68 lines
1.6 KiB
C
68 lines
1.6 KiB
C
|
// SPDX-License-Identifier: GPL-2.0
|
||
|
|
// Copyright (c) 2018 Facebook
|
||
|
|
|
||
|
|
#include <linux/bpf.h>
|
||
|
|
#include <bpf/bpf_helpers.h>
|
||
|
|
|
||
|
|
#ifndef PERF_MAX_STACK_DEPTH
|
||
|
|
#define PERF_MAX_STACK_DEPTH 127
|
||
|
|
#endif
|
||
|
|
|
||
|
|
struct {
|
||
|
|
__uint(type, BPF_MAP_TYPE_ARRAY);
|
||
|
|
__uint(max_entries, 1);
|
||
|
|
__type(key, __u32);
|
||
|
|
__type(value, __u32);
|
||
|
|
} control_map SEC(".maps");
|
||
|
|
|
||
|
|
struct {
|
||
|
|
__uint(type, BPF_MAP_TYPE_HASH);
|
||
|
|
__uint(max_entries, 16384);
|
||
|
|
__type(key, __u32);
|
||
|
|
__type(value, __u32);
|
||
|
|
} stackid_hmap SEC(".maps");
|
||
|
|
|
||
|
|
typedef struct bpf_stack_build_id stack_trace_t[PERF_MAX_STACK_DEPTH];
|
||
|
|
|
||
|
|
struct {
|
||
|
|
__uint(type, BPF_MAP_TYPE_STACK_TRACE);
|
||
|
|
__uint(max_entries, 128);
|
||
|
|
__uint(map_flags, BPF_F_STACK_BUILD_ID);
|
||
|
|
__type(key, __u32);
|
||
|
|
__type(value, stack_trace_t);
|
||
|
|
} stackmap SEC(".maps");
|
||
|
|
|
||
|
|
struct {
|
||
|
|
__uint(type, BPF_MAP_TYPE_ARRAY);
|
||
|
|
__uint(max_entries, 128);
|
||
|
|
__type(key, __u32);
|
||
|
|
__type(value, stack_trace_t);
|
||
|
|
} stack_amap SEC(".maps");
|
||
|
|
|
||
|
|
SEC("kprobe/urandom_read_iter")
|
||
|
|
int oncpu(struct pt_regs *args)
|
||
|
|
{
|
||
|
|
__u32 max_len = sizeof(struct bpf_stack_build_id)
|
||
|
|
* PERF_MAX_STACK_DEPTH;
|
||
|
|
__u32 key = 0, val = 0, *value_p;
|
||
|
|
void *stack_p;
|
||
|
|
|
||
|
|
value_p = bpf_map_lookup_elem(&control_map, &key);
|
||
|
|
if (value_p && *value_p)
|
||
|
|
return 0; /* skip if non-zero *value_p */
|
||
|
|
|
||
|
|
/* The size of stackmap and stackid_hmap should be the same */
|
||
|
|
key = bpf_get_stackid(args, &stackmap, BPF_F_USER_STACK);
|
||
|
|
if ((int)key >= 0) {
|
||
|
|
bpf_map_update_elem(&stackid_hmap, &key, &val, 0);
|
||
|
|
stack_p = bpf_map_lookup_elem(&stack_amap, &key);
|
||
|
|
if (stack_p)
|
||
|
|
bpf_get_stack(args, stack_p, max_len,
|
||
|
|
BPF_F_USER_STACK | BPF_F_USER_BUILD_ID);
|
||
|
|
}
|
||
|
|
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
char _license[] SEC("license") = "GPL";
|