61 lines · c
1/* Copyright (c) 2016, Facebook2 *3 * This program is free software; you can redistribute it and/or4 * modify it under the terms of version 2 of the GNU General Public5 * License as published by the Free Software Foundation.6 */7#include "vmlinux.h"8#include <linux/version.h>9#include <bpf/bpf_helpers.h>10#include <bpf/bpf_tracing.h>11 12#ifndef PERF_MAX_STACK_DEPTH13#define PERF_MAX_STACK_DEPTH 12714#endif15 16struct {17 __uint(type, BPF_MAP_TYPE_HASH);18 __type(key, long);19 __type(value, long);20 __uint(max_entries, 1024);21} my_map SEC(".maps");22struct {23 __uint(type, BPF_MAP_TYPE_PERCPU_HASH);24 __uint(key_size, sizeof(long));25 __uint(value_size, sizeof(long));26 __uint(max_entries, 1024);27} my_map2 SEC(".maps");28 29struct {30 __uint(type, BPF_MAP_TYPE_STACK_TRACE);31 __uint(key_size, sizeof(u32));32 __uint(value_size, PERF_MAX_STACK_DEPTH * sizeof(u64));33 __uint(max_entries, 10000);34} stackmap SEC(".maps");35 36#define PROG(foo) \37int foo(struct pt_regs *ctx) \38{ \39 long v = PT_REGS_IP(ctx), *val; \40\41 val = bpf_map_lookup_elem(&my_map, &v); \42 bpf_map_update_elem(&my_map, &v, &v, BPF_ANY); \43 bpf_map_update_elem(&my_map2, &v, &v, BPF_ANY); \44 bpf_map_delete_elem(&my_map2, &v); \45 bpf_get_stackid(ctx, &stackmap, BPF_F_REUSE_STACKID); \46 return 0; \47}48 49/* add kprobes to all possible *spin* functions */50SEC("kprobe.multi/spin_*lock*")PROG(spin_lock)51SEC("kprobe.multi/*_spin_on_owner")PROG(spin_on_owner)52SEC("kprobe.multi/_raw_spin_*lock*")PROG(raw_spin_lock)53 54/* and to inner bpf helpers */55SEC("kprobe/htab_map_update_elem")PROG(p15)56SEC("kprobe/__htab_percpu_map_update_elem")PROG(p16)57SEC("kprobe/htab_map_alloc")PROG(p17)58 59char _license[] SEC("license") = "GPL";60u32 _version SEC("version") = LINUX_VERSION_CODE;61