1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (c) 2021 Facebook */ 3 4 #include "vmlinux.h" 5 #include <bpf/bpf_helpers.h> 6 #include <bpf/bpf_tracing.h> 7 #include <errno.h> 8 9 int my_tid; 10 11 __u64 kprobe_res; 12 __u64 kprobe_multi_res; 13 __u64 kretprobe_res; 14 __u64 uprobe_res; 15 __u64 uretprobe_res; 16 __u64 tp_res; 17 __u64 pe_res; 18 __u64 raw_tp_res; 19 __u64 tp_btf_res; 20 __u64 fentry_res; 21 __u64 fexit_res; 22 __u64 fmod_ret_res; 23 __u64 lsm_res; 24 25 static void update(void *ctx, __u64 *res) 26 { 27 if (my_tid != (u32)bpf_get_current_pid_tgid()) 28 return; 29 30 *res |= bpf_get_attach_cookie(ctx); 31 } 32 33 SEC("kprobe") 34 int handle_kprobe(struct pt_regs *ctx) 35 { 36 update(ctx, &kprobe_res); 37 return 0; 38 } 39 40 SEC("kretprobe") 41 int handle_kretprobe(struct pt_regs *ctx) 42 { 43 update(ctx, &kretprobe_res); 44 return 0; 45 } 46 47 SEC("uprobe") 48 int handle_uprobe(struct pt_regs *ctx) 49 { 50 update(ctx, &uprobe_res); 51 return 0; 52 } 53 54 SEC("uretprobe") 55 int handle_uretprobe(struct pt_regs *ctx) 56 { 57 update(ctx, &uretprobe_res); 58 return 0; 59 } 60 61 /* bpf_prog_array, used by kernel internally to keep track of attached BPF 62 * programs to a given BPF hook (e.g., for tracepoints) doesn't allow the same 63 * BPF program to be attached multiple times. So have three identical copies 64 * ready to attach to the same tracepoint. 65 */ 66 SEC("tp/syscalls/sys_enter_nanosleep") 67 int handle_tp1(struct pt_regs *ctx) 68 { 69 update(ctx, &tp_res); 70 return 0; 71 } 72 SEC("tp/syscalls/sys_enter_nanosleep") 73 int handle_tp2(struct pt_regs *ctx) 74 { 75 update(ctx, &tp_res); 76 return 0; 77 } 78 SEC("tp/syscalls/sys_enter_nanosleep") 79 int handle_tp3(void *ctx) 80 { 81 update(ctx, &tp_res); 82 return 1; 83 } 84 85 SEC("perf_event") 86 int handle_pe(struct pt_regs *ctx) 87 { 88 update(ctx, &pe_res); 89 return 0; 90 } 91 92 SEC("raw_tp/sys_enter") 93 int handle_raw_tp(void *ctx) 94 { 95 update(ctx, &raw_tp_res); 96 return 0; 97 } 98 99 SEC("tp_btf/sys_enter") 100 int handle_tp_btf(void *ctx) 101 { 102 update(ctx, &tp_btf_res); 103 return 0; 104 } 105 106 SEC("fentry/bpf_fentry_test1") 107 int BPF_PROG(fentry_test1, int a) 108 { 109 update(ctx, &fentry_res); 110 return 0; 111 } 112 113 SEC("fexit/bpf_fentry_test1") 114 int BPF_PROG(fexit_test1, int a, int ret) 115 { 116 update(ctx, &fexit_res); 117 return 0; 118 } 119 120 SEC("fmod_ret/bpf_modify_return_test") 121 int BPF_PROG(fmod_ret_test, int _a, int *_b, int _ret) 122 { 123 update(ctx, &fmod_ret_res); 124 return 1234; 125 } 126 127 SEC("lsm/file_mprotect") 128 int BPF_PROG(test_int_hook, struct vm_area_struct *vma, 129 unsigned long reqprot, unsigned long prot, int ret) 130 { 131 if (my_tid != (u32)bpf_get_current_pid_tgid()) 132 return ret; 133 update(ctx, &lsm_res); 134 return -EPERM; 135 } 136 137 char _license[] SEC("license") = "GPL"; 138