1 /* Copyright (c) 2015 PLUMgrid, http://plumgrid.com 2 * 3 * This program is free software; you can redistribute it and/or 4 * modify it under the terms of version 2 of the GNU General Public 5 * License as published by the Free Software Foundation. 6 */ 7 #include "vmlinux.h" 8 #include <linux/version.h> 9 #include <bpf/bpf_helpers.h> 10 #include <bpf/bpf_tracing.h> 11 12 struct pair { 13 u64 val; 14 u64 ip; 15 }; 16 17 struct { 18 __uint(type, BPF_MAP_TYPE_HASH); 19 __type(key, long); 20 __type(value, struct pair); 21 __uint(max_entries, 1000000); 22 } my_map SEC(".maps"); 23 24 /* kprobe is NOT a stable ABI. If kernel internals change this bpf+kprobe 25 * example will no longer be meaningful 26 */ 27 SEC("kprobe/kmem_cache_free") 28 int bpf_prog1(struct pt_regs *ctx) 29 { 30 long ptr = PT_REGS_PARM2(ctx); 31 32 bpf_map_delete_elem(&my_map, &ptr); 33 return 0; 34 } 35 36 SEC("kretprobe/kmem_cache_alloc_node") 37 int bpf_prog2(struct pt_regs *ctx) 38 { 39 long ptr = PT_REGS_RC(ctx); 40 long ip = 0; 41 42 /* get ip address of kmem_cache_alloc_node() caller */ 43 BPF_KRETPROBE_READ_RET_IP(ip, ctx); 44 45 struct pair v = { 46 .val = bpf_ktime_get_ns(), 47 .ip = ip, 48 }; 49 50 bpf_map_update_elem(&my_map, &ptr, &v, BPF_ANY); 51 return 0; 52 } 53 char _license[] SEC("license") = "GPL"; 54 u32 _version SEC("version") = LINUX_VERSION_CODE; 55