@@ -35,11 +35,14 @@ char LICENSE[] SEC("license") = "GPL";
3535 __uint(max_entries, size); \
3636 } name SEC(".maps")
3737
38- BPF_HASH_MAP (tracked_pids , __u32 , __u8 , 10000 ); /* Map to store PIDs we're tracking */
39- BPF_HASH_MAP (pids_ppid , __u32 , __u32 , 10000 ); /* Map to store parent-child relationships to detect hierarchy */
40- BPF_RINGBUF (events , 256 * 1024 ); /* Ring buffer for sending events to userspace */
41- BPF_ARRAY_MAP (tracking_enabled , __u8 , 1 ); /* Map to control whether tracking is enabled (0 = disabled, 1
42- = enabled) */
38+ /* Map to store PIDs we're tracking */
39+ BPF_HASH_MAP (tracked_pids , __u32 , __u8 , 10000 );
40+ /* Map to store parent-child relationships to detect hierarchy */
41+ BPF_HASH_MAP (pids_ppid , __u32 , __u32 , 10000 );
42+ /* Ring buffer for sending events to userspace */
43+ BPF_RINGBUF (events , 256 * 1024 );
44+ /* Map to control whether tracking is enabled (0 = disabled, 1 = enabled) */
45+ BPF_ARRAY_MAP (tracking_enabled , __u8 , 1 );
4346
4447/* == Code that tracks process forks and execs == */
4548
@@ -127,28 +130,28 @@ static __always_inline __u64* take_param(void* map) {
127130 * Usage: SUBMIT_EVENT(event_type, { e->data.foo = bar; })
128131 */
129132#define SUBMIT_EVENT (evt_type , fill_data ) \
130- { \
133+ { \
131134 __u64 tid = bpf_get_current_pid_tgid(); \
132135 __u32 pid = tid >> 32; \
133- \
136+ \
134137 if (!is_tracked(pid) || !is_enabled()) { \
135- return 0; \
136- } \
137- \
138+ return 0; \
139+ } \
140+ \
138141 struct event* e = bpf_ringbuf_reserve(&events, sizeof(*e), 0); \
139- if (!e) { \
140- return 0; \
141- } \
142- \
142+ if (!e) { \
143+ return 0; \
144+ } \
145+ \
143146 e->header.timestamp = bpf_ktime_get_ns(); \
144- e->header.pid = pid; \
147+ e->header.pid = pid; \
145148 e->header.tid = tid & 0xFFFFFFFF; \
146149 e->header.event_type = evt_type; \
147- \
148- fill_data; \
149- \
150- bpf_ringbuf_submit(e, 0); \
151- return 0; \
150+ \
151+ fill_data; \
152+ \
153+ bpf_ringbuf_submit(e, 0); \
154+ return 0; \
152155 }
153156
154157/* Helper to submit an allocation event (malloc, calloc) */
@@ -177,9 +180,7 @@ static __always_inline int submit_calloc_event(__u64 size, __u64 addr) {
177180
178181/* Helper to submit a free event */
179182static __always_inline int submit_free_event (__u64 addr ) {
180- SUBMIT_EVENT (EVENT_TYPE_FREE , {
181- e -> data .free .addr = addr ;
182- });
183+ SUBMIT_EVENT (EVENT_TYPE_FREE , { e -> data .free .addr = addr ; });
183184}
184185
185186/* Helper to submit a realloc event with both old and new addresses */
@@ -200,22 +201,22 @@ static __always_inline int submit_mmap_event(__u64 addr, __u64 size, __u8 event_
200201}
201202
202203/* Macro to generate uprobe/uretprobe pairs for allocation functions with 1 argument */
203- #define UPROBE_ARG_RET (name , arg_expr , submit_block ) \
204- BPF_HASH_MAP(name##_arg, __u64, __u64, 10000); \
205- SEC("uprobe") \
206- int uprobe_##name(struct pt_regs* ctx) { return store_param(&name##_arg, arg_expr); } \
207- SEC("uretprobe") \
208- int uretprobe_##name(struct pt_regs* ctx) { \
209- __u64* arg_ptr = take_param(&name##_arg); \
210- if (!arg_ptr) { \
211- return 0; \
212- } \
213- __u64 ret_val = PT_REGS_RC(ctx); \
214- if (ret_val == 0) { \
215- return 0; \
216- } \
217- __u64 arg0 = *arg_ptr; \
218- submit_block; \
204+ #define UPROBE_ARG_RET (name , arg_expr , submit_block ) \
205+ BPF_HASH_MAP(name##_arg, __u64, __u64, 10000); \
206+ SEC("uprobe") \
207+ int uprobe_##name(struct pt_regs* ctx) { return store_param(&name##_arg, arg_expr); } \
208+ SEC("uretprobe") \
209+ int uretprobe_##name(struct pt_regs* ctx) { \
210+ __u64* arg_ptr = take_param(&name##_arg); \
211+ if (!arg_ptr) { \
212+ return 0; \
213+ } \
214+ __u64 ret_val = PT_REGS_RC(ctx); \
215+ if (ret_val == 0) { \
216+ return 0; \
217+ } \
218+ __u64 arg0 = *arg_ptr; \
219+ submit_block; \
219220 }
220221
221222/* Macro for simple return value only functions like free */
@@ -230,80 +231,68 @@ static __always_inline int submit_mmap_event(__u64 addr, __u64 size, __u8 event_
230231 }
231232
232233/* Macro to generate uprobe/uretprobe pairs for functions with 2 arguments */
233- #define UPROBE_ARGS_RET (name , arg0_expr , arg1_expr , submit_block ) \
234- struct name##_args_t { \
235- __u64 arg0; \
236- __u64 arg1; \
237- }; \
238- BPF_HASH_MAP(name##_args, __u64, struct name##_args_t, 10000); \
239- SEC("uprobe") \
240- int uprobe_##name(struct pt_regs* ctx) { \
241- __u64 tid = bpf_get_current_pid_tgid(); \
242- __u32 pid = tid >> 32; \
243- \
244- if (!is_tracked(pid)) { \
245- return 0; \
246- } \
247- \
248- struct name##_args_t args = { \
249- .arg0 = arg0_expr, \
250- .arg1 = arg1_expr \
251- }; \
252- \
253- bpf_map_update_elem(&name##_args, &tid, &args, BPF_ANY); \
254- return 0; \
255- } \
256- SEC("uretprobe") \
257- int uretprobe_##name(struct pt_regs* ctx) { \
258- __u64 tid = bpf_get_current_pid_tgid(); \
259- struct name##_args_t* args = bpf_map_lookup_elem(&name##_args, &tid); \
260- \
261- if (!args) { \
262- return 0; \
263- } \
264- \
265- struct name##_args_t a = *args; \
266- bpf_map_delete_elem(&name##_args, &tid); \
267- \
268- __u64 ret_val = PT_REGS_RC(ctx); \
269- if (ret_val == 0) { \
270- return 0; \
271- } \
272- \
273- __u64 arg0 = a.arg0; \
274- __u64 arg1 = a.arg1; \
275- submit_block; \
234+ #define UPROBE_ARGS_RET (name , arg0_expr , arg1_expr , submit_block ) \
235+ struct name##_args_t { \
236+ __u64 arg0; \
237+ __u64 arg1; \
238+ }; \
239+ BPF_HASH_MAP(name##_args, __u64, struct name##_args_t, 10000); \
240+ SEC("uprobe") \
241+ int uprobe_##name(struct pt_regs* ctx) { \
242+ __u64 tid = bpf_get_current_pid_tgid(); \
243+ __u32 pid = tid >> 32; \
244+ \
245+ if (!is_tracked(pid)) { \
246+ return 0; \
247+ } \
248+ \
249+ struct name##_args_t args = {.arg0 = arg0_expr, .arg1 = arg1_expr}; \
250+ \
251+ bpf_map_update_elem(&name##_args, &tid, &args, BPF_ANY); \
252+ return 0; \
253+ } \
254+ SEC("uretprobe") \
255+ int uretprobe_##name(struct pt_regs* ctx) { \
256+ __u64 tid = bpf_get_current_pid_tgid(); \
257+ struct name##_args_t* args = bpf_map_lookup_elem(&name##_args, &tid); \
258+ \
259+ if (!args) { \
260+ return 0; \
261+ } \
262+ \
263+ struct name##_args_t a = *args; \
264+ bpf_map_delete_elem(&name##_args, &tid); \
265+ \
266+ __u64 ret_val = PT_REGS_RC(ctx); \
267+ if (ret_val == 0) { \
268+ return 0; \
269+ } \
270+ \
271+ __u64 arg0 = a.arg0; \
272+ __u64 arg1 = a.arg1; \
273+ submit_block; \
276274 }
277275
278276/* malloc: allocates with size parameter */
279- UPROBE_ARG_RET (malloc , PT_REGS_PARM1 (ctx ), {
280- return submit_alloc_event (arg0 , ret_val );
281- })
277+ UPROBE_ARG_RET (malloc , PT_REGS_PARM1 (ctx ), { return submit_alloc_event (arg0 , ret_val ); })
282278
283279/* free: deallocates by address */
284- UPROBE_RET (free , PT_REGS_PARM1 (ctx ), {
285- return submit_free_event (arg0 );
286- })
280+ UPROBE_RET (free , PT_REGS_PARM1 (ctx ), { return submit_free_event (arg0 ); })
287281
288282/* calloc: allocates with nmemb * size */
289- UPROBE_ARG_RET (calloc , PT_REGS_PARM1 (ctx ) * PT_REGS_PARM2 (ctx ), {
290- return submit_calloc_event (arg0 , ret_val );
291- })
283+ UPROBE_ARG_RET (calloc , PT_REGS_PARM1 (ctx ) * PT_REGS_PARM2 (ctx ),
284+ { return submit_calloc_event (arg0 , ret_val ); })
292285
293286/* realloc: reallocates with old_addr and new size */
294- UPROBE_ARGS_RET (realloc , PT_REGS_PARM2 (ctx ), PT_REGS_PARM1 (ctx ), {
295- return submit_realloc_event (arg1 , ret_val , arg0 );
296- })
287+ UPROBE_ARGS_RET (realloc , PT_REGS_PARM2 (ctx ), PT_REGS_PARM1 (ctx ),
288+ { return submit_realloc_event (arg1 , ret_val , arg0 ); })
297289
298290/* aligned_alloc: allocates with alignment and size */
299- UPROBE_ARG_RET (aligned_alloc , PT_REGS_PARM2 (ctx ), {
300- return submit_aligned_alloc_event (arg0 , ret_val );
301- })
291+ UPROBE_ARG_RET (aligned_alloc , PT_REGS_PARM2 (ctx ),
292+ { return submit_aligned_alloc_event (arg0 , ret_val ); })
302293
303294/* memalign: allocates with alignment and size (legacy interface) */
304- UPROBE_ARG_RET (memalign , PT_REGS_PARM2 (ctx ), {
305- return submit_aligned_alloc_event (arg0 , ret_val );
306- })
295+ UPROBE_ARG_RET (memalign , PT_REGS_PARM2 (ctx ), { return submit_aligned_alloc_event (arg0 , ret_val ); })
307296
308297/* Map to store mmap parameters between entry and return */
309298struct mmap_args {
0 commit comments