Attachment 1476812 Details for Bug 1618958 – Testing source code file

Testing source code file

kprobes_kern.c (text/x-csrc), 2.74 KB, created by Stanislav Kozina on 2018-08-18 20:00:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stanislav Kozina

Created: 2018-08-18 20:00:17 UTC

Size: 2.74 KB

patch

obsolete

>/* Copyright (c) 2013-2015 PLUMgrid, http://plumgrid.com
> *
> * This program is free software; you can redistribute it and/or
> * modify it under the terms of version 2 of the GNU General Public
> * License as published by the Free Software Foundation.
> */
>#include <linux/bpf.h>
>#include <linux/version.h>
>
>#define SEC(NAME) __attribute__((section(NAME), used))
>
>struct pt_regs {
>/*
> * C ABI says these regs are callee-preserved. They aren't saved on kernel entry
> * unless syscall needs a complete, fully filled "struct pt_regs".
> */
>        unsigned long r15;
>        unsigned long r14;
>        unsigned long r13;
>        unsigned long r12;
>        unsigned long bp;
>        unsigned long bx;
>/* These regs are callee-clobbered. Always saved on kernel entry. */
>        unsigned long r11;
>        unsigned long r10;
>        unsigned long r9;
>        unsigned long r8;
>        unsigned long ax;
>        unsigned long cx;
>        unsigned long dx;
>        unsigned long si;
>        unsigned long di;
>/*
> * On syscall entry, this is syscall#. On CPU exception, this is error code.
> * On hw interrupt, it's IRQ number:
> */
>        unsigned long orig_ax;
>/* Return frame for iretq */
>        unsigned long ip;
>        unsigned long cs;
>        unsigned long flags;
>        unsigned long sp;
>        unsigned long ss;
>/* top of stack page */
>};
>
>#define PT_REGS_PARM1(x) ((x)->di)
>#define PT_REGS_PARM2(x) ((x)->si)
>#define PT_REGS_PARM3(x) ((x)->dx)
>#define PT_REGS_PARM4(x) ((x)->cx)
>#define PT_REGS_PARM5(x) ((x)->r8)
>#define PT_REGS_RET(x) ((x)->sp)
>#define PT_REGS_FP(x) ((x)->bp)
>#define PT_REGS_RC(x) ((x)->ax)
>#define PT_REGS_SP(x) ((x)->sp)
>#define PT_REGS_IP(x) ((x)->ip)
>
>struct bpf_map_def {
>        unsigned int type;
>        unsigned int key_size;
>        unsigned int value_size;
>        unsigned int max_entries;
>        unsigned int map_flags;
>        unsigned int inner_map_idx;
>        unsigned int numa_node;
>};
>
>static void *(*bpf_map_lookup_elem)(void *map, void *key) =
>        (void *) BPF_FUNC_map_lookup_elem;
>static int (*bpf_map_update_elem)(void *map, void *key, void *value,
>		unsigned long long flags) =
>	(void *) BPF_FUNC_map_update_elem;
>
>struct bpf_map_def SEC("maps") my_map = {
>        .type = BPF_MAP_TYPE_HASH,
>        .key_size = sizeof(int),
>        .value_size = sizeof(int),
>        .max_entries = 256,
>};
>
>SEC("kprobe/sys_kill")
>int bpf_prog1(struct pt_regs *ctx)
>{
>	int tpid, sig;
>	int *count;
>	int init_val = 1;
>
>	tpid = (int) PT_REGS_PARM1(ctx);
>	sig = (int) PT_REGS_PARM2(ctx);
>
>        count = bpf_map_lookup_elem(&my_map, &tpid);
>	if (count)
>                __sync_fetch_and_add(count, 1);
>	else
>		bpf_map_update_elem(&my_map, &tpid, &init_val, BPF_ANY);
>
>	return 0;
>}
>
>char _license[] SEC("license") = "GPL";
>__u32 _version SEC("version") = LINUX_VERSION_CODE;

Actions: View

Attachments on bug 1618958: 1476812