samples/bpf: Add kmem_alloc()/free() tracker tool (9811e353) · Commits · 戴 / test

samples/bpf/Makefile

+4 −0

Original line number	Diff line number	Diff line
		@@ -9,6 +9,7 @@ hostprogs-y += sockex2
		hostprogs-y += tracex1
		hostprogs-y += tracex2
		hostprogs-y += tracex3
		hostprogs-y += tracex4

		test_verifier-objs := test_verifier.o libbpf.o
		test_maps-objs := test_maps.o libbpf.o
		@@ -18,6 +19,7 @@ sockex2-objs := bpf_load.o libbpf.o sockex2_user.o
		tracex1-objs := bpf_load.o libbpf.o tracex1_user.o
		tracex2-objs := bpf_load.o libbpf.o tracex2_user.o
		tracex3-objs := bpf_load.o libbpf.o tracex3_user.o
		tracex4-objs := bpf_load.o libbpf.o tracex4_user.o

		# Tell kbuild to always build the programs
		always := $(hostprogs-y)
		@@ -26,6 +28,7 @@ always += sockex2_kern.o
		always += tracex1_kern.o
		always += tracex2_kern.o
		always += tracex3_kern.o
		always += tracex4_kern.o

		HOSTCFLAGS += -I$(objtree)/usr/include

		@@ -35,6 +38,7 @@ HOSTLOADLIBES_sockex2 += -lelf
		HOSTLOADLIBES_tracex1 += -lelf
		HOSTLOADLIBES_tracex2 += -lelf
		HOSTLOADLIBES_tracex3 += -lelf
		HOSTLOADLIBES_tracex4 += -lelf -lrt

		# point this to your LLVM backend with bpf support
		LLC=$(srctree)/tools/bpf/llvm/bld/Debug+Asserts/bin/llc

0 → 100644

+54 −0

Original line number	Diff line number	Diff line
		/* Copyright (c) 2015 PLUMgrid, http://plumgrid.com
		*
		* This program is free software; you can redistribute it and/or
		* modify it under the terms of version 2 of the GNU General Public
		* License as published by the Free Software Foundation.
		*/
		#include <linux/ptrace.h>
		#include <linux/version.h>
		#include <uapi/linux/bpf.h>
		#include "bpf_helpers.h"

		struct pair {
		u64 val;
		u64 ip;
		};

		struct bpf_map_def SEC("maps") my_map = {
		.type = BPF_MAP_TYPE_HASH,
		.key_size = sizeof(long),
		.value_size = sizeof(struct pair),
		.max_entries = 1000000,
		};

		/* kprobe is NOT a stable ABI. If kernel internals change this bpf+kprobe
		* example will no longer be meaningful
		*/
		SEC("kprobe/kmem_cache_free")
		int bpf_prog1(struct pt_regs *ctx)
		{
		long ptr = ctx->si;

		bpf_map_delete_elem(&my_map, &ptr);
		return 0;
		}

		SEC("kretprobe/kmem_cache_alloc_node")
		int bpf_prog2(struct pt_regs *ctx)
		{
		long ptr = ctx->ax;
		long ip = 0;

		/* get ip address of kmem_cache_alloc_node() caller */
		bpf_probe_read(&ip, sizeof(ip), (void *)(ctx->bp + sizeof(ip)));

		struct pair v = {
		.val = bpf_ktime_get_ns(),
		.ip = ip,
		};

		bpf_map_update_elem(&my_map, &ptr, &v, BPF_ANY);
		return 0;
		}
		char _license[] SEC("license") = "GPL";
		u32 _version SEC("version") = LINUX_VERSION_CODE;

0 → 100644

+69 −0

Original line number	Diff line number	Diff line
		/* Copyright (c) 2015 PLUMgrid, http://plumgrid.com
		*
		* This program is free software; you can redistribute it and/or
		* modify it under the terms of version 2 of the GNU General Public
		* License as published by the Free Software Foundation.
		*/
		#include <stdio.h>
		#include <stdlib.h>
		#include <signal.h>
		#include <unistd.h>
		#include <stdbool.h>
		#include <string.h>
		#include <time.h>
		#include <linux/bpf.h>
		#include "libbpf.h"
		#include "bpf_load.h"

		struct pair {
		long long val;
		__u64 ip;
		};

		static __u64 time_get_ns(void)
		{
		struct timespec ts;

		clock_gettime(CLOCK_MONOTONIC, &ts);
		return ts.tv_sec * 1000000000ull + ts.tv_nsec;
		}

		static void print_old_objects(int fd)
		{
		long long val = time_get_ns();
		__u64 key, next_key;
		struct pair v;

		key = write(1, "\e[1;1H\e[2J", 12); /* clear screen */

		key = -1;
		while (bpf_get_next_key(map_fd[0], &key, &next_key) == 0) {
		bpf_lookup_elem(map_fd[0], &next_key, &v);
		key = next_key;
		if (val - v.val < 1000000000ll)
		/* object was allocated more then 1 sec ago */
		continue;
		printf("obj 0x%llx is %2lldsec old was allocated at ip %llx\n",
		next_key, (val - v.val) / 1000000000ll, v.ip);
		}
		}

		int main(int ac, char **argv)
		{
		char filename[256];
		int i;

		snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);

		if (load_bpf_file(filename)) {
		printf("%s", bpf_log_buf);
		return 1;
		}

		for (i = 0; ; i++) {
		print_old_objects(map_fd[1]);
		sleep(1);
		}

		return 0;
		}