1 /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
2 #ifndef __BPF_TRACING_H__
3 #define __BPF_TRACING_H__
5 #include <bpf/bpf_helpers.h>
7 /* Scan the ARCH passed in from ARCH env variable (see Makefile) */
8 #if defined(__TARGET_ARCH_x86)
10 #define bpf_target_defined
11 #elif defined(__TARGET_ARCH_s390)
12 #define bpf_target_s390
13 #define bpf_target_defined
14 #elif defined(__TARGET_ARCH_arm)
15 #define bpf_target_arm
16 #define bpf_target_defined
17 #elif defined(__TARGET_ARCH_arm64)
18 #define bpf_target_arm64
19 #define bpf_target_defined
20 #elif defined(__TARGET_ARCH_mips)
21 #define bpf_target_mips
22 #define bpf_target_defined
23 #elif defined(__TARGET_ARCH_powerpc)
24 #define bpf_target_powerpc
25 #define bpf_target_defined
26 #elif defined(__TARGET_ARCH_sparc)
27 #define bpf_target_sparc
28 #define bpf_target_defined
29 #elif defined(__TARGET_ARCH_riscv)
30 #define bpf_target_riscv
31 #define bpf_target_defined
32 #elif defined(__TARGET_ARCH_arc)
33 #define bpf_target_arc
34 #define bpf_target_defined
35 #elif defined(__TARGET_ARCH_loongarch)
36 #define bpf_target_loongarch
37 #define bpf_target_defined
40 /* Fall back to what the compiler says */
41 #if defined(__x86_64__)
42 #define bpf_target_x86
43 #define bpf_target_defined
44 #elif defined(__s390__)
45 #define bpf_target_s390
46 #define bpf_target_defined
47 #elif defined(__arm__)
48 #define bpf_target_arm
49 #define bpf_target_defined
50 #elif defined(__aarch64__)
51 #define bpf_target_arm64
52 #define bpf_target_defined
53 #elif defined(__mips__)
54 #define bpf_target_mips
55 #define bpf_target_defined
56 #elif defined(__powerpc__)
57 #define bpf_target_powerpc
58 #define bpf_target_defined
59 #elif defined(__sparc__)
60 #define bpf_target_sparc
61 #define bpf_target_defined
62 #elif defined(__riscv) && __riscv_xlen == 64
63 #define bpf_target_riscv
64 #define bpf_target_defined
65 #elif defined(__arc__)
66 #define bpf_target_arc
67 #define bpf_target_defined
68 #elif defined(__loongarch__)
69 #define bpf_target_loongarch
70 #define bpf_target_defined
71 #endif /* no compiler target */
75 #ifndef __BPF_TARGET_MISSING
76 #define __BPF_TARGET_MISSING "GCC error \"Must specify a BPF target arch via __TARGET_ARCH_xxx\""
79 #if defined(bpf_target_x86)
82 * https://en.wikipedia.org/wiki/X86_calling_conventions#System_V_AMD64_ABI
85 #if defined(__KERNEL__) || defined(__VMLINUX_H__)
87 #define __PT_PARM1_REG di
88 #define __PT_PARM2_REG si
89 #define __PT_PARM3_REG dx
90 #define __PT_PARM4_REG cx
91 #define __PT_PARM5_REG r8
92 #define __PT_PARM6_REG r9
93 #define __PT_RET_REG sp
94 #define __PT_FP_REG bp
95 #define __PT_RC_REG ax
96 #define __PT_SP_REG sp
97 #define __PT_IP_REG ip
98 /* syscall uses r10 for PARM4 */
99 #define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)
100 #define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)
106 /* i386 kernel is built with -mregparm=3 */
107 #define __PT_PARM1_REG eax
108 #define __PT_PARM2_REG edx
109 #define __PT_PARM3_REG ecx
110 #define __PT_RET_REG esp
111 #define __PT_FP_REG ebp
112 #define __PT_RC_REG eax
113 #define __PT_SP_REG esp
114 #define __PT_IP_REG eip
118 #define __PT_PARM1_REG rdi
119 #define __PT_PARM2_REG rsi
120 #define __PT_PARM3_REG rdx
121 #define __PT_PARM4_REG rcx
122 #define __PT_PARM5_REG r8
123 #define __PT_PARM6_REG r9
124 #define __PT_RET_REG rsp
125 #define __PT_FP_REG rbp
126 #define __PT_RC_REG rax
127 #define __PT_SP_REG rsp
128 #define __PT_IP_REG rip
129 /* syscall uses r10 for PARM4 */
130 #define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)
131 #define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)
133 #endif /* __i386__ */
135 #endif /* __KERNEL__ || __VMLINUX_H__ */
137 #elif defined(bpf_target_s390)
139 struct pt_regs___s390 {
140 unsigned long orig_gpr2;
143 /* s390 provides user_pt_regs instead of struct pt_regs to userspace */
144 #define __PT_REGS_CAST(x) ((const user_pt_regs *)(x))
145 #define __PT_PARM1_REG gprs[2]
146 #define __PT_PARM2_REG gprs[3]
147 #define __PT_PARM3_REG gprs[4]
148 #define __PT_PARM4_REG gprs[5]
149 #define __PT_PARM5_REG gprs[6]
150 #define __PT_RET_REG gprs[14]
151 #define __PT_FP_REG gprs[11] /* Works only with CONFIG_FRAME_POINTER */
152 #define __PT_RC_REG gprs[2]
153 #define __PT_SP_REG gprs[15]
154 #define __PT_IP_REG psw.addr
155 #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)
156 #define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___s390 *)(x), orig_gpr2)
158 #elif defined(bpf_target_arm)
161 * https://github.com/ARM-software/abi-aa/blob/main/aapcs32/aapcs32.rst#machine-registers
164 #define __PT_PARM1_REG uregs[0]
165 #define __PT_PARM2_REG uregs[1]
166 #define __PT_PARM3_REG uregs[2]
167 #define __PT_PARM4_REG uregs[3]
168 #define __PT_RET_REG uregs[14]
169 #define __PT_FP_REG uregs[11] /* Works only with CONFIG_FRAME_POINTER */
170 #define __PT_RC_REG uregs[0]
171 #define __PT_SP_REG uregs[13]
172 #define __PT_IP_REG uregs[12]
174 #elif defined(bpf_target_arm64)
177 * https://github.com/ARM-software/abi-aa/blob/main/aapcs64/aapcs64.rst#machine-registers
180 struct pt_regs___arm64 {
181 unsigned long orig_x0;
184 /* arm64 provides struct user_pt_regs instead of struct pt_regs to userspace */
185 #define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x))
186 #define __PT_PARM1_REG regs[0]
187 #define __PT_PARM2_REG regs[1]
188 #define __PT_PARM3_REG regs[2]
189 #define __PT_PARM4_REG regs[3]
190 #define __PT_PARM5_REG regs[4]
191 #define __PT_PARM6_REG regs[5]
192 #define __PT_PARM7_REG regs[6]
193 #define __PT_PARM8_REG regs[7]
194 #define __PT_RET_REG regs[30]
195 #define __PT_FP_REG regs[29] /* Works only with CONFIG_FRAME_POINTER */
196 #define __PT_RC_REG regs[0]
197 #define __PT_SP_REG sp
198 #define __PT_IP_REG pc
199 #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)
200 #define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___arm64 *)(x), orig_x0)
202 #elif defined(bpf_target_mips)
205 * N64 ABI is assumed right now.
206 * https://en.wikipedia.org/wiki/MIPS_architecture#Calling_conventions
209 #define __PT_PARM1_REG regs[4]
210 #define __PT_PARM2_REG regs[5]
211 #define __PT_PARM3_REG regs[6]
212 #define __PT_PARM4_REG regs[7]
213 #define __PT_PARM5_REG regs[8]
214 #define __PT_PARM6_REG regs[9]
215 #define __PT_PARM7_REG regs[10]
216 #define __PT_PARM8_REG regs[11]
217 #define __PT_RET_REG regs[31]
218 #define __PT_FP_REG regs[30] /* Works only with CONFIG_FRAME_POINTER */
219 #define __PT_RC_REG regs[2]
220 #define __PT_SP_REG regs[29]
221 #define __PT_IP_REG cp0_epc
223 #elif defined(bpf_target_powerpc)
226 * http://refspecs.linux-foundation.org/elf/elfspec_ppc.pdf (page 3-14,
227 * section "Function Calling Sequence")
230 #define __PT_PARM1_REG gpr[3]
231 #define __PT_PARM2_REG gpr[4]
232 #define __PT_PARM3_REG gpr[5]
233 #define __PT_PARM4_REG gpr[6]
234 #define __PT_PARM5_REG gpr[7]
235 #define __PT_PARM6_REG gpr[8]
236 #define __PT_PARM7_REG gpr[9]
237 #define __PT_PARM8_REG gpr[10]
238 #define __PT_RET_REG regs[31]
239 #define __PT_FP_REG __unsupported__
240 #define __PT_RC_REG gpr[3]
241 #define __PT_SP_REG sp
242 #define __PT_IP_REG nip
243 /* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER. */
244 #define PT_REGS_SYSCALL_REGS(ctx) ctx
246 #elif defined(bpf_target_sparc)
249 * https://en.wikipedia.org/wiki/Calling_convention#SPARC
252 #define __PT_PARM1_REG u_regs[UREG_I0]
253 #define __PT_PARM2_REG u_regs[UREG_I1]
254 #define __PT_PARM3_REG u_regs[UREG_I2]
255 #define __PT_PARM4_REG u_regs[UREG_I3]
256 #define __PT_PARM5_REG u_regs[UREG_I4]
257 #define __PT_PARM6_REG u_regs[UREG_I5]
258 #define __PT_RET_REG u_regs[UREG_I7]
259 #define __PT_FP_REG __unsupported__
260 #define __PT_RC_REG u_regs[UREG_I0]
261 #define __PT_SP_REG u_regs[UREG_FP]
262 /* Should this also be a bpf_target check for the sparc case? */
263 #if defined(__arch64__)
264 #define __PT_IP_REG tpc
266 #define __PT_IP_REG pc
269 #elif defined(bpf_target_riscv)
272 * https://github.com/riscv-non-isa/riscv-elf-psabi-doc/blob/master/riscv-cc.adoc#risc-v-calling-conventions
275 #define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))
276 #define __PT_PARM1_REG a0
277 #define __PT_PARM2_REG a1
278 #define __PT_PARM3_REG a2
279 #define __PT_PARM4_REG a3
280 #define __PT_PARM5_REG a4
281 #define __PT_PARM6_REG a5
282 #define __PT_PARM7_REG a6
283 #define __PT_PARM8_REG a7
284 #define __PT_RET_REG ra
285 #define __PT_FP_REG s0
286 #define __PT_RC_REG a0
287 #define __PT_SP_REG sp
288 #define __PT_IP_REG pc
289 /* riscv does not select ARCH_HAS_SYSCALL_WRAPPER. */
290 #define PT_REGS_SYSCALL_REGS(ctx) ctx
292 #elif defined(bpf_target_arc)
294 /* arc provides struct user_pt_regs instead of struct pt_regs to userspace */
295 #define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))
296 #define __PT_PARM1_REG scratch.r0
297 #define __PT_PARM2_REG scratch.r1
298 #define __PT_PARM3_REG scratch.r2
299 #define __PT_PARM4_REG scratch.r3
300 #define __PT_PARM5_REG scratch.r4
301 #define __PT_RET_REG scratch.blink
302 #define __PT_FP_REG __unsupported__
303 #define __PT_RC_REG scratch.r0
304 #define __PT_SP_REG scratch.sp
305 #define __PT_IP_REG scratch.ret
306 /* arc does not select ARCH_HAS_SYSCALL_WRAPPER. */
307 #define PT_REGS_SYSCALL_REGS(ctx) ctx
309 #elif defined(bpf_target_loongarch)
311 /* https://loongson.github.io/LoongArch-Documentation/LoongArch-ELF-ABI-EN.html */
313 #define __PT_PARM1_REG regs[4]
314 #define __PT_PARM2_REG regs[5]
315 #define __PT_PARM3_REG regs[6]
316 #define __PT_PARM4_REG regs[7]
317 #define __PT_PARM5_REG regs[8]
318 #define __PT_RET_REG regs[1]
319 #define __PT_FP_REG regs[22]
320 #define __PT_RC_REG regs[4]
321 #define __PT_SP_REG regs[3]
322 #define __PT_IP_REG csr_era
323 /* loongarch does not select ARCH_HAS_SYSCALL_WRAPPER. */
324 #define PT_REGS_SYSCALL_REGS(ctx) ctx
328 #if defined(bpf_target_defined)
332 /* allow some architectures to override `struct pt_regs` */
333 #ifndef __PT_REGS_CAST
334 #define __PT_REGS_CAST(x) (x)
338 * Different architectures support different number of arguments passed
339 * through registers. i386 supports just 3, some arches support up to 8.
341 #ifndef __PT_PARM4_REG
342 #define __PT_PARM4_REG __unsupported__
344 #ifndef __PT_PARM5_REG
345 #define __PT_PARM5_REG __unsupported__
347 #ifndef __PT_PARM6_REG
348 #define __PT_PARM6_REG __unsupported__
350 #ifndef __PT_PARM7_REG
351 #define __PT_PARM7_REG __unsupported__
353 #ifndef __PT_PARM8_REG
354 #define __PT_PARM8_REG __unsupported__
357 #define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)
358 #define PT_REGS_PARM2(x) (__PT_REGS_CAST(x)->__PT_PARM2_REG)
359 #define PT_REGS_PARM3(x) (__PT_REGS_CAST(x)->__PT_PARM3_REG)
360 #define PT_REGS_PARM4(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG)
361 #define PT_REGS_PARM5(x) (__PT_REGS_CAST(x)->__PT_PARM5_REG)
362 #define PT_REGS_PARM6(x) (__PT_REGS_CAST(x)->__PT_PARM6_REG)
363 #define PT_REGS_PARM7(x) (__PT_REGS_CAST(x)->__PT_PARM7_REG)
364 #define PT_REGS_PARM8(x) (__PT_REGS_CAST(x)->__PT_PARM8_REG)
365 #define PT_REGS_RET(x) (__PT_REGS_CAST(x)->__PT_RET_REG)
366 #define PT_REGS_FP(x) (__PT_REGS_CAST(x)->__PT_FP_REG)
367 #define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG)
368 #define PT_REGS_SP(x) (__PT_REGS_CAST(x)->__PT_SP_REG)
369 #define PT_REGS_IP(x) (__PT_REGS_CAST(x)->__PT_IP_REG)
371 #define PT_REGS_PARM1_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_REG)
372 #define PT_REGS_PARM2_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_REG)
373 #define PT_REGS_PARM3_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_REG)
374 #define PT_REGS_PARM4_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_REG)
375 #define PT_REGS_PARM5_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_REG)
376 #define PT_REGS_PARM6_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM6_REG)
377 #define PT_REGS_PARM7_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM7_REG)
378 #define PT_REGS_PARM8_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM8_REG)
379 #define PT_REGS_RET_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RET_REG)
380 #define PT_REGS_FP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_FP_REG)
381 #define PT_REGS_RC_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RC_REG)
382 #define PT_REGS_SP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_SP_REG)
383 #define PT_REGS_IP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_IP_REG)
385 #if defined(bpf_target_powerpc)
387 #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = (ctx)->link; })
388 #define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP
390 #elif defined(bpf_target_sparc)
392 #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ (ip) = PT_REGS_RET(ctx); })
393 #define BPF_KRETPROBE_READ_RET_IP BPF_KPROBE_READ_RET_IP
397 #define BPF_KPROBE_READ_RET_IP(ip, ctx) \
398 ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)PT_REGS_RET(ctx)); })
399 #define BPF_KRETPROBE_READ_RET_IP(ip, ctx) \
400 ({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)(PT_REGS_FP(ctx) + sizeof(ip))); })
404 #ifndef PT_REGS_PARM1_SYSCALL
405 #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1(x)
407 #define PT_REGS_PARM2_SYSCALL(x) PT_REGS_PARM2(x)
408 #define PT_REGS_PARM3_SYSCALL(x) PT_REGS_PARM3(x)
409 #ifndef PT_REGS_PARM4_SYSCALL
410 #define PT_REGS_PARM4_SYSCALL(x) PT_REGS_PARM4(x)
412 #define PT_REGS_PARM5_SYSCALL(x) PT_REGS_PARM5(x)
414 #ifndef PT_REGS_PARM1_CORE_SYSCALL
415 #define PT_REGS_PARM1_CORE_SYSCALL(x) PT_REGS_PARM1_CORE(x)
417 #define PT_REGS_PARM2_CORE_SYSCALL(x) PT_REGS_PARM2_CORE(x)
418 #define PT_REGS_PARM3_CORE_SYSCALL(x) PT_REGS_PARM3_CORE(x)
419 #ifndef PT_REGS_PARM4_CORE_SYSCALL
420 #define PT_REGS_PARM4_CORE_SYSCALL(x) PT_REGS_PARM4_CORE(x)
422 #define PT_REGS_PARM5_CORE_SYSCALL(x) PT_REGS_PARM5_CORE(x)
424 #else /* defined(bpf_target_defined) */
426 #define PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
427 #define PT_REGS_PARM2(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
428 #define PT_REGS_PARM3(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
429 #define PT_REGS_PARM4(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
430 #define PT_REGS_PARM5(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
431 #define PT_REGS_PARM6(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
432 #define PT_REGS_PARM7(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
433 #define PT_REGS_PARM8(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
434 #define PT_REGS_RET(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
435 #define PT_REGS_FP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
436 #define PT_REGS_RC(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
437 #define PT_REGS_SP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
438 #define PT_REGS_IP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
440 #define PT_REGS_PARM1_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
441 #define PT_REGS_PARM2_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
442 #define PT_REGS_PARM3_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
443 #define PT_REGS_PARM4_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
444 #define PT_REGS_PARM5_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
445 #define PT_REGS_PARM6_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
446 #define PT_REGS_PARM7_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
447 #define PT_REGS_PARM8_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
448 #define PT_REGS_RET_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
449 #define PT_REGS_FP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
450 #define PT_REGS_RC_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
451 #define PT_REGS_SP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
452 #define PT_REGS_IP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
454 #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
455 #define BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
457 #define PT_REGS_PARM1_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
458 #define PT_REGS_PARM2_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
459 #define PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
460 #define PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
461 #define PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
463 #define PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
464 #define PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
465 #define PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
466 #define PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
467 #define PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
469 #endif /* defined(bpf_target_defined) */
472 * When invoked from a syscall handler kprobe, returns a pointer to a
473 * struct pt_regs containing syscall arguments and suitable for passing to
474 * PT_REGS_PARMn_SYSCALL() and PT_REGS_PARMn_CORE_SYSCALL().
476 #ifndef PT_REGS_SYSCALL_REGS
477 /* By default, assume that the arch selects ARCH_HAS_SYSCALL_WRAPPER. */
478 #define PT_REGS_SYSCALL_REGS(ctx) ((struct pt_regs *)PT_REGS_PARM1(ctx))
481 #ifndef ___bpf_concat
482 #define ___bpf_concat(a, b) a ## b
485 #define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
488 #define ___bpf_nth(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _a, _b, _c, N, ...) N
491 #define ___bpf_narg(...) ___bpf_nth(_, ##__VA_ARGS__, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0)
494 #define ___bpf_ctx_cast0() ctx
495 #define ___bpf_ctx_cast1(x) ___bpf_ctx_cast0(), (void *)ctx[0]
496 #define ___bpf_ctx_cast2(x, args...) ___bpf_ctx_cast1(args), (void *)ctx[1]
497 #define ___bpf_ctx_cast3(x, args...) ___bpf_ctx_cast2(args), (void *)ctx[2]
498 #define ___bpf_ctx_cast4(x, args...) ___bpf_ctx_cast3(args), (void *)ctx[3]
499 #define ___bpf_ctx_cast5(x, args...) ___bpf_ctx_cast4(args), (void *)ctx[4]
500 #define ___bpf_ctx_cast6(x, args...) ___bpf_ctx_cast5(args), (void *)ctx[5]
501 #define ___bpf_ctx_cast7(x, args...) ___bpf_ctx_cast6(args), (void *)ctx[6]
502 #define ___bpf_ctx_cast8(x, args...) ___bpf_ctx_cast7(args), (void *)ctx[7]
503 #define ___bpf_ctx_cast9(x, args...) ___bpf_ctx_cast8(args), (void *)ctx[8]
504 #define ___bpf_ctx_cast10(x, args...) ___bpf_ctx_cast9(args), (void *)ctx[9]
505 #define ___bpf_ctx_cast11(x, args...) ___bpf_ctx_cast10(args), (void *)ctx[10]
506 #define ___bpf_ctx_cast12(x, args...) ___bpf_ctx_cast11(args), (void *)ctx[11]
507 #define ___bpf_ctx_cast(args...) ___bpf_apply(___bpf_ctx_cast, ___bpf_narg(args))(args)
510 * BPF_PROG is a convenience wrapper for generic tp_btf/fentry/fexit and
511 * similar kinds of BPF programs, that accept input arguments as a single
512 * pointer to untyped u64 array, where each u64 can actually be a typed
513 * pointer or integer of different size. Instead of requring user to write
514 * manual casts and work with array elements by index, BPF_PROG macro
515 * allows user to declare a list of named and typed input arguments in the
516 * same syntax as for normal C function. All the casting is hidden and
517 * performed transparently, while user code can just assume working with
518 * function arguments of specified type and name.
520 * Original raw context argument is preserved as well as 'ctx' argument.
521 * This is useful when using BPF helpers that expect original context
522 * as one of the parameters (e.g., for bpf_perf_event_output()).
524 #define BPF_PROG(name, args...) \
525 name(unsigned long long *ctx); \
526 static __always_inline typeof(name(0)) \
527 ____##name(unsigned long long *ctx, ##args); \
528 typeof(name(0)) name(unsigned long long *ctx) \
530 _Pragma("GCC diagnostic push") \
531 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
532 return ____##name(___bpf_ctx_cast(args)); \
533 _Pragma("GCC diagnostic pop") \
535 static __always_inline typeof(name(0)) \
536 ____##name(unsigned long long *ctx, ##args)
539 #define ___bpf_nth2(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, \
540 _14, _15, _16, _17, _18, _19, _20, _21, _22, _23, _24, N, ...) N
543 #define ___bpf_narg2(...) \
544 ___bpf_nth2(_, ##__VA_ARGS__, 12, 12, 11, 11, 10, 10, 9, 9, 8, 8, 7, 7, \
545 6, 6, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 0)
548 #define ___bpf_treg_cnt(t) \
549 __builtin_choose_expr(sizeof(t) == 1, 1, \
550 __builtin_choose_expr(sizeof(t) == 2, 1, \
551 __builtin_choose_expr(sizeof(t) == 4, 1, \
552 __builtin_choose_expr(sizeof(t) == 8, 1, \
553 __builtin_choose_expr(sizeof(t) == 16, 2, \
556 #define ___bpf_reg_cnt0() (0)
557 #define ___bpf_reg_cnt1(t, x) (___bpf_reg_cnt0() + ___bpf_treg_cnt(t))
558 #define ___bpf_reg_cnt2(t, x, args...) (___bpf_reg_cnt1(args) + ___bpf_treg_cnt(t))
559 #define ___bpf_reg_cnt3(t, x, args...) (___bpf_reg_cnt2(args) + ___bpf_treg_cnt(t))
560 #define ___bpf_reg_cnt4(t, x, args...) (___bpf_reg_cnt3(args) + ___bpf_treg_cnt(t))
561 #define ___bpf_reg_cnt5(t, x, args...) (___bpf_reg_cnt4(args) + ___bpf_treg_cnt(t))
562 #define ___bpf_reg_cnt6(t, x, args...) (___bpf_reg_cnt5(args) + ___bpf_treg_cnt(t))
563 #define ___bpf_reg_cnt7(t, x, args...) (___bpf_reg_cnt6(args) + ___bpf_treg_cnt(t))
564 #define ___bpf_reg_cnt8(t, x, args...) (___bpf_reg_cnt7(args) + ___bpf_treg_cnt(t))
565 #define ___bpf_reg_cnt9(t, x, args...) (___bpf_reg_cnt8(args) + ___bpf_treg_cnt(t))
566 #define ___bpf_reg_cnt10(t, x, args...) (___bpf_reg_cnt9(args) + ___bpf_treg_cnt(t))
567 #define ___bpf_reg_cnt11(t, x, args...) (___bpf_reg_cnt10(args) + ___bpf_treg_cnt(t))
568 #define ___bpf_reg_cnt12(t, x, args...) (___bpf_reg_cnt11(args) + ___bpf_treg_cnt(t))
569 #define ___bpf_reg_cnt(args...) ___bpf_apply(___bpf_reg_cnt, ___bpf_narg2(args))(args)
571 #define ___bpf_union_arg(t, x, n) \
572 __builtin_choose_expr(sizeof(t) == 1, ({ union { __u8 z[1]; t x; } ___t = { .z = {ctx[n]}}; ___t.x; }), \
573 __builtin_choose_expr(sizeof(t) == 2, ({ union { __u16 z[1]; t x; } ___t = { .z = {ctx[n]} }; ___t.x; }), \
574 __builtin_choose_expr(sizeof(t) == 4, ({ union { __u32 z[1]; t x; } ___t = { .z = {ctx[n]} }; ___t.x; }), \
575 __builtin_choose_expr(sizeof(t) == 8, ({ union { __u64 z[1]; t x; } ___t = {.z = {ctx[n]} }; ___t.x; }), \
576 __builtin_choose_expr(sizeof(t) == 16, ({ union { __u64 z[2]; t x; } ___t = {.z = {ctx[n], ctx[n + 1]} }; ___t.x; }), \
579 #define ___bpf_ctx_arg0(n, args...)
580 #define ___bpf_ctx_arg1(n, t, x) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt1(t, x))
581 #define ___bpf_ctx_arg2(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt2(t, x, args)) ___bpf_ctx_arg1(n, args)
582 #define ___bpf_ctx_arg3(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt3(t, x, args)) ___bpf_ctx_arg2(n, args)
583 #define ___bpf_ctx_arg4(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt4(t, x, args)) ___bpf_ctx_arg3(n, args)
584 #define ___bpf_ctx_arg5(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt5(t, x, args)) ___bpf_ctx_arg4(n, args)
585 #define ___bpf_ctx_arg6(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt6(t, x, args)) ___bpf_ctx_arg5(n, args)
586 #define ___bpf_ctx_arg7(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt7(t, x, args)) ___bpf_ctx_arg6(n, args)
587 #define ___bpf_ctx_arg8(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt8(t, x, args)) ___bpf_ctx_arg7(n, args)
588 #define ___bpf_ctx_arg9(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt9(t, x, args)) ___bpf_ctx_arg8(n, args)
589 #define ___bpf_ctx_arg10(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt10(t, x, args)) ___bpf_ctx_arg9(n, args)
590 #define ___bpf_ctx_arg11(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt11(t, x, args)) ___bpf_ctx_arg10(n, args)
591 #define ___bpf_ctx_arg12(n, t, x, args...) , ___bpf_union_arg(t, x, n - ___bpf_reg_cnt12(t, x, args)) ___bpf_ctx_arg11(n, args)
592 #define ___bpf_ctx_arg(args...) ___bpf_apply(___bpf_ctx_arg, ___bpf_narg2(args))(___bpf_reg_cnt(args), args)
594 #define ___bpf_ctx_decl0()
595 #define ___bpf_ctx_decl1(t, x) , t x
596 #define ___bpf_ctx_decl2(t, x, args...) , t x ___bpf_ctx_decl1(args)
597 #define ___bpf_ctx_decl3(t, x, args...) , t x ___bpf_ctx_decl2(args)
598 #define ___bpf_ctx_decl4(t, x, args...) , t x ___bpf_ctx_decl3(args)
599 #define ___bpf_ctx_decl5(t, x, args...) , t x ___bpf_ctx_decl4(args)
600 #define ___bpf_ctx_decl6(t, x, args...) , t x ___bpf_ctx_decl5(args)
601 #define ___bpf_ctx_decl7(t, x, args...) , t x ___bpf_ctx_decl6(args)
602 #define ___bpf_ctx_decl8(t, x, args...) , t x ___bpf_ctx_decl7(args)
603 #define ___bpf_ctx_decl9(t, x, args...) , t x ___bpf_ctx_decl8(args)
604 #define ___bpf_ctx_decl10(t, x, args...) , t x ___bpf_ctx_decl9(args)
605 #define ___bpf_ctx_decl11(t, x, args...) , t x ___bpf_ctx_decl10(args)
606 #define ___bpf_ctx_decl12(t, x, args...) , t x ___bpf_ctx_decl11(args)
607 #define ___bpf_ctx_decl(args...) ___bpf_apply(___bpf_ctx_decl, ___bpf_narg2(args))(args)
610 * BPF_PROG2 is an enhanced version of BPF_PROG in order to handle struct
611 * arguments. Since each struct argument might take one or two u64 values
612 * in the trampoline stack, argument type size is needed to place proper number
613 * of u64 values for each argument. Therefore, BPF_PROG2 has different
614 * syntax from BPF_PROG. For example, for the following BPF_PROG syntax:
616 * int BPF_PROG(test2, int a, int b) { ... }
618 * the corresponding BPF_PROG2 syntax is:
620 * int BPF_PROG2(test2, int, a, int, b) { ... }
622 * where type and the corresponding argument name are separated by comma.
624 * Use BPF_PROG2 macro if one of the arguments might be a struct/union larger
627 * int BPF_PROG2(test_struct_arg, struct bpf_testmod_struct_arg_1, a, int, b,
628 * int, c, int, d, struct bpf_testmod_struct_arg_2, e, int, ret)
630 * // access a, b, c, d, e, and ret directly
634 #define BPF_PROG2(name, args...) \
635 name(unsigned long long *ctx); \
636 static __always_inline typeof(name(0)) \
637 ____##name(unsigned long long *ctx ___bpf_ctx_decl(args)); \
638 typeof(name(0)) name(unsigned long long *ctx) \
640 return ____##name(ctx ___bpf_ctx_arg(args)); \
642 static __always_inline typeof(name(0)) \
643 ____##name(unsigned long long *ctx ___bpf_ctx_decl(args))
647 #define ___bpf_kprobe_args0() ctx
648 #define ___bpf_kprobe_args1(x) ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx)
649 #define ___bpf_kprobe_args2(x, args...) ___bpf_kprobe_args1(args), (void *)PT_REGS_PARM2(ctx)
650 #define ___bpf_kprobe_args3(x, args...) ___bpf_kprobe_args2(args), (void *)PT_REGS_PARM3(ctx)
651 #define ___bpf_kprobe_args4(x, args...) ___bpf_kprobe_args3(args), (void *)PT_REGS_PARM4(ctx)
652 #define ___bpf_kprobe_args5(x, args...) ___bpf_kprobe_args4(args), (void *)PT_REGS_PARM5(ctx)
653 #define ___bpf_kprobe_args6(x, args...) ___bpf_kprobe_args5(args), (void *)PT_REGS_PARM6(ctx)
654 #define ___bpf_kprobe_args7(x, args...) ___bpf_kprobe_args6(args), (void *)PT_REGS_PARM7(ctx)
655 #define ___bpf_kprobe_args8(x, args...) ___bpf_kprobe_args7(args), (void *)PT_REGS_PARM8(ctx)
656 #define ___bpf_kprobe_args(args...) ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)
659 * BPF_KPROBE serves the same purpose for kprobes as BPF_PROG for
660 * tp_btf/fentry/fexit BPF programs. It hides the underlying platform-specific
661 * low-level way of getting kprobe input arguments from struct pt_regs, and
662 * provides a familiar typed and named function arguments syntax and
663 * semantics of accessing kprobe input paremeters.
665 * Original struct pt_regs* context is preserved as 'ctx' argument. This might
666 * be necessary when using BPF helpers like bpf_perf_event_output().
668 #define BPF_KPROBE(name, args...) \
669 name(struct pt_regs *ctx); \
670 static __always_inline typeof(name(0)) \
671 ____##name(struct pt_regs *ctx, ##args); \
672 typeof(name(0)) name(struct pt_regs *ctx) \
674 _Pragma("GCC diagnostic push") \
675 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
676 return ____##name(___bpf_kprobe_args(args)); \
677 _Pragma("GCC diagnostic pop") \
679 static __always_inline typeof(name(0)) \
680 ____##name(struct pt_regs *ctx, ##args)
682 #define ___bpf_kretprobe_args0() ctx
683 #define ___bpf_kretprobe_args1(x) ___bpf_kretprobe_args0(), (void *)PT_REGS_RC(ctx)
684 #define ___bpf_kretprobe_args(args...) ___bpf_apply(___bpf_kretprobe_args, ___bpf_narg(args))(args)
687 * BPF_KRETPROBE is similar to BPF_KPROBE, except, it only provides optional
688 * return value (in addition to `struct pt_regs *ctx`), but no input
689 * arguments, because they will be clobbered by the time probed function
692 #define BPF_KRETPROBE(name, args...) \
693 name(struct pt_regs *ctx); \
694 static __always_inline typeof(name(0)) \
695 ____##name(struct pt_regs *ctx, ##args); \
696 typeof(name(0)) name(struct pt_regs *ctx) \
698 _Pragma("GCC diagnostic push") \
699 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
700 return ____##name(___bpf_kretprobe_args(args)); \
701 _Pragma("GCC diagnostic pop") \
703 static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args)
705 /* If kernel has CONFIG_ARCH_HAS_SYSCALL_WRAPPER, read pt_regs directly */
706 #define ___bpf_syscall_args0() ctx
707 #define ___bpf_syscall_args1(x) ___bpf_syscall_args0(), (void *)PT_REGS_PARM1_SYSCALL(regs)
708 #define ___bpf_syscall_args2(x, args...) ___bpf_syscall_args1(args), (void *)PT_REGS_PARM2_SYSCALL(regs)
709 #define ___bpf_syscall_args3(x, args...) ___bpf_syscall_args2(args), (void *)PT_REGS_PARM3_SYSCALL(regs)
710 #define ___bpf_syscall_args4(x, args...) ___bpf_syscall_args3(args), (void *)PT_REGS_PARM4_SYSCALL(regs)
711 #define ___bpf_syscall_args5(x, args...) ___bpf_syscall_args4(args), (void *)PT_REGS_PARM5_SYSCALL(regs)
712 #define ___bpf_syscall_args(args...) ___bpf_apply(___bpf_syscall_args, ___bpf_narg(args))(args)
714 /* If kernel doesn't have CONFIG_ARCH_HAS_SYSCALL_WRAPPER, we have to BPF_CORE_READ from pt_regs */
715 #define ___bpf_syswrap_args0() ctx
716 #define ___bpf_syswrap_args1(x) ___bpf_syswrap_args0(), (void *)PT_REGS_PARM1_CORE_SYSCALL(regs)
717 #define ___bpf_syswrap_args2(x, args...) ___bpf_syswrap_args1(args), (void *)PT_REGS_PARM2_CORE_SYSCALL(regs)
718 #define ___bpf_syswrap_args3(x, args...) ___bpf_syswrap_args2(args), (void *)PT_REGS_PARM3_CORE_SYSCALL(regs)
719 #define ___bpf_syswrap_args4(x, args...) ___bpf_syswrap_args3(args), (void *)PT_REGS_PARM4_CORE_SYSCALL(regs)
720 #define ___bpf_syswrap_args5(x, args...) ___bpf_syswrap_args4(args), (void *)PT_REGS_PARM5_CORE_SYSCALL(regs)
721 #define ___bpf_syswrap_args(args...) ___bpf_apply(___bpf_syswrap_args, ___bpf_narg(args))(args)
724 * BPF_KSYSCALL is a variant of BPF_KPROBE, which is intended for
725 * tracing syscall functions, like __x64_sys_close. It hides the underlying
726 * platform-specific low-level way of getting syscall input arguments from
727 * struct pt_regs, and provides a familiar typed and named function arguments
728 * syntax and semantics of accessing syscall input parameters.
730 * Original struct pt_regs * context is preserved as 'ctx' argument. This might
731 * be necessary when using BPF helpers like bpf_perf_event_output().
733 * At the moment BPF_KSYSCALL does not transparently handle all the calling
734 * convention quirks for the following syscalls:
736 * - mmap(): __ARCH_WANT_SYS_OLD_MMAP.
737 * - clone(): CONFIG_CLONE_BACKWARDS, CONFIG_CLONE_BACKWARDS2 and
738 * CONFIG_CLONE_BACKWARDS3.
739 * - socket-related syscalls: __ARCH_WANT_SYS_SOCKETCALL.
742 * This may or may not change in the future. User needs to take extra measures
743 * to handle such quirks explicitly, if necessary.
745 * This macro relies on BPF CO-RE support and virtual __kconfig externs.
747 #define BPF_KSYSCALL(name, args...) \
748 name(struct pt_regs *ctx); \
749 extern _Bool LINUX_HAS_SYSCALL_WRAPPER __kconfig; \
750 static __always_inline typeof(name(0)) \
751 ____##name(struct pt_regs *ctx, ##args); \
752 typeof(name(0)) name(struct pt_regs *ctx) \
754 struct pt_regs *regs = LINUX_HAS_SYSCALL_WRAPPER \
755 ? (struct pt_regs *)PT_REGS_PARM1(ctx) \
757 _Pragma("GCC diagnostic push") \
758 _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
759 if (LINUX_HAS_SYSCALL_WRAPPER) \
760 return ____##name(___bpf_syswrap_args(args)); \
762 return ____##name(___bpf_syscall_args(args)); \
763 _Pragma("GCC diagnostic pop") \
765 static __always_inline typeof(name(0)) \
766 ____##name(struct pt_regs *ctx, ##args)
768 #define BPF_KPROBE_SYSCALL BPF_KSYSCALL