@@ -11,18 +11,17 @@ stats application.
1111 - [[#tracepoint-program-section][Tracepoint program section]]
1212 - [[#tracepoint-arguments][Tracepoint arguments]]
1313 - [[#tracepoint-attaching][Tracepoint attaching]]
14- - [[#hash-map][HASH map]]
14+ - [[#hash-map][HASH map]]
1515- [[#assignments][Assignments]]
1616 - [[#assignment-1-setting-up-your-test-lab][Assignment 1: Setting up your test lab]]
1717 - [[#assignment-2-load-tracepoint-monitor-program][Assignment 2: Load tracepoint monitor program]]
1818
19-
2019* XDP tracepoints
2120
2221The eBPF programs can be attached also to tracepoints. There are
2322several tracepoints related to the xdp tracepoint subsystem:
2423
25- #+begin_example sh
24+ #+begin_src sh
2625ls /sys/kernel/debug/tracing/events/xdp/
2726xdp_cpumap_enqueue
2827xdp_cpumap_kthread
@@ -32,24 +31,24 @@ xdp_redirect
3231xdp_redirect_err
3332xdp_redirect_map
3433xdp_redirect_map_err
35- #+end_example
34+ #+end_src
3635
3736** Tracepoint program section
3837
3938The bpf library expects the tracepoint eBPF program to be stored
4039in a section with following name:
4140
42- #+begin_example sh
41+ #+begin_src C
4342tracepoint/<sys>/<tracepoint>
44- #+end_example
43+ #+end_src
4544
4645where =<sys>= is the tracepoint subsystem and =<tracepoint>= is
4746the tracepoint name, which can be done with following construct:
4847
49- #+begin_example sh
48+ #+begin_src sh
5049SEC("tracepoint/xdp/xdp_exception")
5150int trace_xdp_exception(struct xdp_exception_ctx *ctx)
52- #+end_example
51+ #+end_src
5352
5453** Tracepoint arguments
5554
@@ -58,7 +57,7 @@ to the structure, that defines the tracepoint fields.
5857
5958Like for xdp:xdp_exception tracepoint:
6059
61- #+begin_example sh
60+ #+begin_src C
6261struct xdp_exception_ctx {
6362 __u64 __pad; // First 8 bytes are not accessible by bpf code
6463 __s32 prog_id; // offset:8; size:4; signed:1;
@@ -67,11 +66,11 @@ struct xdp_exception_ctx {
6766};
6867
6968int trace_xdp_exception(struct xdp_exception_ctx *ctx)
70- #+end_example
69+ #+end_src
7170
7271This struct is exported in tracepoint format file:
7372
74- #+begin_example sh
73+ #+begin_src C
7574# cat /sys/kernel/debug/tracing/events/xdp/xdp_exception/format
7675...
7776 field:unsigned short common_type; offset:0; size:2; signed:0;
@@ -83,16 +82,16 @@ This struct is exported in tracepoint format file:
8382 field:u32 act; offset:12; size:4; signed:0;
8483 field:int ifindex; offset:16; size:4; signed:1;
8584...
86- #+end_example
85+ #+end_src
8786
8887** Tracepoint attaching
8988
9089To load a tracepoint program for this example we use following bpf
9190library helper function:
9291
93- #+begin_example sh
92+ #+begin_src sh
9493bpf_prog_load(cfg->filename, BPF_PROG_TYPE_TRACEPOINT, &obj, &bpf_fd))
95- #+end_example
94+ #+end_src
9695
9796It loads all the programs from the object together with maps and
9897returns file descriptor of the first one.
@@ -101,9 +100,9 @@ To attach the program to the tracepoint we need to create a tracepoint
101100perf event and attach the eBPF program to it, using its file descriptor
102101via PERF_EVENT_IOC_SET_BPF ioctl call:
103102
104- #+begin_example sh
103+ #+begin_src sh
105104err = ioctl(fd, PERF_EVENT_IOC_SET_BPF, bpf_fd);
106- #+end_example
105+ #+end_src
107106
108107Please check trace_load_and_stats.c load_bpf_and_trace_attach function
109108for all the details.
@@ -112,19 +111,19 @@ for all the details.
112111
113112This example is using PERCPU HASH map, that stores number of aborted
114113packets for interface
115- #+begin_example sh
114+ #+begin_src C
116115struct bpf_map_def SEC("maps") xdp_stats_map = {
117116 .type = BPF_MAP_TYPE_PERCPU_HASH,
118117 .key_size = sizeof(__s32),
119118 .value_size = sizeof(__u64),
120119 .max_entries = 10,
121120};
122- #+end_example
121+ #+end_src
123122
124123The interface is similar to the ARRAY map except that we need to specifically
125124create new element in the hash if it does not exist:
126125
127- #+begin_example sh
126+ #+begin_src C
128127/* Lookup in kernel BPF-side returns pointer to actual data. */
129128valp = bpf_map_lookup_elem(&xdp_stats_map, &key);
130129
@@ -137,7 +136,7 @@ if (!valp) {
137136}
138137
139138(*valp)++;
140- #+end_example
139+ #+end_src
141140
142141Please check trace_prog_kern.c for the full code.
143142
@@ -151,44 +150,44 @@ Basic02 - loading a program by name [[https://github.com/xdp-project/xdp-tutoria
151150and load XDP program from xdp_prog_kern.o that will abort every
152151incoming packet:
153152
154- #+begin_example sh
153+ #+begin_src C
155154SEC("xdp_abort")
156155int xdp_drop_func(struct xdp_md *ctx)
157156{
158157 return XDP_ABORTED;
159158}
160- #+end_example
159+ #+end_src
161160
162161with xdp_loader from previous lessson:
163162Assignment 2: Add xdp_abort program [[https://github.com/xdp-project/xdp-tutorial/tree/master/basic02-prog-by-name#assignment-2-add-xdp_abort-program]]
164163
165164Setup the environment:
166165
167- #+begin_example sh
166+ #+begin_src sh
168167$ sudo ../testenv/testenv.sh setup --name veth-basic02
169- #+end_example
168+ #+end_src
170169
171170Load the XDP program, tak produces aborted packets:
172171
173- #+begin_example sh
172+ #+begin_src sh
174173$ sudo ./xdp_loader --dev veth-basic02 --force --progsec xdp_abort
175- #+end_example
174+ #+end_src
176175
177176and make some packets:
178177
179- #+begin_example sh
178+ #+begin_src sh
180179$ sudo ../testenv/testenv.sh enter --name veth-basic02
181180# ping fc00:dead:cafe:1::1
182181PING fc00:dead:cafe:1::1(fc00:dead:cafe:1::1) 56 data bytes
183- #+end_example
182+ #+end_src
184183
185184** Assignment 2: Load tracepoint monitor program
186185
187186Now when you run the trace_load_and_stats application it will
188187load and attach the tracepoint eBPF program and display number
189188of aborted packets per interface:
190189
191- #+begin_example
190+ #+begin_src sh
192191# ./trace_load_and_stats
193192Success: Loaded BPF-object(trace_prog_kern.o)
194193
@@ -199,4 +198,4 @@ veth-basic02 (2)
199198veth-basic02 (4)
200199veth-basic02 (6)
201200...
202- #+end_example
201+ #+end_src
0 commit comments