1 | #include "vmlinux.h" |
2 | #include <linux/version.h> |
3 | #include <bpf/bpf_helpers.h> |
4 | #include <bpf/bpf_tracing.h> |
5 | #include <bpf/bpf_core_read.h> |
6 | |
7 | struct { |
8 | __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); |
9 | __uint(key_size, sizeof(int)); |
10 | __uint(value_size, sizeof(u32)); |
11 | __uint(max_entries, 64); |
12 | } counters SEC(".maps" ); |
13 | |
14 | struct { |
15 | __uint(type, BPF_MAP_TYPE_HASH); |
16 | __type(key, int); |
17 | __type(value, u64); |
18 | __uint(max_entries, 64); |
19 | } values SEC(".maps" ); |
20 | |
21 | struct { |
22 | __uint(type, BPF_MAP_TYPE_HASH); |
23 | __type(key, int); |
24 | __type(value, struct bpf_perf_event_value); |
25 | __uint(max_entries, 64); |
26 | } values2 SEC(".maps" ); |
27 | |
28 | SEC("kprobe/htab_map_get_next_key" ) |
29 | int bpf_prog1(struct pt_regs *ctx) |
30 | { |
31 | u32 key = bpf_get_smp_processor_id(); |
32 | u64 count, *val; |
33 | s64 error; |
34 | |
35 | count = bpf_perf_event_read(&counters, key); |
36 | error = (s64)count; |
37 | if (error <= -2 && error >= -22) |
38 | return 0; |
39 | |
40 | val = bpf_map_lookup_elem(&values, &key); |
41 | if (val) |
42 | *val = count; |
43 | else |
44 | bpf_map_update_elem(&values, &key, &count, BPF_NOEXIST); |
45 | |
46 | return 0; |
47 | } |
48 | |
49 | /* |
50 | * Since *_map_lookup_elem can't be expected to trigger bpf programs |
51 | * due to potential deadlocks (bpf_disable_instrumentation), this bpf |
52 | * program will be attached to bpf_map_copy_value (which is called |
53 | * from map_lookup_elem) and will only filter the hashtable type. |
54 | */ |
55 | SEC("kprobe/bpf_map_copy_value" ) |
56 | int BPF_KPROBE(bpf_prog2, struct bpf_map *map) |
57 | { |
58 | u32 key = bpf_get_smp_processor_id(); |
59 | struct bpf_perf_event_value *val, buf; |
60 | enum bpf_map_type type; |
61 | int error; |
62 | |
63 | type = BPF_CORE_READ(map, map_type); |
64 | if (type != BPF_MAP_TYPE_HASH) |
65 | return 0; |
66 | |
67 | error = bpf_perf_event_read_value(&counters, key, &buf, sizeof(buf)); |
68 | if (error) |
69 | return 0; |
70 | |
71 | val = bpf_map_lookup_elem(&values2, &key); |
72 | if (val) |
73 | *val = buf; |
74 | else |
75 | bpf_map_update_elem(&values2, &key, &buf, BPF_NOEXIST); |
76 | |
77 | return 0; |
78 | } |
79 | |
80 | char _license[] SEC("license" ) = "GPL" ; |
81 | u32 _version SEC("version" ) = LINUX_VERSION_CODE; |
82 | |