144 lines · c
1// SPDX-License-Identifier: GPL-2.02#include "vmlinux.h"3#include <bpf/bpf_helpers.h>4#include <bpf/bpf_tracing.h>5#include <bpf/usdt.bpf.h>6 7char _license[] SEC("license") = "GPL";8 9__u64 uprobe_multi_func_1_addr = 0;10__u64 uprobe_multi_func_2_addr = 0;11__u64 uprobe_multi_func_3_addr = 0;12 13__u64 uprobe_multi_func_1_result = 0;14__u64 uprobe_multi_func_2_result = 0;15__u64 uprobe_multi_func_3_result = 0;16 17__u64 uretprobe_multi_func_1_result = 0;18__u64 uretprobe_multi_func_2_result = 0;19__u64 uretprobe_multi_func_3_result = 0;20 21__u64 uprobe_multi_sleep_result = 0;22 23int pid = 0;24int child_pid = 0;25int child_tid = 0;26int child_pid_usdt = 0;27int child_tid_usdt = 0;28 29int expect_pid = 0;30bool bad_pid_seen = false;31bool bad_pid_seen_usdt = false;32 33bool test_cookie = false;34void *user_ptr = 0;35 36static __always_inline bool verify_sleepable_user_copy(void)37{38 char data[9];39 40 bpf_copy_from_user(data, sizeof(data), user_ptr);41 return bpf_strncmp(data, sizeof(data), "test_data") == 0;42}43 44static void uprobe_multi_check(void *ctx, bool is_return, bool is_sleep)45{46 __u64 cur_pid_tgid = bpf_get_current_pid_tgid();47 __u32 cur_pid;48 49 cur_pid = cur_pid_tgid >> 32;50 if (pid && cur_pid != pid)51 return;52 53 if (expect_pid && cur_pid != expect_pid)54 bad_pid_seen = true;55 56 child_pid = cur_pid_tgid >> 32;57 child_tid = (__u32)cur_pid_tgid;58 59 __u64 cookie = test_cookie ? bpf_get_attach_cookie(ctx) : 0;60 __u64 addr = bpf_get_func_ip(ctx);61 62#define SET(__var, __addr, __cookie) ({ \63 if (addr == __addr && \64 (!test_cookie || (cookie == __cookie))) \65 __var += 1; \66})67 68 if (is_return) {69 SET(uretprobe_multi_func_1_result, uprobe_multi_func_1_addr, 2);70 SET(uretprobe_multi_func_2_result, uprobe_multi_func_2_addr, 3);71 SET(uretprobe_multi_func_3_result, uprobe_multi_func_3_addr, 1);72 } else {73 SET(uprobe_multi_func_1_result, uprobe_multi_func_1_addr, 3);74 SET(uprobe_multi_func_2_result, uprobe_multi_func_2_addr, 1);75 SET(uprobe_multi_func_3_result, uprobe_multi_func_3_addr, 2);76 }77 78#undef SET79 80 if (is_sleep && verify_sleepable_user_copy())81 uprobe_multi_sleep_result += 1;82}83 84SEC("uprobe.multi//proc/self/exe:uprobe_multi_func_*")85int uprobe(struct pt_regs *ctx)86{87 uprobe_multi_check(ctx, false, false);88 return 0;89}90 91SEC("uretprobe.multi//proc/self/exe:uprobe_multi_func_*")92int uretprobe(struct pt_regs *ctx)93{94 uprobe_multi_check(ctx, true, false);95 return 0;96}97 98SEC("uprobe.multi.s//proc/self/exe:uprobe_multi_func_*")99int uprobe_sleep(struct pt_regs *ctx)100{101 uprobe_multi_check(ctx, false, true);102 return 0;103}104 105SEC("uretprobe.multi.s//proc/self/exe:uprobe_multi_func_*")106int uretprobe_sleep(struct pt_regs *ctx)107{108 uprobe_multi_check(ctx, true, true);109 return 0;110}111 112SEC("uprobe.multi//proc/self/exe:uprobe_multi_func_*")113int uprobe_extra(struct pt_regs *ctx)114{115 /* we need this one just to mix PID-filtered and global uprobes */116 return 0;117}118 119SEC("usdt")120int usdt_pid(struct pt_regs *ctx)121{122 __u64 cur_pid_tgid = bpf_get_current_pid_tgid();123 __u32 cur_pid;124 125 cur_pid = cur_pid_tgid >> 32;126 if (pid && cur_pid != pid)127 return 0;128 129 if (expect_pid && cur_pid != expect_pid)130 bad_pid_seen_usdt = true;131 132 child_pid_usdt = cur_pid_tgid >> 32;133 child_tid_usdt = (__u32)cur_pid_tgid;134 135 return 0;136}137 138SEC("usdt")139int usdt_extra(struct pt_regs *ctx)140{141 /* we need this one just to mix PID-filtered and global USDT probes */142 return 0;143}144