1 /* eBPF example program:
2 *
3 * - Creates arraymap in kernel with 4 bytes keys and 8 byte values
4 *
5 * - Loads eBPF program
6 *
7 * The eBPF program accesses the map passed in to store two pieces of
8 * information. The number of invocations of the program, which maps
9 * to the number of packets received, is stored to key 0. Key 1 is
10 * incremented on each iteration by the number of bytes stored in
11 * the skb.
12 *
13 * - Detaches any eBPF program previously attached to the cgroup
14 *
15 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH
16 *
17 * - Every second, reads map[0] and map[1] to see how many bytes and
18 * packets were seen on any socket of tasks in the given cgroup.
19 */
20
21 #define _GNU_SOURCE
22
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <stddef.h>
26 #include <string.h>
27 #include <unistd.h>
28 #include <assert.h>
29 #include <errno.h>
30 #include <fcntl.h>
31
32 #include <linux/bpf.h>
33
34 #include "libbpf.h"
35
36 enum {
37 MAP_KEY_PACKETS,
38 MAP_KEY_BYTES,
39 };
40
prog_load(int map_fd,int verdict)41 static int prog_load(int map_fd, int verdict)
42 {
43 struct bpf_insn prog[] = {
44 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* save r6 so it's not clobbered by BPF_CALL */
45
46 /* Count packets */
47 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */
48 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
49 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
50 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
51 BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* load map fd to r1 */
52 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
53 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
54 BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */
55 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
56
57 /* Count bytes */
58 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */
59 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
60 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
61 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
62 BPF_LD_MAP_FD(BPF_REG_1, map_fd),
63 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
64 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
65 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */
66 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
67
68 BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
69 BPF_EXIT_INSN(),
70 };
71
72 return bpf_prog_load(BPF_PROG_TYPE_CGROUP_SKB,
73 prog, sizeof(prog), "GPL", 0);
74 }
75
usage(const char * argv0)76 static int usage(const char *argv0)
77 {
78 printf("Usage: %s <cg-path> <egress|ingress> [drop]\n", argv0);
79 return EXIT_FAILURE;
80 }
81
main(int argc,char ** argv)82 int main(int argc, char **argv)
83 {
84 int cg_fd, map_fd, prog_fd, key, ret;
85 long long pkt_cnt, byte_cnt;
86 enum bpf_attach_type type;
87 int verdict = 1;
88
89 if (argc < 3)
90 return usage(argv[0]);
91
92 if (strcmp(argv[2], "ingress") == 0)
93 type = BPF_CGROUP_INET_INGRESS;
94 else if (strcmp(argv[2], "egress") == 0)
95 type = BPF_CGROUP_INET_EGRESS;
96 else
97 return usage(argv[0]);
98
99 if (argc > 3 && strcmp(argv[3], "drop") == 0)
100 verdict = 0;
101
102 cg_fd = open(argv[1], O_DIRECTORY | O_RDONLY);
103 if (cg_fd < 0) {
104 printf("Failed to open cgroup path: '%s'\n", strerror(errno));
105 return EXIT_FAILURE;
106 }
107
108 map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY,
109 sizeof(key), sizeof(byte_cnt),
110 256, 0);
111 if (map_fd < 0) {
112 printf("Failed to create map: '%s'\n", strerror(errno));
113 return EXIT_FAILURE;
114 }
115
116 prog_fd = prog_load(map_fd, verdict);
117 printf("Output from kernel verifier:\n%s\n-------\n", bpf_log_buf);
118
119 if (prog_fd < 0) {
120 printf("Failed to load prog: '%s'\n", strerror(errno));
121 return EXIT_FAILURE;
122 }
123
124 ret = bpf_prog_detach(cg_fd, type);
125 printf("bpf_prog_detach() returned '%s' (%d)\n", strerror(errno), errno);
126
127 ret = bpf_prog_attach(prog_fd, cg_fd, type, 0);
128 if (ret < 0) {
129 printf("Failed to attach prog to cgroup: '%s'\n",
130 strerror(errno));
131 return EXIT_FAILURE;
132 }
133
134 while (1) {
135 key = MAP_KEY_PACKETS;
136 assert(bpf_lookup_elem(map_fd, &key, &pkt_cnt) == 0);
137
138 key = MAP_KEY_BYTES;
139 assert(bpf_lookup_elem(map_fd, &key, &byte_cnt) == 0);
140
141 printf("cgroup received %lld packets, %lld bytes\n",
142 pkt_cnt, byte_cnt);
143 sleep(1);
144 }
145
146 return EXIT_SUCCESS;
147 }
148