1ee5cf82cSAndrii Nakryiko // SPDX-License-Identifier: GPL-2.0
2ee5cf82cSAndrii Nakryiko // Copyright (c) 2019 Facebook
3ee5cf82cSAndrii Nakryiko
4ee5cf82cSAndrii Nakryiko #include <linux/ptrace.h>
5ee5cf82cSAndrii Nakryiko #include <linux/bpf.h>
63e689141SToke Høiland-Jørgensen #include <bpf/bpf_helpers.h>
7df8ff353SAndrii Nakryiko #include <bpf/bpf_tracing.h>
8ee5cf82cSAndrii Nakryiko
9ee5cf82cSAndrii Nakryiko struct {
10*57385ae3SAndrii Nakryiko __uint(type, BPF_MAP_TYPE_ARRAY);
11*57385ae3SAndrii Nakryiko __type(key, int);
12*57385ae3SAndrii Nakryiko __type(value, int);
13*57385ae3SAndrii Nakryiko __uint(max_entries, 1);
14*57385ae3SAndrii Nakryiko } my_pid_map SEC(".maps");
15*57385ae3SAndrii Nakryiko
16*57385ae3SAndrii Nakryiko struct {
17ee5cf82cSAndrii Nakryiko __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
18bd368cb5SHengqi Chen __type(key, int);
19bd368cb5SHengqi Chen __type(value, int);
20ee5cf82cSAndrii Nakryiko } perf_buf_map SEC(".maps");
21ee5cf82cSAndrii Nakryiko
22*57385ae3SAndrii Nakryiko SEC("tp/raw_syscalls/sys_enter")
handle_sys_enter(void * ctx)236984cbc6SAndrii Nakryiko int handle_sys_enter(void *ctx)
24ee5cf82cSAndrii Nakryiko {
25*57385ae3SAndrii Nakryiko int zero = 0, *my_pid, cur_pid;
26ee5cf82cSAndrii Nakryiko int cpu = bpf_get_smp_processor_id();
27ee5cf82cSAndrii Nakryiko
28*57385ae3SAndrii Nakryiko my_pid = bpf_map_lookup_elem(&my_pid_map, &zero);
29*57385ae3SAndrii Nakryiko if (!my_pid)
30*57385ae3SAndrii Nakryiko return 1;
31*57385ae3SAndrii Nakryiko
32*57385ae3SAndrii Nakryiko cur_pid = bpf_get_current_pid_tgid() >> 32;
33*57385ae3SAndrii Nakryiko if (cur_pid != *my_pid)
34*57385ae3SAndrii Nakryiko return 1;
35*57385ae3SAndrii Nakryiko
36ee5cf82cSAndrii Nakryiko bpf_perf_event_output(ctx, &perf_buf_map, BPF_F_CURRENT_CPU,
37ee5cf82cSAndrii Nakryiko &cpu, sizeof(cpu));
38*57385ae3SAndrii Nakryiko return 1;
39ee5cf82cSAndrii Nakryiko }
40ee5cf82cSAndrii Nakryiko
41ee5cf82cSAndrii Nakryiko char _license[] SEC("license") = "GPL";
42