1 /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
2 #ifndef __BPF_TRACING_H__
3 #define __BPF_TRACING_H__
4 
5 #include <bpf/bpf_helpers.h>
6 
7 /* Scan the ARCH passed in from ARCH env variable (see Makefile) */
8 #if defined(__TARGET_ARCH_x86)
9 	#define bpf_target_x86
10 	#define bpf_target_defined
11 #elif defined(__TARGET_ARCH_s390)
12 	#define bpf_target_s390
13 	#define bpf_target_defined
14 #elif defined(__TARGET_ARCH_arm)
15 	#define bpf_target_arm
16 	#define bpf_target_defined
17 #elif defined(__TARGET_ARCH_arm64)
18 	#define bpf_target_arm64
19 	#define bpf_target_defined
20 #elif defined(__TARGET_ARCH_mips)
21 	#define bpf_target_mips
22 	#define bpf_target_defined
23 #elif defined(__TARGET_ARCH_powerpc)
24 	#define bpf_target_powerpc
25 	#define bpf_target_defined
26 #elif defined(__TARGET_ARCH_sparc)
27 	#define bpf_target_sparc
28 	#define bpf_target_defined
29 #elif defined(__TARGET_ARCH_riscv)
30 	#define bpf_target_riscv
31 	#define bpf_target_defined
32 #elif defined(__TARGET_ARCH_arc)
33 	#define bpf_target_arc
34 	#define bpf_target_defined
35 #else
36 
37 /* Fall back to what the compiler says */
38 #if defined(__x86_64__)
39 	#define bpf_target_x86
40 	#define bpf_target_defined
41 #elif defined(__s390__)
42 	#define bpf_target_s390
43 	#define bpf_target_defined
44 #elif defined(__arm__)
45 	#define bpf_target_arm
46 	#define bpf_target_defined
47 #elif defined(__aarch64__)
48 	#define bpf_target_arm64
49 	#define bpf_target_defined
50 #elif defined(__mips__)
51 	#define bpf_target_mips
52 	#define bpf_target_defined
53 #elif defined(__powerpc__)
54 	#define bpf_target_powerpc
55 	#define bpf_target_defined
56 #elif defined(__sparc__)
57 	#define bpf_target_sparc
58 	#define bpf_target_defined
59 #elif defined(__riscv) && __riscv_xlen == 64
60 	#define bpf_target_riscv
61 	#define bpf_target_defined
62 #elif defined(__arc__)
63 	#define bpf_target_arc
64 	#define bpf_target_defined
65 #endif /* no compiler target */
66 
67 #endif
68 
69 #ifndef __BPF_TARGET_MISSING
70 #define __BPF_TARGET_MISSING "GCC error \"Must specify a BPF target arch via __TARGET_ARCH_xxx\""
71 #endif
72 
73 #if defined(bpf_target_x86)
74 
75 #if defined(__KERNEL__) || defined(__VMLINUX_H__)
76 
77 #define __PT_PARM1_REG di
78 #define __PT_PARM2_REG si
79 #define __PT_PARM3_REG dx
80 #define __PT_PARM4_REG cx
81 #define __PT_PARM5_REG r8
82 #define __PT_RET_REG sp
83 #define __PT_FP_REG bp
84 #define __PT_RC_REG ax
85 #define __PT_SP_REG sp
86 #define __PT_IP_REG ip
87 /* syscall uses r10 for PARM4 */
88 #define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)
89 #define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)
90 
91 #else
92 
93 #ifdef __i386__
94 
95 #define __PT_PARM1_REG eax
96 #define __PT_PARM2_REG edx
97 #define __PT_PARM3_REG ecx
98 /* i386 kernel is built with -mregparm=3 */
99 #define __PT_PARM4_REG __unsupported__
100 #define __PT_PARM5_REG __unsupported__
101 #define __PT_RET_REG esp
102 #define __PT_FP_REG ebp
103 #define __PT_RC_REG eax
104 #define __PT_SP_REG esp
105 #define __PT_IP_REG eip
106 
107 #else /* __i386__ */
108 
109 #define __PT_PARM1_REG rdi
110 #define __PT_PARM2_REG rsi
111 #define __PT_PARM3_REG rdx
112 #define __PT_PARM4_REG rcx
113 #define __PT_PARM5_REG r8
114 #define __PT_RET_REG rsp
115 #define __PT_FP_REG rbp
116 #define __PT_RC_REG rax
117 #define __PT_SP_REG rsp
118 #define __PT_IP_REG rip
119 /* syscall uses r10 for PARM4 */
120 #define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)
121 #define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)
122 
123 #endif /* __i386__ */
124 
125 #endif /* __KERNEL__ || __VMLINUX_H__ */
126 
127 #elif defined(bpf_target_s390)
128 
129 struct pt_regs___s390 {
130 	unsigned long orig_gpr2;
131 };
132 
133 /* s390 provides user_pt_regs instead of struct pt_regs to userspace */
134 #define __PT_REGS_CAST(x) ((const user_pt_regs *)(x))
135 #define __PT_PARM1_REG gprs[2]
136 #define __PT_PARM2_REG gprs[3]
137 #define __PT_PARM3_REG gprs[4]
138 #define __PT_PARM4_REG gprs[5]
139 #define __PT_PARM5_REG gprs[6]
140 #define __PT_RET_REG grps[14]
141 #define __PT_FP_REG gprs[11]	/* Works only with CONFIG_FRAME_POINTER */
142 #define __PT_RC_REG gprs[2]
143 #define __PT_SP_REG gprs[15]
144 #define __PT_IP_REG psw.addr
145 #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)
146 #define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___s390 *)(x), orig_gpr2)
147 
148 #elif defined(bpf_target_arm)
149 
150 #define __PT_PARM1_REG uregs[0]
151 #define __PT_PARM2_REG uregs[1]
152 #define __PT_PARM3_REG uregs[2]
153 #define __PT_PARM4_REG uregs[3]
154 #define __PT_PARM5_REG uregs[4]
155 #define __PT_RET_REG uregs[14]
156 #define __PT_FP_REG uregs[11]	/* Works only with CONFIG_FRAME_POINTER */
157 #define __PT_RC_REG uregs[0]
158 #define __PT_SP_REG uregs[13]
159 #define __PT_IP_REG uregs[12]
160 
161 #elif defined(bpf_target_arm64)
162 
163 struct pt_regs___arm64 {
164 	unsigned long orig_x0;
165 };
166 
167 /* arm64 provides struct user_pt_regs instead of struct pt_regs to userspace */
168 #define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x))
169 #define __PT_PARM1_REG regs[0]
170 #define __PT_PARM2_REG regs[1]
171 #define __PT_PARM3_REG regs[2]
172 #define __PT_PARM4_REG regs[3]
173 #define __PT_PARM5_REG regs[4]
174 #define __PT_RET_REG regs[30]
175 #define __PT_FP_REG regs[29]	/* Works only with CONFIG_FRAME_POINTER */
176 #define __PT_RC_REG regs[0]
177 #define __PT_SP_REG sp
178 #define __PT_IP_REG pc
179 #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)
180 #define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___arm64 *)(x), orig_x0)
181 
182 #elif defined(bpf_target_mips)
183 
184 #define __PT_PARM1_REG regs[4]
185 #define __PT_PARM2_REG regs[5]
186 #define __PT_PARM3_REG regs[6]
187 #define __PT_PARM4_REG regs[7]
188 #define __PT_PARM5_REG regs[8]
189 #define __PT_RET_REG regs[31]
190 #define __PT_FP_REG regs[30]	/* Works only with CONFIG_FRAME_POINTER */
191 #define __PT_RC_REG regs[2]
192 #define __PT_SP_REG regs[29]
193 #define __PT_IP_REG cp0_epc
194 
195 #elif defined(bpf_target_powerpc)
196 
197 #define __PT_PARM1_REG gpr[3]
198 #define __PT_PARM2_REG gpr[4]
199 #define __PT_PARM3_REG gpr[5]
200 #define __PT_PARM4_REG gpr[6]
201 #define __PT_PARM5_REG gpr[7]
202 #define __PT_RET_REG regs[31]
203 #define __PT_FP_REG __unsupported__
204 #define __PT_RC_REG gpr[3]
205 #define __PT_SP_REG sp
206 #define __PT_IP_REG nip
207 /* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER. */
208 #define PT_REGS_SYSCALL_REGS(ctx) ctx
209 
210 #elif defined(bpf_target_sparc)
211 
212 #define __PT_PARM1_REG u_regs[UREG_I0]
213 #define __PT_PARM2_REG u_regs[UREG_I1]
214 #define __PT_PARM3_REG u_regs[UREG_I2]
215 #define __PT_PARM4_REG u_regs[UREG_I3]
216 #define __PT_PARM5_REG u_regs[UREG_I4]
217 #define __PT_RET_REG u_regs[UREG_I7]
218 #define __PT_FP_REG __unsupported__
219 #define __PT_RC_REG u_regs[UREG_I0]
220 #define __PT_SP_REG u_regs[UREG_FP]
221 /* Should this also be a bpf_target check for the sparc case? */
222 #if defined(__arch64__)
223 #define __PT_IP_REG tpc
224 #else
225 #define __PT_IP_REG pc
226 #endif
227 
228 #elif defined(bpf_target_riscv)
229 
230 #define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))
231 #define __PT_PARM1_REG a0
232 #define __PT_PARM2_REG a1
233 #define __PT_PARM3_REG a2
234 #define __PT_PARM4_REG a3
235 #define __PT_PARM5_REG a4
236 #define __PT_RET_REG ra
237 #define __PT_FP_REG s0
238 #define __PT_RC_REG a0
239 #define __PT_SP_REG sp
240 #define __PT_IP_REG pc
241 /* riscv does not select ARCH_HAS_SYSCALL_WRAPPER. */
242 #define PT_REGS_SYSCALL_REGS(ctx) ctx
243 
244 #elif defined(bpf_target_arc)
245 
246 /* arc provides struct user_pt_regs instead of struct pt_regs to userspace */
247 #define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))
248 #define __PT_PARM1_REG scratch.r0
249 #define __PT_PARM2_REG scratch.r1
250 #define __PT_PARM3_REG scratch.r2
251 #define __PT_PARM4_REG scratch.r3
252 #define __PT_PARM5_REG scratch.r4
253 #define __PT_RET_REG scratch.blink
254 #define __PT_FP_REG __unsupported__
255 #define __PT_RC_REG scratch.r0
256 #define __PT_SP_REG scratch.sp
257 #define __PT_IP_REG scratch.ret
258 /* arc does not select ARCH_HAS_SYSCALL_WRAPPER. */
259 #define PT_REGS_SYSCALL_REGS(ctx) ctx
260 
261 #endif
262 
263 #if defined(bpf_target_defined)
264 
265 struct pt_regs;
266 
267 /* allow some architecutres to override `struct pt_regs` */
268 #ifndef __PT_REGS_CAST
269 #define __PT_REGS_CAST(x) (x)
270 #endif
271 
272 #define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)
273 #define PT_REGS_PARM2(x) (__PT_REGS_CAST(x)->__PT_PARM2_REG)
274 #define PT_REGS_PARM3(x) (__PT_REGS_CAST(x)->__PT_PARM3_REG)
275 #define PT_REGS_PARM4(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG)
276 #define PT_REGS_PARM5(x) (__PT_REGS_CAST(x)->__PT_PARM5_REG)
277 #define PT_REGS_RET(x) (__PT_REGS_CAST(x)->__PT_RET_REG)
278 #define PT_REGS_FP(x) (__PT_REGS_CAST(x)->__PT_FP_REG)
279 #define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG)
280 #define PT_REGS_SP(x) (__PT_REGS_CAST(x)->__PT_SP_REG)
281 #define PT_REGS_IP(x) (__PT_REGS_CAST(x)->__PT_IP_REG)
282 
283 #define PT_REGS_PARM1_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_REG)
284 #define PT_REGS_PARM2_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_REG)
285 #define PT_REGS_PARM3_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_REG)
286 #define PT_REGS_PARM4_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_REG)
287 #define PT_REGS_PARM5_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_REG)
288 #define PT_REGS_RET_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RET_REG)
289 #define PT_REGS_FP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_FP_REG)
290 #define PT_REGS_RC_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RC_REG)
291 #define PT_REGS_SP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_SP_REG)
292 #define PT_REGS_IP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_IP_REG)
293 
294 #if defined(bpf_target_powerpc)
295 
296 #define BPF_KPROBE_READ_RET_IP(ip, ctx)		({ (ip) = (ctx)->link; })
297 #define BPF_KRETPROBE_READ_RET_IP		BPF_KPROBE_READ_RET_IP
298 
299 #elif defined(bpf_target_sparc)
300 
301 #define BPF_KPROBE_READ_RET_IP(ip, ctx)		({ (ip) = PT_REGS_RET(ctx); })
302 #define BPF_KRETPROBE_READ_RET_IP		BPF_KPROBE_READ_RET_IP
303 
304 #else
305 
306 #define BPF_KPROBE_READ_RET_IP(ip, ctx)					    \
307 	({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)PT_REGS_RET(ctx)); })
308 #define BPF_KRETPROBE_READ_RET_IP(ip, ctx)				    \
309 	({ bpf_probe_read_kernel(&(ip), sizeof(ip), (void *)(PT_REGS_FP(ctx) + sizeof(ip))); })
310 
311 #endif
312 
313 #ifndef PT_REGS_PARM1_SYSCALL
314 #define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1(x)
315 #endif
316 #define PT_REGS_PARM2_SYSCALL(x) PT_REGS_PARM2(x)
317 #define PT_REGS_PARM3_SYSCALL(x) PT_REGS_PARM3(x)
318 #ifndef PT_REGS_PARM4_SYSCALL
319 #define PT_REGS_PARM4_SYSCALL(x) PT_REGS_PARM4(x)
320 #endif
321 #define PT_REGS_PARM5_SYSCALL(x) PT_REGS_PARM5(x)
322 
323 #ifndef PT_REGS_PARM1_CORE_SYSCALL
324 #define PT_REGS_PARM1_CORE_SYSCALL(x) PT_REGS_PARM1_CORE(x)
325 #endif
326 #define PT_REGS_PARM2_CORE_SYSCALL(x) PT_REGS_PARM2_CORE(x)
327 #define PT_REGS_PARM3_CORE_SYSCALL(x) PT_REGS_PARM3_CORE(x)
328 #ifndef PT_REGS_PARM4_CORE_SYSCALL
329 #define PT_REGS_PARM4_CORE_SYSCALL(x) PT_REGS_PARM4_CORE(x)
330 #endif
331 #define PT_REGS_PARM5_CORE_SYSCALL(x) PT_REGS_PARM5_CORE(x)
332 
333 #else /* defined(bpf_target_defined) */
334 
335 #define PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
336 #define PT_REGS_PARM2(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
337 #define PT_REGS_PARM3(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
338 #define PT_REGS_PARM4(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
339 #define PT_REGS_PARM5(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
340 #define PT_REGS_RET(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
341 #define PT_REGS_FP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
342 #define PT_REGS_RC(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
343 #define PT_REGS_SP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
344 #define PT_REGS_IP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
345 
346 #define PT_REGS_PARM1_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
347 #define PT_REGS_PARM2_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
348 #define PT_REGS_PARM3_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
349 #define PT_REGS_PARM4_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
350 #define PT_REGS_PARM5_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
351 #define PT_REGS_RET_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
352 #define PT_REGS_FP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
353 #define PT_REGS_RC_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
354 #define PT_REGS_SP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
355 #define PT_REGS_IP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
356 
357 #define BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
358 #define BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
359 
360 #define PT_REGS_PARM1_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
361 #define PT_REGS_PARM2_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
362 #define PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
363 #define PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
364 #define PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
365 
366 #define PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
367 #define PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
368 #define PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
369 #define PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
370 #define PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
371 
372 #endif /* defined(bpf_target_defined) */
373 
374 /*
375  * When invoked from a syscall handler kprobe, returns a pointer to a
376  * struct pt_regs containing syscall arguments and suitable for passing to
377  * PT_REGS_PARMn_SYSCALL() and PT_REGS_PARMn_CORE_SYSCALL().
378  */
379 #ifndef PT_REGS_SYSCALL_REGS
380 /* By default, assume that the arch selects ARCH_HAS_SYSCALL_WRAPPER. */
381 #define PT_REGS_SYSCALL_REGS(ctx) ((struct pt_regs *)PT_REGS_PARM1(ctx))
382 #endif
383 
384 #ifndef ___bpf_concat
385 #define ___bpf_concat(a, b) a ## b
386 #endif
387 #ifndef ___bpf_apply
388 #define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
389 #endif
390 #ifndef ___bpf_nth
391 #define ___bpf_nth(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _a, _b, _c, N, ...) N
392 #endif
393 #ifndef ___bpf_narg
394 #define ___bpf_narg(...) ___bpf_nth(_, ##__VA_ARGS__, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0)
395 #endif
396 
397 #define ___bpf_ctx_cast0()            ctx
398 #define ___bpf_ctx_cast1(x)           ___bpf_ctx_cast0(), (void *)ctx[0]
399 #define ___bpf_ctx_cast2(x, args...)  ___bpf_ctx_cast1(args), (void *)ctx[1]
400 #define ___bpf_ctx_cast3(x, args...)  ___bpf_ctx_cast2(args), (void *)ctx[2]
401 #define ___bpf_ctx_cast4(x, args...)  ___bpf_ctx_cast3(args), (void *)ctx[3]
402 #define ___bpf_ctx_cast5(x, args...)  ___bpf_ctx_cast4(args), (void *)ctx[4]
403 #define ___bpf_ctx_cast6(x, args...)  ___bpf_ctx_cast5(args), (void *)ctx[5]
404 #define ___bpf_ctx_cast7(x, args...)  ___bpf_ctx_cast6(args), (void *)ctx[6]
405 #define ___bpf_ctx_cast8(x, args...)  ___bpf_ctx_cast7(args), (void *)ctx[7]
406 #define ___bpf_ctx_cast9(x, args...)  ___bpf_ctx_cast8(args), (void *)ctx[8]
407 #define ___bpf_ctx_cast10(x, args...) ___bpf_ctx_cast9(args), (void *)ctx[9]
408 #define ___bpf_ctx_cast11(x, args...) ___bpf_ctx_cast10(args), (void *)ctx[10]
409 #define ___bpf_ctx_cast12(x, args...) ___bpf_ctx_cast11(args), (void *)ctx[11]
410 #define ___bpf_ctx_cast(args...)      ___bpf_apply(___bpf_ctx_cast, ___bpf_narg(args))(args)
411 
412 /*
413  * BPF_PROG is a convenience wrapper for generic tp_btf/fentry/fexit and
414  * similar kinds of BPF programs, that accept input arguments as a single
415  * pointer to untyped u64 array, where each u64 can actually be a typed
416  * pointer or integer of different size. Instead of requring user to write
417  * manual casts and work with array elements by index, BPF_PROG macro
418  * allows user to declare a list of named and typed input arguments in the
419  * same syntax as for normal C function. All the casting is hidden and
420  * performed transparently, while user code can just assume working with
421  * function arguments of specified type and name.
422  *
423  * Original raw context argument is preserved as well as 'ctx' argument.
424  * This is useful when using BPF helpers that expect original context
425  * as one of the parameters (e.g., for bpf_perf_event_output()).
426  */
427 #define BPF_PROG(name, args...)						    \
428 name(unsigned long long *ctx);						    \
429 static __always_inline typeof(name(0))					    \
430 ____##name(unsigned long long *ctx, ##args);				    \
431 typeof(name(0)) name(unsigned long long *ctx)				    \
432 {									    \
433 	_Pragma("GCC diagnostic push")					    \
434 	_Pragma("GCC diagnostic ignored \"-Wint-conversion\"")		    \
435 	return ____##name(___bpf_ctx_cast(args));			    \
436 	_Pragma("GCC diagnostic pop")					    \
437 }									    \
438 static __always_inline typeof(name(0))					    \
439 ____##name(unsigned long long *ctx, ##args)
440 
441 #ifndef ___bpf_nth2
442 #define ___bpf_nth2(_, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13,	\
443 		    _14, _15, _16, _17, _18, _19, _20, _21, _22, _23, _24, N, ...) N
444 #endif
445 #ifndef ___bpf_narg2
446 #define ___bpf_narg2(...)	\
447 	___bpf_nth2(_, ##__VA_ARGS__, 12, 12, 11, 11, 10, 10, 9, 9, 8, 8, 7, 7,	\
448 		    6, 6, 5, 5, 4, 4, 3, 3, 2, 2, 1, 1, 0)
449 #endif
450 
451 #define ___bpf_treg_cnt(t) \
452 	__builtin_choose_expr(sizeof(t) == 1, 1,	\
453 	__builtin_choose_expr(sizeof(t) == 2, 1,	\
454 	__builtin_choose_expr(sizeof(t) == 4, 1,	\
455 	__builtin_choose_expr(sizeof(t) == 8, 1,	\
456 	__builtin_choose_expr(sizeof(t) == 16, 2,	\
457 			      (void)0)))))
458 
459 #define ___bpf_reg_cnt0()		(0)
460 #define ___bpf_reg_cnt1(t, x)		(___bpf_reg_cnt0() + ___bpf_treg_cnt(t))
461 #define ___bpf_reg_cnt2(t, x, args...)	(___bpf_reg_cnt1(args) + ___bpf_treg_cnt(t))
462 #define ___bpf_reg_cnt3(t, x, args...)	(___bpf_reg_cnt2(args) + ___bpf_treg_cnt(t))
463 #define ___bpf_reg_cnt4(t, x, args...)	(___bpf_reg_cnt3(args) + ___bpf_treg_cnt(t))
464 #define ___bpf_reg_cnt5(t, x, args...)	(___bpf_reg_cnt4(args) + ___bpf_treg_cnt(t))
465 #define ___bpf_reg_cnt6(t, x, args...)	(___bpf_reg_cnt5(args) + ___bpf_treg_cnt(t))
466 #define ___bpf_reg_cnt7(t, x, args...)	(___bpf_reg_cnt6(args) + ___bpf_treg_cnt(t))
467 #define ___bpf_reg_cnt8(t, x, args...)	(___bpf_reg_cnt7(args) + ___bpf_treg_cnt(t))
468 #define ___bpf_reg_cnt9(t, x, args...)	(___bpf_reg_cnt8(args) + ___bpf_treg_cnt(t))
469 #define ___bpf_reg_cnt10(t, x, args...)	(___bpf_reg_cnt9(args) + ___bpf_treg_cnt(t))
470 #define ___bpf_reg_cnt11(t, x, args...)	(___bpf_reg_cnt10(args) + ___bpf_treg_cnt(t))
471 #define ___bpf_reg_cnt12(t, x, args...)	(___bpf_reg_cnt11(args) + ___bpf_treg_cnt(t))
472 #define ___bpf_reg_cnt(args...)	 ___bpf_apply(___bpf_reg_cnt, ___bpf_narg2(args))(args)
473 
474 #define ___bpf_union_arg(t, x, n) \
475 	__builtin_choose_expr(sizeof(t) == 1, ({ union { __u8 z[1]; t x; } ___t = { .z = {ctx[n]}}; ___t.x; }), \
476 	__builtin_choose_expr(sizeof(t) == 2, ({ union { __u16 z[1]; t x; } ___t = { .z = {ctx[n]} }; ___t.x; }), \
477 	__builtin_choose_expr(sizeof(t) == 4, ({ union { __u32 z[1]; t x; } ___t = { .z = {ctx[n]} }; ___t.x; }), \
478 	__builtin_choose_expr(sizeof(t) == 8, ({ union { __u64 z[1]; t x; } ___t = {.z = {ctx[n]} }; ___t.x; }), \
479 	__builtin_choose_expr(sizeof(t) == 16, ({ union { __u64 z[2]; t x; } ___t = {.z = {ctx[n], ctx[n + 1]} }; ___t.x; }), \
480 			      (void)0)))))
481 
482 #define ___bpf_ctx_arg0(n, args...)
483 #define ___bpf_ctx_arg1(n, t, x)		, ___bpf_union_arg(t, x, n - ___bpf_reg_cnt1(t, x))
484 #define ___bpf_ctx_arg2(n, t, x, args...)	, ___bpf_union_arg(t, x, n - ___bpf_reg_cnt2(t, x, args)) ___bpf_ctx_arg1(n, args)
485 #define ___bpf_ctx_arg3(n, t, x, args...)	, ___bpf_union_arg(t, x, n - ___bpf_reg_cnt3(t, x, args)) ___bpf_ctx_arg2(n, args)
486 #define ___bpf_ctx_arg4(n, t, x, args...)	, ___bpf_union_arg(t, x, n - ___bpf_reg_cnt4(t, x, args)) ___bpf_ctx_arg3(n, args)
487 #define ___bpf_ctx_arg5(n, t, x, args...)	, ___bpf_union_arg(t, x, n - ___bpf_reg_cnt5(t, x, args)) ___bpf_ctx_arg4(n, args)
488 #define ___bpf_ctx_arg6(n, t, x, args...)	, ___bpf_union_arg(t, x, n - ___bpf_reg_cnt6(t, x, args)) ___bpf_ctx_arg5(n, args)
489 #define ___bpf_ctx_arg7(n, t, x, args...)	, ___bpf_union_arg(t, x, n - ___bpf_reg_cnt7(t, x, args)) ___bpf_ctx_arg6(n, args)
490 #define ___bpf_ctx_arg8(n, t, x, args...)	, ___bpf_union_arg(t, x, n - ___bpf_reg_cnt8(t, x, args)) ___bpf_ctx_arg7(n, args)
491 #define ___bpf_ctx_arg9(n, t, x, args...)	, ___bpf_union_arg(t, x, n - ___bpf_reg_cnt9(t, x, args)) ___bpf_ctx_arg8(n, args)
492 #define ___bpf_ctx_arg10(n, t, x, args...)	, ___bpf_union_arg(t, x, n - ___bpf_reg_cnt10(t, x, args)) ___bpf_ctx_arg9(n, args)
493 #define ___bpf_ctx_arg11(n, t, x, args...)	, ___bpf_union_arg(t, x, n - ___bpf_reg_cnt11(t, x, args)) ___bpf_ctx_arg10(n, args)
494 #define ___bpf_ctx_arg12(n, t, x, args...)	, ___bpf_union_arg(t, x, n - ___bpf_reg_cnt12(t, x, args)) ___bpf_ctx_arg11(n, args)
495 #define ___bpf_ctx_arg(args...)	___bpf_apply(___bpf_ctx_arg, ___bpf_narg2(args))(___bpf_reg_cnt(args), args)
496 
497 #define ___bpf_ctx_decl0()
498 #define ___bpf_ctx_decl1(t, x)			, t x
499 #define ___bpf_ctx_decl2(t, x, args...)		, t x ___bpf_ctx_decl1(args)
500 #define ___bpf_ctx_decl3(t, x, args...)		, t x ___bpf_ctx_decl2(args)
501 #define ___bpf_ctx_decl4(t, x, args...)		, t x ___bpf_ctx_decl3(args)
502 #define ___bpf_ctx_decl5(t, x, args...)		, t x ___bpf_ctx_decl4(args)
503 #define ___bpf_ctx_decl6(t, x, args...)		, t x ___bpf_ctx_decl5(args)
504 #define ___bpf_ctx_decl7(t, x, args...)		, t x ___bpf_ctx_decl6(args)
505 #define ___bpf_ctx_decl8(t, x, args...)		, t x ___bpf_ctx_decl7(args)
506 #define ___bpf_ctx_decl9(t, x, args...)		, t x ___bpf_ctx_decl8(args)
507 #define ___bpf_ctx_decl10(t, x, args...)	, t x ___bpf_ctx_decl9(args)
508 #define ___bpf_ctx_decl11(t, x, args...)	, t x ___bpf_ctx_decl10(args)
509 #define ___bpf_ctx_decl12(t, x, args...)	, t x ___bpf_ctx_decl11(args)
510 #define ___bpf_ctx_decl(args...)	___bpf_apply(___bpf_ctx_decl, ___bpf_narg2(args))(args)
511 
512 /*
513  * BPF_PROG2 is an enhanced version of BPF_PROG in order to handle struct
514  * arguments. Since each struct argument might take one or two u64 values
515  * in the trampoline stack, argument type size is needed to place proper number
516  * of u64 values for each argument. Therefore, BPF_PROG2 has different
517  * syntax from BPF_PROG. For example, for the following BPF_PROG syntax:
518  *
519  *   int BPF_PROG(test2, int a, int b) { ... }
520  *
521  * the corresponding BPF_PROG2 syntax is:
522  *
523  *   int BPF_PROG2(test2, int, a, int, b) { ... }
524  *
525  * where type and the corresponding argument name are separated by comma.
526  *
527  * Use BPF_PROG2 macro if one of the arguments might be a struct/union larger
528  * than 8 bytes:
529  *
530  *   int BPF_PROG2(test_struct_arg, struct bpf_testmod_struct_arg_1, a, int, b,
531  *		   int, c, int, d, struct bpf_testmod_struct_arg_2, e, int, ret)
532  *   {
533  *        // access a, b, c, d, e, and ret directly
534  *        ...
535  *   }
536  */
537 #define BPF_PROG2(name, args...)						\
538 name(unsigned long long *ctx);							\
539 static __always_inline typeof(name(0))						\
540 ____##name(unsigned long long *ctx ___bpf_ctx_decl(args));			\
541 typeof(name(0)) name(unsigned long long *ctx)					\
542 {										\
543 	return ____##name(ctx ___bpf_ctx_arg(args));				\
544 }										\
545 static __always_inline typeof(name(0))						\
546 ____##name(unsigned long long *ctx ___bpf_ctx_decl(args))
547 
548 struct pt_regs;
549 
550 #define ___bpf_kprobe_args0()           ctx
551 #define ___bpf_kprobe_args1(x)          ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx)
552 #define ___bpf_kprobe_args2(x, args...) ___bpf_kprobe_args1(args), (void *)PT_REGS_PARM2(ctx)
553 #define ___bpf_kprobe_args3(x, args...) ___bpf_kprobe_args2(args), (void *)PT_REGS_PARM3(ctx)
554 #define ___bpf_kprobe_args4(x, args...) ___bpf_kprobe_args3(args), (void *)PT_REGS_PARM4(ctx)
555 #define ___bpf_kprobe_args5(x, args...) ___bpf_kprobe_args4(args), (void *)PT_REGS_PARM5(ctx)
556 #define ___bpf_kprobe_args(args...)     ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)
557 
558 /*
559  * BPF_KPROBE serves the same purpose for kprobes as BPF_PROG for
560  * tp_btf/fentry/fexit BPF programs. It hides the underlying platform-specific
561  * low-level way of getting kprobe input arguments from struct pt_regs, and
562  * provides a familiar typed and named function arguments syntax and
563  * semantics of accessing kprobe input paremeters.
564  *
565  * Original struct pt_regs* context is preserved as 'ctx' argument. This might
566  * be necessary when using BPF helpers like bpf_perf_event_output().
567  */
568 #define BPF_KPROBE(name, args...)					    \
569 name(struct pt_regs *ctx);						    \
570 static __always_inline typeof(name(0))					    \
571 ____##name(struct pt_regs *ctx, ##args);				    \
572 typeof(name(0)) name(struct pt_regs *ctx)				    \
573 {									    \
574 	_Pragma("GCC diagnostic push")					    \
575 	_Pragma("GCC diagnostic ignored \"-Wint-conversion\"")		    \
576 	return ____##name(___bpf_kprobe_args(args));			    \
577 	_Pragma("GCC diagnostic pop")					    \
578 }									    \
579 static __always_inline typeof(name(0))					    \
580 ____##name(struct pt_regs *ctx, ##args)
581 
582 #define ___bpf_kretprobe_args0()       ctx
583 #define ___bpf_kretprobe_args1(x)      ___bpf_kretprobe_args0(), (void *)PT_REGS_RC(ctx)
584 #define ___bpf_kretprobe_args(args...) ___bpf_apply(___bpf_kretprobe_args, ___bpf_narg(args))(args)
585 
586 /*
587  * BPF_KRETPROBE is similar to BPF_KPROBE, except, it only provides optional
588  * return value (in addition to `struct pt_regs *ctx`), but no input
589  * arguments, because they will be clobbered by the time probed function
590  * returns.
591  */
592 #define BPF_KRETPROBE(name, args...)					    \
593 name(struct pt_regs *ctx);						    \
594 static __always_inline typeof(name(0))					    \
595 ____##name(struct pt_regs *ctx, ##args);				    \
596 typeof(name(0)) name(struct pt_regs *ctx)				    \
597 {									    \
598 	_Pragma("GCC diagnostic push")					    \
599 	_Pragma("GCC diagnostic ignored \"-Wint-conversion\"")		    \
600 	return ____##name(___bpf_kretprobe_args(args));			    \
601 	_Pragma("GCC diagnostic pop")					    \
602 }									    \
603 static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args)
604 
605 /* If kernel has CONFIG_ARCH_HAS_SYSCALL_WRAPPER, read pt_regs directly */
606 #define ___bpf_syscall_args0()           ctx
607 #define ___bpf_syscall_args1(x)          ___bpf_syscall_args0(), (void *)PT_REGS_PARM1_SYSCALL(regs)
608 #define ___bpf_syscall_args2(x, args...) ___bpf_syscall_args1(args), (void *)PT_REGS_PARM2_SYSCALL(regs)
609 #define ___bpf_syscall_args3(x, args...) ___bpf_syscall_args2(args), (void *)PT_REGS_PARM3_SYSCALL(regs)
610 #define ___bpf_syscall_args4(x, args...) ___bpf_syscall_args3(args), (void *)PT_REGS_PARM4_SYSCALL(regs)
611 #define ___bpf_syscall_args5(x, args...) ___bpf_syscall_args4(args), (void *)PT_REGS_PARM5_SYSCALL(regs)
612 #define ___bpf_syscall_args(args...)     ___bpf_apply(___bpf_syscall_args, ___bpf_narg(args))(args)
613 
614 /* If kernel doesn't have CONFIG_ARCH_HAS_SYSCALL_WRAPPER, we have to BPF_CORE_READ from pt_regs */
615 #define ___bpf_syswrap_args0()           ctx
616 #define ___bpf_syswrap_args1(x)          ___bpf_syswrap_args0(), (void *)PT_REGS_PARM1_CORE_SYSCALL(regs)
617 #define ___bpf_syswrap_args2(x, args...) ___bpf_syswrap_args1(args), (void *)PT_REGS_PARM2_CORE_SYSCALL(regs)
618 #define ___bpf_syswrap_args3(x, args...) ___bpf_syswrap_args2(args), (void *)PT_REGS_PARM3_CORE_SYSCALL(regs)
619 #define ___bpf_syswrap_args4(x, args...) ___bpf_syswrap_args3(args), (void *)PT_REGS_PARM4_CORE_SYSCALL(regs)
620 #define ___bpf_syswrap_args5(x, args...) ___bpf_syswrap_args4(args), (void *)PT_REGS_PARM5_CORE_SYSCALL(regs)
621 #define ___bpf_syswrap_args(args...)     ___bpf_apply(___bpf_syswrap_args, ___bpf_narg(args))(args)
622 
623 /*
624  * BPF_KSYSCALL is a variant of BPF_KPROBE, which is intended for
625  * tracing syscall functions, like __x64_sys_close. It hides the underlying
626  * platform-specific low-level way of getting syscall input arguments from
627  * struct pt_regs, and provides a familiar typed and named function arguments
628  * syntax and semantics of accessing syscall input parameters.
629  *
630  * Original struct pt_regs * context is preserved as 'ctx' argument. This might
631  * be necessary when using BPF helpers like bpf_perf_event_output().
632  *
633  * At the moment BPF_KSYSCALL does not transparently handle all the calling
634  * convention quirks for the following syscalls:
635  *
636  * - mmap(): __ARCH_WANT_SYS_OLD_MMAP.
637  * - clone(): CONFIG_CLONE_BACKWARDS, CONFIG_CLONE_BACKWARDS2 and
638  *            CONFIG_CLONE_BACKWARDS3.
639  * - socket-related syscalls: __ARCH_WANT_SYS_SOCKETCALL.
640  * - compat syscalls.
641  *
642  * This may or may not change in the future. User needs to take extra measures
643  * to handle such quirks explicitly, if necessary.
644  *
645  * This macro relies on BPF CO-RE support and virtual __kconfig externs.
646  */
647 #define BPF_KSYSCALL(name, args...)					    \
648 name(struct pt_regs *ctx);						    \
649 extern _Bool LINUX_HAS_SYSCALL_WRAPPER __kconfig;			    \
650 static __always_inline typeof(name(0))					    \
651 ____##name(struct pt_regs *ctx, ##args);				    \
652 typeof(name(0)) name(struct pt_regs *ctx)				    \
653 {									    \
654 	struct pt_regs *regs = LINUX_HAS_SYSCALL_WRAPPER		    \
655 			       ? (struct pt_regs *)PT_REGS_PARM1(ctx)	    \
656 			       : ctx;					    \
657 	_Pragma("GCC diagnostic push")					    \
658 	_Pragma("GCC diagnostic ignored \"-Wint-conversion\"")		    \
659 	if (LINUX_HAS_SYSCALL_WRAPPER)					    \
660 		return ____##name(___bpf_syswrap_args(args));		    \
661 	else								    \
662 		return ____##name(___bpf_syscall_args(args));		    \
663 	_Pragma("GCC diagnostic pop")					    \
664 }									    \
665 static __always_inline typeof(name(0))					    \
666 ____##name(struct pt_regs *ctx, ##args)
667 
668 #define BPF_KPROBE_SYSCALL BPF_KSYSCALL
669 
670 #endif
671