1 /* eBPF mini library */
4 #include <linux/unistd.h>
7 #include <linux/netlink.h>
10 #include <net/ethernet.h>
12 #include <linux/if_packet.h>
13 #include <arpa/inet.h>
16 static __u64
ptr_to_u64(void *ptr
)
18 return (__u64
) (unsigned long) ptr
;
21 int bpf_create_map(enum bpf_map_type map_type
, int key_size
, int value_size
,
22 int max_entries
, int map_flags
)
24 union bpf_attr attr
= {
27 .value_size
= value_size
,
28 .max_entries
= max_entries
,
29 .map_flags
= map_flags
,
32 return syscall(__NR_bpf
, BPF_MAP_CREATE
, &attr
, sizeof(attr
));
35 int bpf_update_elem(int fd
, void *key
, void *value
, unsigned long long flags
)
37 union bpf_attr attr
= {
39 .key
= ptr_to_u64(key
),
40 .value
= ptr_to_u64(value
),
44 return syscall(__NR_bpf
, BPF_MAP_UPDATE_ELEM
, &attr
, sizeof(attr
));
47 int bpf_lookup_elem(int fd
, void *key
, void *value
)
49 union bpf_attr attr
= {
51 .key
= ptr_to_u64(key
),
52 .value
= ptr_to_u64(value
),
55 return syscall(__NR_bpf
, BPF_MAP_LOOKUP_ELEM
, &attr
, sizeof(attr
));
58 int bpf_delete_elem(int fd
, void *key
)
60 union bpf_attr attr
= {
62 .key
= ptr_to_u64(key
),
65 return syscall(__NR_bpf
, BPF_MAP_DELETE_ELEM
, &attr
, sizeof(attr
));
68 int bpf_get_next_key(int fd
, void *key
, void *next_key
)
70 union bpf_attr attr
= {
72 .key
= ptr_to_u64(key
),
73 .next_key
= ptr_to_u64(next_key
),
76 return syscall(__NR_bpf
, BPF_MAP_GET_NEXT_KEY
, &attr
, sizeof(attr
));
79 #define ROUND_UP(x, n) (((x) + (n) - 1u) & ~((n) - 1u))
81 char bpf_log_buf
[LOG_BUF_SIZE
];
83 int bpf_prog_load(enum bpf_prog_type prog_type
,
84 const struct bpf_insn
*insns
, int prog_len
,
85 const char *license
, int kern_version
)
87 union bpf_attr attr
= {
88 .prog_type
= prog_type
,
89 .insns
= ptr_to_u64((void *) insns
),
90 .insn_cnt
= prog_len
/ sizeof(struct bpf_insn
),
91 .license
= ptr_to_u64((void *) license
),
92 .log_buf
= ptr_to_u64(bpf_log_buf
),
93 .log_size
= LOG_BUF_SIZE
,
97 /* assign one field outside of struct init to make sure any
98 * padding is zero initialized
100 attr
.kern_version
= kern_version
;
104 return syscall(__NR_bpf
, BPF_PROG_LOAD
, &attr
, sizeof(attr
));
107 int bpf_obj_pin(int fd
, const char *pathname
)
109 union bpf_attr attr
= {
110 .pathname
= ptr_to_u64((void *)pathname
),
114 return syscall(__NR_bpf
, BPF_OBJ_PIN
, &attr
, sizeof(attr
));
117 int bpf_obj_get(const char *pathname
)
119 union bpf_attr attr
= {
120 .pathname
= ptr_to_u64((void *)pathname
),
123 return syscall(__NR_bpf
, BPF_OBJ_GET
, &attr
, sizeof(attr
));
126 int open_raw_sock(const char *name
)
128 struct sockaddr_ll sll
;
131 sock
= socket(PF_PACKET
, SOCK_RAW
| SOCK_NONBLOCK
| SOCK_CLOEXEC
, htons(ETH_P_ALL
));
133 printf("cannot create raw socket\n");
137 memset(&sll
, 0, sizeof(sll
));
138 sll
.sll_family
= AF_PACKET
;
139 sll
.sll_ifindex
= if_nametoindex(name
);
140 sll
.sll_protocol
= htons(ETH_P_ALL
);
141 if (bind(sock
, (struct sockaddr
*)&sll
, sizeof(sll
)) < 0) {
142 printf("bind to %s: %s\n", name
, strerror(errno
));
150 int perf_event_open(struct perf_event_attr
*attr
, int pid
, int cpu
,
151 int group_fd
, unsigned long flags
)
153 return syscall(__NR_perf_event_open
, attr
, pid
, cpu
,