Commit ea403bb7 authored by Daniel Borkmann's avatar Daniel Borkmann
Browse files

Merge branch 'libbpf-extend-arguments-tracing' 



Andrii Nakryiko says:

====================
This patch set fixes and extends libbpf's bpf_tracing.h support for tracing
arguments of kprobes/uprobes, and syscall as a special case.

Depending on the architecture, anywhere between 3 and 8 arguments can be
passed to a function in registers (so relevant to kprobes and uprobes), but
before this patch set libbpf's macros in bpf_tracing.h only supported up to
5 arguments, which is limiting in practice. This patch set extends
bpf_tracing.h to support up to 8 arguments, if architecture allows. This
includes explicit PT_REGS_PARMx() macro family, as well as BPF_KPROBE() macro.

Now, with tracing syscall arguments situation is sometimes quite different.
For a lot of architectures syscall argument passing through registers differs
from function call sequence at least a little. For i386 it differs *a lot*.
This patch set addresses this issue across all currently supported
architectures and hopefully fixes existing issues. syscall(2) manpage defines
that either 6 or 7 arguments can be supported, depending on architecture, so
libbpf defines 6 or 7 registers per architecture to be used to fetch syscall
arguments.

Also, BPF_UPROBE and BPF_URETPROBE are introduced as part of this patch set.
They are aliases for BPF_KPROBE and BPF_KRETPROBE (as mechanics of argument
fetching of kernel functions and user-space functions are identical), but it
allows BPF users to have less confusing BPF-side code when working with
uprobes.

For both sets of changes selftests are extended to test these new register
definitions to architecture-defined limits. Unfortunately I don't have ability
to test it on all architectures, and BPF CI only tests 3 architecture (x86-64,
arm64, and s390x), so it would be greatly appreciated if people with access to
architectures other than above 3 helped review and test changes.
====================

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parents 7525daee a4d325ae

tools/lib/bpf/bpf_tracing.h

+265 −38
Original line number Diff line number Diff line
@@ -78,6 +78,10 @@ 


#if defined(bpf_target_x86)



/*

 * https://en.wikipedia.org/wiki/X86_calling_conventions#System_V_AMD64_ABI

 */



#if defined(__KERNEL__) || defined(__VMLINUX_H__)



#define __PT_PARM1_REG di
@@ -85,25 +89,40 @@ 
#define __PT_PARM3_REG dx

#define __PT_PARM4_REG cx

#define __PT_PARM5_REG r8

#define __PT_PARM6_REG r9

/*

 * Syscall uses r10 for PARM4. See arch/x86/entry/entry_64.S:entry_SYSCALL_64

 * comments in Linux sources. And refer to syscall(2) manpage.

 */

#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG r10

#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG

#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG



#define __PT_RET_REG sp

#define __PT_FP_REG bp

#define __PT_RC_REG ax

#define __PT_SP_REG sp

#define __PT_IP_REG ip

/* syscall uses r10 for PARM4 */

#define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)

#define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)



#else



#ifdef __i386__



/* i386 kernel is built with -mregparm=3 */

#define __PT_PARM1_REG eax

#define __PT_PARM2_REG edx

#define __PT_PARM3_REG ecx

/* i386 kernel is built with -mregparm=3 */

#define __PT_PARM4_REG __unsupported__

#define __PT_PARM5_REG __unsupported__

/* i386 syscall ABI is very different, refer to syscall(2) manpage */

#define __PT_PARM1_SYSCALL_REG ebx

#define __PT_PARM2_SYSCALL_REG ecx

#define __PT_PARM3_SYSCALL_REG edx

#define __PT_PARM4_SYSCALL_REG esi

#define __PT_PARM5_SYSCALL_REG edi

#define __PT_PARM6_SYSCALL_REG ebp



#define __PT_RET_REG esp

#define __PT_FP_REG ebp

#define __PT_RC_REG eax
@@ -117,14 +136,20 @@ 
#define __PT_PARM3_REG rdx

#define __PT_PARM4_REG rcx

#define __PT_PARM5_REG r8

#define __PT_PARM6_REG r9



#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG r10

#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG

#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG



#define __PT_RET_REG rsp

#define __PT_FP_REG rbp

#define __PT_RC_REG rax

#define __PT_SP_REG rsp

#define __PT_IP_REG rip

/* syscall uses r10 for PARM4 */

#define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)

#define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)



#endif /* __i386__ */
@@ -132,6 +157,10 @@ 


#elif defined(bpf_target_s390)



/*

 * https://github.com/IBM/s390x-abi/releases/download/v1.6/lzsabi_s390x.pdf

 */



struct pt_regs___s390 {

	unsigned long orig_gpr2;

};
@@ -143,21 +172,41 @@ struct pt_regs___s390 { 
#define __PT_PARM3_REG gprs[4]

#define __PT_PARM4_REG gprs[5]

#define __PT_PARM5_REG gprs[6]



#define __PT_PARM1_SYSCALL_REG orig_gpr2

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG

#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG

#define __PT_PARM6_SYSCALL_REG gprs[7]

#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)

#define PT_REGS_PARM1_CORE_SYSCALL(x) \

	BPF_CORE_READ((const struct pt_regs___s390 *)(x), __PT_PARM1_SYSCALL_REG)



#define __PT_RET_REG gprs[14]

#define __PT_FP_REG gprs[11]	/* Works only with CONFIG_FRAME_POINTER */

#define __PT_RC_REG gprs[2]

#define __PT_SP_REG gprs[15]

#define __PT_IP_REG psw.addr

#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)

#define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___s390 *)(x), orig_gpr2)



#elif defined(bpf_target_arm)



/*

 * https://github.com/ARM-software/abi-aa/blob/main/aapcs32/aapcs32.rst#machine-registers

 */



#define __PT_PARM1_REG uregs[0]

#define __PT_PARM2_REG uregs[1]

#define __PT_PARM3_REG uregs[2]

#define __PT_PARM4_REG uregs[3]

#define __PT_PARM5_REG uregs[4]



#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG

#define __PT_PARM6_SYSCALL_REG uregs[5]

#define __PT_PARM7_SYSCALL_REG uregs[6]



#define __PT_RET_REG uregs[14]

#define __PT_FP_REG uregs[11]	/* Works only with CONFIG_FRAME_POINTER */

#define __PT_RC_REG uregs[0]
@@ -166,6 +215,10 @@ struct pt_regs___s390 { 


#elif defined(bpf_target_arm64)



/*

 * https://github.com/ARM-software/abi-aa/blob/main/aapcs64/aapcs64.rst#machine-registers

 */



struct pt_regs___arm64 {

	unsigned long orig_x0;

};
@@ -177,21 +230,49 @@ struct pt_regs___arm64 { 
#define __PT_PARM3_REG regs[2]

#define __PT_PARM4_REG regs[3]

#define __PT_PARM5_REG regs[4]

#define __PT_PARM6_REG regs[5]

#define __PT_PARM7_REG regs[6]

#define __PT_PARM8_REG regs[7]



#define __PT_PARM1_SYSCALL_REG orig_x0

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG

#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG

#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG

#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)

#define PT_REGS_PARM1_CORE_SYSCALL(x) \

	BPF_CORE_READ((const struct pt_regs___arm64 *)(x), __PT_PARM1_SYSCALL_REG)



#define __PT_RET_REG regs[30]

#define __PT_FP_REG regs[29]	/* Works only with CONFIG_FRAME_POINTER */

#define __PT_RC_REG regs[0]

#define __PT_SP_REG sp

#define __PT_IP_REG pc

#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1_CORE_SYSCALL(x)

#define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ((const struct pt_regs___arm64 *)(x), orig_x0)



#elif defined(bpf_target_mips)



/*

 * N64 ABI is assumed right now.

 * https://en.wikipedia.org/wiki/MIPS_architecture#Calling_conventions

 */



#define __PT_PARM1_REG regs[4]

#define __PT_PARM2_REG regs[5]

#define __PT_PARM3_REG regs[6]

#define __PT_PARM4_REG regs[7]

#define __PT_PARM5_REG regs[8]

#define __PT_PARM6_REG regs[9]

#define __PT_PARM7_REG regs[10]

#define __PT_PARM8_REG regs[11]



#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG

#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG /* only N32/N64 */

#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG /* only N32/N64 */



#define __PT_RET_REG regs[31]

#define __PT_FP_REG regs[30]	/* Works only with CONFIG_FRAME_POINTER */

#define __PT_RC_REG regs[2]
@@ -200,26 +281,58 @@ struct pt_regs___arm64 { 


#elif defined(bpf_target_powerpc)



/*

 * http://refspecs.linux-foundation.org/elf/elfspec_ppc.pdf (page 3-14,

 * section "Function Calling Sequence")

 */



#define __PT_PARM1_REG gpr[3]

#define __PT_PARM2_REG gpr[4]

#define __PT_PARM3_REG gpr[5]

#define __PT_PARM4_REG gpr[6]

#define __PT_PARM5_REG gpr[7]

#define __PT_PARM6_REG gpr[8]

#define __PT_PARM7_REG gpr[9]

#define __PT_PARM8_REG gpr[10]



/* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER. */

#define PT_REGS_SYSCALL_REGS(ctx) ctx

#define __PT_PARM1_SYSCALL_REG orig_gpr3

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG

#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG

#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG

#if !defined(__arch64__)

#define __PT_PARM7_SYSCALL_REG __PT_PARM7_REG /* only powerpc (not powerpc64) */

#endif



#define __PT_RET_REG regs[31]

#define __PT_FP_REG __unsupported__

#define __PT_RC_REG gpr[3]

#define __PT_SP_REG sp

#define __PT_IP_REG nip

/* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER. */

#define PT_REGS_SYSCALL_REGS(ctx) ctx



#elif defined(bpf_target_sparc)



/*

 * https://en.wikipedia.org/wiki/Calling_convention#SPARC

 */



#define __PT_PARM1_REG u_regs[UREG_I0]

#define __PT_PARM2_REG u_regs[UREG_I1]

#define __PT_PARM3_REG u_regs[UREG_I2]

#define __PT_PARM4_REG u_regs[UREG_I3]

#define __PT_PARM5_REG u_regs[UREG_I4]

#define __PT_PARM6_REG u_regs[UREG_I5]



#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG

#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG

#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG



#define __PT_RET_REG u_regs[UREG_I7]

#define __PT_FP_REG __unsupported__

#define __PT_RC_REG u_regs[UREG_I0]
@@ -233,22 +346,42 @@ struct pt_regs___arm64 { 


#elif defined(bpf_target_riscv)



/*

 * https://github.com/riscv-non-isa/riscv-elf-psabi-doc/blob/master/riscv-cc.adoc#risc-v-calling-conventions

 */



#define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))

#define __PT_PARM1_REG a0

#define __PT_PARM2_REG a1

#define __PT_PARM3_REG a2

#define __PT_PARM4_REG a3

#define __PT_PARM5_REG a4

#define __PT_PARM6_REG a5

#define __PT_PARM7_REG a6

#define __PT_PARM8_REG a7



/* riscv does not select ARCH_HAS_SYSCALL_WRAPPER. */

#define PT_REGS_SYSCALL_REGS(ctx) ctx

#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG

#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG

#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG



#define __PT_RET_REG ra

#define __PT_FP_REG s0

#define __PT_RC_REG a0

#define __PT_SP_REG sp

#define __PT_IP_REG pc

/* riscv does not select ARCH_HAS_SYSCALL_WRAPPER. */

#define PT_REGS_SYSCALL_REGS(ctx) ctx



#elif defined(bpf_target_arc)



/*

 * Section "Function Calling Sequence" (page 24):

 * https://raw.githubusercontent.com/wiki/foss-for-synopsys-dwc-arc-processors/toolchain/files/ARCv2_ABI.pdf

 */



/* arc provides struct user_pt_regs instead of struct pt_regs to userspace */

#define __PT_REGS_CAST(x) ((const struct user_regs_struct *)(x))

#define __PT_PARM1_REG scratch.r0
@@ -256,30 +389,55 @@ struct pt_regs___arm64 { 
#define __PT_PARM3_REG scratch.r2

#define __PT_PARM4_REG scratch.r3

#define __PT_PARM5_REG scratch.r4

#define __PT_PARM6_REG scratch.r5

#define __PT_PARM7_REG scratch.r6

#define __PT_PARM8_REG scratch.r7



/* arc does not select ARCH_HAS_SYSCALL_WRAPPER. */

#define PT_REGS_SYSCALL_REGS(ctx) ctx

#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG

#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG

#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG



#define __PT_RET_REG scratch.blink

#define __PT_FP_REG __unsupported__

#define __PT_FP_REG scratch.fp

#define __PT_RC_REG scratch.r0

#define __PT_SP_REG scratch.sp

#define __PT_IP_REG scratch.ret

/* arc does not select ARCH_HAS_SYSCALL_WRAPPER. */

#define PT_REGS_SYSCALL_REGS(ctx) ctx



#elif defined(bpf_target_loongarch)



/* https://loongson.github.io/LoongArch-Documentation/LoongArch-ELF-ABI-EN.html */

/*

 * https://docs.kernel.org/loongarch/introduction.html

 * https://loongson.github.io/LoongArch-Documentation/LoongArch-ELF-ABI-EN.html

 */



#define __PT_PARM1_REG regs[4]

#define __PT_PARM2_REG regs[5]

#define __PT_PARM3_REG regs[6]

#define __PT_PARM4_REG regs[7]

#define __PT_PARM5_REG regs[8]

#define __PT_PARM6_REG regs[9]

#define __PT_PARM7_REG regs[10]

#define __PT_PARM8_REG regs[11]



/* loongarch does not select ARCH_HAS_SYSCALL_WRAPPER. */

#define PT_REGS_SYSCALL_REGS(ctx) ctx

#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG __PT_PARM4_REG

#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG

#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG



#define __PT_RET_REG regs[1]

#define __PT_FP_REG regs[22]

#define __PT_RC_REG regs[4]

#define __PT_SP_REG regs[3]

#define __PT_IP_REG csr_era

/* loongarch does not select ARCH_HAS_SYSCALL_WRAPPER. */

#define PT_REGS_SYSCALL_REGS(ctx) ctx



#endif
@@ -287,16 +445,49 @@ struct pt_regs___arm64 { 


struct pt_regs;



/* allow some architecutres to override `struct pt_regs` */

/* allow some architectures to override `struct pt_regs` */

#ifndef __PT_REGS_CAST

#define __PT_REGS_CAST(x) (x)

#endif



/*

 * Different architectures support different number of arguments passed

 * through registers. i386 supports just 3, some arches support up to 8.

 */

#ifndef __PT_PARM4_REG

#define __PT_PARM4_REG __unsupported__

#endif

#ifndef __PT_PARM5_REG

#define __PT_PARM5_REG __unsupported__

#endif

#ifndef __PT_PARM6_REG

#define __PT_PARM6_REG __unsupported__

#endif

#ifndef __PT_PARM7_REG

#define __PT_PARM7_REG __unsupported__

#endif

#ifndef __PT_PARM8_REG

#define __PT_PARM8_REG __unsupported__

#endif

/*

 * Similarly, syscall-specific conventions might differ between function call

 * conventions within each architecutre. All supported architectures pass

 * either 6 or 7 syscall arguments in registers.

 *

 * See syscall(2) manpage for succinct table with information on each arch.

 */

#ifndef __PT_PARM7_SYSCALL_REG

#define __PT_PARM7_SYSCALL_REG __unsupported__

#endif



#define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)

#define PT_REGS_PARM2(x) (__PT_REGS_CAST(x)->__PT_PARM2_REG)

#define PT_REGS_PARM3(x) (__PT_REGS_CAST(x)->__PT_PARM3_REG)

#define PT_REGS_PARM4(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG)

#define PT_REGS_PARM5(x) (__PT_REGS_CAST(x)->__PT_PARM5_REG)

#define PT_REGS_PARM6(x) (__PT_REGS_CAST(x)->__PT_PARM6_REG)

#define PT_REGS_PARM7(x) (__PT_REGS_CAST(x)->__PT_PARM7_REG)

#define PT_REGS_PARM8(x) (__PT_REGS_CAST(x)->__PT_PARM8_REG)

#define PT_REGS_RET(x) (__PT_REGS_CAST(x)->__PT_RET_REG)

#define PT_REGS_FP(x) (__PT_REGS_CAST(x)->__PT_FP_REG)

#define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG)
@@ -308,6 +499,9 @@ struct pt_regs; 
#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_REG)

#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_REG)

#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_REG)

#define PT_REGS_PARM6_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM6_REG)

#define PT_REGS_PARM7_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM7_REG)

#define PT_REGS_PARM8_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM8_REG)

#define PT_REGS_RET_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RET_REG)

#define PT_REGS_FP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_FP_REG)

#define PT_REGS_RC_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RC_REG)
@@ -334,24 +528,33 @@ struct pt_regs; 
#endif



#ifndef PT_REGS_PARM1_SYSCALL

#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1(x)

#define PT_REGS_PARM1_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM1_SYSCALL_REG)

#define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_SYSCALL_REG)

#endif

#ifndef PT_REGS_PARM2_SYSCALL

#define PT_REGS_PARM2_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM2_SYSCALL_REG)

#define PT_REGS_PARM2_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_SYSCALL_REG)

#endif

#ifndef PT_REGS_PARM3_SYSCALL

#define PT_REGS_PARM3_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM3_SYSCALL_REG)

#define PT_REGS_PARM3_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_SYSCALL_REG)

#endif

#define PT_REGS_PARM2_SYSCALL(x) PT_REGS_PARM2(x)

#define PT_REGS_PARM3_SYSCALL(x) PT_REGS_PARM3(x)

#ifndef PT_REGS_PARM4_SYSCALL

#define PT_REGS_PARM4_SYSCALL(x) PT_REGS_PARM4(x)

#define PT_REGS_PARM4_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM4_SYSCALL_REG)

#define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_SYSCALL_REG)

#endif

#define PT_REGS_PARM5_SYSCALL(x) PT_REGS_PARM5(x)



#ifndef PT_REGS_PARM1_CORE_SYSCALL

#define PT_REGS_PARM1_CORE_SYSCALL(x) PT_REGS_PARM1_CORE(x)

#ifndef PT_REGS_PARM5_SYSCALL

#define PT_REGS_PARM5_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM5_SYSCALL_REG)

#define PT_REGS_PARM5_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_SYSCALL_REG)

#endif

#define PT_REGS_PARM2_CORE_SYSCALL(x) PT_REGS_PARM2_CORE(x)

#define PT_REGS_PARM3_CORE_SYSCALL(x) PT_REGS_PARM3_CORE(x)

#ifndef PT_REGS_PARM4_CORE_SYSCALL

#define PT_REGS_PARM4_CORE_SYSCALL(x) PT_REGS_PARM4_CORE(x)

#ifndef PT_REGS_PARM6_SYSCALL

#define PT_REGS_PARM6_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM6_SYSCALL_REG)

#define PT_REGS_PARM6_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM6_SYSCALL_REG)

#endif

#ifndef PT_REGS_PARM7_SYSCALL

#define PT_REGS_PARM7_SYSCALL(x) (__PT_REGS_CAST(x)->__PT_PARM7_SYSCALL_REG)

#define PT_REGS_PARM7_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM7_SYSCALL_REG)

#endif

#define PT_REGS_PARM5_CORE_SYSCALL(x) PT_REGS_PARM5_CORE(x)



#else /* defined(bpf_target_defined) */
@@ -360,6 +563,9 @@ struct pt_regs; 
#define PT_REGS_PARM3(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM4(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM5(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM6(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM7(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM8(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_RET(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_FP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_RC(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
@@ -371,6 +577,9 @@ struct pt_regs; 
#define PT_REGS_PARM3_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM4_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM5_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM6_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM7_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM8_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_RET_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_FP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_RC_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })
@@ -385,12 +594,16 @@ struct pt_regs; 
#define PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM6_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM7_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })



#define PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM6_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

#define PT_REGS_PARM7_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })



#endif /* defined(bpf_target_defined) */
@@ -576,6 +789,9 @@ struct pt_regs; 
#define ___bpf_kprobe_args3(x, args...) ___bpf_kprobe_args2(args), (void *)PT_REGS_PARM3(ctx)

#define ___bpf_kprobe_args4(x, args...) ___bpf_kprobe_args3(args), (void *)PT_REGS_PARM4(ctx)

#define ___bpf_kprobe_args5(x, args...) ___bpf_kprobe_args4(args), (void *)PT_REGS_PARM5(ctx)

#define ___bpf_kprobe_args6(x, args...) ___bpf_kprobe_args5(args), (void *)PT_REGS_PARM6(ctx)

#define ___bpf_kprobe_args7(x, args...) ___bpf_kprobe_args6(args), (void *)PT_REGS_PARM7(ctx)

#define ___bpf_kprobe_args8(x, args...) ___bpf_kprobe_args7(args), (void *)PT_REGS_PARM8(ctx)

#define ___bpf_kprobe_args(args...)     ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)



/*
@@ -632,6 +848,8 @@ static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args) 
#define ___bpf_syscall_args3(x, args...) ___bpf_syscall_args2(args), (void *)PT_REGS_PARM3_SYSCALL(regs)

#define ___bpf_syscall_args4(x, args...) ___bpf_syscall_args3(args), (void *)PT_REGS_PARM4_SYSCALL(regs)

#define ___bpf_syscall_args5(x, args...) ___bpf_syscall_args4(args), (void *)PT_REGS_PARM5_SYSCALL(regs)

#define ___bpf_syscall_args6(x, args...) ___bpf_syscall_args5(args), (void *)PT_REGS_PARM6_SYSCALL(regs)

#define ___bpf_syscall_args7(x, args...) ___bpf_syscall_args6(args), (void *)PT_REGS_PARM7_SYSCALL(regs)

#define ___bpf_syscall_args(args...)     ___bpf_apply(___bpf_syscall_args, ___bpf_narg(args))(args)



/* If kernel doesn't have CONFIG_ARCH_HAS_SYSCALL_WRAPPER, we have to BPF_CORE_READ from pt_regs */
@@ -641,6 +859,8 @@ static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args) 
#define ___bpf_syswrap_args3(x, args...) ___bpf_syswrap_args2(args), (void *)PT_REGS_PARM3_CORE_SYSCALL(regs)

#define ___bpf_syswrap_args4(x, args...) ___bpf_syswrap_args3(args), (void *)PT_REGS_PARM4_CORE_SYSCALL(regs)

#define ___bpf_syswrap_args5(x, args...) ___bpf_syswrap_args4(args), (void *)PT_REGS_PARM5_CORE_SYSCALL(regs)

#define ___bpf_syswrap_args6(x, args...) ___bpf_syswrap_args5(args), (void *)PT_REGS_PARM6_CORE_SYSCALL(regs)

#define ___bpf_syswrap_args7(x, args...) ___bpf_syswrap_args6(args), (void *)PT_REGS_PARM7_CORE_SYSCALL(regs)

#define ___bpf_syswrap_args(args...)     ___bpf_apply(___bpf_syswrap_args, ___bpf_narg(args))(args)



/*
@@ -690,4 +910,11 @@ ____##name(struct pt_regs *ctx, ##args) 


#define BPF_KPROBE_SYSCALL BPF_KSYSCALL



/* BPF_UPROBE and BPF_URETPROBE are identical to BPF_KPROBE and BPF_KRETPROBE,

 * but are named way less confusingly for SEC("uprobe") and SEC("uretprobe")

 * use cases.

 */

#define BPF_UPROBE(name, args...)  BPF_KPROBE(name, ##args)

#define BPF_URETPROBE(name, args...)  BPF_KRETPROBE(name, ##args)



#endif

tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c

+17 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Copyright 2022 Sony Group Corporation */

#define _GNU_SOURCE

#include <fcntl.h>

#include <sys/prctl.h>

#include <test_progs.h>

#include "bpf_syscall_macro.skel.h"
@@ -13,6 +15,8 @@ void test_bpf_syscall_macro(void) 
	unsigned long exp_arg3 = 13;

	unsigned long exp_arg4 = 14;

	unsigned long exp_arg5 = 15;

	loff_t off_in, off_out;

	ssize_t r;



	/* check whether it can open program */

	skel = bpf_syscall_macro__open();
@@ -33,6 +37,7 @@ void test_bpf_syscall_macro(void) 


	/* check whether args of syscall are copied correctly */

	prctl(exp_arg1, exp_arg2, exp_arg3, exp_arg4, exp_arg5);



#if defined(__aarch64__) || defined(__s390__)

	ASSERT_NEQ(skel->bss->arg1, exp_arg1, "syscall_arg1");

#else
@@ -68,6 +73,18 @@ void test_bpf_syscall_macro(void) 
	ASSERT_EQ(skel->bss->arg4_syscall, exp_arg4, "BPF_KPROBE_SYSCALL_arg4");

	ASSERT_EQ(skel->bss->arg5_syscall, exp_arg5, "BPF_KPROBE_SYSCALL_arg5");



	r = splice(-42, &off_in, 42, &off_out, 0x12340000, SPLICE_F_NONBLOCK);

	err = -errno;

	ASSERT_EQ(r, -1, "splice_res");

	ASSERT_EQ(err, -EBADF, "splice_err");



	ASSERT_EQ(skel->bss->splice_fd_in, -42, "splice_arg1");

	ASSERT_EQ(skel->bss->splice_off_in, (__u64)&off_in, "splice_arg2");

	ASSERT_EQ(skel->bss->splice_fd_out, 42, "splice_arg3");

	ASSERT_EQ(skel->bss->splice_off_out, (__u64)&off_out, "splice_arg4");

	ASSERT_EQ(skel->bss->splice_len, 0x12340000, "splice_arg5");

	ASSERT_EQ(skel->bss->splice_flags, SPLICE_F_NONBLOCK, "splice_arg6");



cleanup:

	bpf_syscall_macro__destroy(skel);

}

tools/testing/selftests/bpf/prog_tests/uprobe_autoattach.c

+28 −5
Original line number Diff line number Diff line
@@ -3,18 +3,21 @@ 


#include <test_progs.h>

#include "test_uprobe_autoattach.skel.h"

#include "progs/bpf_misc.h"



/* uprobe attach point */

static noinline int autoattach_trigger_func(int arg)

static noinline int autoattach_trigger_func(int arg1, int arg2, int arg3,

					    int arg4, int arg5, int arg6,

					    int arg7, int arg8)

{

	asm volatile ("");

	return arg + 1;

	return arg1 + arg2 + arg3 + arg4 + arg5 + arg6 + arg7 + arg8 + 1;

}



void test_uprobe_autoattach(void)

{

	struct test_uprobe_autoattach *skel;

	int trigger_val = 100, trigger_ret;

	int trigger_ret;

	size_t malloc_sz = 1;

	char *mem;
@@ -28,22 +31,42 @@ void test_uprobe_autoattach(void) 
	skel->bss->test_pid = getpid();



	/* trigger & validate uprobe & uretprobe */

	trigger_ret = autoattach_trigger_func(trigger_val);

	trigger_ret = autoattach_trigger_func(1, 2, 3, 4, 5, 6, 7, 8);



	skel->bss->test_pid = getpid();



	/* trigger & validate shared library u[ret]probes attached by name */

	mem = malloc(malloc_sz);



	ASSERT_EQ(skel->bss->uprobe_byname_parm1, trigger_val, "check_uprobe_byname_parm1");

	ASSERT_EQ(skel->bss->uprobe_byname_parm1, 1, "check_uprobe_byname_parm1");

	ASSERT_EQ(skel->bss->uprobe_byname_ran, 1, "check_uprobe_byname_ran");

	ASSERT_EQ(skel->bss->uretprobe_byname_rc, trigger_ret, "check_uretprobe_byname_rc");

	ASSERT_EQ(skel->bss->uretprobe_byname_ret, trigger_ret, "check_uretprobe_byname_ret");

	ASSERT_EQ(skel->bss->uretprobe_byname_ran, 2, "check_uretprobe_byname_ran");

	ASSERT_EQ(skel->bss->uprobe_byname2_parm1, malloc_sz, "check_uprobe_byname2_parm1");

	ASSERT_EQ(skel->bss->uprobe_byname2_ran, 3, "check_uprobe_byname2_ran");

	ASSERT_EQ(skel->bss->uretprobe_byname2_rc, mem, "check_uretprobe_byname2_rc");

	ASSERT_EQ(skel->bss->uretprobe_byname2_ran, 4, "check_uretprobe_byname2_ran");



	ASSERT_EQ(skel->bss->a[0], 1, "arg1");

	ASSERT_EQ(skel->bss->a[1], 2, "arg2");

	ASSERT_EQ(skel->bss->a[2], 3, "arg3");

#if FUNC_REG_ARG_CNT > 3

	ASSERT_EQ(skel->bss->a[3], 4, "arg4");

#endif

#if FUNC_REG_ARG_CNT > 4

	ASSERT_EQ(skel->bss->a[4], 5, "arg5");

#endif

#if FUNC_REG_ARG_CNT > 5

	ASSERT_EQ(skel->bss->a[5], 6, "arg6");

#endif

#if FUNC_REG_ARG_CNT > 6

	ASSERT_EQ(skel->bss->a[6], 7, "arg7");

#endif

#if FUNC_REG_ARG_CNT > 7

	ASSERT_EQ(skel->bss->a[7], 8, "arg8");

#endif



	free(mem);

cleanup:

	test_uprobe_autoattach__destroy(skel);

tools/testing/selftests/bpf/progs/bpf_misc.h

+25 −0
Original line number Diff line number Diff line
@@ -28,4 +28,29 @@ 
#define SYS_PREFIX "__se_"

#endif



/* How many arguments are passed to function in register */

#if defined(__TARGET_ARCH_x86) || defined(__x86_64__)

#define FUNC_REG_ARG_CNT 6

#elif defined(__i386__)

#define FUNC_REG_ARG_CNT 3

#elif defined(__TARGET_ARCH_s390) || defined(__s390x__)

#define FUNC_REG_ARG_CNT 5

#elif defined(__TARGET_ARCH_arm) || defined(__arm__)

#define FUNC_REG_ARG_CNT 4

#elif defined(__TARGET_ARCH_arm64) || defined(__aarch64__)

#define FUNC_REG_ARG_CNT 8

#elif defined(__TARGET_ARCH_mips) || defined(__mips__)

#define FUNC_REG_ARG_CNT 8

#elif defined(__TARGET_ARCH_powerpc) || defined(__powerpc__) || defined(__powerpc64__)

#define FUNC_REG_ARG_CNT 8

#elif defined(__TARGET_ARCH_sparc) || defined(__sparc__)

#define FUNC_REG_ARG_CNT 6

#elif defined(__TARGET_ARCH_riscv) || defined(__riscv__)

#define FUNC_REG_ARG_CNT 8

#else

/* default to 5 for others */

#define FUNC_REG_ARG_CNT 5

#endif





#endif

tools/testing/selftests/bpf/progs/bpf_syscall_macro.c

+26 −0

File changed.

Preview size limit exceeded, changes collapsed.