mirror of
				git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
				synced 2025-09-04 20:19:47 +08:00 
			
		
		
		
	 3677d0a131
			
		
	
	
		3677d0a131
		
	
	
	
	
		
			
			For the problem of increasing fragmentation of the bpf loader programs,
instead of using bpf_loader.o, which is used in samples/bpf, this
commit refactors the existing kprobe tracing programs with libbbpf
bpf loader.
    - For kprobe events pointing to system calls, the SYSCALL() macro in
    trace_common.h was used.
    - Adding a kprobe event and attaching a bpf program to it was done
    through bpf_program_attach().
    - Instead of using the existing BPF MAP definition, MAP definition
    has been refactored with the new BTF-defined MAP format.
Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200823085334.9413-3-danieltimlee@gmail.com
		
	
			
		
			
				
	
	
		
			45 lines
		
	
	
		
			1.1 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			45 lines
		
	
	
		
			1.1 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
| /* Copyright (c) 2016 Sargun Dhillon <sargun@sargun.me>
 | |
|  *
 | |
|  * This program is free software; you can redistribute it and/or
 | |
|  * modify it under the terms of version 2 of the GNU General Public
 | |
|  * License as published by the Free Software Foundation.
 | |
|  */
 | |
| 
 | |
| #include <linux/ptrace.h>
 | |
| #include <uapi/linux/bpf.h>
 | |
| #include <linux/version.h>
 | |
| #include <bpf/bpf_helpers.h>
 | |
| #include <uapi/linux/utsname.h>
 | |
| #include "trace_common.h"
 | |
| 
 | |
| struct {
 | |
| 	__uint(type, BPF_MAP_TYPE_CGROUP_ARRAY);
 | |
| 	__uint(key_size, sizeof(u32));
 | |
| 	__uint(value_size, sizeof(u32));
 | |
| 	__uint(max_entries, 1);
 | |
| } cgroup_map SEC(".maps");
 | |
| 
 | |
| struct {
 | |
| 	__uint(type, BPF_MAP_TYPE_ARRAY);
 | |
| 	__type(key, u32);
 | |
| 	__type(value, u64);
 | |
| 	__uint(max_entries, 1);
 | |
| } perf_map SEC(".maps");
 | |
| 
 | |
| /* Writes the last PID that called sync to a map at index 0 */
 | |
| SEC("kprobe/" SYSCALL(sys_sync))
 | |
| int bpf_prog1(struct pt_regs *ctx)
 | |
| {
 | |
| 	u64 pid = bpf_get_current_pid_tgid();
 | |
| 	int idx = 0;
 | |
| 
 | |
| 	if (!bpf_current_task_under_cgroup(&cgroup_map, 0))
 | |
| 		return 0;
 | |
| 
 | |
| 	bpf_map_update_elem(&perf_map, &idx, &pid, BPF_ANY);
 | |
| 	return 0;
 | |
| }
 | |
| 
 | |
| char _license[] SEC("license") = "GPL";
 | |
| u32 _version SEC("version") = LINUX_VERSION_CODE;
 |