Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/* Copyright 2016 Netflix, Inc.
2 *
3 * This program is free software; you can redistribute it and/or
4 * modify it under the terms of version 2 of the GNU General Public
5 * License as published by the Free Software Foundation.
6 */
7#include <linux/version.h>
8#include <linux/ptrace.h>
9#include <uapi/linux/bpf.h>
10#include <uapi/linux/bpf_perf_event.h>
11#include <bpf/bpf_helpers.h>
12#include <bpf/bpf_tracing.h>
13
14#define MAX_IPS 8192
15
16struct bpf_map_def SEC("maps") ip_map = {
17 .type = BPF_MAP_TYPE_HASH,
18 .key_size = sizeof(u64),
19 .value_size = sizeof(u32),
20 .max_entries = MAX_IPS,
21};
22
23SEC("perf_event")
24int do_sample(struct bpf_perf_event_data *ctx)
25{
26 u64 ip;
27 u32 *value, init_val = 1;
28
29 ip = PT_REGS_IP(&ctx->regs);
30 value = bpf_map_lookup_elem(&ip_map, &ip);
31 if (value)
32 *value += 1;
33 else
34 /* E2BIG not tested for this example only */
35 bpf_map_update_elem(&ip_map, &ip, &init_val, BPF_NOEXIST);
36
37 return 0;
38}
39char _license[] SEC("license") = "GPL";