1 /* eBPF example program:
3 * - Creates arraymap in kernel with 4 bytes keys and 8 byte values
7 * The eBPF program accesses the map passed in to store two pieces of
8 * information. The number of invocations of the program, which maps
9 * to the number of packets received, is stored to key 0. Key 1 is
10 * incremented on each iteration by the number of bytes stored in
13 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH
15 * - Every second, reads map[0] and map[1] to see how many bytes and
16 * packets were seen on any socket of tasks in the given cgroup.
30 #include <linux/bpf.h>
39 static int prog_load(int map_fd, int verdict)
41 struct bpf_insn prog[] = {
42 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* save r6 so it's not clobbered by BPF_CALL */
45 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */
46 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
47 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
48 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
49 BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* load map fd to r1 */
50 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
51 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
52 BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */
53 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
56 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */
57 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
58 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
59 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
60 BPF_LD_MAP_FD(BPF_REG_1, map_fd),
61 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
62 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
63 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */
64 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
66 BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
70 return bpf_prog_load(BPF_PROG_TYPE_CGROUP_SKB,
71 prog, sizeof(prog), "GPL", 0);
74 static int usage(const char *argv0)
76 printf("Usage: %s [-d] [-D] <cg-path> <egress|ingress>\n", argv0);
77 printf(" -d Drop Traffic\n");
78 printf(" -D Detach filter, and exit\n");
82 static int attach_filter(int cg_fd, int type, int verdict)
84 int prog_fd, map_fd, ret, key;
85 long long pkt_cnt, byte_cnt;
87 map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY,
88 sizeof(key), sizeof(byte_cnt),
91 printf("Failed to create map: '%s'\n", strerror(errno));
95 prog_fd = prog_load(map_fd, verdict);
96 printf("Output from kernel verifier:\n%s\n-------\n", bpf_log_buf);
99 printf("Failed to load prog: '%s'\n", strerror(errno));
103 ret = bpf_prog_attach(prog_fd, cg_fd, type);
105 printf("Failed to attach prog to cgroup: '%s'\n",
110 key = MAP_KEY_PACKETS;
111 assert(bpf_lookup_elem(map_fd, &key, &pkt_cnt) == 0);
114 assert(bpf_lookup_elem(map_fd, &key, &byte_cnt) == 0);
116 printf("cgroup received %lld packets, %lld bytes\n",
124 int main(int argc, char **argv)
126 int detach_only = 0, verdict = 1;
127 enum bpf_attach_type type;
130 while ((opt = getopt(argc, argv, "Dd")) != -1) {
139 return usage(argv[0]);
143 if (argc - optind < 2)
144 return usage(argv[0]);
146 if (strcmp(argv[optind + 1], "ingress") == 0)
147 type = BPF_CGROUP_INET_INGRESS;
148 else if (strcmp(argv[optind + 1], "egress") == 0)
149 type = BPF_CGROUP_INET_EGRESS;
151 return usage(argv[0]);
153 cg_fd = open(argv[optind], O_DIRECTORY | O_RDONLY);
155 printf("Failed to open cgroup path: '%s'\n", strerror(errno));
160 ret = bpf_prog_detach(cg_fd, type);
161 printf("bpf_prog_detach() returned '%s' (%d)\n",
162 strerror(errno), errno);
164 ret = attach_filter(cg_fd, type, verdict);