1 | /* Copyright (c) 2013-2015 PLUMgrid, http://plumgrid.com |
2 | * |
3 | * This program is free software; you can redistribute it and/or |
4 | * modify it under the terms of version 2 of the GNU General Public |
5 | * License as published by the Free Software Foundation. |
6 | */ |
7 | #include "vmlinux.h" |
8 | #include "net_shared.h" |
9 | #include <linux/version.h> |
10 | #include <bpf/bpf_helpers.h> |
11 | #include <bpf/bpf_core_read.h> |
12 | #include <bpf/bpf_tracing.h> |
13 | |
14 | /* kprobe is NOT a stable ABI |
15 | * kernel functions can be removed, renamed or completely change semantics. |
16 | * Number of arguments and their positions can change, etc. |
17 | * In such case this bpf+kprobe example will no longer be meaningful |
18 | */ |
19 | SEC("kprobe.multi/__netif_receive_skb_core*" ) |
20 | int bpf_prog1(struct pt_regs *ctx) |
21 | { |
22 | /* attaches to kprobe __netif_receive_skb_core, |
23 | * looks for packets on loobpack device and prints them |
24 | * (wildcard is used for avoiding symbol mismatch due to optimization) |
25 | */ |
26 | char devname[IFNAMSIZ]; |
27 | struct net_device *dev; |
28 | struct sk_buff *skb; |
29 | int len; |
30 | |
31 | bpf_core_read(&skb, sizeof(skb), (void *)PT_REGS_PARM1(ctx)); |
32 | dev = BPF_CORE_READ(skb, dev); |
33 | len = BPF_CORE_READ(skb, len); |
34 | |
35 | BPF_CORE_READ_STR_INTO(&devname, dev, name); |
36 | |
37 | if (devname[0] == 'l' && devname[1] == 'o') { |
38 | char fmt[] = "skb %p len %d\n" ; |
39 | /* using bpf_trace_printk() for DEBUG ONLY */ |
40 | bpf_trace_printk(fmt, sizeof(fmt), skb, len); |
41 | } |
42 | |
43 | return 0; |
44 | } |
45 | |
46 | char _license[] SEC("license" ) = "GPL" ; |
47 | u32 _version SEC("version" ) = LINUX_VERSION_CODE; |
48 | |