tracex4_kern.c 1.2 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455
  1. /* Copyright (c) 2015 PLUMgrid, http://plumgrid.com
  2. *
  3. * This program is free software; you can redistribute it and/or
  4. * modify it under the terms of version 2 of the GNU General Public
  5. * License as published by the Free Software Foundation.
  6. */
  7. #include <linux/ptrace.h>
  8. #include <linux/version.h>
  9. #include <uapi/linux/bpf.h>
  10. #include <bpf/bpf_helpers.h>
  11. #include <bpf/bpf_tracing.h>
  12. struct pair {
  13. u64 val;
  14. u64 ip;
  15. };
  16. struct {
  17. __uint(type, BPF_MAP_TYPE_HASH);
  18. __type(key, long);
  19. __type(value, struct pair);
  20. __uint(max_entries, 1000000);
  21. } my_map SEC(".maps");
  22. /* kprobe is NOT a stable ABI. If kernel internals change this bpf+kprobe
  23. * example will no longer be meaningful
  24. */
  25. SEC("kprobe/kmem_cache_free")
  26. int bpf_prog1(struct pt_regs *ctx)
  27. {
  28. long ptr = PT_REGS_PARM2(ctx);
  29. bpf_map_delete_elem(&my_map, &ptr);
  30. return 0;
  31. }
  32. SEC("kretprobe/kmem_cache_alloc_node")
  33. int bpf_prog2(struct pt_regs *ctx)
  34. {
  35. long ptr = PT_REGS_RC(ctx);
  36. long ip = 0;
  37. /* get ip address of kmem_cache_alloc_node() caller */
  38. BPF_KRETPROBE_READ_RET_IP(ip, ctx);
  39. struct pair v = {
  40. .val = bpf_ktime_get_ns(),
  41. .ip = ip,
  42. };
  43. bpf_map_update_elem(&my_map, &ptr, &v, BPF_ANY);
  44. return 0;
  45. }
  46. char _license[] SEC("license") = "GPL";
  47. u32 _version SEC("version") = LINUX_VERSION_CODE;