1 /* eBPF mini library */
7 int bpf_create_map(enum bpf_map_type map_type, int key_size, int value_size,
8 int max_entries, int map_flags);
9 int bpf_update_elem(int fd, void *key, void *value, unsigned long long flags);
10 int bpf_lookup_elem(int fd, void *key, void *value);
11 int bpf_delete_elem(int fd, void *key);
12 int bpf_get_next_key(int fd, void *key, void *next_key);
14 int bpf_prog_load(enum bpf_prog_type prog_type,
15 const struct bpf_insn *insns, int insn_len,
16 const char *license, int kern_version);
18 int bpf_obj_pin(int fd, const char *pathname);
19 int bpf_obj_get(const char *pathname);
21 #define LOG_BUF_SIZE 65536
22 extern char bpf_log_buf[LOG_BUF_SIZE];
24 /* ALU ops on registers, bpf_add|sub|...: dst_reg += src_reg */
26 #define BPF_ALU64_REG(OP, DST, SRC) \
27 ((struct bpf_insn) { \
28 .code = BPF_ALU64 | BPF_OP(OP) | BPF_X, \
34 #define BPF_ALU32_REG(OP, DST, SRC) \
35 ((struct bpf_insn) { \
36 .code = BPF_ALU | BPF_OP(OP) | BPF_X, \
42 /* ALU ops on immediates, bpf_add|sub|...: dst_reg += imm32 */
44 #define BPF_ALU64_IMM(OP, DST, IMM) \
45 ((struct bpf_insn) { \
46 .code = BPF_ALU64 | BPF_OP(OP) | BPF_K, \
52 #define BPF_ALU32_IMM(OP, DST, IMM) \
53 ((struct bpf_insn) { \
54 .code = BPF_ALU | BPF_OP(OP) | BPF_K, \
60 /* Short form of mov, dst_reg = src_reg */
62 #define BPF_MOV64_REG(DST, SRC) \
63 ((struct bpf_insn) { \
64 .code = BPF_ALU64 | BPF_MOV | BPF_X, \
70 #define BPF_MOV32_REG(DST, SRC) \
71 ((struct bpf_insn) { \
72 .code = BPF_ALU | BPF_MOV | BPF_X, \
78 /* Short form of mov, dst_reg = imm32 */
80 #define BPF_MOV64_IMM(DST, IMM) \
81 ((struct bpf_insn) { \
82 .code = BPF_ALU64 | BPF_MOV | BPF_K, \
88 #define BPF_MOV32_IMM(DST, IMM) \
89 ((struct bpf_insn) { \
90 .code = BPF_ALU | BPF_MOV | BPF_K, \
96 /* BPF_LD_IMM64 macro encodes single 'load 64-bit immediate' insn */
97 #define BPF_LD_IMM64(DST, IMM) \
98 BPF_LD_IMM64_RAW(DST, 0, IMM)
100 #define BPF_LD_IMM64_RAW(DST, SRC, IMM) \
101 ((struct bpf_insn) { \
102 .code = BPF_LD | BPF_DW | BPF_IMM, \
106 .imm = (__u32) (IMM) }), \
107 ((struct bpf_insn) { \
108 .code = 0, /* zero is reserved opcode */ \
112 .imm = ((__u64) (IMM)) >> 32 })
114 #ifndef BPF_PSEUDO_MAP_FD
115 # define BPF_PSEUDO_MAP_FD 1
118 /* pseudo BPF_LD_IMM64 insn used to refer to process-local map_fd */
119 #define BPF_LD_MAP_FD(DST, MAP_FD) \
120 BPF_LD_IMM64_RAW(DST, BPF_PSEUDO_MAP_FD, MAP_FD)
123 /* Direct packet access, R0 = *(uint *) (skb->data + imm32) */
125 #define BPF_LD_ABS(SIZE, IMM) \
126 ((struct bpf_insn) { \
127 .code = BPF_LD | BPF_SIZE(SIZE) | BPF_ABS, \
133 /* Memory load, dst_reg = *(uint *) (src_reg + off16) */
135 #define BPF_LDX_MEM(SIZE, DST, SRC, OFF) \
136 ((struct bpf_insn) { \
137 .code = BPF_LDX | BPF_SIZE(SIZE) | BPF_MEM, \
143 /* Memory store, *(uint *) (dst_reg + off16) = src_reg */
145 #define BPF_STX_MEM(SIZE, DST, SRC, OFF) \
146 ((struct bpf_insn) { \
147 .code = BPF_STX | BPF_SIZE(SIZE) | BPF_MEM, \
153 /* Memory store, *(uint *) (dst_reg + off16) = imm32 */
155 #define BPF_ST_MEM(SIZE, DST, OFF, IMM) \
156 ((struct bpf_insn) { \
157 .code = BPF_ST | BPF_SIZE(SIZE) | BPF_MEM, \
163 /* Conditional jumps against registers, if (dst_reg 'op' src_reg) goto pc + off16 */
165 #define BPF_JMP_REG(OP, DST, SRC, OFF) \
166 ((struct bpf_insn) { \
167 .code = BPF_JMP | BPF_OP(OP) | BPF_X, \
173 /* Conditional jumps against immediates, if (dst_reg 'op' imm32) goto pc + off16 */
175 #define BPF_JMP_IMM(OP, DST, IMM, OFF) \
176 ((struct bpf_insn) { \
177 .code = BPF_JMP | BPF_OP(OP) | BPF_K, \
183 /* Raw code statement block */
185 #define BPF_RAW_INSN(CODE, DST, SRC, OFF, IMM) \
186 ((struct bpf_insn) { \
195 #define BPF_EXIT_INSN() \
196 ((struct bpf_insn) { \
197 .code = BPF_JMP | BPF_EXIT, \
203 /* create RAW socket and bind to interface 'name' */
204 int open_raw_sock(const char *name);
206 struct perf_event_attr;
207 int perf_event_open(struct perf_event_attr *attr, int pid, int cpu,
208 int group_fd, unsigned long flags);