1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2021 Facebook */
5 #include <bpf/bpf_helpers.h>
6 #include <bpf/bpf_tracing.h>
12 __u64 kprobe_multi_res;
25 static void update(void *ctx, __u64 *res)
27 if (my_tid != (u32)bpf_get_current_pid_tgid())
30 *res |= bpf_get_attach_cookie(ctx);
34 int handle_kprobe(struct pt_regs *ctx)
36 update(ctx, &kprobe_res);
41 int handle_kretprobe(struct pt_regs *ctx)
43 update(ctx, &kretprobe_res);
48 int handle_uprobe(struct pt_regs *ctx)
50 update(ctx, &uprobe_res);
55 int handle_uretprobe(struct pt_regs *ctx)
57 update(ctx, &uretprobe_res);
61 /* bpf_prog_array, used by kernel internally to keep track of attached BPF
62 * programs to a given BPF hook (e.g., for tracepoints) doesn't allow the same
63 * BPF program to be attached multiple times. So have three identical copies
64 * ready to attach to the same tracepoint.
66 SEC("tp/syscalls/sys_enter_nanosleep")
67 int handle_tp1(struct pt_regs *ctx)
72 SEC("tp/syscalls/sys_enter_nanosleep")
73 int handle_tp2(struct pt_regs *ctx)
78 SEC("tp/syscalls/sys_enter_nanosleep")
79 int handle_tp3(void *ctx)
86 int handle_pe(struct pt_regs *ctx)
92 SEC("raw_tp/sys_enter")
93 int handle_raw_tp(void *ctx)
95 update(ctx, &raw_tp_res);
99 SEC("tp_btf/sys_enter")
100 int handle_tp_btf(void *ctx)
102 update(ctx, &tp_btf_res);
106 SEC("fentry/bpf_fentry_test1")
107 int BPF_PROG(fentry_test1, int a)
109 update(ctx, &fentry_res);
113 SEC("fexit/bpf_fentry_test1")
114 int BPF_PROG(fexit_test1, int a, int ret)
116 update(ctx, &fexit_res);
120 SEC("fmod_ret/bpf_modify_return_test")
121 int BPF_PROG(fmod_ret_test, int _a, int *_b, int _ret)
123 update(ctx, &fmod_ret_res);
127 SEC("lsm/file_mprotect")
128 int BPF_PROG(test_int_hook, struct vm_area_struct *vma,
129 unsigned long reqprot, unsigned long prot, int ret)
131 if (my_tid != (u32)bpf_get_current_pid_tgid())
133 update(ctx, &lsm_res);
137 char _license[] SEC("license") = "GPL";