91 lines · c
1// SPDX-License-Identifier: GPL-2.02/* Copyright (c) 2020 Facebook */3 4#include "vmlinux.h"5#include <asm/unistd.h>6#include <bpf/bpf_helpers.h>7#include <bpf/bpf_tracing.h>8#include <bpf/bpf_core_read.h>9 10#define MY_TV_NSEC 133711 12bool tp_called = false;13bool raw_tp_called = false;14bool tp_btf_called = false;15bool kprobe_called = false;16bool fentry_called = false;17 18SEC("tp/syscalls/sys_enter_nanosleep")19int handle__tp(struct syscall_trace_enter *args)20{21 struct __kernel_timespec *ts;22 long tv_nsec;23 24 if (args->nr != __NR_nanosleep)25 return 0;26 27 ts = (void *)args->args[0];28 if (bpf_probe_read_user(&tv_nsec, sizeof(ts->tv_nsec), &ts->tv_nsec) ||29 tv_nsec != MY_TV_NSEC)30 return 0;31 32 tp_called = true;33 return 0;34}35 36SEC("raw_tp/sys_enter")37int BPF_PROG(handle__raw_tp, struct pt_regs *regs, long id)38{39 struct __kernel_timespec *ts;40 long tv_nsec;41 42 if (id != __NR_nanosleep)43 return 0;44 45 ts = (void *)PT_REGS_PARM1_CORE_SYSCALL(regs);46 if (bpf_probe_read_user(&tv_nsec, sizeof(ts->tv_nsec), &ts->tv_nsec) ||47 tv_nsec != MY_TV_NSEC)48 return 0;49 50 raw_tp_called = true;51 return 0;52}53 54SEC("tp_btf/sys_enter")55int BPF_PROG(handle__tp_btf, struct pt_regs *regs, long id)56{57 struct __kernel_timespec *ts;58 long tv_nsec;59 60 if (id != __NR_nanosleep)61 return 0;62 63 ts = (void *)PT_REGS_PARM1_CORE_SYSCALL(regs);64 if (bpf_probe_read_user(&tv_nsec, sizeof(ts->tv_nsec), &ts->tv_nsec) ||65 tv_nsec != MY_TV_NSEC)66 return 0;67 68 tp_btf_called = true;69 return 0;70}71 72SEC("kprobe/hrtimer_start_range_ns")73int BPF_KPROBE(handle__kprobe, struct hrtimer *timer, ktime_t tim, u64 delta_ns,74 const enum hrtimer_mode mode)75{76 if (tim == MY_TV_NSEC)77 kprobe_called = true;78 return 0;79}80 81SEC("fentry/hrtimer_start_range_ns")82int BPF_PROG(handle__fentry, struct hrtimer *timer, ktime_t tim, u64 delta_ns,83 const enum hrtimer_mode mode)84{85 if (tim == MY_TV_NSEC)86 fentry_called = true;87 return 0;88}89 90char _license[] SEC("license") = "GPL";91