Skip to content

Instantly share code, notes, and snippets.

View mattnite's full-sized avatar

Matt Knight mattnite

207 followers · 31 following
View GitHub Profile
@mattnite
mattnite / main.zig
Last active October 16, 2020 07:21
Main program for BPF perf buffer example
const std = @import("std");
const bpf = @import("bpf");
const mem = std.mem;
usingnamespace @import("common.zig");
const os = std.os;
const assert = std.debug.assert;
const c = @cImport({
@mattnite
mattnite / load.zig
Created October 4, 2020 12:15
Relocating BPF map fds
for (self.progs.items) |*prog| {
const rel_name = try std.mem.join(self.allocator, "", &[_][]const u8{ ".rel", prog.name });
defer self.allocator.free(rel_name);
const rel_section: *Elf.Section = for (self.elf.relos.items) |relo| {
if (mem.eql(u8, self.elf.get_section_name(relo), rel_name)) {
break relo;
}
} else continue;
@mattnite
mattnite / bpf-asm
Created October 3, 2020 18:17
Minimal BPF Program Assembly
$ llvm-objdump -d src/probe.o
src/probe.o: file format ELF64-BPF
Disassembly of section socket1:
0000000000000000 bpf_prog:
0: bf 16 00 00 00 00 00 00 r6 = r1
1: 85 00 00 00 05 00 00 00 call 5
2: 7b 0a f8 ff 00 00 00 00 *(u64 *)(r10 - 8) = r0
@mattnite
mattnite / insn_and_map_def.zig
Last active October 3, 2020 18:11
Zig BPF Insn and Map Definition
pub const Insn = packed struct {
code: u8,
dst: u4,
src: u4,
off: i16,
imm: i32,
};
pub const MapDef = extern struct {
type: u32,
@mattnite
mattnite / build.zig
Last active October 3, 2020 17:28
Minimal build script for BPF programs
const std = @import("std");
const Builder = std.build.Builder;
const builtin = @import("builtin");
pub fn build(b: *Builder) void {
const target = b.standardTargetOptions(.{});
const obj = b.addObject("probe", "src/probe.zig");
obj.setTarget(std.zig.CrossTarget{
.cpu_arch = switch ((target.cpu_arch orelse builtin.arch).endian()) {
@mattnite
mattnite / section-headers
Last active October 3, 2020 16:42
section headers for simple bpf program
$ llvm-objdump --section-headers src/probe.o
src/probe.o: file format ELF64-BPF
Sections:
Idx Name Size VMA Type
0 00000000 0000000000000000
1 .text 00000000 0000000000000000 TEXT
2 socket1 00000070 0000000000000000 TEXT
3 .relsocket1 00000010 0000000000000000
@mattnite
mattnite / probe.zig
Last active October 16, 2020 07:15
simple BPF program
const std = @import("std");
const mem = std.mem
usingnamespace @import("bpf");
export var events linksection("maps") = PerfEventArray.init(256, 0);
export fn bpf_prog(ctx: *SkBuff) linksection("socket1") c_int {
var time = ktime_get_ns();
events.event_output(ctx, F_CURRENT_CPU, mem.asBytes(&time)) catch {};
@mattnite
mattnite / probe.zig
Created September 30, 2020 08:32
opensnoop zig
// SPDX-License-Identifier: GPL-2.0
// Copyright (c) 2020 Matt Knight
//
// Base on the opensnoop probe as part of libbpf-tools
// Copyright (c) 2019 Facebook
// Copyright (c) 2020 Netflix
usingnamespace BPF.kern;
const std = @import("std");
@mattnite
mattnite / main.zig
Last active September 28, 2020 04:18
Zig BPF with Perf Buffer in userspace
const std = @import("std");
const bpf = @import("bpf");
const mem = std.mem;
usingnamespace @import("common.zig");
const BPF = std.os.linux.BPF;
const os = std.os;
const assert = std.debug.assert;