Alexei Starovoitov | 9811e35 | 2015-03-25 12:49:26 -0700 | [diff] [blame] | 1 | /* Copyright (c) 2015 PLUMgrid, http://plumgrid.com |
| 2 | * |
| 3 | * This program is free software; you can redistribute it and/or |
| 4 | * modify it under the terms of version 2 of the GNU General Public |
| 5 | * License as published by the Free Software Foundation. |
| 6 | */ |
| 7 | #include <linux/ptrace.h> |
| 8 | #include <linux/version.h> |
| 9 | #include <uapi/linux/bpf.h> |
Toke Høiland-Jørgensen | 7cf245a | 2020-01-20 14:06:49 +0100 | [diff] [blame] | 10 | #include <bpf/bpf_helpers.h> |
| 11 | #include <bpf/bpf_tracing.h> |
Alexei Starovoitov | 9811e35 | 2015-03-25 12:49:26 -0700 | [diff] [blame] | 12 | |
| 13 | struct pair { |
| 14 | u64 val; |
| 15 | u64 ip; |
| 16 | }; |
| 17 | |
Daniel T. Lee | 59929cd | 2020-05-16 13:06:08 +0900 | [diff] [blame] | 18 | struct { |
| 19 | __uint(type, BPF_MAP_TYPE_HASH); |
| 20 | __type(key, long); |
| 21 | __type(value, struct pair); |
| 22 | __uint(max_entries, 1000000); |
| 23 | } my_map SEC(".maps"); |
Alexei Starovoitov | 9811e35 | 2015-03-25 12:49:26 -0700 | [diff] [blame] | 24 | |
| 25 | /* kprobe is NOT a stable ABI. If kernel internals change this bpf+kprobe |
| 26 | * example will no longer be meaningful |
| 27 | */ |
| 28 | SEC("kprobe/kmem_cache_free") |
| 29 | int bpf_prog1(struct pt_regs *ctx) |
| 30 | { |
Michael Holzheu | d912557 | 2015-07-06 16:20:07 +0200 | [diff] [blame] | 31 | long ptr = PT_REGS_PARM2(ctx); |
Alexei Starovoitov | 9811e35 | 2015-03-25 12:49:26 -0700 | [diff] [blame] | 32 | |
| 33 | bpf_map_delete_elem(&my_map, &ptr); |
| 34 | return 0; |
| 35 | } |
| 36 | |
| 37 | SEC("kretprobe/kmem_cache_alloc_node") |
| 38 | int bpf_prog2(struct pt_regs *ctx) |
| 39 | { |
Michael Holzheu | d912557 | 2015-07-06 16:20:07 +0200 | [diff] [blame] | 40 | long ptr = PT_REGS_RC(ctx); |
Alexei Starovoitov | 9811e35 | 2015-03-25 12:49:26 -0700 | [diff] [blame] | 41 | long ip = 0; |
| 42 | |
| 43 | /* get ip address of kmem_cache_alloc_node() caller */ |
Naveen N. Rao | 138d615 | 2016-04-04 22:31:34 +0530 | [diff] [blame] | 44 | BPF_KRETPROBE_READ_RET_IP(ip, ctx); |
Alexei Starovoitov | 9811e35 | 2015-03-25 12:49:26 -0700 | [diff] [blame] | 45 | |
| 46 | struct pair v = { |
| 47 | .val = bpf_ktime_get_ns(), |
| 48 | .ip = ip, |
| 49 | }; |
| 50 | |
| 51 | bpf_map_update_elem(&my_map, &ptr, &v, BPF_ANY); |
| 52 | return 0; |
| 53 | } |
| 54 | char _license[] SEC("license") = "GPL"; |
| 55 | u32 _version SEC("version") = LINUX_VERSION_CODE; |