118 lines · c
1// SPDX-License-Identifier: GPL-2.02/* Copyright (c) 2022, Oracle and/or its affiliates. */3 4#include "vmlinux.h"5 6#include <bpf/bpf_core_read.h>7#include <bpf/bpf_helpers.h>8#include <bpf/bpf_tracing.h>9#include "bpf_misc.h"10 11int uprobe_byname_parm1 = 0;12int uprobe_byname_ran = 0;13int uretprobe_byname_rc = 0;14int uretprobe_byname_ret = 0;15int uretprobe_byname_ran = 0;16u64 uprobe_byname2_parm1 = 0;17int uprobe_byname2_ran = 0;18u64 uretprobe_byname2_rc = 0;19int uretprobe_byname2_ran = 0;20 21int test_pid;22 23int a[8];24 25/* This program cannot auto-attach, but that should not stop other26 * programs from attaching.27 */28SEC("uprobe")29int handle_uprobe_noautoattach(struct pt_regs *ctx)30{31 return 0;32}33 34SEC("uprobe//proc/self/exe:autoattach_trigger_func")35int BPF_UPROBE(handle_uprobe_byname36 , int arg137 , int arg238 , int arg339#if FUNC_REG_ARG_CNT > 340 , int arg441#endif42#if FUNC_REG_ARG_CNT > 443 , int arg544#endif45#if FUNC_REG_ARG_CNT > 546 , int arg647#endif48#if FUNC_REG_ARG_CNT > 649 , int arg750#endif51#if FUNC_REG_ARG_CNT > 752 , int arg853#endif54)55{56 uprobe_byname_parm1 = PT_REGS_PARM1_CORE(ctx);57 uprobe_byname_ran = 1;58 59 a[0] = arg1;60 a[1] = arg2;61 a[2] = arg3;62#if FUNC_REG_ARG_CNT > 363 a[3] = arg4;64#endif65#if FUNC_REG_ARG_CNT > 466 a[4] = arg5;67#endif68#if FUNC_REG_ARG_CNT > 569 a[5] = arg6;70#endif71#if FUNC_REG_ARG_CNT > 672 a[6] = arg7;73#endif74#if FUNC_REG_ARG_CNT > 775 a[7] = arg8;76#endif77 return 0;78}79 80SEC("uretprobe//proc/self/exe:autoattach_trigger_func")81int BPF_URETPROBE(handle_uretprobe_byname, int ret)82{83 uretprobe_byname_rc = PT_REGS_RC_CORE(ctx);84 uretprobe_byname_ret = ret;85 uretprobe_byname_ran = 2;86 87 return 0;88}89 90 91SEC("uprobe/libc.so.6:fopen")92int BPF_UPROBE(handle_uprobe_byname2, const char *pathname, const char *mode)93{94 int pid = bpf_get_current_pid_tgid() >> 32;95 96 /* ignore irrelevant invocations */97 if (test_pid != pid)98 return 0;99 uprobe_byname2_parm1 = (u64)(long)pathname;100 uprobe_byname2_ran = 3;101 return 0;102}103 104SEC("uretprobe/libc.so.6:fopen")105int BPF_URETPROBE(handle_uretprobe_byname2, void *ret)106{107 int pid = bpf_get_current_pid_tgid() >> 32;108 109 /* ignore irrelevant invocations */110 if (test_pid != pid)111 return 0;112 uretprobe_byname2_rc = (u64)(long)ret;113 uretprobe_byname2_ran = 4;114 return 0;115}116 117char _license[] SEC("license") = "GPL";118