reg_cnt0() + ___bpf_treg_cnt(t))
699#define ___bpf_reg_cnt2(t, x, args...) (___bpf_reg_cnt1(args) + ___bpf_treg_cnt(t))
700#define ___bpf_reg_cnt3(t, x, args...) (___bpf_reg_cnt2(args) + ___bpf_treg_cnt(t))
701#define ___bpf_reg_cnt4(t, x, args...) (___bpf_reg_cnt3(args) + ___bpf_treg_cnt(t))
702#define ___bpf_reg_cnt5(t, x, args...) (___bpf_reg_cnt4(args) + ___bpf_treg_cnt(t))
703#define ___bpf_reg_cnt6(t, x, args...) (___bpf_reg_cnt5(args) + ___bpf_treg_cnt(t))
704#define ___bpf_reg_cnt7(t, x, args...) (___bpf_reg_cnt6(args) + ___bpf_treg_cnt(t))
705#define ___bpf_reg_cnt8(t, x, args...) (___bpf_reg_cnt7(args) + ___bpf_treg_cnt(t))
706#define ___bpf_reg_cnt9(t, x, args...) (___bpf_reg_cnt8(args) + ___bpf_treg_cnt(t))
707#define ___bpf_reg_cnt10(t, x, args...) (___bpf_reg_cnt9(args) + ___bpf_treg_cnt(t))
708#define ___bpf_reg_cnt11(t, x, args...) (___bpf_reg_cnt10(args) + ___bpf_treg_cnt(t))
709#define ___bpf_reg_cnt12(t, x, args...) (___bpf_reg_cnt11(args) + ___bpf_treg_cnt(t))
710#define ___bpf_reg_cnt(args...) ___bpf_apply(___bpf_reg_cnt, ___bpf_narg2(args))(args)
711
712#define ___bpf_union_arg(t, x, n) \
713 __builtin_choose_expr(sizeof(t) == 1, ({ union { __u8 z[1]; t x; } ___t = { .z = {ctx[n]}}; ___t.x; }), \
714 __builtin_choose_expr(sizeof(t) == 2, ({ union { __u16 z[1]; t x; } ___t = { .z = {ctx[n]} }; ___t.x; }), \
715 __builtin_choose_expr(sizeof(t) == 4, ({ union { __u32 z[1]; t x; } ___t = { .z = {ctx[n]} }; ___t.x; }), \
716 __builtin_choose_expr(sizeof(t) == 8, ({ union { __u64 z[1]; t x; } ___t = {.z = {ctx[n]} }; ___t.x; }), \
717 __builtin_choose_expr(sizeof(t) == 16, ({ union { __u64 z[2]; t x; } ___t = {.z = {ctx[n], ctx[n + 1]} }; ___t.x; }), \
718 (void)0)))))
719
720#define ___bpf_ctx_arg0(n, args...)
721#define ___bpf_ctx_arg1(n, t, x) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt1(t, x))
722#define ___bpf_ctx_arg2(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt2(t, x, args)) ___bpf_ctx_arg1(n, args)
723#define ___bpf_ctx_arg3(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt3(t, x, args)) ___bpf_ctx_arg2(n, args)
724#define ___bpf_ctx_arg4(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt4(t, x, args)) ___bpf_ctx_arg3(n, args)
725#define ___bpf_ctx_arg5(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt5(t, x, args)) ___bpf_ctx_arg4(n, args)
726#define ___bpf_ctx_arg6(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt6(t, x, args)) ___bpf_ctx_arg5(n, args)
727#define ___bpf_ctx_arg7(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt7(t, x, args)) ___bpf_ctx_arg6(n, args)
728#define ___bpf_ctx_arg8(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt8(t, x, args)) ___bpf_ctx_arg7(n, args)
729#define ___bpf_ctx_arg9(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt9(t, x, args)) ___bpf_ctx_arg8(n, args)
730#define ___bpf_ctx_arg10(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt10(t, x, args)) ___bpf_ctx_arg9(n, args)
731#define ___bpf_ctx_arg11(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt11(t, x, args)) ___bpf_ctx_arg10(n, args)
732#define ___bpf_ctx_arg12(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt12(t, x, args)) ___bpf_ctx_arg11(n, args)
733#define ___bpf_ctx_arg(args...) ___bpf_apply(___bpf_ctx_arg, ___bpf_narg2(args))(___bpf_reg_cnt(args), args)
734
735#define ___bpf_ctx_decl0()
736#define ___bpf_ctx_decl1(t, x) , t x
737#define ___bpf_ctx_decl2(t, x, args...) , t x ___bpf_ctx_decl1(args)
738#define ___bpf_ctx_decl3(t, x, args...) , t x ___bpf_ctx_decl2(args)
739#define ___bpf_ctx_decl4(t, x, args...) , t x ___bpf_ctx_decl3(args)
740#define ___bpf_ctx_decl5(t, x, args...) , t x ___bpf_ctx_decl4(args)
741#define ___bpf_ctx_decl6(t, x, args...) , t x ___bpf_ctx_decl5(args)
742#define ___bpf_ctx_decl7(t, x, args...) , t x ___bpf_ctx_decl6(args)
743#define ___bpf_ctx_decl8(t, x, args...) , t x ___bpf_ctx_decl7(args)
744#define ___bpf_ctx_decl9(t, x, args...) , t x ___bpf_ctx_decl8(args)
745#define ___bpf_ctx_decl10(t, x, args...) , t x ___bpf_ctx_decl9(args)
746#define ___bpf_ctx_decl11(t, x, args...) , t x ___bpf_ctx_decl10(args)
747#define ___bpf_ctx_decl12(t, x, args...) , t x ___bpf_ctx_decl11(args)
748#define ___bpf_ctx_decl(args...) ___bpf_apply(___bpf_ctx_decl, ___bpf_narg2(args))(args)
749
750/*
751 * BPF_PROG2 is an enhanced version of BPF_PROG in order to handle struct
752 * arguments. Since each struct argument might take one or two u64 values
753 * in the trampoline stack, argument type size is needed to place proper number
754 * of u64 values for each argument. Therefore, BPF_PROG2 has different
755 * syntax from BPF_PROG. For example, for the following BPF_PROG syntax:
756 *
757 * int BPF_PROG(test2, int a, int b) { ... }
758 *
759 * the corresponding BPF_PROG2 syntax is:
760 *
761 * int BPF_PROG2(test2, int, a, int, b) { ... }
762 *
763 * where type and the corresponding argument name are separated by comma.
764 *
765 * Use BPF_PROG2 macro if one of the arguments might be a struct/union larger
766 * than 8 bytes:
767 *
768 * int BPF_PROG2(test_struct_arg, struct bpf_testmod_struct_arg_1, a, int, b,
769 * int, c, int, d, struct bpf_testmod_struct_arg_2, e, int, ret)
770 * {
771 * // access a, b, c, d, e, and ret directly
772 * ...
773 * }
774 */
775#define BPF_PROG2(name, args...) \
776name(unsigned long long *ctx); \
777static __always_inline typeof(name(0)) \
778____##name(unsigned long long *ctx ___bpf_ctx_decl(args)); \
779typeof(name(0)) name(unsigned long long *ctx) \
780{ \
781 return ____##name(ctx ___bpf_ctx_arg(args)); \
782} \
783static __always_inline typeof(name(0)) \
784____##name(unsigned long long *ctx ___bpf_ctx_decl(args))
785
786struct pt_regs;
787
788#define ___bpf_kprobe_args0() ctx
789#define ___bpf_kprobe_args1(x) ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx)
790#define ___bpf_kprobe_args2(x, args...) ___bpf_kprobe_args1(args), (void *)PT_REGS_PARM2(ctx)
791#define ___bpf_kprobe_args3(x, args...) ___bpf_kprobe_args2(args), (void *)PT_REGS_PARM3(ctx)
792#define ___bpf_kprobe_args4(x, args...) ___bpf_kprobe_args3(args), (void *)PT_REGS_PARM4(ctx)
793#define ___bpf_kprobe_args5(x, args...) ___bpf_kprobe_args4(args), (void *)PT_REGS_PARM5(ctx)
794#define ___bpf_kprobe_args6(x, args...) ___bpf_kprobe_args5(args), (void *)PT_REGS_PARM6(ctx)
795#define ___bpf_kprobe_args7(x, args...) ___bpf_kprobe_args6(args), (void *)PT_REGS_PARM7(ctx)
796#define ___bpf_kprobe_args8(x, args...) ___bpf_kprobe_args7(args), (void *)PT_REGS_PARM8(ctx)
797#define ___bpf_kprobe_args(args...) ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)
798
799/*
800 * BPF_KPROBE serves the same purpose for kprobes as BPF_PROG for
801 * tp_btf/fentry/fexit BPF programs. It hides the underlying platform-specific
802 * low-level way of getting kprobe input arguments from struct pt_regs, and
803 * provides a familiar typed and named function arguments syntax and
804 * semantics of accessing kprobe input paremeters.
805 *
806 * Original struct pt_regs* context is preserved as 'ctx' argument. This might
807 * be necessary when using BPF helpers like bpf_perf_event_output().
808 */
809#define BPF_KPROBE(name, args...) \
810name(struct pt_regs *ctx); \
811static __always_inline typeof(name(0)) \
812____##name(struct pt_regs *ctx, ##args); \
813typeof(name(0)) name(struct pt_regs *ctx) \
814{ \
815 _Pragma("GCC diagnostic push") \
816 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
817 return ____##name(___bpf_kprobe_args(args)); \
818 _Pragma("GCC diagnostic pop") \
819} \
820static __always_inline typeof(name(0)) \
821____##name(struct pt_regs *ctx, ##args)
822
823#define ___bpf_kretprobe_args0() ctx
824#define ___bpf_kretprobe_args1(x) ___bpf_kretprobe_args0(), (void *)PT_REGS_RC(ctx)
825#define ___bpf_kretprobe_args(args...) ___bpf_apply(___bpf_kretprobe_args, ___bpf_narg(args))(args)
826
827/*
828 * BPF_KRETPROBE is similar to BPF_KPROBE, except, it only provides optional
829 * return value (in addition to `struct pt_regs *ctx`), but no input
830 * arguments, because they will be clobbered by the time probed function
831 * returns.
832 */
833#define BPF_KRETPROBE(name, args...) \
834name(struct pt_regs *ctx); \
835static __always_inline typeof(name(0)) \
836____##name(struct pt_regs *ctx, ##args); \
837typeof(name(0)) name(struct pt_regs *ctx) \
838{ \
839 _Pragma("GCC diagnostic push") \
840 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
841 return ____##name(___bpf_kretprobe_args(args)); \
842 _Pragma("GCC diagnostic pop") \
843} \
844static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args)
845
846/* If kernel has CONFIG_ARCH_HAS_SYSCALL_WRAPPER, read pt_regs directly */
847#define ___bpf_syscall_args0() ctx
848#define ___bpf_syscall_args1(x) ___bpf_syscall_args0(), (void *)PT_REGS_PARM1_SYSCALL(regs)
849#define ___bpf_syscall_args2(x, args...) ___bpf_syscall_args1(args), (void *)PT_REGS_PARM2_SYSCALL(regs)
850#define ___bpf_syscall_args3(x, args...) ___bpf_syscall_args2(args), (void *)PT_REGS_PARM3_SYSCALL(regs)
851#define ___bpf_syscall_args4(x, args...) ___bpf_syscall_args3(args), (void *)PT_REGS_PARM4_SYSCALL(regs)
852#define ___bpf_syscall_args5(x, args...) ___bpf_syscall_args4(args), (void *)PT_REGS_PARM5_SYSCALL(regs)
853#define ___bpf_syscall_args6(x, args...) ___bpf_syscall_args5(args), (void *)PT_REGS_PARM6_SYSCALL(regs)
854#define ___bpf_syscall_args7(x, args...) ___bpf_syscall_args6(args), (void *)PT_REGS_PARM7_SYSCALL(regs)
855#define ___bpf_syscall_args(args...) ___bpf_apply(___bpf_syscall_args, ___bpf_narg(args))(args)
856
857/* If kernel doesn't have CONFIG_ARCH_HAS_SYSCALL_WRAPPER, we have to BPF_CORE_READ from pt_regs */
858#define ___bpf_syswrap_args0() ctx
859#define ___bpf_syswrap_args1(x) ___bpf_syswrap_args0(), (void *)PT_REGS_PARM1_CORE_SYSCALL(regs)
860#define ___bpf_syswrap_args2(x, args...) ___bpf_syswrap_args1(args), (void *)PT_REGS_PARM2_CORE_SYSCALL(regs)
861#define ___bpf_syswrap_args3(x, args...) ___bpf_syswrap_args2(args), (void *)PT_REGS_PARM3_CORE_SYSCALL(regs)
862#define ___bpf_syswrap_args4(x, args...) ___bpf_syswrap_args3(args), (void *)PT_REGS_PARM4_CORE_SYSCALL(regs)
863#define ___bpf_syswrap_args5(x, args...) ___bpf_syswrap_args4(args), (void *)PT_REGS_PARM5_CORE_SYSCALL(regs)
864#define ___bpf_syswrap_args6(x, args...) ___bpf_syswrap_args5(args), (void *)PT_REGS_PARM6_CORE_SYSCALL(regs)
865#define ___bpf_syswrap_args7(x, args...) ___bpf_syswrap_args6(args), (void *)PT_REGS_PARM7_CORE_SYSCALL(regs)
866#define ___bpf_syswrap_args(args...) ___bpf_apply(___bpf_syswrap_args, ___bpf_narg(args))(args)
867
868/*
869 * BPF_KSYSCALL is a variant of BPF_KPROBE, which is intended for
870 * tracing syscall functions, like __x64_sys_close. It hides the underlying
871 * platform-specific low-level way of getting syscall input arguments from
872 * struct pt_regs, and provides a familiar typed and named function arguments
873 * syntax and semantics of accessing syscall input parameters.
874 *
875 * Original struct pt_regs * context is preserved as 'ctx' argument. This might
876 * be necessary when using BPF helpers like bpf_perf_event_output().
877 *
878 * At the moment BPF_KSYSCALL does not transparently handle all the calling
879 * convention quirks for the following syscalls:
880 *
881 * - mmap(): __ARCH_WANT_SYS_OLD_MMAP.
882 * - clone(): CONFIG_CLONE_BACKWARDS, CONFIG_CLONE_BACKWARDS2 and
883 * CONFIG_CLONE_BACKWARDS3.
884 * - socket-related syscalls: __ARCH_WANT_SYS_SOCKETCALL.
885 * - compat syscalls.
886 *
887 * This may or may not change in the future. User needs to take extra measures
888 * to handle such quirks explicitly, if necessary.
889 *
890 * This macro relies on BPF CO-RE support and virtual __kconfig externs.
891 */
892#define BPF_KSYSCALL(name, args...) \
893name(struct pt_regs *ctx); \
894extern _Bool LINUX_HAS_SYSCALL_WRAPPER __kconfig; \
895static __always_inline typeof(name(0)) \
896____##name(struct pt_regs *ctx, ##args); \
897typeof(name(0)) name(struct pt_regs *ctx) \
898{ \
899 struct pt_regs *regs = LINUX_HAS_SYSCALL_WRAPPER \
900 ? (struct pt_regs *)PT_REGS_PARM1(ctx) \
901 : ctx; \
902 _Pragma("GCC diagnostic push") \
903 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
904 if (LINUX_HAS_SYSCALL_WRAPPER) \
905 return ____##name(___bpf_syswrap_args(args)); \
906 else \
907 return ____##name(___bpf_syscall_args(args)); \
908 _Pragma("GCC diagnostic pop") \
909} \
910static __always_inline typeof(name(0)) \
911____##name(struct pt_regs *ctx, ##args)
912
913#define BPF_KPROBE_SYSCALL BPF_KSYSCALL
914
915/* BPF_UPROBE and BPF_URETPROBE are identical to BPF_KPROBE and BPF_KRETPROBE,
916 * but are named way less confusingly for SEC("uprobe") and SEC("uretprobe")
917 * use cases.
918 */
919#define BPF_UPROBE(name, args...) BPF_KPROBE(name, ##args)
920#define BPF_URETPROBE(name, args...) BPF_KRETPROBE(name, ##args)
921
922#endif
1/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
2#ifndef __BPF_TRACING_H__
3#define __BPF_TRACING_H__
4
5#include <bpf/bpf_helpers.h>
6
7/* Scan the ARCH passed in from ARCH env variable (see Makefile) */
8#if defined(__TARGET_ARCH_x86)
9 #define bpf_target_x86
10 #define bpf_target_defined
11#elif defined(__TARGET_ARCH_s390)
12 #define bpf_target_s390
13 #define bpf_target_defined
14#elif defined(__TARGET_ARCH_arm)
15 #define bpf_target_arm
16 #define bpf_target_defined
17#elif defined(__TARGET_ARCH_arm64)
18 #define bpf_target_arm64
19 #define bpf_target_defined
20#elif defined(__TARGET_ARCH_mips)
21 #define bpf_target_mips
22 #define bpf_target_defined
23#elif defined(__TARGET_ARCH_powerpc)
24 #define bpf_target_powerpc
25 #define bpf_target_defined
26#elif defined(__TARGET_ARCH_sparc)
27 #define bpf_target_sparc
28 #define bpf_target_defined
29#elif defined(__TARGET_ARCH_riscv)
30 #define bpf_target_riscv
31 #define bpf_target_defined
32#elif defined(__TARGET_ARCH_arc)
33 #define bpf_target_arc
34 #define bpf_target_defined
35#else
36
37/* Fall back to what the compiler says */
38#if defined(__x86_64__)
39 #define bpf_target_x86
40 #define bpf_target_defined
41#elif defined(__s390__)
42 #define bpf_target_s390
43 #define bpf_target_defined
44#elif defined(__arm__)
45 #define bpf_target_arm
46 #define bpf_target_defined
47#elif defined(__aarch64__)
48 #define bpf_target_arm64
49 #define bpf_target_defined
50#elif defined(__mips__)
51 #define bpf_target_mips
52 #define bpf_target_defined
53#elif defined(__powerpc__)
54 #define bpf_target_powerpc
55 #define bpf_target_defined
56#elif defined(__sparc__)
57 #define bpf_target_sparc
58 #define bpf_target_defined
59#elif defined(__riscv) && __riscv_xlen == 64
60 #define bpf_target_riscv
61 #define bpf_target_defined
62#elif defined(__arc__)
63 #define bpf_target_arc
64 #define bpf_target_defined
65#endif /* no compiler target */
66
67#endif
68
69#ifndef __BPF_TARGET_MISSING
70#define __BPF_TARGET_MISSING "GCC error \"Must specify a BPF target arch via __TARGET_ARCH_xxx\""
71#endif
72
73#if defined(bpf_target_x86)
74
75#if defined(__KERNEL__) || defined(__VMLINUX_H__)
76
77#define __PT_PARM1_REG di
78#define __PT_PARM2_REG si
79#define __PT_PARM3_REG dx
80#define __PT_PARM4_REG cx
81#define __PT_PARM5_REG r8
82#define __PT_RET_REG sp
83#define __PT_FP_REG bp
84#define __PT_RC_REG ax
85#define __PT_SP_REG sp
86#define __PT_IP_REG ip
87/* syscall uses r10 for PARM4 */
88#define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)
89#define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)
90
91#else
92
93#ifdef __i386__
94
95#define __PT_PARM1_REG eax
96#define __PT_PARM2_REG edx
97#define __PT_PARM3_REG ecx
98/* i386 kernel is built with -mregparm=3 */
99#define __PT_PARM4_REG __unsupported__
100#define __PT_PARM5_REG __unsupported__
101#define __PT_RET_REG esp
102#define __PT_FP_REG ebp
103#define __PT_RC_REG eax
104#define __PT_SP_REG esp
105#define __PT_IP_REG eip
106
107#else /* __i386__ */
108
109#define __PT_PARM1_REG rdi
110#define __PT_PARM2_REG rsi
111#define __PT_PARM3_REG rdx
112#define __PT_PARM4_REG rcx
113#define __PT_PARM5_REG r8
114#define __PT_RET_REG rsp
115#define __PT_FP_REG rbp
116#define __PT_RC_REG rax
117#define __PT_SP_REG rsp
118#define __PT_IP_REG rip
119/* syscall uses r10 for PARM4 */
120#define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)
121#define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)
122
123#endif /* __i386__ */
124
125#endif /* __KERNEL__ || __VMLINUX_H__ */
126
127#elif defined(bpf_target_s390)
128
129struct pt_regs___s390 {
130 unsigned long orig_gpr2;
131};
132
133/* s390 provides user_pt_regs instead of struct pt_regs to userspace */
134#define __PT_REGS_CAST(x) ((const user_pt_regs *)(x))
135#define __PT_PARM1_REG gprs[2]
136#define __PT_PARM2_REG gprs[3]
137#define __PT_PARM3_REG gprs[4]
138#define __PT_PARM4_REG gprs[5]
139#define __PT_PARM5_REG gprs[6]
140#define __PT_RET_REG grps[14]
141#define __PT_FP_REG gprs[11] /* Works only with CONFIG_FRAME_POINTER */
142#define __PT_RC_REG gprs[2]
143#define __PT_SP_REG gprs[15]
144#define __PT_IP_REG psw.addr
145#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)
146#define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___s390 *)(x), orig_gpr2)
147
148#elif defined(bpf_target_arm)
149
150#define __PT_PARM1_REG uregs[0]
151#define __PT_PARM2_REG uregs[1]
152#define __PT_PARM3_REG uregs[2]
153#define __PT_PARM4_REG uregs[3]
154#define __PT_PARM5_REG uregs[4]
155#define __PT_RET_REG uregs[14]
156#define __PT_FP_REG uregs[11] /* Works only with CONFIG_FRAME_POINTER */
157#define __PT_RC_REG uregs[0]
158#define __PT_SP_REG uregs[13]
159#define __PT_IP_REG uregs[12]
160
161#elif defined(bpf_target_arm64)
162
163struct pt_regs___arm64 {
164 unsigned long orig_x0;
165};
166
167/* arm64 provides struct user_pt_regs instead of struct pt_regs to userspace */
168#define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x))
169#define __PT_PARM1_REG regs[0]
170#define __PT_PARM2_REG regs[1]
171#define __PT_PARM3_REG regs[2]
172#define __PT_PARM4_REG regs[3]
173#define __PT_PARM5_REG regs[4]
174#define __PT_RET_REG regs[30]
175#define __PT_FP_REG regs[29] /* Works only with CONFIG_FRAME_POINTER */
176#define __PT_RC_REG regs[0]
177#define __PT_SP_REG sp
178#define __PT_IP_REG pc
179#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)
180#define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___arm64 *)(x), orig_x0)
181
182#elif defined(bpf_target_mips)
183
184#define __PT_PARM1_REG regs[4]
185#define __PT_PARM2_REG regs[5]
186#define __PT_PARM3_REG regs[6]
187#define __PT_PARM4_REG regs[7]
188#define __PT_PARM5_REG regs[8]
189#define __PT_RET_REG regs[31]
190#define __PT_FP_REG regs[30] /* Works only with CONFIG_FRAME_POINTER */
191#define __PT_RC_REG regs[2]
192#define __PT_SP_REG regs[29]
193#define __PT_IP_REG cp0_epc
194
195#elif defined(bpf_target_powerpc)
196
197#define __PT_PARM1_REG gpr[3]
198#define __PT_PARM2_REG gpr[4]
199#define __PT_PARM3_REG gpr[5]
200#define __PT_PARM4_REG gpr[6]
201#define __PT_PARM5_REG gpr[7]
202#define __PT_RET_REG regs[31]
203#define __PT_FP_REG __unsupported__
204#define __PT_RC_REG gpr[3]
205#define __PT_SP_REG sp
206#define __PT_IP_REG nip
207/* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER. */
208#define PT_REGS_SYSCALL_REGS(ctx) ctx
209
210#elif defined(bpf_target_sparc)
211
212#define __PT_PARM1_REG u_regs[UREG_I0]
213#define __PT_PARM2_REG u_regs[UREG_I1]
214#define __PT_PARM3_REG u_regs[UREG_I2]
215#define __PT_PARM4_REG u_regs[UREG_I3]
216#define __PT_PARM5_REG u_regs[UREG_I4]
217#define __PT_RET_REG u_regs[UREG_I7]
218#define __PT_FP_REG __unsupported__
219#define __PT_RC_REG u_regs[UREG_I0]
220#define __PT_SP_REG u_regs[UREG_FP]
221/* Should this also be a bpf_target check for the sparc case? */
222#if defined(__arch64__)
223#define __PT_IP_REG tpc
224#else
225#define __PT_IP_REG pc
226#endif
227
228#elif defined(bpf_target_riscv)
229
230#define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))
231#define __PT_PARM1_REG a0
232#define __PT_PARM2_REG a1
233#define __PT_PARM3_REG a2
234#define __PT_PARM4_REG a3
235#define __PT_PARM5_REG a4
236#define __PT_RET_REG ra
237#define __PT_FP_REG s0
238#define __PT_RC_REG a0
239#define __PT_SP_REG sp
240#define __PT_IP_REG pc
241/* riscv does not select ARCH_HAS_SYSCALL_WRAPPER. */
242#define PT_REGS_SYSCALL_REGS(ctx) ctx
243
244#elif defined(bpf_target_arc)
245
246/* arc provides struct user_pt_regs instead of struct pt_regs to userspace */
247#define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))
248#define __PT_PARM1_REG scratch.r0
249#define __PT_PARM2_REG scratch.r1
250#define __PT_PARM3_REG scratch.r2
251#define __PT_PARM4_REG scratch.r3
252#define __PT_PARM5_REG scratch.r4
253#define __PT_RET_REG scratch.blink
254#define __PT_FP_REG __unsupported__
255#define __PT_RC_REG scratch.r0
256#define __PT_SP_REG scratch.sp
257#define __PT_IP_REG scratch.ret
258/* arc does not select ARCH_HAS_SYSCALL_WRAPPER. */
259#define PT_REGS_SYSCALL_REGS(ctx) ctx
260
261#endif
262
263#if defined(bpf_target_defined)
264
265struct pt_regs;
266
267/* allow some architecutres to override `struct pt_regs` */
268#ifndef __PT_REGS_CAST
269#define __PT_REGS_CAST(x) (x)
270#endif
271
272#define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)
273#define PT_REGS_PARM2(x) (__PT_REGS_CAST(x)->__PT_PARM2_REG)
274#define PT_REGS_PARM3(x) (__PT_REGS_CAST(x)->__PT_PARM3_REG)
275#define PT_REGS_PARM4(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG)
276#define PT_REGS_PARM5(x) (__PT_REGS_CAST(x)->__PT_PARM5_REG)
277#define PT_REGS_RET(x) (__PT_REGS_CAST(x)->__PT_RET_REG)
278#define PT_REGS_FP(x) (__PT_REGS_CAST(x)->__PT_FP_REG)
279#define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG)
280#define PT_REGS_SP(x) (__PT_REGS_CAST(x)->__PT_SP_REG)
281#define PT_REGS_IP(x) (__PT_REGS_CAST(x)->__PT_IP_REG)
282
283#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_REG)
284#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_REG)
285#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_REG)
286#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_REG)
287#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_REG)
288#define PT_REGS_RET_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RET_REG)
289#define PT_REGS_FP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_FP_REG)
290#define PT_REGS_RC_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RC_REG)
291#define PT_REGS_SP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_SP_REG)
292#define PT_REGS_IP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_IP_REG)
293
294#if defined(bpf_target_powerpc)
295
296#define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = (ctx)->link; })
297#define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP
298
299#elif defined(bpf_target_sparc)
300
301#define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = PT_REGS_RET(ctx); })
302#define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP
303
304#else
305
306#define BPF_KPROBE_READ_RET_IP(ip, ctx) \
307 ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)PT_REGS_RET(ctx)); })
308#define BPF_KRETPROBE_READ_RET_IP(ip, ctx) \
309 ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)(PT_REGS_FP(ctx) + sizeof(ip))); })
310
311#endif
312
313#ifndef PT_REGS_PARM1_SYSCALL
314#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1(x)
315#endif
316#define PT_REGS_PARM2_SYSCALL(x) PT_REGS_PARM2(x)
317#define PT_REGS_PARM3_SYSCALL(x) PT_REGS_PARM3(x)
318#ifndef PT_REGS_PARM4_SYSCALL
319#define PT_REGS_PARM4_SYSCALL(x) PT_REGS_PARM4(x)
320#endif
321#define PT_REGS_PARM5_SYSCALL(x) PT_REGS_PARM5(x)
322
323#ifndef PT_REGS_PARM1_CORE_SYSCALL
324#define PT_REGS_PARM1_CORE_SYSCALL(x) PT_REGS_PARM1_CORE(x)
325#endif
326#define PT_REGS_PARM2_CORE_SYSCALL(x) PT_REGS_PARM2_CORE(x)
327#define PT_REGS_PARM3_CORE_SYSCALL(x) PT_REGS_PARM3_CORE(x)
328#ifndef PT_REGS_PARM4_CORE_SYSCALL
329#define PT_REGS_PARM4_CORE_SYSCALL(x) PT_REGS_PARM4_CORE(x)
330#endif
331#define PT_REGS_PARM5_CORE_SYSCALL(x) PT_REGS_PARM5_CORE(x)
332
333#else /* defined(bpf_target_defined) */
334
335#define PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
336#define PT_REGS_PARM2(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
337#define PT_REGS_PARM3(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
338#define PT_REGS_PARM4(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
339#define PT_REGS_PARM5(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
340#define PT_REGS_RET(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
341#define PT_REGS_FP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
342#define PT_REGS_RC(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
343#define PT_REGS_SP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
344#define PT_REGS_IP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
345
346#define PT_REGS_PARM1_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
347#define PT_REGS_PARM2_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
348#define PT_REGS_PARM3_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
349#define PT_REGS_PARM4_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
350#define PT_REGS_PARM5_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
351#define PT_REGS_RET_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
352#define PT_REGS_FP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
353#define PT_REGS_RC_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
354#define PT_REGS_SP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
355#define PT_REGS_IP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
356
357#define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
358#define BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
359
360#define PT_REGS_PARM1_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
361#define PT_REGS_PARM2_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
362#define PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
363#define PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
364#define PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
365
366#define PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
367#define PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
368#define PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
369#define PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
370#define PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
371
372#endif /* defined(bpf_target_defined) */
373
374/*
375 * When invoked from a syscall handler kprobe, returns a pointer to a
376 * struct pt_regs containing syscall arguments and suitable for passing to
377 * PT_REGS_PARMn_SYSCALL() and PT_REGS_PARMn_CORE_SYSCALL().
378 */
379#ifndef PT_REGS_SYSCALL_REGS
380/* By default, assume that the arch selects ARCH_HAS_SYSCALL_WRAPPER. */
381#define PT_REGS_SYSCALL_REGS(ctx) ((struct pt_regs *)PT_REGS_PARM1(ctx))
382#endif
383
384#ifndef ___bpf_concat
385#define ___bpf_concat(a, b) a ## b
386#endif
387#ifndef ___bpf_apply
388#define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
389#endif
390#ifndef ___bpf_nth
391#define ___bpf_nth(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _a, _b, _c, N, ...) N
392#endif
393#ifndef ___bpf_narg
394#define ___bpf_narg(...) ___bpf_nth(_, ##__VA_ARGS__, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0)
395#endif
396
397#define ___bpf_ctx_cast0() ctx
398#define ___bpf_ctx_cast1(x) ___bpf_ctx_cast0(), (void *)ctx[0]
399#define ___bpf_ctx_cast2(x, args...) ___bpf_ctx_cast1(args), (void *)ctx[1]
400#define ___bpf_ctx_cast3(x, args...) ___bpf_ctx_cast2(args), (void *)ctx[2]
401#define ___bpf_ctx_cast4(x, args...) ___bpf_ctx_cast3(args), (void *)ctx[3]
402#define ___bpf_ctx_cast5(x, args...) ___bpf_ctx_cast4(args), (void *)ctx[4]
403#define ___bpf_ctx_cast6(x, args...) ___bpf_ctx_cast5(args), (void *)ctx[5]
404#define ___bpf_ctx_cast7(x, args...) ___bpf_ctx_cast6(args), (void *)ctx[6]
405#define ___bpf_ctx_cast8(x, args...) ___bpf_ctx_cast7(args), (void *)ctx[7]
406#define ___bpf_ctx_cast9(x, args...) ___bpf_ctx_cast8(args), (void *)ctx[8]
407#define ___bpf_ctx_cast10(x, args...) ___bpf_ctx_cast9(args), (void *)ctx[9]
408#define ___bpf_ctx_cast11(x, args...) ___bpf_ctx_cast10(args), (void *)ctx[10]
409#define ___bpf_ctx_cast12(x, args...) ___bpf_ctx_cast11(args), (void *)ctx[11]
410#define ___bpf_ctx_cast(args...) ___bpf_apply(___bpf_ctx_cast, ___bpf_narg(args))(args)
411
412/*
413 * BPF_PROG is a convenience wrapper for generic tp_btf/fentry/fexit and
414 * similar kinds of BPF programs, that accept input arguments as a single
415 * pointer to untyped u64 array, where each u64 can actually be a typed
416 * pointer or integer of different size. Instead of requring user to write
417 * manual casts and work with array elements by index, BPF_PROG macro
418 * allows user to declare a list of named and typed input arguments in the
419 * same syntax as for normal C function. All the casting is hidden and
420 * performed transparently, while user code can just assume working with
421 * function arguments of specified type and name.
422 *
423 * Original raw context argument is preserved as well as 'ctx' argument.
424 * This is useful when using BPF helpers that expect original context
425 * as one of the parameters (e.g., for bpf_perf_event_output()).
426 */
427#define BPF_PROG(name, args...) \
428name(unsigned long long *ctx); \
429static __always_inline typeof(name(0)) \
430____##name(unsigned long long *ctx, ##args); \
431typeof(name(0)) name(unsigned long long *ctx) \
432{ \
433 _Pragma("GCC diagnostic push") \
434 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
435 return ____##name(___bpf_ctx_cast(args)); \
436 _Pragma("GCC diagnostic pop") \
437} \
438static __always_inline typeof(name(0)) \
439____##name(unsigned long long *ctx, ##args)
440
441#ifndef ___bpf_nth2
442#define ___bpf_nth2(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, \
443 _14, _15, _16, _17, _18, _19, _20, _21, _22, _23, _24, N, ...) N
444#endif
445#ifndef ___bpf_narg2
446#define ___bpf_narg2(...) \
447 ___bpf_nth2(_, ##__VA_ARGS__, 12, 12, 11, 11, 10, 10, 9, 9, 8, 8, 7, 7, \
448 6, 6, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 0)
449#endif
450
451#define ___bpf_treg_cnt(t) \
452 __builtin_choose_expr(sizeof(t) == 1, 1, \
453 __builtin_choose_expr(sizeof(t) == 2, 1, \
454 __builtin_choose_expr(sizeof(t) == 4, 1, \
455 __builtin_choose_expr(sizeof(t) == 8, 1, \
456 __builtin_choose_expr(sizeof(t) == 16, 2, \
457 (void)0)))))
458
459#define ___bpf_reg_cnt0() (0)
460#define ___bpf_reg_cnt1(t, x) (___bpf_reg_cnt0() + ___bpf_treg_cnt(t))
461#define ___bpf_reg_cnt2(t, x, args...) (___bpf_reg_cnt1(args) + ___bpf_treg_cnt(t))
462#define ___bpf_reg_cnt3(t, x, args...) (___bpf_reg_cnt2(args) + ___bpf_treg_cnt(t))
463#define ___bpf_reg_cnt4(t, x, args...) (___bpf_reg_cnt3(args) + ___bpf_treg_cnt(t))
464#define ___bpf_reg_cnt5(t, x, args...) (___bpf_reg_cnt4(args) + ___bpf_treg_cnt(t))
465#define ___bpf_reg_cnt6(t, x, args...) (___bpf_reg_cnt5(args) + ___bpf_treg_cnt(t))
466#define ___bpf_reg_cnt7(t, x, args...) (___bpf_reg_cnt6(args) + ___bpf_treg_cnt(t))
467#define ___bpf_reg_cnt8(t, x, args...) (___bpf_reg_cnt7(args) + ___bpf_treg_cnt(t))
468#define ___bpf_reg_cnt9(t, x, args...) (___bpf_reg_cnt8(args) + ___bpf_treg_cnt(t))
469#define ___bpf_reg_cnt10(t, x, args...) (___bpf_reg_cnt9(args) + ___bpf_treg_cnt(t))
470#define ___bpf_reg_cnt11(t, x, args...) (___bpf_reg_cnt10(args) + ___bpf_treg_cnt(t))
471#define ___bpf_reg_cnt12(t, x, args...) (___bpf_reg_cnt11(args) + ___bpf_treg_cnt(t))
472#define ___bpf_reg_cnt(args...) ___bpf_apply(___bpf_reg_cnt, ___bpf_narg2(args))(args)
473
474#define ___bpf_union_arg(t, x, n) \
475 __builtin_choose_expr(sizeof(t) == 1, ({ union { __u8 z[1]; t x; } ___t = { .z = {ctx[n]}}; ___t.x; }), \
476 __builtin_choose_expr(sizeof(t) == 2, ({ union { __u16 z[1]; t x; } ___t = { .z = {ctx[n]} }; ___t.x; }), \
477 __builtin_choose_expr(sizeof(t) == 4, ({ union { __u32 z[1]; t x; } ___t = { .z = {ctx[n]} }; ___t.x; }), \
478 __builtin_choose_expr(sizeof(t) == 8, ({ union { __u64 z[1]; t x; } ___t = {.z = {ctx[n]} }; ___t.x; }), \
479 __builtin_choose_expr(sizeof(t) == 16, ({ union { __u64 z[2]; t x; } ___t = {.z = {ctx[n], ctx[n + 1]} }; ___t.x; }), \
480 (void)0)))))
481
482#define ___bpf_ctx_arg0(n, args...)
483#define ___bpf_ctx_arg1(n, t, x) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt1(t, x))
484#define ___bpf_ctx_arg2(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt2(t, x, args)) ___bpf_ctx_arg1(n, args)
485#define ___bpf_ctx_arg3(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt3(t, x, args)) ___bpf_ctx_arg2(n, args)
486#define ___bpf_ctx_arg4(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt4(t, x, args)) ___bpf_ctx_arg3(n, args)
487#define ___bpf_ctx_arg5(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt5(t, x, args)) ___bpf_ctx_arg4(n, args)
488#define ___bpf_ctx_arg6(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt6(t, x, args)) ___bpf_ctx_arg5(n, args)
489#define ___bpf_ctx_arg7(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt7(t, x, args)) ___bpf_ctx_arg6(n, args)
490#define ___bpf_ctx_arg8(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt8(t, x, args)) ___bpf_ctx_arg7(n, args)
491#define ___bpf_ctx_arg9(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt9(t, x, args)) ___bpf_ctx_arg8(n, args)
492#define ___bpf_ctx_arg10(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt10(t, x, args)) ___bpf_ctx_arg9(n, args)
493#define ___bpf_ctx_arg11(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt11(t, x, args)) ___bpf_ctx_arg10(n, args)
494#define ___bpf_ctx_arg12(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt12(t, x, args)) ___bpf_ctx_arg11(n, args)
495#define ___bpf_ctx_arg(args...) ___bpf_apply(___bpf_ctx_arg, ___bpf_narg2(args))(___bpf_reg_cnt(args), args)
496
497#define ___bpf_ctx_decl0()
498#define ___bpf_ctx_decl1(t, x) , t x
499#define ___bpf_ctx_decl2(t, x, args...) , t x ___bpf_ctx_decl1(args)
500#define ___bpf_ctx_decl3(t, x, args...) , t x ___bpf_ctx_decl2(args)
501#define ___bpf_ctx_decl4(t, x, args...) , t x ___bpf_ctx_decl3(args)
502#define ___bpf_ctx_decl5(t, x, args...) , t x ___bpf_ctx_decl4(args)
503#define ___bpf_ctx_decl6(t, x, args...) , t x ___bpf_ctx_decl5(args)
504#define ___bpf_ctx_decl7(t, x, args...) , t x ___bpf_ctx_decl6(args)
505#define ___bpf_ctx_decl8(t, x, args...) , t x ___bpf_ctx_decl7(args)
506#define ___bpf_ctx_decl9(t, x, args...) , t x ___bpf_ctx_decl8(args)
507#define ___bpf_ctx_decl10(t, x, args...) , t x ___bpf_ctx_decl9(args)
508#define ___bpf_ctx_decl11(t, x, args...) , t x ___bpf_ctx_decl10(args)
509#define ___bpf_ctx_decl12(t, x, args...) , t x ___bpf_ctx_decl11(args)
510#define ___bpf_ctx_decl(args...) ___bpf_apply(___bpf_ctx_decl, ___bpf_narg2(args))(args)
511
512/*
513 * BPF_PROG2 is an enhanced version of BPF_PROG in order to handle struct
514 * arguments. Since each struct argument might take one or two u64 values
515 * in the trampoline stack, argument type size is needed to place proper number
516 * of u64 values for each argument. Therefore, BPF_PROG2 has different
517 * syntax from BPF_PROG. For example, for the following BPF_PROG syntax:
518 *
519 * int BPF_PROG(test2, int a, int b) { ... }
520 *
521 * the corresponding BPF_PROG2 syntax is:
522 *
523 * int BPF_PROG2(test2, int, a, int, b) { ... }
524 *
525 * where type and the corresponding argument name are separated by comma.
526 *
527 * Use BPF_PROG2 macro if one of the arguments might be a struct/union larger
528 * than 8 bytes:
529 *
530 * int BPF_PROG2(test_struct_arg, struct bpf_testmod_struct_arg_1, a, int, b,
531 * int, c, int, d, struct bpf_testmod_struct_arg_2, e, int, ret)
532 * {
533 * // access a, b, c, d, e, and ret directly
534 * ...
535 * }
536 */
537#define BPF_PROG2(name, args...) \
538name(unsigned long long *ctx); \
539static __always_inline typeof(name(0)) \
540____##name(unsigned long long *ctx ___bpf_ctx_decl(args)); \
541typeof(name(0)) name(unsigned long long *ctx) \
542{ \
543 return ____##name(ctx ___bpf_ctx_arg(args)); \
544} \
545static __always_inline typeof(name(0)) \
546____##name(unsigned long long *ctx ___bpf_ctx_decl(args))
547
548struct pt_regs;
549
550#define ___bpf_kprobe_args0() ctx
551#define ___bpf_kprobe_args1(x) ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx)
552#define ___bpf_kprobe_args2(x, args...) ___bpf_kprobe_args1(args), (void *)PT_REGS_PARM2(ctx)
553#define ___bpf_kprobe_args3(x, args...) ___bpf_kprobe_args2(args), (void *)PT_REGS_PARM3(ctx)
554#define ___bpf_kprobe_args4(x, args...) ___bpf_kprobe_args3(args), (void *)PT_REGS_PARM4(ctx)
555#define ___bpf_kprobe_args5(x, args...) ___bpf_kprobe_args4(args), (void *)PT_REGS_PARM5(ctx)
556#define ___bpf_kprobe_args(args...) ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)
557
558/*
559 * BPF_KPROBE serves the same purpose for kprobes as BPF_PROG for
560 * tp_btf/fentry/fexit BPF programs. It hides the underlying platform-specific
561 * low-level way of getting kprobe input arguments from struct pt_regs, and
562 * provides a familiar typed and named function arguments syntax and
563 * semantics of accessing kprobe input paremeters.
564 *
565 * Original struct pt_regs* context is preserved as 'ctx' argument. This might
566 * be necessary when using BPF helpers like bpf_perf_event_output().
567 */
568#define BPF_KPROBE(name, args...) \
569name(struct pt_regs *ctx); \
570static __always_inline typeof(name(0)) \
571____##name(struct pt_regs *ctx, ##args); \
572typeof(name(0)) name(struct pt_regs *ctx) \
573{ \
574 _Pragma("GCC diagnostic push") \
575 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
576 return ____##name(___bpf_kprobe_args(args)); \
577 _Pragma("GCC diagnostic pop") \
578} \
579static __always_inline typeof(name(0)) \
580____##name(struct pt_regs *ctx, ##args)
581
582#define ___bpf_kretprobe_args0() ctx
583#define ___bpf_kretprobe_args1(x) ___bpf_kretprobe_args0(), (void *)PT_REGS_RC(ctx)
584#define ___bpf_kretprobe_args(args...) ___bpf_apply(___bpf_kretprobe_args, ___bpf_narg(args))(args)
585
586/*
587 * BPF_KRETPROBE is similar to BPF_KPROBE, except, it only provides optional
588 * return value (in addition to `struct pt_regs *ctx`), but no input
589 * arguments, because they will be clobbered by the time probed function
590 * returns.
591 */
592#define BPF_KRETPROBE(name, args...) \
593name(struct pt_regs *ctx); \
594static __always_inline typeof(name(0)) \
595____##name(struct pt_regs *ctx, ##args); \
596typeof(name(0)) name(struct pt_regs *ctx) \
597{ \
598 _Pragma("GCC diagnostic push") \
599 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
600 return ____##name(___bpf_kretprobe_args(args)); \
601 _Pragma("GCC diagnostic pop") \
602} \
603static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args)
604
605/* If kernel has CONFIG_ARCH_HAS_SYSCALL_WRAPPER, read pt_regs directly */
606#define ___bpf_syscall_args0() ctx
607#define ___bpf_syscall_args1(x) ___bpf_syscall_args0(), (void *)PT_REGS_PARM1_SYSCALL(regs)
608#define ___bpf_syscall_args2(x, args...) ___bpf_syscall_args1(args), (void *)PT_REGS_PARM2_SYSCALL(regs)
609#define ___bpf_syscall_args3(x, args...) ___bpf_syscall_args2(args), (void *)PT_REGS_PARM3_SYSCALL(regs)
610#define ___bpf_syscall_args4(x, args...) ___bpf_syscall_args3(args), (void *)PT_REGS_PARM4_SYSCALL(regs)
611#define ___bpf_syscall_args5(x, args...) ___bpf_syscall_args4(args), (void *)PT_REGS_PARM5_SYSCALL(regs)
612#define ___bpf_syscall_args(args...) ___bpf_apply(___bpf_syscall_args, ___bpf_narg(args))(args)
613
614/* If kernel doesn't have CONFIG_ARCH_HAS_SYSCALL_WRAPPER, we have to BPF_CORE_READ from pt_regs */
615#define ___bpf_syswrap_args0() ctx
616#define ___bpf_syswrap_args1(x) ___bpf_syswrap_args0(), (void *)PT_REGS_PARM1_CORE_SYSCALL(regs)
617#define ___bpf_syswrap_args2(x, args...) ___bpf_syswrap_args1(args), (void *)PT_REGS_PARM2_CORE_SYSCALL(regs)
618#define ___bpf_syswrap_args3(x, args...) ___bpf_syswrap_args2(args), (void *)PT_REGS_PARM3_CORE_SYSCALL(regs)
619#define ___bpf_syswrap_args4(x, args...) ___bpf_syswrap_args3(args), (void *)PT_REGS_PARM4_CORE_SYSCALL(regs)
620#define ___bpf_syswrap_args5(x, args...) ___bpf_syswrap_args4(args), (void *)PT_REGS_PARM5_CORE_SYSCALL(regs)
621#define ___bpf_syswrap_args(args...) ___bpf_apply(___bpf_syswrap_args, ___bpf_narg(args))(args)
622
623/*
624 * BPF_KSYSCALL is a variant of BPF_KPROBE, which is intended for
625 * tracing syscall functions, like __x64_sys_close. It hides the underlying
626 * platform-specific low-level way of getting syscall input arguments from
627 * struct pt_regs, and provides a familiar typed and named function arguments
628 * syntax and semantics of accessing syscall input parameters.
629 *
630 * Original struct pt_regs * context is preserved as 'ctx' argument. This might
631 * be necessary when using BPF helpers like bpf_perf_event_output().
632 *
633 * At the moment BPF_KSYSCALL does not transparently handle all the calling
634 * convention quirks for the following syscalls:
635 *
636 * - mmap(): __ARCH_WANT_SYS_OLD_MMAP.
637 * - clone(): CONFIG_CLONE_BACKWARDS, CONFIG_CLONE_BACKWARDS2 and
638 * CONFIG_CLONE_BACKWARDS3.
639 * - socket-related syscalls: __ARCH_WANT_SYS_SOCKETCALL.
640 * - compat syscalls.
641 *
642 * This may or may not change in the future. User needs to take extra measures
643 * to handle such quirks explicitly, if necessary.
644 *
645 * This macro relies on BPF CO-RE support and virtual __kconfig externs.
646 */
647#define BPF_KSYSCALL(name, args...) \
648name(struct pt_regs *ctx); \
649extern _Bool LINUX_HAS_SYSCALL_WRAPPER __kconfig; \
650static __always_inline typeof(name(0)) \
651____##name(struct pt_regs *ctx, ##args); \
652typeof(name(0)) name(struct pt_regs *ctx) \
653{ \
654 struct pt_regs *regs = LINUX_HAS_SYSCALL_WRAPPER \
655 ? (struct pt_regs *)PT_REGS_PARM1(ctx) \
656 : ctx; \
657 _Pragma("GCC diagnostic push") \
658 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
659 if (LINUX_HAS_SYSCALL_WRAPPER) \
660 return ____##name(___bpf_syswrap_args(args)); \
661 else \
662 return ____##name(___bpf_syscall_args(args)); \
663 _Pragma("GCC diagnostic pop") \
664} \
665static __always_inline typeof(name(0)) \
666____##name(struct pt_regs *ctx, ##args)
667
668#define BPF_KPROBE_SYSCALL BPF_KSYSCALL
669
670#endif