1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2021 Facebook */
5 #include <bpf/bpf_helpers.h>
6 #include <bpf/bpf_tracing.h>
12 __u64 kprobe_multi_res;
23 static void update(void *ctx, __u64 *res)
25 if (my_tid != (u32)bpf_get_current_pid_tgid())
28 *res |= bpf_get_attach_cookie(ctx);
32 int handle_kprobe(struct pt_regs *ctx)
34 update(ctx, &kprobe_res);
39 int handle_kretprobe(struct pt_regs *ctx)
41 update(ctx, &kretprobe_res);
46 int handle_uprobe(struct pt_regs *ctx)
48 update(ctx, &uprobe_res);
53 int handle_uretprobe(struct pt_regs *ctx)
55 update(ctx, &uretprobe_res);
59 /* bpf_prog_array, used by kernel internally to keep track of attached BPF
60 * programs to a given BPF hook (e.g., for tracepoints) doesn't allow the same
61 * BPF program to be attached multiple times. So have three identical copies
62 * ready to attach to the same tracepoint.
64 SEC("tp/syscalls/sys_enter_nanosleep")
65 int handle_tp1(struct pt_regs *ctx)
70 SEC("tp/syscalls/sys_enter_nanosleep")
71 int handle_tp2(struct pt_regs *ctx)
76 SEC("tp/syscalls/sys_enter_nanosleep")
77 int handle_tp3(void *ctx)
84 int handle_pe(struct pt_regs *ctx)
90 SEC("fentry/bpf_fentry_test1")
91 int BPF_PROG(fentry_test1, int a)
93 update(ctx, &fentry_res);
97 SEC("fexit/bpf_fentry_test1")
98 int BPF_PROG(fexit_test1, int a, int ret)
100 update(ctx, &fexit_res);
104 SEC("fmod_ret/bpf_modify_return_test")
105 int BPF_PROG(fmod_ret_test, int _a, int *_b, int _ret)
107 update(ctx, &fmod_ret_res);
111 SEC("lsm/file_mprotect")
112 int BPF_PROG(test_int_hook, struct vm_area_struct *vma,
113 unsigned long reqprot, unsigned long prot, int ret)
115 if (my_tid != (u32)bpf_get_current_pid_tgid())
117 update(ctx, &lsm_res);
121 char _license[] SEC("license") = "GPL";