From c28748233b4736bd31b3d3c3011d42054cc738f5 Mon Sep 17 00:00:00 2001 From: Hengqi Chen Date: Mon, 7 Feb 2022 22:31:34 +0800 Subject: selftests/bpf: Test BPF_KPROBE_SYSCALL macro Add tests for the newly added BPF_KPROBE_SYSCALL macro. Signed-off-by: Hengqi Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220207143134.2977852-3-hengqi.chen@gmail.com --- .../selftests/bpf/progs/bpf_syscall_macro.c | 23 ++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'tools/testing/selftests/bpf/progs/bpf_syscall_macro.c') diff --git a/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c b/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c index 496e54d0ac22..05838ed9b89c 100644 --- a/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c +++ b/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c @@ -21,6 +21,12 @@ unsigned long arg4_core_cx = 0; unsigned long arg4_core = 0; unsigned long arg5_core = 0; +int option_syscall = 0; +unsigned long arg2_syscall = 0; +unsigned long arg3_syscall = 0; +unsigned long arg4_syscall = 0; +unsigned long arg5_syscall = 0; + const volatile pid_t filter_pid = 0; SEC("kprobe/" SYS_PREFIX "sys_prctl") @@ -58,4 +64,21 @@ int BPF_KPROBE(handle_sys_prctl) return 0; } +SEC("kprobe/" SYS_PREFIX "sys_prctl") +int BPF_KPROBE_SYSCALL(prctl_enter, int option, unsigned long arg2, + unsigned long arg3, unsigned long arg4, unsigned long arg5) +{ + pid_t pid = bpf_get_current_pid_tgid() >> 32; + + if (pid != filter_pid) + return 0; + + option_syscall = option; + arg2_syscall = arg2; + arg3_syscall = arg3; + arg4_syscall = arg4; + arg5_syscall = arg5; + return 0; +} + char _license[] SEC("license") = "GPL"; -- cgit v1.2.3-59-g8ed1b