1*4882a593Smuzhiyun // SPDX-License-Identifier: GPL-2.0
2*4882a593Smuzhiyun /* Copyright (c) 2020 Facebook */
3*4882a593Smuzhiyun
4*4882a593Smuzhiyun #include "vmlinux.h"
5*4882a593Smuzhiyun #include <bpf/bpf_helpers.h>
6*4882a593Smuzhiyun #include <bpf/bpf_tracing.h>
7*4882a593Smuzhiyun #include <bpf/bpf_core_read.h>
8*4882a593Smuzhiyun
9*4882a593Smuzhiyun #define MAX_LEN 256
10*4882a593Smuzhiyun
11*4882a593Smuzhiyun char buf_in1[MAX_LEN] = {};
12*4882a593Smuzhiyun char buf_in2[MAX_LEN] = {};
13*4882a593Smuzhiyun
14*4882a593Smuzhiyun int test_pid = 0;
15*4882a593Smuzhiyun bool capture = false;
16*4882a593Smuzhiyun
17*4882a593Smuzhiyun /* .bss */
18*4882a593Smuzhiyun __u64 payload1_len1 = 0;
19*4882a593Smuzhiyun __u64 payload1_len2 = 0;
20*4882a593Smuzhiyun __u64 total1 = 0;
21*4882a593Smuzhiyun char payload1[MAX_LEN + MAX_LEN] = {};
22*4882a593Smuzhiyun
23*4882a593Smuzhiyun /* .data */
24*4882a593Smuzhiyun int payload2_len1 = -1;
25*4882a593Smuzhiyun int payload2_len2 = -1;
26*4882a593Smuzhiyun int total2 = -1;
27*4882a593Smuzhiyun char payload2[MAX_LEN + MAX_LEN] = { 1 };
28*4882a593Smuzhiyun
29*4882a593Smuzhiyun int payload3_len1 = -1;
30*4882a593Smuzhiyun int payload3_len2 = -1;
31*4882a593Smuzhiyun int total3= -1;
32*4882a593Smuzhiyun char payload3[MAX_LEN + MAX_LEN] = { 1 };
33*4882a593Smuzhiyun
34*4882a593Smuzhiyun int payload4_len1 = -1;
35*4882a593Smuzhiyun int payload4_len2 = -1;
36*4882a593Smuzhiyun int total4= -1;
37*4882a593Smuzhiyun char payload4[MAX_LEN + MAX_LEN] = { 1 };
38*4882a593Smuzhiyun
39*4882a593Smuzhiyun SEC("raw_tp/sys_enter")
handler64_unsigned(void * regs)40*4882a593Smuzhiyun int handler64_unsigned(void *regs)
41*4882a593Smuzhiyun {
42*4882a593Smuzhiyun int pid = bpf_get_current_pid_tgid() >> 32;
43*4882a593Smuzhiyun void *payload = payload1;
44*4882a593Smuzhiyun u64 len;
45*4882a593Smuzhiyun
46*4882a593Smuzhiyun /* ignore irrelevant invocations */
47*4882a593Smuzhiyun if (test_pid != pid || !capture)
48*4882a593Smuzhiyun return 0;
49*4882a593Smuzhiyun
50*4882a593Smuzhiyun len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in1[0]);
51*4882a593Smuzhiyun if (len <= MAX_LEN) {
52*4882a593Smuzhiyun payload += len;
53*4882a593Smuzhiyun payload1_len1 = len;
54*4882a593Smuzhiyun }
55*4882a593Smuzhiyun
56*4882a593Smuzhiyun len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in2[0]);
57*4882a593Smuzhiyun if (len <= MAX_LEN) {
58*4882a593Smuzhiyun payload += len;
59*4882a593Smuzhiyun payload1_len2 = len;
60*4882a593Smuzhiyun }
61*4882a593Smuzhiyun
62*4882a593Smuzhiyun total1 = payload - (void *)payload1;
63*4882a593Smuzhiyun
64*4882a593Smuzhiyun return 0;
65*4882a593Smuzhiyun }
66*4882a593Smuzhiyun
67*4882a593Smuzhiyun SEC("raw_tp/sys_exit")
handler64_signed(void * regs)68*4882a593Smuzhiyun int handler64_signed(void *regs)
69*4882a593Smuzhiyun {
70*4882a593Smuzhiyun int pid = bpf_get_current_pid_tgid() >> 32;
71*4882a593Smuzhiyun void *payload = payload3;
72*4882a593Smuzhiyun long len;
73*4882a593Smuzhiyun
74*4882a593Smuzhiyun /* ignore irrelevant invocations */
75*4882a593Smuzhiyun if (test_pid != pid || !capture)
76*4882a593Smuzhiyun return 0;
77*4882a593Smuzhiyun
78*4882a593Smuzhiyun len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in1[0]);
79*4882a593Smuzhiyun if (len >= 0) {
80*4882a593Smuzhiyun payload += len;
81*4882a593Smuzhiyun payload3_len1 = len;
82*4882a593Smuzhiyun }
83*4882a593Smuzhiyun len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in2[0]);
84*4882a593Smuzhiyun if (len >= 0) {
85*4882a593Smuzhiyun payload += len;
86*4882a593Smuzhiyun payload3_len2 = len;
87*4882a593Smuzhiyun }
88*4882a593Smuzhiyun total3 = payload - (void *)payload3;
89*4882a593Smuzhiyun
90*4882a593Smuzhiyun return 0;
91*4882a593Smuzhiyun }
92*4882a593Smuzhiyun
93*4882a593Smuzhiyun SEC("tp/raw_syscalls/sys_enter")
handler32_unsigned(void * regs)94*4882a593Smuzhiyun int handler32_unsigned(void *regs)
95*4882a593Smuzhiyun {
96*4882a593Smuzhiyun int pid = bpf_get_current_pid_tgid() >> 32;
97*4882a593Smuzhiyun void *payload = payload2;
98*4882a593Smuzhiyun u32 len;
99*4882a593Smuzhiyun
100*4882a593Smuzhiyun /* ignore irrelevant invocations */
101*4882a593Smuzhiyun if (test_pid != pid || !capture)
102*4882a593Smuzhiyun return 0;
103*4882a593Smuzhiyun
104*4882a593Smuzhiyun len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in1[0]);
105*4882a593Smuzhiyun if (len <= MAX_LEN) {
106*4882a593Smuzhiyun payload += len;
107*4882a593Smuzhiyun payload2_len1 = len;
108*4882a593Smuzhiyun }
109*4882a593Smuzhiyun
110*4882a593Smuzhiyun len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in2[0]);
111*4882a593Smuzhiyun if (len <= MAX_LEN) {
112*4882a593Smuzhiyun payload += len;
113*4882a593Smuzhiyun payload2_len2 = len;
114*4882a593Smuzhiyun }
115*4882a593Smuzhiyun
116*4882a593Smuzhiyun total2 = payload - (void *)payload2;
117*4882a593Smuzhiyun
118*4882a593Smuzhiyun return 0;
119*4882a593Smuzhiyun }
120*4882a593Smuzhiyun
121*4882a593Smuzhiyun SEC("tp/raw_syscalls/sys_exit")
handler32_signed(void * regs)122*4882a593Smuzhiyun int handler32_signed(void *regs)
123*4882a593Smuzhiyun {
124*4882a593Smuzhiyun int pid = bpf_get_current_pid_tgid() >> 32;
125*4882a593Smuzhiyun void *payload = payload4;
126*4882a593Smuzhiyun int len;
127*4882a593Smuzhiyun
128*4882a593Smuzhiyun /* ignore irrelevant invocations */
129*4882a593Smuzhiyun if (test_pid != pid || !capture)
130*4882a593Smuzhiyun return 0;
131*4882a593Smuzhiyun
132*4882a593Smuzhiyun len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in1[0]);
133*4882a593Smuzhiyun if (len >= 0) {
134*4882a593Smuzhiyun payload += len;
135*4882a593Smuzhiyun payload4_len1 = len;
136*4882a593Smuzhiyun }
137*4882a593Smuzhiyun len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in2[0]);
138*4882a593Smuzhiyun if (len >= 0) {
139*4882a593Smuzhiyun payload += len;
140*4882a593Smuzhiyun payload4_len2 = len;
141*4882a593Smuzhiyun }
142*4882a593Smuzhiyun total4 = payload - (void *)payload4;
143*4882a593Smuzhiyun
144*4882a593Smuzhiyun return 0;
145*4882a593Smuzhiyun }
146*4882a593Smuzhiyun
147*4882a593Smuzhiyun SEC("tp/syscalls/sys_exit_getpid")
handler_exit(void * regs)148*4882a593Smuzhiyun int handler_exit(void *regs)
149*4882a593Smuzhiyun {
150*4882a593Smuzhiyun long bla;
151*4882a593Smuzhiyun
152*4882a593Smuzhiyun if (bpf_probe_read_kernel(&bla, sizeof(bla), 0))
153*4882a593Smuzhiyun return 1;
154*4882a593Smuzhiyun else
155*4882a593Smuzhiyun return 0;
156*4882a593Smuzhiyun }
157*4882a593Smuzhiyun
158*4882a593Smuzhiyun char LICENSE[] SEC("license") = "GPL";
159