1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2020 Facebook */
5 #include <bpf/bpf_tracing.h>
6 #include <bpf/bpf_core_read.h>
7 #include <bpf/bpf_helpers.h>
11 __u32 last_notclose_state
;
16 __uint(type
, BPF_MAP_TYPE_SK_STORAGE
);
17 __uint(map_flags
, BPF_F_NO_PREALLOC
);
19 __type(value
, struct sk_stg
);
20 } sk_stg_map
SEC(".maps");
24 __uint(type
, BPF_MAP_TYPE_SK_STORAGE
);
25 __uint(map_flags
, BPF_F_NO_PREALLOC
);
28 } del_sk_stg_map
SEC(".maps");
30 char task_comm
[16] = "";
32 SEC("tp_btf/inet_sock_set_state")
33 int BPF_PROG(trace_inet_sock_set_state
, struct sock
*sk
, int oldstate
,
38 if (newstate
== BPF_TCP_CLOSE
)
41 stg
= bpf_sk_storage_get(&sk_stg_map
, sk
, 0,
42 BPF_SK_STORAGE_GET_F_CREATE
);
46 stg
->last_notclose_state
= newstate
;
48 bpf_sk_storage_delete(&del_sk_stg_map
, sk
);
53 static void set_task_info(struct sock
*sk
)
55 struct task_struct
*task
;
58 stg
= bpf_sk_storage_get(&sk_stg_map
, sk
, 0,
59 BPF_SK_STORAGE_GET_F_CREATE
);
63 stg
->pid
= bpf_get_current_pid_tgid();
65 task
= (struct task_struct
*)bpf_get_current_task();
66 bpf_core_read_str(&stg
->comm
, sizeof(stg
->comm
), &task
->comm
);
67 bpf_core_read_str(&task_comm
, sizeof(task_comm
), &task
->comm
);
70 SEC("fentry/inet_csk_listen_start")
71 int BPF_PROG(trace_inet_csk_listen_start
, struct sock
*sk
, int backlog
)
78 SEC("fentry/tcp_connect")
79 int BPF_PROG(trace_tcp_connect
, struct sock
*sk
)
86 SEC("fexit/inet_csk_accept")
87 int BPF_PROG(inet_csk_accept
, struct sock
*sk
, int flags
, int *err
, bool kern
,
88 struct sock
*accepted_sk
)
90 set_task_info(accepted_sk
);
95 char _license
[] SEC("license") = "GPL";