1 /* eBPF mini library */
4 #include <linux/unistd.h>
7 #include <linux/netlink.h>
10 #include <net/ethernet.h>
12 #include <linux/if_packet.h>
13 #include <arpa/inet.h>
16 static __u64 ptr_to_u64(void *ptr)
18 return (__u64) (unsigned long) ptr;
21 int bpf_create_map(enum bpf_map_type map_type, int key_size, int value_size,
22 int max_entries, int map_flags)
24 union bpf_attr attr = {
27 .value_size = value_size,
28 .max_entries = max_entries,
29 .map_flags = map_flags,
32 return syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));
35 int bpf_update_elem(int fd, void *key, void *value, unsigned long long flags)
37 union bpf_attr attr = {
39 .key = ptr_to_u64(key),
40 .value = ptr_to_u64(value),
44 return syscall(__NR_bpf, BPF_MAP_UPDATE_ELEM, &attr, sizeof(attr));
47 int bpf_lookup_elem(int fd, void *key, void *value)
49 union bpf_attr attr = {
51 .key = ptr_to_u64(key),
52 .value = ptr_to_u64(value),
55 return syscall(__NR_bpf, BPF_MAP_LOOKUP_ELEM, &attr, sizeof(attr));
58 int bpf_delete_elem(int fd, void *key)
60 union bpf_attr attr = {
62 .key = ptr_to_u64(key),
65 return syscall(__NR_bpf, BPF_MAP_DELETE_ELEM, &attr, sizeof(attr));
68 int bpf_get_next_key(int fd, void *key, void *next_key)
70 union bpf_attr attr = {
72 .key = ptr_to_u64(key),
73 .next_key = ptr_to_u64(next_key),
76 return syscall(__NR_bpf, BPF_MAP_GET_NEXT_KEY, &attr, sizeof(attr));
79 #define ROUND_UP(x, n) (((x) + (n) - 1u) & ~((n) - 1u))
81 char bpf_log_buf[LOG_BUF_SIZE];
83 int bpf_prog_load(enum bpf_prog_type prog_type,
84 const struct bpf_insn *insns, int prog_len,
85 const char *license, int kern_version)
87 union bpf_attr attr = {
88 .prog_type = prog_type,
89 .insns = ptr_to_u64((void *) insns),
90 .insn_cnt = prog_len / sizeof(struct bpf_insn),
91 .license = ptr_to_u64((void *) license),
92 .log_buf = ptr_to_u64(bpf_log_buf),
93 .log_size = LOG_BUF_SIZE,
97 /* assign one field outside of struct init to make sure any
98 * padding is zero initialized
100 attr.kern_version = kern_version;
104 return syscall(__NR_bpf, BPF_PROG_LOAD, &attr, sizeof(attr));
107 int bpf_obj_pin(int fd, const char *pathname)
109 union bpf_attr attr = {
110 .pathname = ptr_to_u64((void *)pathname),
114 return syscall(__NR_bpf, BPF_OBJ_PIN, &attr, sizeof(attr));
117 int bpf_obj_get(const char *pathname)
119 union bpf_attr attr = {
120 .pathname = ptr_to_u64((void *)pathname),
123 return syscall(__NR_bpf, BPF_OBJ_GET, &attr, sizeof(attr));
126 int open_raw_sock(const char *name)
128 struct sockaddr_ll sll;
131 sock = socket(PF_PACKET, SOCK_RAW | SOCK_NONBLOCK | SOCK_CLOEXEC, htons(ETH_P_ALL));
133 printf("cannot create raw socket\n");
137 memset(&sll, 0, sizeof(sll));
138 sll.sll_family = AF_PACKET;
139 sll.sll_ifindex = if_nametoindex(name);
140 sll.sll_protocol = htons(ETH_P_ALL);
141 if (bind(sock, (struct sockaddr *)&sll, sizeof(sll)) < 0) {
142 printf("bind to %s: %s\n", name, strerror(errno));
150 int perf_event_open(struct perf_event_attr *attr, int pid, int cpu,
151 int group_fd, unsigned long flags)
153 return syscall(__NR_perf_event_open, attr, pid, cpu,