2016-11-23 18:52:30 +03:00
/* eBPF example program:
*
* - Creates arraymap in kernel with 4 bytes keys and 8 byte values
*
* - Loads eBPF program
*
* The eBPF program accesses the map passed in to store two pieces of
* information . The number of invocations of the program , which maps
* to the number of packets received , is stored to key 0. Key 1 is
* incremented on each iteration by the number of bytes stored in
* the skb .
*
* - Attaches the new program to a cgroup using BPF_PROG_ATTACH
*
* - Every second , reads map [ 0 ] and map [ 1 ] to see how many bytes and
* packets were seen on any socket of tasks in the given cgroup .
*/
# define _GNU_SOURCE
# include <stdio.h>
# include <stdlib.h>
# include <stddef.h>
# include <string.h>
# include <unistd.h>
# include <assert.h>
# include <errno.h>
# include <fcntl.h>
# include <linux/bpf.h>
2018-05-15 08:35:03 +03:00
# include <bpf/bpf.h>
2016-11-23 18:52:30 +03:00
2018-05-15 08:35:03 +03:00
# include "bpf_insn.h"
2022-07-12 10:23:02 +03:00
# include "bpf_util.h"
2016-11-23 18:52:30 +03:00
enum {
MAP_KEY_PACKETS ,
MAP_KEY_BYTES ,
} ;
samples/bpf: Make samples more libbpf-centric
Switch all of the sample code to use the function names from
tools/lib/bpf so that they're consistent with that, and to declare their
own log buffers. This allow the next commit to be purely devoted to
getting rid of the duplicate library in samples/bpf.
Committer notes:
Testing it:
On a fedora rawhide container, with clang/llvm 3.9, sharing the host
linux kernel git tree:
# make O=/tmp/build/linux/ headers_install
# make O=/tmp/build/linux -C samples/bpf/
Since I forgot to make it privileged, just tested it outside the
container, using what it generated:
# uname -a
Linux jouet 4.9.0-rc8+ #1 SMP Mon Dec 12 11:20:49 BRT 2016 x86_64 x86_64 x86_64 GNU/Linux
# cd /var/lib/docker/devicemapper/mnt/c43e09a53ff56c86a07baf79847f00e2cc2a17a1e2220e1adbf8cbc62734feda/rootfs/tmp/build/linux/samples/bpf/
# ls -la offwaketime
-rwxr-xr-x. 1 root root 24200 Dec 15 12:19 offwaketime
# file offwaketime
offwaketime: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=c940d3f127d5e66cdd680e42d885cb0b64f8a0e4, not stripped
# readelf -SW offwaketime_kern.o | grep PROGBITS
[ 2] .text PROGBITS 0000000000000000 000040 000000 00 AX 0 0 4
[ 3] kprobe/try_to_wake_up PROGBITS 0000000000000000 000040 0000d8 00 AX 0 0 8
[ 5] tracepoint/sched/sched_switch PROGBITS 0000000000000000 000118 000318 00 AX 0 0 8
[ 7] maps PROGBITS 0000000000000000 000430 000050 00 WA 0 0 4
[ 8] license PROGBITS 0000000000000000 000480 000004 00 WA 0 0 1
[ 9] version PROGBITS 0000000000000000 000484 000004 00 WA 0 0 4
# ./offwaketime | head -5
swapper/1;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule;__schedule;-;---;; 106
CPU 0/KVM;entry_SYSCALL_64_fastpath;sys_ioctl;do_vfs_ioctl;kvm_vcpu_ioctl;kvm_arch_vcpu_ioctl_run;kvm_vcpu_block;schedule;__schedule;-;try_to_wake_up;swake_up_locked;swake_up;apic_timer_expired;apic_timer_fn;__hrtimer_run_queues;hrtimer_interrupt;local_apic_timer_interrupt;smp_apic_timer_interrupt;__irqentry_text_start;cpuidle_enter;call_cpuidle;cpu_startup_entry;start_secondary;;swapper/3 2
Compositor;entry_SYSCALL_64_fastpath;sys_futex;do_futex;futex_wait;futex_wait_queue_me;schedule;__schedule;-;try_to_wake_up;futex_requeue;do_futex;sys_futex;entry_SYSCALL_64_fastpath;;SoftwareVsyncTh 5
firefox;entry_SYSCALL_64_fastpath;sys_poll;do_sys_poll;poll_schedule_timeout;schedule_hrtimeout_range;schedule_hrtimeout_range_clock;schedule;__schedule;-;try_to_wake_up;pollwake;__wake_up_common;__wake_up_sync_key;pipe_write;__vfs_write;vfs_write;sys_write;entry_SYSCALL_64_fastpath;;Timer 13
JS Helper;entry_SYSCALL_64_fastpath;sys_futex;do_futex;futex_wait;futex_wait_queue_me;schedule;__schedule;-;try_to_wake_up;do_futex;sys_futex;entry_SYSCALL_64_fastpath;;firefox 2
#
Signed-off-by: Joe Stringer <joe@ovn.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Alexei Starovoitov <ast@fb.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Wang Nan <wangnan0@huawei.com>
Cc: netdev@vger.kernel.org
Link: http://lkml.kernel.org/r/20161214224342.12858-2-joe@ovn.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2016-12-15 01:43:38 +03:00
char bpf_log_buf [ BPF_LOG_BUF_SIZE ] ;
2016-11-23 18:52:30 +03:00
static int prog_load ( int map_fd , int verdict )
{
struct bpf_insn prog [ ] = {
BPF_MOV64_REG ( BPF_REG_6 , BPF_REG_1 ) , /* save r6 so it's not clobbered by BPF_CALL */
/* Count packets */
BPF_MOV64_IMM ( BPF_REG_0 , MAP_KEY_PACKETS ) , /* r0 = 0 */
BPF_STX_MEM ( BPF_W , BPF_REG_10 , BPF_REG_0 , - 4 ) , /* *(u32 *)(fp - 4) = r0 */
BPF_MOV64_REG ( BPF_REG_2 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_2 , - 4 ) , /* r2 = fp - 4 */
BPF_LD_MAP_FD ( BPF_REG_1 , map_fd ) , /* load map fd to r1 */
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_map_lookup_elem ) ,
BPF_JMP_IMM ( BPF_JEQ , BPF_REG_0 , 0 , 2 ) ,
BPF_MOV64_IMM ( BPF_REG_1 , 1 ) , /* r1 = 1 */
2021-01-14 21:17:44 +03:00
BPF_ATOMIC_OP ( BPF_DW , BPF_ADD , BPF_REG_0 , BPF_REG_1 , 0 ) ,
2016-11-23 18:52:30 +03:00
/* Count bytes */
BPF_MOV64_IMM ( BPF_REG_0 , MAP_KEY_BYTES ) , /* r0 = 1 */
BPF_STX_MEM ( BPF_W , BPF_REG_10 , BPF_REG_0 , - 4 ) , /* *(u32 *)(fp - 4) = r0 */
BPF_MOV64_REG ( BPF_REG_2 , BPF_REG_10 ) ,
BPF_ALU64_IMM ( BPF_ADD , BPF_REG_2 , - 4 ) , /* r2 = fp - 4 */
BPF_LD_MAP_FD ( BPF_REG_1 , map_fd ) ,
BPF_RAW_INSN ( BPF_JMP | BPF_CALL , 0 , 0 , 0 , BPF_FUNC_map_lookup_elem ) ,
BPF_JMP_IMM ( BPF_JEQ , BPF_REG_0 , 0 , 2 ) ,
BPF_LDX_MEM ( BPF_W , BPF_REG_1 , BPF_REG_6 , offsetof ( struct __sk_buff , len ) ) , /* r1 = skb->len */
2021-01-14 21:17:44 +03:00
BPF_ATOMIC_OP ( BPF_DW , BPF_ADD , BPF_REG_0 , BPF_REG_1 , 0 ) ,
2016-11-23 18:52:30 +03:00
BPF_MOV64_IMM ( BPF_REG_0 , verdict ) , /* r0 = verdict */
BPF_EXIT_INSN ( ) ,
} ;
2022-07-12 10:23:02 +03:00
size_t insns_cnt = ARRAY_SIZE ( prog ) ;
2021-12-02 02:28:23 +03:00
LIBBPF_OPTS ( bpf_prog_load_opts , opts ,
. log_buf = bpf_log_buf ,
. log_size = BPF_LOG_BUF_SIZE ,
) ;
2016-11-23 18:52:30 +03:00
2021-12-02 02:28:23 +03:00
return bpf_prog_load ( BPF_PROG_TYPE_CGROUP_SKB , NULL , " GPL " ,
prog , insns_cnt , & opts ) ;
2016-11-23 18:52:30 +03:00
}
static int usage ( const char * argv0 )
{
2016-11-29 01:52:42 +03:00
printf ( " Usage: %s [-d] [-D] <cg-path> <egress|ingress> \n " , argv0 ) ;
printf ( " -d Drop Traffic \n " ) ;
printf ( " -D Detach filter, and exit \n " ) ;
2016-11-23 18:52:30 +03:00
return EXIT_FAILURE ;
}
2016-11-29 01:52:42 +03:00
static int attach_filter ( int cg_fd , int type , int verdict )
2016-11-23 18:52:30 +03:00
{
2016-11-29 01:52:42 +03:00
int prog_fd , map_fd , ret , key ;
2016-11-23 18:52:30 +03:00
long long pkt_cnt , byte_cnt ;
2021-12-02 02:28:23 +03:00
map_fd = bpf_map_create ( BPF_MAP_TYPE_ARRAY , NULL ,
2016-11-23 18:52:30 +03:00
sizeof ( key ) , sizeof ( byte_cnt ) ,
2021-12-02 02:28:23 +03:00
256 , NULL ) ;
2016-11-23 18:52:30 +03:00
if ( map_fd < 0 ) {
printf ( " Failed to create map: '%s' \n " , strerror ( errno ) ) ;
return EXIT_FAILURE ;
}
prog_fd = prog_load ( map_fd , verdict ) ;
printf ( " Output from kernel verifier: \n %s \n ------- \n " , bpf_log_buf ) ;
if ( prog_fd < 0 ) {
printf ( " Failed to load prog: '%s' \n " , strerror ( errno ) ) ;
return EXIT_FAILURE ;
}
2017-02-11 07:28:24 +03:00
ret = bpf_prog_attach ( prog_fd , cg_fd , type , 0 ) ;
2016-11-23 18:52:30 +03:00
if ( ret < 0 ) {
printf ( " Failed to attach prog to cgroup: '%s' \n " ,
strerror ( errno ) ) ;
return EXIT_FAILURE ;
}
while ( 1 ) {
key = MAP_KEY_PACKETS ;
samples/bpf: Make samples more libbpf-centric
Switch all of the sample code to use the function names from
tools/lib/bpf so that they're consistent with that, and to declare their
own log buffers. This allow the next commit to be purely devoted to
getting rid of the duplicate library in samples/bpf.
Committer notes:
Testing it:
On a fedora rawhide container, with clang/llvm 3.9, sharing the host
linux kernel git tree:
# make O=/tmp/build/linux/ headers_install
# make O=/tmp/build/linux -C samples/bpf/
Since I forgot to make it privileged, just tested it outside the
container, using what it generated:
# uname -a
Linux jouet 4.9.0-rc8+ #1 SMP Mon Dec 12 11:20:49 BRT 2016 x86_64 x86_64 x86_64 GNU/Linux
# cd /var/lib/docker/devicemapper/mnt/c43e09a53ff56c86a07baf79847f00e2cc2a17a1e2220e1adbf8cbc62734feda/rootfs/tmp/build/linux/samples/bpf/
# ls -la offwaketime
-rwxr-xr-x. 1 root root 24200 Dec 15 12:19 offwaketime
# file offwaketime
offwaketime: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=c940d3f127d5e66cdd680e42d885cb0b64f8a0e4, not stripped
# readelf -SW offwaketime_kern.o | grep PROGBITS
[ 2] .text PROGBITS 0000000000000000 000040 000000 00 AX 0 0 4
[ 3] kprobe/try_to_wake_up PROGBITS 0000000000000000 000040 0000d8 00 AX 0 0 8
[ 5] tracepoint/sched/sched_switch PROGBITS 0000000000000000 000118 000318 00 AX 0 0 8
[ 7] maps PROGBITS 0000000000000000 000430 000050 00 WA 0 0 4
[ 8] license PROGBITS 0000000000000000 000480 000004 00 WA 0 0 1
[ 9] version PROGBITS 0000000000000000 000484 000004 00 WA 0 0 4
# ./offwaketime | head -5
swapper/1;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule;__schedule;-;---;; 106
CPU 0/KVM;entry_SYSCALL_64_fastpath;sys_ioctl;do_vfs_ioctl;kvm_vcpu_ioctl;kvm_arch_vcpu_ioctl_run;kvm_vcpu_block;schedule;__schedule;-;try_to_wake_up;swake_up_locked;swake_up;apic_timer_expired;apic_timer_fn;__hrtimer_run_queues;hrtimer_interrupt;local_apic_timer_interrupt;smp_apic_timer_interrupt;__irqentry_text_start;cpuidle_enter;call_cpuidle;cpu_startup_entry;start_secondary;;swapper/3 2
Compositor;entry_SYSCALL_64_fastpath;sys_futex;do_futex;futex_wait;futex_wait_queue_me;schedule;__schedule;-;try_to_wake_up;futex_requeue;do_futex;sys_futex;entry_SYSCALL_64_fastpath;;SoftwareVsyncTh 5
firefox;entry_SYSCALL_64_fastpath;sys_poll;do_sys_poll;poll_schedule_timeout;schedule_hrtimeout_range;schedule_hrtimeout_range_clock;schedule;__schedule;-;try_to_wake_up;pollwake;__wake_up_common;__wake_up_sync_key;pipe_write;__vfs_write;vfs_write;sys_write;entry_SYSCALL_64_fastpath;;Timer 13
JS Helper;entry_SYSCALL_64_fastpath;sys_futex;do_futex;futex_wait;futex_wait_queue_me;schedule;__schedule;-;try_to_wake_up;do_futex;sys_futex;entry_SYSCALL_64_fastpath;;firefox 2
#
Signed-off-by: Joe Stringer <joe@ovn.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Alexei Starovoitov <ast@fb.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Wang Nan <wangnan0@huawei.com>
Cc: netdev@vger.kernel.org
Link: http://lkml.kernel.org/r/20161214224342.12858-2-joe@ovn.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2016-12-15 01:43:38 +03:00
assert ( bpf_map_lookup_elem ( map_fd , & key , & pkt_cnt ) = = 0 ) ;
2016-11-23 18:52:30 +03:00
key = MAP_KEY_BYTES ;
samples/bpf: Make samples more libbpf-centric
Switch all of the sample code to use the function names from
tools/lib/bpf so that they're consistent with that, and to declare their
own log buffers. This allow the next commit to be purely devoted to
getting rid of the duplicate library in samples/bpf.
Committer notes:
Testing it:
On a fedora rawhide container, with clang/llvm 3.9, sharing the host
linux kernel git tree:
# make O=/tmp/build/linux/ headers_install
# make O=/tmp/build/linux -C samples/bpf/
Since I forgot to make it privileged, just tested it outside the
container, using what it generated:
# uname -a
Linux jouet 4.9.0-rc8+ #1 SMP Mon Dec 12 11:20:49 BRT 2016 x86_64 x86_64 x86_64 GNU/Linux
# cd /var/lib/docker/devicemapper/mnt/c43e09a53ff56c86a07baf79847f00e2cc2a17a1e2220e1adbf8cbc62734feda/rootfs/tmp/build/linux/samples/bpf/
# ls -la offwaketime
-rwxr-xr-x. 1 root root 24200 Dec 15 12:19 offwaketime
# file offwaketime
offwaketime: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=c940d3f127d5e66cdd680e42d885cb0b64f8a0e4, not stripped
# readelf -SW offwaketime_kern.o | grep PROGBITS
[ 2] .text PROGBITS 0000000000000000 000040 000000 00 AX 0 0 4
[ 3] kprobe/try_to_wake_up PROGBITS 0000000000000000 000040 0000d8 00 AX 0 0 8
[ 5] tracepoint/sched/sched_switch PROGBITS 0000000000000000 000118 000318 00 AX 0 0 8
[ 7] maps PROGBITS 0000000000000000 000430 000050 00 WA 0 0 4
[ 8] license PROGBITS 0000000000000000 000480 000004 00 WA 0 0 1
[ 9] version PROGBITS 0000000000000000 000484 000004 00 WA 0 0 4
# ./offwaketime | head -5
swapper/1;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule;__schedule;-;---;; 106
CPU 0/KVM;entry_SYSCALL_64_fastpath;sys_ioctl;do_vfs_ioctl;kvm_vcpu_ioctl;kvm_arch_vcpu_ioctl_run;kvm_vcpu_block;schedule;__schedule;-;try_to_wake_up;swake_up_locked;swake_up;apic_timer_expired;apic_timer_fn;__hrtimer_run_queues;hrtimer_interrupt;local_apic_timer_interrupt;smp_apic_timer_interrupt;__irqentry_text_start;cpuidle_enter;call_cpuidle;cpu_startup_entry;start_secondary;;swapper/3 2
Compositor;entry_SYSCALL_64_fastpath;sys_futex;do_futex;futex_wait;futex_wait_queue_me;schedule;__schedule;-;try_to_wake_up;futex_requeue;do_futex;sys_futex;entry_SYSCALL_64_fastpath;;SoftwareVsyncTh 5
firefox;entry_SYSCALL_64_fastpath;sys_poll;do_sys_poll;poll_schedule_timeout;schedule_hrtimeout_range;schedule_hrtimeout_range_clock;schedule;__schedule;-;try_to_wake_up;pollwake;__wake_up_common;__wake_up_sync_key;pipe_write;__vfs_write;vfs_write;sys_write;entry_SYSCALL_64_fastpath;;Timer 13
JS Helper;entry_SYSCALL_64_fastpath;sys_futex;do_futex;futex_wait;futex_wait_queue_me;schedule;__schedule;-;try_to_wake_up;do_futex;sys_futex;entry_SYSCALL_64_fastpath;;firefox 2
#
Signed-off-by: Joe Stringer <joe@ovn.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Alexei Starovoitov <ast@fb.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Wang Nan <wangnan0@huawei.com>
Cc: netdev@vger.kernel.org
Link: http://lkml.kernel.org/r/20161214224342.12858-2-joe@ovn.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2016-12-15 01:43:38 +03:00
assert ( bpf_map_lookup_elem ( map_fd , & key , & byte_cnt ) = = 0 ) ;
2016-11-23 18:52:30 +03:00
printf ( " cgroup received %lld packets, %lld bytes \n " ,
pkt_cnt , byte_cnt ) ;
sleep ( 1 ) ;
}
return EXIT_SUCCESS ;
}
2016-11-29 01:52:42 +03:00
int main ( int argc , char * * argv )
{
int detach_only = 0 , verdict = 1 ;
enum bpf_attach_type type ;
int opt , cg_fd , ret ;
while ( ( opt = getopt ( argc , argv , " Dd " ) ) ! = - 1 ) {
switch ( opt ) {
case ' d ' :
verdict = 0 ;
break ;
case ' D ' :
detach_only = 1 ;
break ;
default :
return usage ( argv [ 0 ] ) ;
}
}
if ( argc - optind < 2 )
return usage ( argv [ 0 ] ) ;
if ( strcmp ( argv [ optind + 1 ] , " ingress " ) = = 0 )
type = BPF_CGROUP_INET_INGRESS ;
else if ( strcmp ( argv [ optind + 1 ] , " egress " ) = = 0 )
type = BPF_CGROUP_INET_EGRESS ;
else
return usage ( argv [ 0 ] ) ;
cg_fd = open ( argv [ optind ] , O_DIRECTORY | O_RDONLY ) ;
if ( cg_fd < 0 ) {
printf ( " Failed to open cgroup path: '%s' \n " , strerror ( errno ) ) ;
return EXIT_FAILURE ;
}
if ( detach_only ) {
ret = bpf_prog_detach ( cg_fd , type ) ;
printf ( " bpf_prog_detach() returned '%s' (%d) \n " ,
strerror ( errno ) , errno ) ;
} else
ret = attach_filter ( cg_fd , type , verdict ) ;
return ret ;
}