🔥🐝 BlazeBPF

🖨️ Output & Debugging

bpf_printk()

Print formatted message to kernel trace buffer

int bpf_printk(const char *fmt, ...)

bpf_trace_printk()

Legacy trace printing function

int bpf_trace_printk(const char *fmt, u32 fmt_size, ...)

🗺️ Map Operations

bpf_map_lookup_elem()

Look up element in map by key

void *bpf_map_lookup_elem(void *map, const void *key)

bpf_map_update_elem()

Update or insert element in map

int bpf_map_update_elem(void *map, const void *key, const void *value, u64 flags)

bpf_map_delete_elem()

Delete element from map by key

int bpf_map_delete_elem(void *map, const void *key)

🕒 Time & Random

bpf_ktime_get_ns()

Get current kernel time in nanoseconds

u64 bpf_ktime_get_ns(void)

bpf_get_prandom_u32()

Get pseudo-random 32-bit number

u32 bpf_get_prandom_u32(void)

🌐 Network Operations

bpf_ntohs()

Convert network byte order to host (16-bit)

u16 bpf_ntohs(u16 netshort)

bpf_ntohl()

Convert network byte order to host (32-bit)

u32 bpf_ntohl(u32 netlong)

bpf_htons()

Convert host to network byte order (16-bit)

u16 bpf_htons(u16 hostshort)

bpf_htonl()

Convert host to network byte order (32-bit)

u32 bpf_htonl(u32 hostlong)

bpf_csum_diff()

Compute checksum difference for packet modification

s64 bpf_csum_diff(__be32 *from, u32 from_size, __be32 *to, u32 to_size, __wsum seed)

bpf_l3_csum_replace()

Recalculate L3 (IP) checksum after modification

int bpf_l3_csum_replace(struct sk_buff *skb, u32 offset, u64 from, u64 to, u64 size)

bpf_l4_csum_replace()

Recalculate L4 (TCP/UDP) checksum after modification

int bpf_l4_csum_replace(struct sk_buff *skb, u32 offset, u64 from, u64 to, u64 flags)

bpf_redirect()

Redirect packet to another interface

int bpf_redirect(u32 ifindex, u64 flags)

bpf_clone_redirect()

Clone and redirect packet to another interface

int bpf_clone_redirect(struct sk_buff *skb, u32 ifindex, u64 flags)

bpf_skb_store_bytes()

Write bytes to packet data

int bpf_skb_store_bytes(struct sk_buff *skb, u32 offset, const void *from, u32 len, u64 flags)

bpf_skb_load_bytes()

Read bytes from packet data

int bpf_skb_load_bytes(const struct sk_buff *skb, u32 offset, void *to, u32 len)

👤 Process & Task Info

bpf_get_current_pid_tgid()

Get current process and thread group ID

u64 bpf_get_current_pid_tgid(void)

bpf_get_current_uid_gid()

Get current user and group ID

u64 bpf_get_current_uid_gid(void)

bpf_get_current_comm()

Get current process name

int bpf_get_current_comm(void *buf, u32 size_of_buf)

bpf_get_current_task()

Get pointer to current task_struct

u64 bpf_get_current_task(void)

bpf_get_current_cgroup_id()

Get current cgroup ID

u64 bpf_get_current_cgroup_id(void)

🔍 Memory & Data Access

bpf_probe_read()

Safely read memory from kernel space

int bpf_probe_read(void *dst, u32 size, const void *unsafe_ptr)

bpf_probe_read_user()

Safely read memory from user space

int bpf_probe_read_user(void *dst, u32 size, const void *unsafe_ptr)

bpf_probe_read_kernel()

Safely read memory from kernel space (modern)

int bpf_probe_read_kernel(void *dst, u32 size, const void *unsafe_ptr)

bpf_probe_read_str()

Safely read null-terminated string from kernel

int bpf_probe_read_str(void *dst, u32 size, const void *unsafe_ptr)

bpf_probe_write_user()

Write to user space memory

int bpf_probe_write_user(void *dst, const void *src, u32 len)

🔄 Ring Buffer & Perf Events

bpf_ringbuf_reserve()

Reserve space in ring buffer

void *bpf_ringbuf_reserve(void *ringbuf, u64 size, u64 flags)

bpf_ringbuf_submit()

Submit reserved data to ring buffer

void bpf_ringbuf_submit(void *data, u64 flags)

bpf_ringbuf_discard()

Discard reserved ring buffer data

void bpf_ringbuf_discard(void *data, u64 flags)

bpf_ringbuf_output()

Copy data to ring buffer (one-shot)

int bpf_ringbuf_output(void *ringbuf, void *data, u64 size, u64 flags)

bpf_ringbuf_query()

Query ring buffer properties

u64 bpf_ringbuf_query(void *ringbuf, u64 flags)

bpf_perf_event_output()

Send data to perf event buffer

int bpf_perf_event_output(void *ctx, void *map, u64 flags, void *data, u64 size)

bpf_perf_event_read()

Read value from perf event counter

u64 bpf_perf_event_read(void *map, u64 flags)

🎯 Program Control & Calls

bpf_tail_call()

Chain to another BPF program

void bpf_tail_call(void *ctx, void *prog_array_map, u32 index)

bpf_override_return()

Override function return value (error injection)

int bpf_override_return(struct pt_regs *regs, u64 rc)

bpf_get_func_ret()

Get function return value

int bpf_get_func_ret(void *ctx, u64 *rc)

bpf_get_func_arg()

Get function argument value

int bpf_get_func_arg(void *ctx, u32 n, u64 *value)

📊 Stack & Tracing

bpf_get_stackid()

Get stack trace ID for stack map

int bpf_get_stackid(void *ctx, void *map, u64 flags)

bpf_get_stack()

Get stack trace into buffer

int bpf_get_stack(void *ctx, void *buf, u32 size, u64 flags)

bpf_get_attach_cookie()

Get attach cookie (BPF link parameter)

u64 bpf_get_attach_cookie(void *ctx)

bpf_send_signal()

Send signal to current task

int bpf_send_signal(u32 sig)

🔒 Security & Capabilities

bpf_get_current_ancestor_cgroup_id()

Get ancestor cgroup ID at specified level

u64 bpf_get_current_ancestor_cgroup_id(int ancestor_level)

bpf_check_mtu()

Check if packet fits MTU

int bpf_check_mtu(void *ctx, u32 ifindex, u32 *mtu_len, s32 len_diff, u64 flags)

🛠️ Utilities & Helpers

bpf_get_smp_processor_id()

Get current CPU core ID

u32 bpf_get_smp_processor_id(void)

bpf_get_numa_node_id()

Get NUMA node ID of current CPU

int bpf_get_numa_node_id(void)

bpf_ktime_get_boot_ns()

Get time since boot in nanoseconds

u64 bpf_ktime_get_boot_ns(void)

bpf_ktime_get_coarse_ns()

Get coarse time (faster but less precise)

u64 bpf_ktime_get_coarse_ns(void)

bpf_jiffies64()

Get system jiffies (kernel time unit)

u64 bpf_jiffies64(void)

bpf_spin_lock()

Acquire spin lock

void bpf_spin_lock(struct bpf_spin_lock *lock)

bpf_spin_unlock()

Release spin lock

void bpf_spin_unlock(struct bpf_spin_lock *lock)

Basic TC Program

Simple Traffic Control program structure

SEC("tc") int tc_program(struct __sk_buff *skb) { bpf_printk("Packet size: %d\\n", skb->len); return TC_ACT_OK; } char _license[] SEC("license") = "GPL";

Basic XDP Program

Simple XDP packet processing

SEC("xdp") int xdp_program(struct xdp_md *ctx) { bpf_printk("XDP packet received\\n"); return XDP_PASS; } char _license[] SEC("license") = "GPL";

Packet Header Parsing

Parse Ethernet and IP headers

void *data_end = (void *)(long)ctx->data_end; void *data = (void *)(long)ctx->data; struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return XDP_DROP; if (eth->h_proto != bpf_htons(ETH_P_IP)) return XDP_PASS; struct iphdr *ip = (void *)(eth + 1); if ((void *)(ip + 1) > data_end) return XDP_DROP;

Map Usage Pattern

Common map operations

struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, 1024); __type(key, __u32); __type(value, __u64); } my_map SEC(".maps"); // Lookup __u64 *value = bpf_map_lookup_elem(&my_map, &key); if (value) { // Update existing (*value)++; } else { // Insert new __u64 new_val = 1; bpf_map_update_elem(&my_map, &key, &new_val, BPF_ANY); }

BPF_MAP_TYPE_HASH

Hash table for key-value storage

Fast lookups, O(1) average case

BPF_MAP_TYPE_ARRAY

Array map with integer keys

Direct indexing, O(1) access

BPF_MAP_TYPE_PERCPU_HASH

Per-CPU hash table for performance

No locking needed, high performance

BPF_MAP_TYPE_RINGBUF

Ring buffer for event streaming

Efficient event communication

💡 Tip of the Day

Use bpf_printk() for debugging - view output with: sudo cat /sys/kernel/debug/tracing/trace_pipe

❓ Frequently Asked Questions

📌 What is eBPF? ▼

eBPF (extended Berkeley Packet Filter) is a revolutionary technology that allows you to run sandboxed programs in the Linux kernel without changing kernel source code or loading kernel modules. It's used for networking, security, observability, and more.

🔧 How do I debug my eBPF program? ▼

Use bpf_printk() to print debug messages. View output with: sudo cat /sys/kernel/debug/tracing/trace_pipe. For more advanced debugging, use bpftool: sudo bpftool prog tracelog

🗺️ What map types should I use? ▼

BPF_MAP_TYPE_HASH: Key-value storage with fast lookups
BPF_MAP_TYPE_ARRAY: Fixed-size array indexed by integers
BPF_MAP_TYPE_PERCPU_HASH: Per-CPU hash for high-performance scenarios
BPF_MAP_TYPE_RINGBUF: Ring buffer for efficient event streaming

⚠️ Why does my program fail verification? ▼

Common reasons:

Missing bounds checks on packet data
Unbounded loops (use #pragma unroll)
Invalid memory access
Stack size exceeded (512 bytes limit)

Always check pointers before dereferencing and ensure loops have fixed iteration counts.

🚀 What's the difference between XDP and TC? ▼

XDP (eXpress Data Path): Runs at the earliest point in the network stack (driver level). Fastest performance but limited packet manipulation.

TC (Traffic Control): Runs after XDP in the network stack. More flexibility for packet modification but slightly lower performance.

📚 Where can I learn more? ▼

Check out the Tutorials tab for guided lessons, or visit the Community tab for links to documentation, forums, and learning resources.

📖 Quick Reference

Common Return Values

XDP_PASS - Pass packet to network stack
XDP_DROP - Drop packet
XDP_TX - Transmit packet back
TC_ACT_OK - Allow packet (TC)
TC_ACT_SHOT - Drop packet (TC)

Key Data Structures

struct xdp_md - XDP context
struct __sk_buff - TC/socket context
struct ethhdr - Ethernet header
struct iphdr - IP header

Common Flags

BPF_ANY - Create or update
BPF_NOEXIST - Create only
BPF_EXIST - Update only
ETH_P_IP - IPv4 protocol