-
Notifications
You must be signed in to change notification settings - Fork 6
/
kprobe.zig
63 lines (53 loc) · 2.38 KB
/
kprobe.zig
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
const std = @import("std");
const root = @import("root.zig");
const print = std.debug.print;
const testing = std.testing;
const allocator = root.allocator;
const libbpf = root.libbpf;
test "kprobe" {
const bytes = @embedFile("@kprobe");
_ = libbpf.libbpf_set_print(root.dbg_printf);
const obj = libbpf.bpf_object__open_mem(bytes.ptr, bytes.len, null);
if (obj == null) {
print("failed to open bpf object: {}\n", .{std.posix.errno(-1)});
return error.OPEN;
}
defer libbpf.bpf_object__close(obj);
var ret = libbpf.bpf_object__load(obj);
if (ret != 0) {
print("failed to load bpf object: {}\n", .{std.posix.errno(-1)});
return error.LOAD;
}
const entry_prog = libbpf.bpf_object__find_program_by_name(obj, "test_kprobe").?;
const exit_prog = libbpf.bpf_object__find_program_by_name(obj, "test_kretprobe").?;
const arg2 = libbpf.bpf_object__find_map_by_name(obj, "entry").?;
const rc = libbpf.bpf_object__find_map_by_name(obj, "exit").?;
const entry_link = libbpf.bpf_program__attach(entry_prog) orelse {
print("failed to attach entry_prog {s}: {}\n", .{ libbpf.bpf_program__name(entry_prog), std.posix.errno(-1) });
return error.ATTACH;
};
defer _ = libbpf.bpf_link__destroy(entry_link);
const exit_link = libbpf.bpf_program__attach(exit_prog) orelse {
print("failed to attach prog {s}: {}\n", .{ libbpf.bpf_program__name(exit_prog), std.posix.errno(-1) });
return error.ATTACH;
};
defer _ = libbpf.bpf_link__destroy(exit_link);
var buf: [64]u8 = undefined;
const arg0 = "/nonexist";
const n = std.os.linux.listxattr(arg0, &buf, buf.len);
const k: u32 = 0;
var got_entry: u64 = undefined;
ret = libbpf.bpf_map__lookup_elem(arg2, &k, @sizeOf(@TypeOf(k)), &got_entry, @sizeOf(@TypeOf(got_entry)), 0);
if (ret != 0) {
print("failed loopup map element: {}\n", .{std.posix.errno(-1)});
return error.MAP_LOOKUP;
}
var got_ret: isize = undefined;
ret = libbpf.bpf_map__lookup_elem(rc, &k, @sizeOf(@TypeOf(k)), &got_ret, @sizeOf(@TypeOf(got_ret)), 0);
if (ret != 0) {
print("failed loopup map element: {}\n", .{std.posix.errno(-1)});
return error.MAP_LOOKUP;
}
try testing.expectEqual(@intFromPtr(arg0.ptr) + @intFromPtr(&buf) + buf.len, got_entry);
try testing.expectEqual(@as(isize, @bitCast(n)), got_ret);
}