Blog

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>

char LICENSE[] SEC("license") = "GPL";

const volatile int mode = 1;		/* 로드 전에 유저 공간에서 설정 */
const volatile __u32 target_tgid = 0;

struct {
	__uint(type, BPF_MAP_TYPE_HASH);
	__uint(max_entries, 1);
	__type(key, u32);
	__type(value, u64);
} hash_cnt SEC(".maps");

struct {
	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
	__uint(max_entries, 1);
	__type(key, u32);
	__type(value, u64);
} pcpu_cnt SEC(".maps");

SEC("tp/syscalls/sys_enter_getppid")
int count(void *ctx)
{
	u32 key = 0;
	u64 *v;

	if ((bpf_get_current_pid_tgid() >> 32) != target_tgid)
		return 0;
	if (mode == 3) {
		v = bpf_map_lookup_elem(&pcpu_cnt, &key);
		if (v)
			*v += 1;		/* CPU마다 별도 슬롯 */
		return 0;
	}
	v = bpf_map_lookup_elem(&hash_cnt, &key);
	if (!v)
		return 0;
	if (mode == 1)
		*v += 1;			/* 비원자적 증가 */
	else
		__sync_fetch_and_add(v, 1);	/* 원자적 증가 */
	return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <pthread.h>
#include <time.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <bpf/libbpf.h>
#include <bpf/bpf.h>
#include "counter.skel.h"

#define ITERS 2000000

static void *worker(void *arg)
{
	for (int i = 0; i < ITERS; i++)
		syscall(SYS_getppid);
	return NULL;
}

int main(int argc, char **argv)
{
	int mode = argc > 1 ? atoi(argv[1]) : 1;
	int nthr = argc > 2 ? atoi(argv[2]) : 4;
	int ncpu = libbpf_num_possible_cpus();
	struct counter_bpf *skel = NULL;
	pthread_t th[64];
	struct timespec t0, t1;
	unsigned long long total = 0;
	unsigned int key = 0;

	if (mode > 0) {
		skel = counter_bpf__open();
		skel->rodata->mode = mode;		/* const volatile 값 주입 */
		skel->rodata->target_tgid = getpid();
		if (counter_bpf__load(skel) || counter_bpf__attach(skel))
			return 1;
		unsigned long long zero = 0;
		bpf_map__update_elem(skel->maps.hash_cnt, &key, sizeof(key), &zero, sizeof(zero), BPF_ANY);
	}

	clock_gettime(CLOCK_MONOTONIC, &t0);
	for (int i = 0; i < nthr; i++)
		pthread_create(&th[i], NULL, worker, NULL);
	for (int i = 0; i < nthr; i++)
		pthread_join(th[i], NULL);
	clock_gettime(CLOCK_MONOTONIC, &t1);

	if (mode == 3) {
		unsigned long long vals[ncpu];
		bpf_map__lookup_elem(skel->maps.pcpu_cnt, &key, sizeof(key), vals, sizeof(vals), 0);
		for (int c = 0; c < ncpu; c++)
			total += vals[c];
	} else if (mode > 0) {
		bpf_map__lookup_elem(skel->maps.hash_cnt, &key, sizeof(key), &total, sizeof(total), 0);
	}

	double sec = (t1.tv_sec - t0.tv_sec) + (t1.tv_nsec - t0.tv_nsec) / 1e9;
	unsigned long long expect = (unsigned long long)nthr * ITERS;
	printf("mode=%d threads=%d  expected=%llu counted=%llu lost=%lld  %.1f ns/iter\n",
	       mode, nthr, expect, total, mode ? (long long)(expect - total) : 0LL, sec * 1e9 / ITERS);
	counter_bpf__destroy(skel);
	return 0;
}

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>

char LICENSE[] SEC("license") = "GPL";

struct {
	__uint(type, BPF_MAP_TYPE_HASH);
	__uint(max_entries, 4);
	__type(key, u32);
	__type(value, u64);
} plain SEC(".maps");

struct {
	__uint(type, BPF_MAP_TYPE_LRU_HASH);
	__uint(max_entries, 4);
	__type(key, u32);
	__type(value, u64);
} lru SEC(".maps");

#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <bpf/libbpf.h>
#include "lru.skel.h"

static void dump(const char *name, struct bpf_map *m)
{
	unsigned int key, next, *prev = NULL;

	printf("%-6s keys:", name);
	while (!bpf_map__get_next_key(m, prev, &next, sizeof(next))) {
		printf(" %u", next);
		key = next;
		prev = &key;
	}
	printf("\n");
}

int main(void)
{
	struct lru_bpf *skel = lru_bpf__open_and_load();
	unsigned long long val = 0;

	if (!skel)
		return 1;
	for (unsigned int k = 1; k <= 8; k++) {
		int e1 = bpf_map__update_elem(skel->maps.plain, &k, sizeof(k), &val, sizeof(val), BPF_ANY);
		int e2 = bpf_map__update_elem(skel->maps.lru, &k, sizeof(k), &val, sizeof(val), BPF_ANY);
		printf("insert %u: hash=%-8s lru=%s\n", k, e1 ? strerror(-e1) : "ok", e2 ? strerror(-e2) : "ok");
	}
	dump("hash", skel->maps.plain);
	dump("lru", skel->maps.lru);
	lru_bpf__destroy(skel);
	return 0;
}

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>

char LICENSE[] SEC("license") = "GPL";

struct event {
	u32 pid;
	u64 ts;
	char pad[48];
};

struct {
	__uint(type, BPF_MAP_TYPE_RINGBUF);
	__uint(max_entries, 4096);	/* 유저 공간에서 로드 전에 바꾼다 */
} rb SEC(".maps");

__u64 dropped = 0;
const volatile __u32 target_tgid = 0;
const volatile __u64 submit_flags = 0;

SEC("tp/syscalls/sys_enter_getppid")
int produce(void *ctx)
{
	struct event *e;

	if ((bpf_get_current_pid_tgid() >> 32) != target_tgid)
		return 0;
	e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
	if (!e) {
		__sync_fetch_and_add(&dropped, 1);	/* 공간 부족 */
		return 0;
	}
	e->pid = bpf_get_current_pid_tgid();
	e->ts = bpf_ktime_get_ns();
	bpf_ringbuf_submit(e, submit_flags);
	return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <pthread.h>
#include <sys/syscall.h>
#include <bpf/libbpf.h>
#include "ringdrop.skel.h"

#define EVENTS (delay_us ? 20000 : 200000)
static unsigned long long received;
static volatile int done;
static int delay_us;

static int on_event(void *ctx, void *data, size_t len) { received++; return 0; }

static void *producer(void *arg)
{
	for (int i = 0; i < EVENTS; i++) {
		syscall(SYS_getppid);
		if (delay_us)
			usleep(delay_us);
	}
	done = 1;
	return NULL;
}

int main(int argc, char **argv)
{
	unsigned int size = atoi(argv[1]);
	int poll_ms = argc > 2 ? atoi(argv[2]) : 10;
	int nowakeup = argc > 4 ? atoi(argv[4]) : 0;

	delay_us = argc > 3 ? atoi(argv[3]) : 0;
	struct ringdrop_bpf *skel = ringdrop_bpf__open();
	pthread_t th;

	bpf_map__set_max_entries(skel->maps.rb, size);	/* 링 버퍼 크기 */
	skel->rodata->target_tgid = getpid();
	if (nowakeup)
		skel->rodata->submit_flags = BPF_RB_NO_WAKEUP;
	if (ringdrop_bpf__load(skel) || ringdrop_bpf__attach(skel))
		return 1;
	struct ring_buffer *rb = ring_buffer__new(bpf_map__fd(skel->maps.rb), on_event, NULL, NULL);

	pthread_create(&th, NULL, producer, NULL);
	while (!done) {
		if (poll_ms == 0) {
			ring_buffer__poll(rb, 100);	/* 이벤트가 오면 바로 깨어남 */
			continue;
		}
		usleep(poll_ms * 1000);		/* 느린 소비자 흉내 */
		ring_buffer__consume(rb);
	}
	pthread_join(th, NULL);
	ring_buffer__consume(rb);
	printf("ringbuf %7u B, poll %2d ms, delay %d us, nowakeup %d: received=%6llu dropped=%6llu\n",
	       size, poll_ms, delay_us, nowakeup, received, skel->bss->dropped);
	ring_buffer__free(rb);
	ringdrop_bpf__destroy(skel);
	return 0;
}

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>

char LICENSE[] SEC("license") = "GPL";

struct {
	__uint(type, BPF_MAP_TYPE_HASH);
	__uint(max_entries, 1024);
	__type(key, char[16]);
	__type(value, u64);
	__uint(pinning, LIBBPF_PIN_BY_NAME);	/* /sys/fs/bpf/exec_count 에 고정 */
} exec_count SEC(".maps");

SEC("tp/sched/sched_process_exec")
int count_exec(void *ctx)
{
	char comm[16] = {};
	u64 one = 1, *v;

	bpf_get_current_comm(comm, sizeof(comm));
	v = bpf_map_lookup_elem(&exec_count, comm);
	if (v)
		__sync_fetch_and_add(v, 1);
	else
		bpf_map_update_elem(&exec_count, comm, &one, BPF_NOEXIST);
	return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include "pin.skel.h"

int main(int argc, char **argv)
{
	int sec = argc > 1 ? atoi(argv[1]) : 5;
	struct pin_bpf *skel = pin_bpf__open_and_load();	/* 고정된 맵이 있으면 재사용 */

	if (!skel || pin_bpf__attach(skel))
		return 1;
	sleep(sec);
	pin_bpf__destroy(skel);		/* 프로그램은 떼어지지만 맵은 남는다 */
	return 0;
}