diff mbox series

[v2,bpf-next,2/2] selftests/bpf: Add a test for open coded kmem_cache iter

Message ID 20241024074815.1255066-2-namhyung@kernel.org (mailing list archive)
State New
Headers show
Series [v2,bpf-next,1/2] bpf: Add open coded version of kmem_cache iterator | expand

Commit Message

Namhyung Kim Oct. 24, 2024, 7:48 a.m. UTC
The new subtest is attached to sleepable fentry of syncfs() syscall.
It iterates the kmem_cache using bpf_for_each loop and count the number
of entries.  Finally it checks it with the number of entries from the
regular iterator.

  $ ./vmtest.sh -- ./test_progs -t kmem_cache_iter
  ...
  #130/1   kmem_cache_iter/check_task_struct:OK
  #130/2   kmem_cache_iter/check_slabinfo:OK
  #130/3   kmem_cache_iter/open_coded_iter:OK
  #130     kmem_cache_iter:OK
  Summary: 1/3 PASSED, 0 SKIPPED, 0 FAILED

Also simplify the code by using attach routine of the skeleton.

Signed-off-by: Namhyung Kim <namhyung@kernel.org>
---
v2)
 * remove unnecessary detach  (Martin)
 * check pid in syncfs to prevent surprise  (Martin)
 * remove unnecessary local variable  (Andrii)

 .../testing/selftests/bpf/bpf_experimental.h  |  6 ++++
 .../bpf/prog_tests/kmem_cache_iter.c          | 28 +++++++++++--------
 .../selftests/bpf/progs/kmem_cache_iter.c     | 28 +++++++++++++++++++
 3 files changed, 50 insertions(+), 12 deletions(-)

Comments

Alexei Starovoitov Oct. 24, 2024, 6:08 p.m. UTC | #1
On Thu, Oct 24, 2024 at 12:48 AM Namhyung Kim <namhyung@kernel.org> wrote:
>
> The new subtest is attached to sleepable fentry of syncfs() syscall.
> It iterates the kmem_cache using bpf_for_each loop and count the number
> of entries.  Finally it checks it with the number of entries from the
> regular iterator.
>
>   $ ./vmtest.sh -- ./test_progs -t kmem_cache_iter
>   ...
>   #130/1   kmem_cache_iter/check_task_struct:OK
>   #130/2   kmem_cache_iter/check_slabinfo:OK
>   #130/3   kmem_cache_iter/open_coded_iter:OK
>   #130     kmem_cache_iter:OK
>   Summary: 1/3 PASSED, 0 SKIPPED, 0 FAILED
>
> Also simplify the code by using attach routine of the skeleton.
>
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> ---
> v2)
>  * remove unnecessary detach  (Martin)
>  * check pid in syncfs to prevent surprise  (Martin)
>  * remove unnecessary local variable  (Andrii)
>
>  .../testing/selftests/bpf/bpf_experimental.h  |  6 ++++
>  .../bpf/prog_tests/kmem_cache_iter.c          | 28 +++++++++++--------
>  .../selftests/bpf/progs/kmem_cache_iter.c     | 28 +++++++++++++++++++
>  3 files changed, 50 insertions(+), 12 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/bpf_experimental.h b/tools/testing/selftests/bpf/bpf_experimental.h
> index b0668f29f7b394eb..cd8ecd39c3f3c68d 100644
> --- a/tools/testing/selftests/bpf/bpf_experimental.h
> +++ b/tools/testing/selftests/bpf/bpf_experimental.h
> @@ -582,4 +582,10 @@ extern int bpf_wq_set_callback_impl(struct bpf_wq *wq,
>                 unsigned int flags__k, void *aux__ign) __ksym;
>  #define bpf_wq_set_callback(timer, cb, flags) \
>         bpf_wq_set_callback_impl(timer, cb, flags, NULL)
> +
> +struct bpf_iter_kmem_cache;
> +extern int bpf_iter_kmem_cache_new(struct bpf_iter_kmem_cache *it) __weak __ksym;
> +extern struct kmem_cache *bpf_iter_kmem_cache_next(struct bpf_iter_kmem_cache *it) __weak __ksym;
> +extern void bpf_iter_kmem_cache_destroy(struct bpf_iter_kmem_cache *it) __weak __ksym;
> +
>  #endif
> diff --git a/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c b/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
> index 848d8fc9171fae45..778b55bc1f912b98 100644
> --- a/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
> +++ b/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
> @@ -68,12 +68,20 @@ static void subtest_kmem_cache_iter_check_slabinfo(struct kmem_cache_iter *skel)
>         fclose(fp);
>  }
>
> +static void subtest_kmem_cache_iter_open_coded(struct kmem_cache_iter *skel)
> +{
> +       skel->bss->tgid = getpid();
> +
> +       /* To trigger the open coded iterator attached to the syscall */
> +       syncfs(0);
> +
> +       /* It should be same as we've seen from the explicit iterator */
> +       ASSERT_EQ(skel->bss->open_coded_seen, skel->bss->kmem_cache_seen, "open_code_seen_eq");
> +}
> +
>  void test_kmem_cache_iter(void)
>  {
> -       DECLARE_LIBBPF_OPTS(bpf_iter_attach_opts, opts);
>         struct kmem_cache_iter *skel = NULL;
> -       union bpf_iter_link_info linfo = {};
> -       struct bpf_link *link;
>         char buf[256];
>         int iter_fd;
>
> @@ -81,16 +89,12 @@ void test_kmem_cache_iter(void)
>         if (!ASSERT_OK_PTR(skel, "kmem_cache_iter__open_and_load"))
>                 return;
>
> -       opts.link_info = &linfo;
> -       opts.link_info_len = sizeof(linfo);
> -
> -       link = bpf_program__attach_iter(skel->progs.slab_info_collector, &opts);
> -       if (!ASSERT_OK_PTR(link, "attach_iter"))
> +       if (!ASSERT_OK(kmem_cache_iter__attach(skel), "skel_attach"))
>                 goto destroy;
>
> -       iter_fd = bpf_iter_create(bpf_link__fd(link));
> +       iter_fd = bpf_iter_create(bpf_link__fd(skel->links.slab_info_collector));
>         if (!ASSERT_GE(iter_fd, 0, "iter_create"))
> -               goto free_link;
> +               goto destroy;
>
>         memset(buf, 0, sizeof(buf));
>         while (read(iter_fd, buf, sizeof(buf) > 0)) {
> @@ -105,11 +109,11 @@ void test_kmem_cache_iter(void)
>                 subtest_kmem_cache_iter_check_task_struct(skel);
>         if (test__start_subtest("check_slabinfo"))
>                 subtest_kmem_cache_iter_check_slabinfo(skel);
> +       if (test__start_subtest("open_coded_iter"))
> +               subtest_kmem_cache_iter_open_coded(skel);
>
>         close(iter_fd);
>
> -free_link:
> -       bpf_link__destroy(link);
>  destroy:
>         kmem_cache_iter__destroy(skel);
>  }
> diff --git a/tools/testing/selftests/bpf/progs/kmem_cache_iter.c b/tools/testing/selftests/bpf/progs/kmem_cache_iter.c
> index 72c9dafecd98406b..e62807caa7593604 100644
> --- a/tools/testing/selftests/bpf/progs/kmem_cache_iter.c
> +++ b/tools/testing/selftests/bpf/progs/kmem_cache_iter.c
> @@ -2,6 +2,8 @@
>  /* Copyright (c) 2024 Google */
>
>  #include "bpf_iter.h"
> +#include "bpf_experimental.h"
> +#include "bpf_misc.h"
>  #include <bpf/bpf_helpers.h>
>  #include <bpf/bpf_tracing.h>
>
> @@ -30,9 +32,12 @@ struct {
>
>  extern struct kmem_cache *bpf_get_kmem_cache(u64 addr) __ksym;
>
> +unsigned int tgid;
> +
>  /* Result, will be checked by userspace */
>  int task_struct_found;
>  int kmem_cache_seen;
> +int open_coded_seen;
>
>  SEC("iter/kmem_cache")
>  int slab_info_collector(struct bpf_iter__kmem_cache *ctx)
> @@ -85,3 +90,26 @@ int BPF_PROG(check_task_struct)
>                 task_struct_found = -2;
>         return 0;
>  }
> +
> +SEC("fentry.s/" SYS_PREFIX "sys_syncfs")
> +int open_coded_iter(const void *ctx)
> +{
> +       struct kmem_cache *s;
> +
> +       if (tgid != bpf_get_current_pid_tgid() >> 32)
> +               return 0;

Pls use syscall prog type and prog_run() it.
No need to attach to exotic syscalls and filter by pid.

> +
> +       bpf_for_each(kmem_cache, s) {
> +               struct kmem_cache_result *r;
> +
> +               r = bpf_map_lookup_elem(&slab_result, &open_coded_seen);
> +               if (!r)
> +                       break;
> +
> +               open_coded_seen++;
> +
> +               if (r->obj_size != s->size)
> +                       break;

The order of 'if' and ++ should probably be changed ?
Otherwise the last object isn't sufficiently checked.

pw-bot: cr
Namhyung Kim Oct. 30, 2024, 1:40 a.m. UTC | #2
Hello,

On Thu, Oct 24, 2024 at 11:08:00AM -0700, Alexei Starovoitov wrote:
> On Thu, Oct 24, 2024 at 12:48 AM Namhyung Kim <namhyung@kernel.org> wrote:
> >
> > The new subtest is attached to sleepable fentry of syncfs() syscall.
> > It iterates the kmem_cache using bpf_for_each loop and count the number
> > of entries.  Finally it checks it with the number of entries from the
> > regular iterator.
> >
> >   $ ./vmtest.sh -- ./test_progs -t kmem_cache_iter
> >   ...
> >   #130/1   kmem_cache_iter/check_task_struct:OK
> >   #130/2   kmem_cache_iter/check_slabinfo:OK
> >   #130/3   kmem_cache_iter/open_coded_iter:OK
> >   #130     kmem_cache_iter:OK
> >   Summary: 1/3 PASSED, 0 SKIPPED, 0 FAILED
> >
> > Also simplify the code by using attach routine of the skeleton.
> >
> > Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> > ---
> > v2)
> >  * remove unnecessary detach  (Martin)
> >  * check pid in syncfs to prevent surprise  (Martin)
> >  * remove unnecessary local variable  (Andrii)
> >
> >  .../testing/selftests/bpf/bpf_experimental.h  |  6 ++++
> >  .../bpf/prog_tests/kmem_cache_iter.c          | 28 +++++++++++--------
> >  .../selftests/bpf/progs/kmem_cache_iter.c     | 28 +++++++++++++++++++
> >  3 files changed, 50 insertions(+), 12 deletions(-)
> >
> > diff --git a/tools/testing/selftests/bpf/bpf_experimental.h b/tools/testing/selftests/bpf/bpf_experimental.h
> > index b0668f29f7b394eb..cd8ecd39c3f3c68d 100644
> > --- a/tools/testing/selftests/bpf/bpf_experimental.h
> > +++ b/tools/testing/selftests/bpf/bpf_experimental.h
> > @@ -582,4 +582,10 @@ extern int bpf_wq_set_callback_impl(struct bpf_wq *wq,
> >                 unsigned int flags__k, void *aux__ign) __ksym;
> >  #define bpf_wq_set_callback(timer, cb, flags) \
> >         bpf_wq_set_callback_impl(timer, cb, flags, NULL)
> > +
> > +struct bpf_iter_kmem_cache;
> > +extern int bpf_iter_kmem_cache_new(struct bpf_iter_kmem_cache *it) __weak __ksym;
> > +extern struct kmem_cache *bpf_iter_kmem_cache_next(struct bpf_iter_kmem_cache *it) __weak __ksym;
> > +extern void bpf_iter_kmem_cache_destroy(struct bpf_iter_kmem_cache *it) __weak __ksym;
> > +
> >  #endif
> > diff --git a/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c b/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
> > index 848d8fc9171fae45..778b55bc1f912b98 100644
> > --- a/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
> > +++ b/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
> > @@ -68,12 +68,20 @@ static void subtest_kmem_cache_iter_check_slabinfo(struct kmem_cache_iter *skel)
> >         fclose(fp);
> >  }
> >
> > +static void subtest_kmem_cache_iter_open_coded(struct kmem_cache_iter *skel)
> > +{
> > +       skel->bss->tgid = getpid();
> > +
> > +       /* To trigger the open coded iterator attached to the syscall */
> > +       syncfs(0);
> > +
> > +       /* It should be same as we've seen from the explicit iterator */
> > +       ASSERT_EQ(skel->bss->open_coded_seen, skel->bss->kmem_cache_seen, "open_code_seen_eq");
> > +}
> > +
> >  void test_kmem_cache_iter(void)
> >  {
> > -       DECLARE_LIBBPF_OPTS(bpf_iter_attach_opts, opts);
> >         struct kmem_cache_iter *skel = NULL;
> > -       union bpf_iter_link_info linfo = {};
> > -       struct bpf_link *link;
> >         char buf[256];
> >         int iter_fd;
> >
> > @@ -81,16 +89,12 @@ void test_kmem_cache_iter(void)
> >         if (!ASSERT_OK_PTR(skel, "kmem_cache_iter__open_and_load"))
> >                 return;
> >
> > -       opts.link_info = &linfo;
> > -       opts.link_info_len = sizeof(linfo);
> > -
> > -       link = bpf_program__attach_iter(skel->progs.slab_info_collector, &opts);
> > -       if (!ASSERT_OK_PTR(link, "attach_iter"))
> > +       if (!ASSERT_OK(kmem_cache_iter__attach(skel), "skel_attach"))
> >                 goto destroy;
> >
> > -       iter_fd = bpf_iter_create(bpf_link__fd(link));
> > +       iter_fd = bpf_iter_create(bpf_link__fd(skel->links.slab_info_collector));
> >         if (!ASSERT_GE(iter_fd, 0, "iter_create"))
> > -               goto free_link;
> > +               goto destroy;
> >
> >         memset(buf, 0, sizeof(buf));
> >         while (read(iter_fd, buf, sizeof(buf) > 0)) {
> > @@ -105,11 +109,11 @@ void test_kmem_cache_iter(void)
> >                 subtest_kmem_cache_iter_check_task_struct(skel);
> >         if (test__start_subtest("check_slabinfo"))
> >                 subtest_kmem_cache_iter_check_slabinfo(skel);
> > +       if (test__start_subtest("open_coded_iter"))
> > +               subtest_kmem_cache_iter_open_coded(skel);
> >
> >         close(iter_fd);
> >
> > -free_link:
> > -       bpf_link__destroy(link);
> >  destroy:
> >         kmem_cache_iter__destroy(skel);
> >  }
> > diff --git a/tools/testing/selftests/bpf/progs/kmem_cache_iter.c b/tools/testing/selftests/bpf/progs/kmem_cache_iter.c
> > index 72c9dafecd98406b..e62807caa7593604 100644
> > --- a/tools/testing/selftests/bpf/progs/kmem_cache_iter.c
> > +++ b/tools/testing/selftests/bpf/progs/kmem_cache_iter.c
> > @@ -2,6 +2,8 @@
> >  /* Copyright (c) 2024 Google */
> >
> >  #include "bpf_iter.h"
> > +#include "bpf_experimental.h"
> > +#include "bpf_misc.h"
> >  #include <bpf/bpf_helpers.h>
> >  #include <bpf/bpf_tracing.h>
> >
> > @@ -30,9 +32,12 @@ struct {
> >
> >  extern struct kmem_cache *bpf_get_kmem_cache(u64 addr) __ksym;
> >
> > +unsigned int tgid;
> > +
> >  /* Result, will be checked by userspace */
> >  int task_struct_found;
> >  int kmem_cache_seen;
> > +int open_coded_seen;
> >
> >  SEC("iter/kmem_cache")
> >  int slab_info_collector(struct bpf_iter__kmem_cache *ctx)
> > @@ -85,3 +90,26 @@ int BPF_PROG(check_task_struct)
> >                 task_struct_found = -2;
> >         return 0;
> >  }
> > +
> > +SEC("fentry.s/" SYS_PREFIX "sys_syncfs")
> > +int open_coded_iter(const void *ctx)
> > +{
> > +       struct kmem_cache *s;
> > +
> > +       if (tgid != bpf_get_current_pid_tgid() >> 32)
> > +               return 0;
> 
> Pls use syscall prog type and prog_run() it.
> No need to attach to exotic syscalls and filter by pid.

Sure, will update in v3.

> 
> > +
> > +       bpf_for_each(kmem_cache, s) {
> > +               struct kmem_cache_result *r;
> > +
> > +               r = bpf_map_lookup_elem(&slab_result, &open_coded_seen);
> > +               if (!r)
> > +                       break;
> > +
> > +               open_coded_seen++;
> > +
> > +               if (r->obj_size != s->size)
> > +                       break;
> 
> The order of 'if' and ++ should probably be changed ?
> Otherwise the last object isn't sufficiently checked.

I don't think so.  The last element should be an actual slab cache and
then the iterator will return NULL to break the loop.  I don't expect it
will hit the if statement.

Thanks,
Namhyung
Namhyung Kim Oct. 30, 2024, 9:35 p.m. UTC | #3
On Tue, Oct 29, 2024 at 06:40:46PM -0700, Namhyung Kim wrote:
> Hello,
> 
> On Thu, Oct 24, 2024 at 11:08:00AM -0700, Alexei Starovoitov wrote:
> > On Thu, Oct 24, 2024 at 12:48 AM Namhyung Kim <namhyung@kernel.org> wrote:
> > >
> > > The new subtest is attached to sleepable fentry of syncfs() syscall.
> > > It iterates the kmem_cache using bpf_for_each loop and count the number
> > > of entries.  Finally it checks it with the number of entries from the
> > > regular iterator.
> > >
> > >   $ ./vmtest.sh -- ./test_progs -t kmem_cache_iter
> > >   ...
> > >   #130/1   kmem_cache_iter/check_task_struct:OK
> > >   #130/2   kmem_cache_iter/check_slabinfo:OK
> > >   #130/3   kmem_cache_iter/open_coded_iter:OK
> > >   #130     kmem_cache_iter:OK
> > >   Summary: 1/3 PASSED, 0 SKIPPED, 0 FAILED
> > >
> > > Also simplify the code by using attach routine of the skeleton.
> > >
> > > Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> > > ---
[SNIP]
> > > +SEC("fentry.s/" SYS_PREFIX "sys_syncfs")
> > > +int open_coded_iter(const void *ctx)
> > > +{
> > > +       struct kmem_cache *s;
> > > +
> > > +       if (tgid != bpf_get_current_pid_tgid() >> 32)
> > > +               return 0;
> > 
> > Pls use syscall prog type and prog_run() it.
> > No need to attach to exotic syscalls and filter by pid.
> 
> Sure, will update in v3.
> 
> > 
> > > +
> > > +       bpf_for_each(kmem_cache, s) {
> > > +               struct kmem_cache_result *r;
> > > +
> > > +               r = bpf_map_lookup_elem(&slab_result, &open_coded_seen);
> > > +               if (!r)
> > > +                       break;
> > > +
> > > +               open_coded_seen++;
> > > +
> > > +               if (r->obj_size != s->size)
> > > +                       break;
> > 
> > The order of 'if' and ++ should probably be changed ?
> > Otherwise the last object isn't sufficiently checked.
> 
> I don't think so.  The last element should be an actual slab cache and
> then the iterator will return NULL to break the loop.  I don't expect it
> will hit the if statement.

Oh, it seems you meant checking the obj_size.  Ok then, I can move the
increment after the check.

Thanks,
Namhyung
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/bpf_experimental.h b/tools/testing/selftests/bpf/bpf_experimental.h
index b0668f29f7b394eb..cd8ecd39c3f3c68d 100644
--- a/tools/testing/selftests/bpf/bpf_experimental.h
+++ b/tools/testing/selftests/bpf/bpf_experimental.h
@@ -582,4 +582,10 @@  extern int bpf_wq_set_callback_impl(struct bpf_wq *wq,
 		unsigned int flags__k, void *aux__ign) __ksym;
 #define bpf_wq_set_callback(timer, cb, flags) \
 	bpf_wq_set_callback_impl(timer, cb, flags, NULL)
+
+struct bpf_iter_kmem_cache;
+extern int bpf_iter_kmem_cache_new(struct bpf_iter_kmem_cache *it) __weak __ksym;
+extern struct kmem_cache *bpf_iter_kmem_cache_next(struct bpf_iter_kmem_cache *it) __weak __ksym;
+extern void bpf_iter_kmem_cache_destroy(struct bpf_iter_kmem_cache *it) __weak __ksym;
+
 #endif
diff --git a/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c b/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
index 848d8fc9171fae45..778b55bc1f912b98 100644
--- a/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
+++ b/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
@@ -68,12 +68,20 @@  static void subtest_kmem_cache_iter_check_slabinfo(struct kmem_cache_iter *skel)
 	fclose(fp);
 }
 
+static void subtest_kmem_cache_iter_open_coded(struct kmem_cache_iter *skel)
+{
+	skel->bss->tgid = getpid();
+
+	/* To trigger the open coded iterator attached to the syscall */
+	syncfs(0);
+
+	/* It should be same as we've seen from the explicit iterator */
+	ASSERT_EQ(skel->bss->open_coded_seen, skel->bss->kmem_cache_seen, "open_code_seen_eq");
+}
+
 void test_kmem_cache_iter(void)
 {
-	DECLARE_LIBBPF_OPTS(bpf_iter_attach_opts, opts);
 	struct kmem_cache_iter *skel = NULL;
-	union bpf_iter_link_info linfo = {};
-	struct bpf_link *link;
 	char buf[256];
 	int iter_fd;
 
@@ -81,16 +89,12 @@  void test_kmem_cache_iter(void)
 	if (!ASSERT_OK_PTR(skel, "kmem_cache_iter__open_and_load"))
 		return;
 
-	opts.link_info = &linfo;
-	opts.link_info_len = sizeof(linfo);
-
-	link = bpf_program__attach_iter(skel->progs.slab_info_collector, &opts);
-	if (!ASSERT_OK_PTR(link, "attach_iter"))
+	if (!ASSERT_OK(kmem_cache_iter__attach(skel), "skel_attach"))
 		goto destroy;
 
-	iter_fd = bpf_iter_create(bpf_link__fd(link));
+	iter_fd = bpf_iter_create(bpf_link__fd(skel->links.slab_info_collector));
 	if (!ASSERT_GE(iter_fd, 0, "iter_create"))
-		goto free_link;
+		goto destroy;
 
 	memset(buf, 0, sizeof(buf));
 	while (read(iter_fd, buf, sizeof(buf) > 0)) {
@@ -105,11 +109,11 @@  void test_kmem_cache_iter(void)
 		subtest_kmem_cache_iter_check_task_struct(skel);
 	if (test__start_subtest("check_slabinfo"))
 		subtest_kmem_cache_iter_check_slabinfo(skel);
+	if (test__start_subtest("open_coded_iter"))
+		subtest_kmem_cache_iter_open_coded(skel);
 
 	close(iter_fd);
 
-free_link:
-	bpf_link__destroy(link);
 destroy:
 	kmem_cache_iter__destroy(skel);
 }
diff --git a/tools/testing/selftests/bpf/progs/kmem_cache_iter.c b/tools/testing/selftests/bpf/progs/kmem_cache_iter.c
index 72c9dafecd98406b..e62807caa7593604 100644
--- a/tools/testing/selftests/bpf/progs/kmem_cache_iter.c
+++ b/tools/testing/selftests/bpf/progs/kmem_cache_iter.c
@@ -2,6 +2,8 @@ 
 /* Copyright (c) 2024 Google */
 
 #include "bpf_iter.h"
+#include "bpf_experimental.h"
+#include "bpf_misc.h"
 #include <bpf/bpf_helpers.h>
 #include <bpf/bpf_tracing.h>
 
@@ -30,9 +32,12 @@  struct {
 
 extern struct kmem_cache *bpf_get_kmem_cache(u64 addr) __ksym;
 
+unsigned int tgid;
+
 /* Result, will be checked by userspace */
 int task_struct_found;
 int kmem_cache_seen;
+int open_coded_seen;
 
 SEC("iter/kmem_cache")
 int slab_info_collector(struct bpf_iter__kmem_cache *ctx)
@@ -85,3 +90,26 @@  int BPF_PROG(check_task_struct)
 		task_struct_found = -2;
 	return 0;
 }
+
+SEC("fentry.s/" SYS_PREFIX "sys_syncfs")
+int open_coded_iter(const void *ctx)
+{
+	struct kmem_cache *s;
+
+	if (tgid != bpf_get_current_pid_tgid() >> 32)
+		return 0;
+
+	bpf_for_each(kmem_cache, s) {
+		struct kmem_cache_result *r;
+
+		r = bpf_map_lookup_elem(&slab_result, &open_coded_seen);
+		if (!r)
+			break;
+
+		open_coded_seen++;
+
+		if (r->obj_size != s->size)
+			break;
+	}
+	return 0;
+}