1
2
3
4#include <linux/bpf.h>
5#include <stdint.h>
6#include "bpf_helpers.h"
7
8char _license[] SEC("license") = "GPL";
9
10static volatile struct data {
11 char in[256];
12 char out[256];
13} data;
14
15struct task_struct {
16 int pid;
17 int tgid;
18};
19
20SEC("raw_tracepoint/sys_enter")
21int test_core_kernel(void *ctx)
22{
23 struct task_struct *task = (void *)bpf_get_current_task();
24 uint64_t pid_tgid = bpf_get_current_pid_tgid();
25 int pid, tgid;
26
27 if (BPF_CORE_READ(&pid, &task->pid) ||
28 BPF_CORE_READ(&tgid, &task->tgid))
29 return 1;
30
31
32 data.out[0] = (((uint64_t)pid << 32) | tgid) == pid_tgid;
33
34 return 0;
35}
36
37