1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (c) 2021 Facebook */ 3 4 #include "vmlinux.h" 5 #include <bpf/bpf_helpers.h> 6 #include <bpf/bpf_tracing.h> 7 8 char _license[] SEC("license") = "GPL"; 9 10 struct { 11 __uint(type, BPF_MAP_TYPE_TASK_STORAGE); 12 __uint(map_flags, BPF_F_NO_PREALLOC); 13 __type(key, int); 14 __type(value, long); 15 } enter_id SEC(".maps"); 16 17 #define MAGIC_VALUE 0xabcd1234 18 19 pid_t target_pid = 0; 20 int mismatch_cnt = 0; 21 int enter_cnt = 0; 22 int exit_cnt = 0; 23 24 SEC("tp_btf/sys_enter") 25 int BPF_PROG(on_enter, struct pt_regs *regs, long id) 26 { 27 struct task_struct *task; 28 long *ptr; 29 30 task = bpf_get_current_task_btf(); 31 if (task->pid != target_pid) 32 return 0; 33 34 ptr = bpf_task_storage_get(&enter_id, task, 0, 35 BPF_LOCAL_STORAGE_GET_F_CREATE); 36 if (!ptr) 37 return 0; 38 39 __sync_fetch_and_add(&enter_cnt, 1); 40 *ptr = MAGIC_VALUE + enter_cnt; 41 42 return 0; 43 } 44 45 SEC("tp_btf/sys_exit") 46 int BPF_PROG(on_exit, struct pt_regs *regs, long id) 47 { 48 struct task_struct *task; 49 long *ptr; 50 51 task = bpf_get_current_task_btf(); 52 if (task->pid != target_pid) 53 return 0; 54 55 ptr = bpf_task_storage_get(&enter_id, task, 0, 56 BPF_LOCAL_STORAGE_GET_F_CREATE); 57 if (!ptr) 58 return 0; 59 60 __sync_fetch_and_add(&exit_cnt, 1); 61 if (*ptr != MAGIC_VALUE + exit_cnt) 62 __sync_fetch_and_add(&mismatch_cnt, 1); 63 return 0; 64 } 65