samples/bpf/sampleip_kern.c

0001 /* Copyright 2016 Netflix, Inc.
0002  *
0003  * This program is free software; you can redistribute it and/or
0004  * modify it under the terms of version 2 of the GNU General Public
0005  * License as published by the Free Software Foundation.
0006  */
0007 #include <linux/ptrace.h>
0008 #include <uapi/linux/bpf.h>
0009 #include <uapi/linux/bpf_perf_event.h>
0010 #include <bpf/bpf_helpers.h>
0011 #include <bpf/bpf_tracing.h>
0012
0013 #define MAX_IPS     8192
0014
0015 struct {
0016     __uint(type, BPF_MAP_TYPE_HASH);
0017     __type(key, u64);
0018     __type(value, u32);
0019     __uint(max_entries, MAX_IPS);
0020 } ip_map SEC(".maps");
0021
0022 SEC("perf_event")
0023 int do_sample(struct bpf_perf_event_data *ctx)
0024 {
0025     u64 ip;
0026     u32 *value, init_val = 1;
0027
0028     ip = PT_REGS_IP(&ctx->regs);
0029     value = bpf_map_lookup_elem(&ip_map, &ip);
0030     if (value)
0031         *value += 1;
0032     else
0033         /* E2BIG not tested for this example only */
0034         bpf_map_update_elem(&ip_map, &ip, &init_val, BPF_NOEXIST);
0035
0036     return 0;
0037 }
0038 char _license[] SEC("license") = "GPL";