bpflbr: Init bpflbr

Signed-off-by: Leon Hwang <[email protected]>

Makefile

@@ -4,7 +4,21 @@
 GOBUILD := go build -v -trimpath
 GOBUILD_CGO_LDFLAGS := CGO_LDFLAGS='-O2 -g -lcapstone -static'
 
+GOGEN := go generate
+
+BPF_OBJ := lbr_bpfel.o lbr_bpfeb.o feat_bpfel.o feat_bpfeb.o
+BPF_SRC := bpf/lbr.c bpf/feature.c
+
 .DEFAULT_GOAL := build
 
-build:
+$(BPF_OBJ): $(BPF_SRC)
+	$(GOGEN)
+
+.PHONY: build
+build: $(BPF_OBJ)
 	$(GOBUILD_CGO_LDFLAGS) $(GOBUILD)
+
+.PHONY: clean
+clean:
+	rm -f $(BPF_OBJ)
+	rm -f bpflbr

bpf/feature.c

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: GPL-2.0 OR Apache-2.0
+/* Copyright 2024 Leon Hwang */
+
+#include "vmlinux.h"
+#include "bpf_helpers.h"
+#include "bpf_tracing.h"
+#include "bpf_core_read.h"
+
+struct bpf_features {
+    bool kprobe_happened;
+    bool has_ringbuf;
+    bool has_branch_snapshot;
+    bool has_func_ret;
+    bool has_func_ip;
+} features;
+
+SEC("fentry/__x64_sys_nanosleep")
+int detect(struct pt_regs *regs)
+{
+    features.kprobe_happened = true;
+
+    /* Detect if bpf_get_func_ip() helper is supported by the kernel.
+     * Added in: 9b99edcae5c8 ("bpf: Add bpf_get_func_ip helper for tracing programs")
+     */
+    features.has_func_ip = bpf_core_enum_value_exists(enum bpf_func_id, BPF_FUNC_get_func_ip);
+
+    /* Detect if bpf_get_func_ret() helper is supported by the kernel.
+     * Added in: f92c1e183604 ("bpf: Add get_func_[arg|ret|arg_cnt] helpers ")
+     */
+    features.has_func_ret = bpf_core_enum_value_exists(enum bpf_func_id, BPF_FUNC_get_func_ret);
+
+    /* Detect if bpf_get_branch_snapshot() helper is supported.
+     * Added in: 856c02dbce4f ("bpf: Introduce helper bpf_get_branch_snapshot")
+     */
+    features.has_branch_snapshot = bpf_core_enum_value_exists(enum bpf_func_id, BPF_FUNC_get_branch_snapshot);
+
+    /* Detect if BPF_MAP_TYPE_RINGBUF map is supported.
+     * Added in: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it")
+     */
+    features.has_ringbuf = bpf_core_enum_value_exists(enum bpf_map_type, BPF_MAP_TYPE_RINGBUF);
+
+    return 0;
+}
+
+char __license[] SEC("license") = "GPL";

bpf/headers/bpf_cleanup.h

@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: Apache-2.0
+/* Copyright 2024 Leon Hwang. */
+
+#ifndef __BPF_CLEANUP_H_
+#define __BPF_CLEANUP_H_
+
+#include "bpf_helpers.h"
+
+#ifndef __cleanup
+#define __cleanup(fn) __attribute__((cleanup(fn)))
+#endif
+
+struct guard_spinlock_t {
+    struct bpf_spin_lock *lock;
+};
+
+void
+guard_spinlock_destructor(struct guard_spinlock_t *guard)
+{
+    bpf_spin_unlock(guard->lock);
+}
+
+#define guard_spinlock_constructor(lock)        \
+({                                              \
+    struct guard_spinlock_t guard = { lock };   \
+    bpf_spin_lock(lock);                        \
+    guard;                                      \
+})
+
+#define guard_spinlock(lock)                                            \
+    struct guard_spinlock_t var __cleanup(guard_spinlock_destructor) =  \
+        guard_spinlock_constructor(lock)
+
+struct guard_ringbuf {
+    void *data;
+    int *err;
+};
+
+void
+guard_ringbuf_destructor(struct guard_ringbuf *guard)
+{
+    if (!guard->data)
+        return;
+
+    if (*guard->err)
+        bpf_ringbuf_discard(guard->data, 0);
+    else
+        bpf_ringbuf_submit(guard->data, 0);
+}
+
+#define guard_ringbuf_constructor(ringbuf, size, _err)  \
+({                                                      \
+    struct guard_ringbuf guard = { };                   \
+    guard.err = _err;                                   \
+    guard.data = bpf_ringbuf_reserve(ringbuf, size, 0); \
+    guard;                                              \
+})
+
+#define guard_ringbuf(_ringbuf, _data, _err)                        \
+    struct guard_ringbuf _g __cleanup(guard_ringbuf_destructor) =   \
+        guard_ringbuf_constructor(_ringbuf, sizeof(*_data), _err);  \
+    _data = (typeof(_data)) _g.data;
+
+#endif // __BPF_CLEANUP_H_