2 * Copyright (c) 2017 Facebook
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of version 2 of the GNU General Public
6 * License as published by the Free Software Foundation.
8 #define KBUILD_MODNAME "foo"
9 #include <linux/ptrace.h>
10 #include <linux/version.h>
11 #include <uapi/linux/bpf.h>
12 #include <uapi/linux/in6.h>
13 #include <bpf/bpf_helpers.h>
14 #include <bpf/bpf_tracing.h>
15 #include <bpf/bpf_core_read.h>
16 #include "trace_common.h"
18 #define MAX_NR_PORTS 65536
22 __uint(type, BPF_MAP_TYPE_ARRAY);
25 __uint(max_entries, MAX_NR_PORTS);
26 } port_a SEC(".maps");
30 __uint(type, BPF_MAP_TYPE_HASH);
33 __uint(max_entries, 1);
34 } port_h SEC(".maps");
38 __uint(type, BPF_MAP_TYPE_HASH);
41 __uint(max_entries, 1);
42 } reg_result_h SEC(".maps");
46 __uint(type, BPF_MAP_TYPE_HASH);
49 __uint(max_entries, 1);
50 } inline_result_h SEC(".maps");
52 /* map #4 */ /* Test case #0 */
54 __uint(type, BPF_MAP_TYPE_ARRAY_OF_MAPS);
55 __uint(max_entries, MAX_NR_PORTS);
56 __uint(key_size, sizeof(u32));
57 __array(values, struct inner_a); /* use inner_a as inner map */
58 } a_of_port_a SEC(".maps");
60 /* map #5 */ /* Test case #1 */
62 __uint(type, BPF_MAP_TYPE_HASH_OF_MAPS);
63 __uint(max_entries, 1);
64 __uint(key_size, sizeof(u32));
65 __array(values, struct inner_a); /* use inner_a as inner map */
66 } h_of_port_a SEC(".maps");
68 /* map #6 */ /* Test case #2 */
70 __uint(type, BPF_MAP_TYPE_HASH_OF_MAPS);
71 __uint(max_entries, 1);
72 __uint(key_size, sizeof(u32));
73 __array(values, struct inner_h); /* use inner_h as inner map */
74 } h_of_port_h SEC(".maps");
76 static __always_inline int do_reg_lookup(void *inner_map, u32 port)
80 result = bpf_map_lookup_elem(inner_map, &port);
81 return result ? *result : -ENOENT;
84 static __always_inline int do_inline_array_lookup(void *inner_map, u32 port)
88 if (inner_map != &port_a)
91 result = bpf_map_lookup_elem(&port_a, &port);
92 return result ? *result : -ENOENT;
95 static __always_inline int do_inline_hash_lookup(void *inner_map, u32 port)
99 if (inner_map != &port_h)
102 result = bpf_map_lookup_elem(&port_h, &port);
103 return result ? *result : -ENOENT;
106 SEC("kprobe/" SYSCALL(sys_connect))
107 int trace_sys_connect(struct pt_regs *ctx)
109 struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1_CORE(ctx);
110 struct sockaddr_in6 *in6;
111 u16 test_case, port, dst6[8];
112 int addrlen, ret, inline_ret, ret_key = 0;
114 void *outer_map, *inner_map;
115 bool inline_hash = false;
117 in6 = (struct sockaddr_in6 *)PT_REGS_PARM2_CORE(real_regs);
118 addrlen = (int)PT_REGS_PARM3_CORE(real_regs);
120 if (addrlen != sizeof(*in6))
123 ret = bpf_probe_read_user(dst6, sizeof(dst6), &in6->sin6_addr);
129 if (dst6[0] != 0xdead || dst6[1] != 0xbeef)
134 ret = bpf_probe_read_user(&port, sizeof(port), &in6->sin6_port);
143 if (test_case == 0) {
144 outer_map = &a_of_port_a;
145 } else if (test_case == 1) {
146 outer_map = &h_of_port_a;
147 } else if (test_case == 2) {
148 outer_map = &h_of_port_h;
155 inner_map = bpf_map_lookup_elem(outer_map, &port_key);
162 ret = do_reg_lookup(inner_map, port_key);
164 if (test_case == 0 || test_case == 1)
165 inline_ret = do_inline_array_lookup(inner_map, port_key);
167 inline_ret = do_inline_hash_lookup(inner_map, port_key);
170 bpf_map_update_elem(®_result_h, &ret_key, &ret, BPF_ANY);
171 bpf_map_update_elem(&inline_result_h, &ret_key, &inline_ret, BPF_ANY);
176 char _license[] SEC("license") = "GPL";
177 u32 _version SEC("version") = LINUX_VERSION_CODE;