55 lines · c
1/* Copyright (c) 2015 PLUMgrid, http://plumgrid.com2 *3 * This program is free software; you can redistribute it and/or4 * modify it under the terms of version 2 of the GNU General Public5 * License as published by the Free Software Foundation.6 */7#include "vmlinux.h"8#include <linux/version.h>9#include <bpf/bpf_helpers.h>10#include <bpf/bpf_tracing.h>11 12struct pair {13 u64 val;14 u64 ip;15};16 17struct {18 __uint(type, BPF_MAP_TYPE_HASH);19 __type(key, long);20 __type(value, struct pair);21 __uint(max_entries, 1000000);22} my_map SEC(".maps");23 24/* kprobe is NOT a stable ABI. If kernel internals change this bpf+kprobe25 * example will no longer be meaningful26 */27SEC("kprobe/kmem_cache_free")28int bpf_prog1(struct pt_regs *ctx)29{30 long ptr = PT_REGS_PARM2(ctx);31 32 bpf_map_delete_elem(&my_map, &ptr);33 return 0;34}35 36SEC("kretprobe/kmem_cache_alloc_node_noprof")37int bpf_prog2(struct pt_regs *ctx)38{39 long ptr = PT_REGS_RC(ctx);40 long ip = 0;41 42 /* get ip address of kmem_cache_alloc_node_noprof() caller */43 BPF_KRETPROBE_READ_RET_IP(ip, ctx);44 45 struct pair v = {46 .val = bpf_ktime_get_ns(),47 .ip = ip,48 };49 50 bpf_map_update_elem(&my_map, &ptr, &v, BPF_ANY);51 return 0;52}53char _license[] SEC("license") = "GPL";54u32 _version SEC("version") = LINUX_VERSION_CODE;55