2 * Copyright (c) 2017 Facebook
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of version 2 of the GNU General Public
6 * License as published by the Free Software Foundation.
8 #define KBUILD_MODNAME "foo"
9 #include <linux/ptrace.h>
10 #include <linux/version.h>
11 #include <uapi/linux/bpf.h>
12 #include <uapi/linux/in6.h>
13 #include <bpf/bpf_helpers.h>
14 #include <bpf/bpf_tracing.h>
15 #include <bpf/bpf_core_read.h>
16 #include "trace_common.h"
18 #define MAX_NR_PORTS 65536
22 __uint(type
, BPF_MAP_TYPE_ARRAY
);
25 __uint(max_entries
, MAX_NR_PORTS
);
26 } port_a
SEC(".maps");
30 __uint(type
, BPF_MAP_TYPE_HASH
);
33 __uint(max_entries
, 1);
34 } port_h
SEC(".maps");
38 __uint(type
, BPF_MAP_TYPE_HASH
);
41 __uint(max_entries
, 1);
42 } reg_result_h
SEC(".maps");
46 __uint(type
, BPF_MAP_TYPE_HASH
);
49 __uint(max_entries
, 1);
50 } inline_result_h
SEC(".maps");
52 /* map #4 */ /* Test case #0 */
54 __uint(type
, BPF_MAP_TYPE_ARRAY_OF_MAPS
);
55 __uint(max_entries
, MAX_NR_PORTS
);
56 __uint(key_size
, sizeof(u32
));
57 __array(values
, struct inner_a
); /* use inner_a as inner map */
58 } a_of_port_a
SEC(".maps");
60 /* map #5 */ /* Test case #1 */
62 __uint(type
, BPF_MAP_TYPE_HASH_OF_MAPS
);
63 __uint(max_entries
, 1);
64 __uint(key_size
, sizeof(u32
));
65 __array(values
, struct inner_a
); /* use inner_a as inner map */
66 } h_of_port_a
SEC(".maps");
68 /* map #6 */ /* Test case #2 */
70 __uint(type
, BPF_MAP_TYPE_HASH_OF_MAPS
);
71 __uint(max_entries
, 1);
72 __uint(key_size
, sizeof(u32
));
73 __array(values
, struct inner_h
); /* use inner_h as inner map */
74 } h_of_port_h
SEC(".maps");
76 static __always_inline
int do_reg_lookup(void *inner_map
, u32 port
)
80 result
= bpf_map_lookup_elem(inner_map
, &port
);
81 return result
? *result
: -ENOENT
;
84 static __always_inline
int do_inline_array_lookup(void *inner_map
, u32 port
)
88 if (inner_map
!= &port_a
)
91 result
= bpf_map_lookup_elem(&port_a
, &port
);
92 return result
? *result
: -ENOENT
;
95 static __always_inline
int do_inline_hash_lookup(void *inner_map
, u32 port
)
99 if (inner_map
!= &port_h
)
102 result
= bpf_map_lookup_elem(&port_h
, &port
);
103 return result
? *result
: -ENOENT
;
106 SEC("kprobe/" SYSCALL(sys_connect
))
107 int trace_sys_connect(struct pt_regs
*ctx
)
109 struct pt_regs
*real_regs
= (struct pt_regs
*)PT_REGS_PARM1_CORE(ctx
);
110 struct sockaddr_in6
*in6
;
111 u16 test_case
, port
, dst6
[8];
112 int addrlen
, ret
, inline_ret
, ret_key
= 0;
114 void *outer_map
, *inner_map
;
115 bool inline_hash
= false;
117 in6
= (struct sockaddr_in6
*)PT_REGS_PARM2_CORE(real_regs
);
118 addrlen
= (int)PT_REGS_PARM3_CORE(real_regs
);
120 if (addrlen
!= sizeof(*in6
))
123 ret
= bpf_probe_read_user(dst6
, sizeof(dst6
), &in6
->sin6_addr
);
129 if (dst6
[0] != 0xdead || dst6
[1] != 0xbeef)
134 ret
= bpf_probe_read_user(&port
, sizeof(port
), &in6
->sin6_port
);
143 if (test_case
== 0) {
144 outer_map
= &a_of_port_a
;
145 } else if (test_case
== 1) {
146 outer_map
= &h_of_port_a
;
147 } else if (test_case
== 2) {
148 outer_map
= &h_of_port_h
;
155 inner_map
= bpf_map_lookup_elem(outer_map
, &port_key
);
162 ret
= do_reg_lookup(inner_map
, port_key
);
164 if (test_case
== 0 || test_case
== 1)
165 inline_ret
= do_inline_array_lookup(inner_map
, port_key
);
167 inline_ret
= do_inline_hash_lookup(inner_map
, port_key
);
170 bpf_map_update_elem(®_result_h
, &ret_key
, &ret
, BPF_ANY
);
171 bpf_map_update_elem(&inline_result_h
, &ret_key
, &inline_ret
, BPF_ANY
);
176 char _license
[] SEC("license") = "GPL";
177 u32 _version
SEC("version") = LINUX_VERSION_CODE
;