use core::ffi::c_void; use crate::{args::FromPtRegs, BpfContext}; // aarch64 uses user_pt_regs instead of pt_regs #[cfg(not(bpf_target_arch = "aarch64"))] use crate::bindings::pt_regs; #[cfg(bpf_target_arch = "aarch64")] use crate::bindings::user_pt_regs as pt_regs; pub struct ProbeContext { pub regs: *mut pt_regs, } impl ProbeContext { pub fn new(ctx: *mut c_void) -> ProbeContext { ProbeContext { regs: ctx as *mut pt_regs, } } /// Returns the `n`th argument to passed to the probe function, starting from 0. /// /// # Examples /// /// ```no_run /// # #![allow(non_camel_case_types)] /// # #![allow(dead_code)] /// # use aya_bpf::{programs::ProbeContext, cty::c_int, helpers::bpf_probe_read}; /// # type pid_t = c_int; /// # struct task_struct { /// # pid: pid_t, /// # } /// unsafe fn try_kprobe_try_to_wake_up(ctx: ProbeContext) -> Result { /// let tp: *const task_struct = ctx.arg(0).ok_or(1u32)?; /// let pid = bpf_probe_read(&(*tp).pid as *const pid_t).map_err(|_| 1u32)?; /// /// // Do something with pid or something else with tp /// /// Ok(0) /// } /// ``` pub fn arg(&self, n: usize) -> Option { T::from_argument(unsafe { &*self.regs }, n) } /// Returns the `n`th stack argument to passed to the probe function, starting from 0. /// /// # Examples /// /// ```no_run /// # # for c-function in x86_64 platform like: /// # # void function_with_many_args(int64 a0, int64 a1, int64 a2, /// # # int64 a3, int64 a4, int64 a5, int64 a6) /// # #![allow(non_camel_case_types)] /// # #![allow(dead_code)] /// unsafe fn try_print_args(ctx: ProbeContext) -> Result { /// let a_0: i64 = ctx.arg(0).ok_or(1u32)?; /// let a_1: i64 = ctx.arg(1).ok_or(1u32)?; /// let a_2: i64 = ctx.arg(2).ok_or(1u32)?; /// let a_3: i64 = ctx.arg(3).ok_or(1u32)?; /// let a_4: i64 = ctx.arg(4).ok_or(1u32)?; /// let a_5: i64 = ctx.arg(5).ok_or(1u32)?; /// let a_6: i64 = ctx.stack_arg(0).ok_or(1u32)?; /// info!( /// &ctx, /// "arg 0-6: {}, {}, {}, {}, {}, {}, {}", /// a_0, /// a_1, /// a_2, /// a_3, /// a_4, /// a_5, /// a_6 /// ); /// /// // Do something with args /// /// Ok(0) /// } /// ``` pub fn stack_arg(&self, n: usize) -> Option { T::from_stack_argument(unsafe { &*self.regs }, n) } /// Returns the return value of the probed function. /// /// # Examples /// /// ```no_run /// # #![allow(dead_code)] /// # use aya_bpf::{programs::ProbeContext, cty::c_int}; /// unsafe fn try_kretprobe_try_to_wake_up(ctx: ProbeContext) -> Result { /// let retval: c_int = ctx.ret().ok_or(1u32)?; /// /// // Do something with retval /// /// Ok(0) /// } /// ``` pub fn ret(&self) -> Option { T::from_retval(unsafe { &*self.regs }) } } impl BpfContext for ProbeContext { fn as_ptr(&self) -> *mut c_void { self.regs as *mut c_void } }