| .. | .. |
|---|
| 18 | 18 | unsigned int numa_node; |
|---|
| 19 | 19 | }; |
|---|
| 20 | 20 | |
|---|
| 21 | +#define bpf_map(name, _type, type_key, type_val, _max_entries) \ |
|---|
| 22 | +struct bpf_map SEC("maps") name = { \ |
|---|
| 23 | + .type = BPF_MAP_TYPE_##_type, \ |
|---|
| 24 | + .key_size = sizeof(type_key), \ |
|---|
| 25 | + .value_size = sizeof(type_val), \ |
|---|
| 26 | + .max_entries = _max_entries, \ |
|---|
| 27 | +}; \ |
|---|
| 28 | +struct ____btf_map_##name { \ |
|---|
| 29 | + type_key key; \ |
|---|
| 30 | + type_val value; \ |
|---|
| 31 | +}; \ |
|---|
| 32 | +struct ____btf_map_##name __attribute__((section(".maps." #name), used)) \ |
|---|
| 33 | + ____btf_map_##name = { } |
|---|
| 34 | + |
|---|
| 35 | +/* |
|---|
| 36 | + * FIXME: this should receive .max_entries as a parameter, as careful |
|---|
| 37 | + * tuning of these limits is needed to avoid hitting limits that |
|---|
| 38 | + * prevents other BPF constructs, such as tracepoint handlers, |
|---|
| 39 | + * to get installed, with cryptic messages from libbpf, etc. |
|---|
| 40 | + * For the current need, 'perf trace --filter-pids', 64 should |
|---|
| 41 | + * be good enough, but this surely needs to be revisited. |
|---|
| 42 | + */ |
|---|
| 43 | +#define pid_map(name, value_type) bpf_map(name, HASH, pid_t, value_type, 64) |
|---|
| 44 | + |
|---|
| 45 | +static int (*bpf_map_update_elem)(struct bpf_map *map, void *key, void *value, u64 flags) = (void *)BPF_FUNC_map_update_elem; |
|---|
| 46 | +static void *(*bpf_map_lookup_elem)(struct bpf_map *map, void *key) = (void *)BPF_FUNC_map_lookup_elem; |
|---|
| 47 | + |
|---|
| 48 | +static void (*bpf_tail_call)(void *ctx, void *map, int index) = (void *)BPF_FUNC_tail_call; |
|---|
| 49 | + |
|---|
| 21 | 50 | #define SEC(NAME) __attribute__((section(NAME), used)) |
|---|
| 22 | 51 | |
|---|
| 23 | 52 | #define probe(function, vars) \ |
|---|
| .. | .. |
|---|
| 26 | 55 | #define syscall_enter(name) \ |
|---|
| 27 | 56 | SEC("syscalls:sys_enter_" #name) syscall_enter_ ## name |
|---|
| 28 | 57 | |
|---|
| 58 | +#define syscall_exit(name) \ |
|---|
| 59 | + SEC("syscalls:sys_exit_" #name) syscall_exit_ ## name |
|---|
| 60 | + |
|---|
| 29 | 61 | #define license(name) \ |
|---|
| 30 | 62 | char _license[] SEC("license") = #name; \ |
|---|
| 31 | 63 | int _version SEC("version") = LINUX_VERSION_CODE; |
|---|
| .. | .. |
|---|
| 33 | 65 | static int (*probe_read)(void *dst, int size, const void *unsafe_addr) = (void *)BPF_FUNC_probe_read; |
|---|
| 34 | 66 | static int (*probe_read_str)(void *dst, int size, const void *unsafe_addr) = (void *)BPF_FUNC_probe_read_str; |
|---|
| 35 | 67 | |
|---|
| 68 | +static int (*perf_event_output)(void *, struct bpf_map *, int, void *, unsigned long) = (void *)BPF_FUNC_perf_event_output; |
|---|
| 69 | + |
|---|
| 36 | 70 | #endif /* _PERF_BPF_H */ |
|---|