eBPF Deep Dive: Từ bpftrace one-liner đến XDP, LSM, và sched_ext

// myebpf.bpf.c
#include "vmlinux.h"           // All kernel types (generated by bpftool)
#include <bpf/bpf_helpers.h>  // BPF helper functions
#include <bpf/bpf_tracing.h>  // Tracing macros
 
// Shared event structure (must match userspace)
struct event {
    u32 pid;
    u8  comm[16];
    u8  filename[256];
};
 
// Ring buffer map for sending events to userspace
struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 256 * 1024); // 256KB ring buffer
} events SEC(".maps");
 
SEC("tracepoint/syscalls/sys_enter_execve")
int trace_execve(struct trace_event_raw_sys_enter *ctx)
{
    struct event *e;
 
    // Reserve space in ring buffer
    e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
    if (!e)
        return 0;
 
    e->pid = bpf_get_current_pid_tgid() >> 32;
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
 
    // Read filename from user space pointer
    bpf_probe_read_user_str(&e->filename, sizeof(e->filename),
                            (void *)ctx->args[0]);
 
    // Submit event to ring buffer
    bpf_ringbuf_submit(e, 0);
    return 0;
}
 
char LICENSE[] SEC("license") = "GPL";

// myebpf.c
#include <stdio.h>
#include <signal.h>
#include <unistd.h>
#include <bpf/libbpf.h>
#include "myebpf.skel.h"  // Auto-generated by bpftool
 
struct event {
    unsigned int pid;
    char comm[16];
    char filename[256];
};
 
static volatile sig_atomic_t stop = 0;
static void sig_handler(int sig) { stop = 1; }
 
static int handle_event(void *ctx, void *data, size_t size)
{
    const struct event *e = data;
    printf("pid=%-6u comm=%-16s file=%s\n", e->pid, e->comm, e->filename);
    return 0;
}
 
int main(void)
{
    struct myebpf_bpf *skel;
    struct ring_buffer *rb;
    int err;
 
    // Open and load BPF skeleton
    skel = myebpf_bpf__open_and_load();
    if (!skel) {
        fprintf(stderr, "Failed to open BPF skeleton\n");
        return 1;
    }
 
    // Attach tracepoint
    err = myebpf_bpf__attach(skel);
    if (err) {
        fprintf(stderr, "Failed to attach BPF programs: %d\n", err);
        goto cleanup;
    }
 
    // Set up ring buffer polling
    rb = ring_buffer__new(bpf_map__fd(skel->maps.events),
                          handle_event, NULL, NULL);
    if (!rb) {
        err = -1;
        fprintf(stderr, "Failed to create ring buffer\n");
        goto cleanup;
    }
 
    signal(SIGINT, sig_handler);
    printf("Tracing execve... Press Ctrl+C to stop.\n");
    printf("%-6s %-16s %s\n", "PID", "COMM", "FILE");
 
    while (!stop) {
        err = ring_buffer__poll(rb, 100 /* timeout_ms */);
        if (err == -EINTR) { err = 0; break; }
        if (err < 0) { fprintf(stderr, "Error polling: %d\n", err); break; }
    }
 
cleanup:
    ring_buffer__free(rb);
    myebpf_bpf__destroy(skel);
    return err;
}

// kprobe_connect.bpf.c
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>
 
struct conn_event {
    u32 pid;
    u32 daddr;   // destination IP (network byte order)
    u16 dport;   // destination port
    u8  comm[16];
};
 
struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 1 << 16);
} events SEC(".maps");
 
SEC("kprobe/tcp_connect")
int BPF_KPROBE(trace_connect, struct sock *sk)
{
    struct conn_event *e;
    u16 family;
 
    // Only IPv4
    family = BPF_CORE_READ(sk, __sk_common.skc_family);
    if (family != AF_INET)
        return 0;
 
    e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
    if (!e)
        return 0;
 
    e->pid = bpf_get_current_pid_tgid() >> 32;
    e->daddr = BPF_CORE_READ(sk, __sk_common.skc_daddr);
    e->dport = bpf_ntohs(BPF_CORE_READ(sk, __sk_common.skc_dport));
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
 
    bpf_ringbuf_submit(e, 0);
    return 0;
}
 
char LICENSE[] SEC("license") = "GPL";

// syscall_counter.bpf.c
 
// Map: PID (u32) -> syscall count (u64)
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 10240);
    __type(key, u32);
    __type(value, u64);
} syscall_count SEC(".maps");
 
SEC("tracepoint/raw_syscalls/sys_enter")
int count_syscalls(struct trace_event_raw_sys_enter *ctx)
{
    u32 pid = bpf_get_current_pid_tgid() >> 32;
    u64 *count;
 
    count = bpf_map_lookup_elem(&syscall_count, &pid);
    if (count) {
        // Atomic increment
        __sync_fetch_and_add(count, 1);
    } else {
        // First time for this PID
        u64 init = 1;
        bpf_map_update_elem(&syscall_count, &pid, &init, BPF_NOEXIST);
    }
    return 0;
}

// userspace
#include <bpf/libbpf.h>
 
void print_top_processes(int map_fd)
{
    u32 key = 0, next_key;
    u64 value;
 
    printf("%-8s %-20s %s\n", "PID", "COMM", "SYSCALLS");
    while (bpf_map_get_next_key(map_fd, &key, &next_key) == 0) {
        bpf_map_lookup_elem(map_fd, &next_key, &value);
        // ... get comm from /proc/$pid/comm ...
        printf("%-8u %-20s %llu\n", next_key, get_comm(next_key), value);
        key = next_key;
    }
}

// Khai báo
struct {
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
    __uint(max_entries, 4); // 4 counters: rx_pkts, rx_bytes, tx_pkts, tx_bytes
    __type(key, u32);
    __type(value, u64);
} stats SEC(".maps");
 
// Trong XDP program
SEC("xdp")
int count_packets(struct xdp_md *ctx)
{
    u32 key = 0; // rx_pkts counter
    u64 *count = bpf_map_lookup_elem(&stats, &key);
    if (count)
        (*count)++;  // No lock needed! Per-CPU
 
    key = 1; // rx_bytes counter
    u64 *bytes = bpf_map_lookup_elem(&stats, &key);
    u32 pkt_size = ctx->data_end - ctx->data;
    if (bytes)
        *bytes += pkt_size;
 
    return XDP_PASS;
}

// Đọc per-CPU array từ userspace
void read_percpu_stats(int map_fd)
{
    int num_cpus = libbpf_num_possible_cpus();
    u64 *values = calloc(num_cpus, sizeof(u64));
 
    // key=0 = rx_pkts
    u32 key = 0;
    bpf_map_lookup_elem(map_fd, &key, values);
 
    u64 total_pkts = 0;
    for (int i = 0; i < num_cpus; i++)
        total_pkts += values[i];
 
    printf("Total packets: %llu\n", total_pkts);
    free(values);
}

// Kernel side
struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 1 << 20); // 1MB
} rb SEC(".maps");
 
struct net_event {
    u64 ts;
    u32 pid;
    u32 daddr;
    u16 dport;
    u8  comm[16];
};
 
SEC("kprobe/tcp_connect")
int BPF_KPROBE(on_connect, struct sock *sk)
{
    struct net_event *e;
 
    // bpf_ringbuf_reserve: allocate space (lock-free)
    e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
    if (!e)
        return 0;  // ring buffer full, drop event
 
    e->ts    = bpf_ktime_get_ns();
    e->pid   = bpf_get_current_pid_tgid() >> 32;
    e->daddr = BPF_CORE_READ(sk, __sk_common.skc_daddr);
    e->dport = bpf_ntohs(BPF_CORE_READ(sk, __sk_common.skc_dport));
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
 
    // bpf_ringbuf_submit: publish event (visible to userspace)
    bpf_ringbuf_submit(e, 0);
    return 0;
}

// Userspace polling
static int handle_event(void *ctx, void *data, size_t data_sz)
{
    const struct net_event *e = data;
    char ip[16];
    inet_ntop(AF_INET, &e->daddr, ip, sizeof(ip));
    printf("[%llu] pid=%-6u comm=%-16s -> %s:%u\n",
           e->ts, e->pid, e->comm, ip, e->dport);
    return 0;
}
 
// Setup ring buffer
struct ring_buffer *rb = ring_buffer__new(
    bpf_map__fd(skel->maps.rb),
    handle_event, NULL, NULL);
 
// Event loop
while (!stop) {
    ring_buffer__poll(rb, 100);
}

// IP blocklist với CIDR support
struct lpm_key {
    __u32 prefixlen;
    __u32 addr;
};
 
struct {
    __uint(type, BPF_MAP_TYPE_LPM_TRIE);
    __uint(max_entries, 1024);
    __type(key, struct lpm_key);
    __type(value, u64);
    __uint(map_flags, BPF_F_NO_PREALLOC);
} ip_blocklist SEC(".maps");
 
// Trong XDP program
SEC("xdp")
int drop_blocked(struct xdp_md *ctx)
{
    // ... parse IP header ...
    struct lpm_key key = {
        .prefixlen = 32,
        .addr = ip->saddr,  // Source IP
    };
    if (bpf_map_lookup_elem(&ip_blocklist, &key))
        return XDP_DROP;
    return XDP_PASS;
}

// Block 192.168.1.0/24
struct lpm_key key = {
    .prefixlen = 24,
    .addr = inet_addr("192.168.1.0"),
};
u64 value = 1;
bpf_map_update_elem(map_fd, &key, &value, BPF_ANY);

// CRUD operations trên map
int map_fd = bpf_map__fd(skel->maps.my_map);
 
// Lookup
u32 key = pid;
u64 value;
int ret = bpf_map_lookup_elem(map_fd, &key, &value);
if (ret == 0) printf("Found: %llu\n", value);
 
// Update (BPF_ANY: create or update, BPF_NOEXIST: only create, BPF_EXIST: only update)
u64 new_value = 100;
bpf_map_update_elem(map_fd, &key, &new_value, BPF_ANY);
 
// Delete
bpf_map_delete_elem(map_fd, &key);
 
// Iterate all entries
u32 cur_key = 0, next_key;
while (bpf_map_get_next_key(map_fd, &cur_key, &next_key) == 0) {
    bpf_map_lookup_elem(map_fd, &next_key, &value);
    // process entry
    cur_key = next_key;
}

// xdp_counter.bpf.c
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
 
struct {
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
    __uint(max_entries, 5);  // one slot per XDP action
    __type(key, u32);
    __type(value, u64);
} action_stats SEC(".maps");
 
SEC("xdp")
int xdp_counter(struct xdp_md *ctx)
{
    u32 action = XDP_PASS;
    u32 key = action;
    u64 *count = bpf_map_lookup_elem(&action_stats, &key);
    if (count)
        (*count)++;
    return action;
}
 
char LICENSE[] SEC("license") = "GPL";

// xdp_blocklist.bpf.c
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
 
struct lpm_key {
    __u32 prefixlen;
    __u32 addr;
};
 
struct {
    __uint(type, BPF_MAP_TYPE_LPM_TRIE);
    __uint(max_entries, 65536);
    __type(key, struct lpm_key);
    __type(value, u64);
    __uint(map_flags, BPF_F_NO_PREALLOC);
} blocklist SEC(".maps");
 
// Stats: [0]=passed, [1]=dropped
struct {
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
    __uint(max_entries, 2);
    __type(key, u32);
    __type(value, u64);
} stats SEC(".maps");
 
static __always_inline void update_stat(u32 key)
{
    u64 *val = bpf_map_lookup_elem(&stats, &key);
    if (val)
        (*val)++;
}
 
SEC("xdp")
int xdp_block(struct xdp_md *ctx)
{
    void *data_end = (void *)(long)ctx->data_end;
    void *data     = (void *)(long)ctx->data;
 
    // Parse Ethernet header
    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end)
        return XDP_PASS;
 
    // Only process IPv4
    if (bpf_ntohs(eth->h_proto) != ETH_P_IP) {
        update_stat(0);
        return XDP_PASS;
    }
 
    // Parse IP header
    struct iphdr *ip = (void *)(eth + 1);
    if ((void *)(ip + 1) > data_end)
        return XDP_PASS;
 
    // LPM lookup
    struct lpm_key key = {
        .prefixlen = 32,
        .addr      = ip->saddr,
    };
 
    if (bpf_map_lookup_elem(&blocklist, &key)) {
        update_stat(1);
        return XDP_DROP;
    }
 
    update_stat(0);
    return XDP_PASS;
}
 
char LICENSE[] SEC("license") = "GPL";

// Thêm IP/network vào blocklist
int add_to_blocklist(int map_fd, const char *cidr)
{
    struct lpm_key key;
    u64 value = 1;
    char ip_str[32];
    int prefix;
 
    sscanf(cidr, "%[^/]/%d", ip_str, &prefix);
    key.prefixlen = prefix;
    key.addr = inet_addr(ip_str) & htonl(~((1u << (32 - prefix)) - 1));
 
    return bpf_map_update_elem(map_fd, &key, &value, BPF_ANY);
}
 
// Block toàn bộ /24
add_to_blocklist(map_fd, "192.168.100.0/24");
// Block IP cụ thể
add_to_blocklist(map_fd, "10.0.0.1/32");

// xdp_ratelimit.bpf.c — Giới hạn packet rate per source IP
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
 
#define RATE_LIMIT_PPS 1000  // packets per second per IP
 
struct rate_limit_val {
    u64 last_ts;   // timestamp of last reset
    u64 pkt_count; // packets since last reset
};
 
struct {
    __uint(type, BPF_MAP_TYPE_LRU_HASH);
    __uint(max_entries, 100000);
    __type(key, u32);   // source IP
    __type(value, struct rate_limit_val);
} rate_map SEC(".maps");
 
SEC("xdp")
int xdp_ratelimit(struct xdp_md *ctx)
{
    void *data_end = (void *)(long)ctx->data_end;
    void *data     = (void *)(long)ctx->data;
 
    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end)
        return XDP_PASS;
 
    if (bpf_ntohs(eth->h_proto) != ETH_P_IP)
        return XDP_PASS;
 
    struct iphdr *ip = (void *)(eth + 1);
    if ((void *)(ip + 1) > data_end)
        return XDP_PASS;
 
    u32 src_ip = ip->saddr;
    u64 now = bpf_ktime_get_ns();
 
    struct rate_limit_val *val = bpf_map_lookup_elem(&rate_map, &src_ip);
    if (val) {
        // Reset counter every second
        if (now - val->last_ts >= 1000000000ULL) {
            val->last_ts = now;
            val->pkt_count = 1;
        } else if (val->pkt_count >= RATE_LIMIT_PPS) {
            return XDP_DROP;  // Exceeded rate limit
        } else {
            val->pkt_count++;
        }
    } else {
        // New IP
        struct rate_limit_val new_val = {
            .last_ts   = now,
            .pkt_count = 1,
        };
        bpf_map_update_elem(&rate_map, &src_ip, &new_val, BPF_ANY);
    }
 
    return XDP_PASS;
}
 
char LICENSE[] SEC("license") = "GPL";

// Redirect packet đến interface khác
SEC("xdp")
int xdp_redirect(struct xdp_md *ctx)
{
    // Redirect đến interface có index 3
    return bpf_redirect(3, 0);
}
 
// Redirect đến CPU khác (XDP_REDIRECT + devmap)
struct {
    __uint(type, BPF_MAP_TYPE_DEVMAP);
    __uint(max_entries, 64);
    __type(key, u32);
    __type(value, u32);
} tx_port SEC(".maps");
 
SEC("xdp")
int xdp_redirect_map(struct xdp_md *ctx)
{
    u32 key = 0;
    return bpf_redirect_map(&tx_port, key, XDP_PASS);
}

// tc_trace.bpf.c
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
#include <linux/pkt_cls.h>  // TC_ACT_*
 
struct pkt_info {
    u32 src_ip;
    u32 dst_ip;
    u16 src_port;
    u16 dst_port;
    u8  proto;
};
 
struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 1 << 16);
} events SEC(".maps");
 
SEC("tc")
int tc_ingress(struct __sk_buff *skb)
{
    void *data_end = (void *)(long)skb->data_end;
    void *data     = (void *)(long)skb->data;
 
    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end)
        return TC_ACT_OK;
 
    if (bpf_ntohs(eth->h_proto) != ETH_P_IP)
        return TC_ACT_OK;
 
    struct iphdr *ip = (void *)(eth + 1);
    if ((void *)(ip + 1) > data_end)
        return TC_ACT_OK;
 
    struct pkt_info *e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
    if (!e)
        return TC_ACT_OK;
 
    e->src_ip = ip->saddr;
    e->dst_ip = ip->daddr;
    e->proto  = ip->protocol;
 
    if (ip->protocol == IPPROTO_TCP) {
        struct tcphdr *tcp = (void *)(ip + 1);
        if ((void *)(tcp + 1) <= data_end) {
            e->src_port = bpf_ntohs(tcp->source);
            e->dst_port = bpf_ntohs(tcp->dest);
        }
    }
 
    bpf_ringbuf_submit(e, 0);
    return TC_ACT_OK;
}
 
char LICENSE[] SEC("license") = "GPL";

// Một số hook points của BPF LSM
lsm/file_open        // Khi file được mở
lsm/bprm_check_security  // Khi execute binary
lsm/socket_connect   // Khi socket connect
lsm/task_kill        // Khi signal được gửi
lsm/socket_create    // Khi socket được tạo
lsm/inode_mkdir      // Khi tạo directory

// security_file.bpf.c
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>
#include <errno.h>
 
// Danh sách process được phép đọc /etc/shadow
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 64);
    __type(key, u32);   // PID
    __type(value, u8);
} allowed_pids SEC(".maps");
 
SEC("lsm/file_open")
int BPF_PROG(restrict_shadow, struct file *file)
{
    char fname[32];
    struct dentry *dentry;
    struct qstr d_name;
 
    // Get filename
    dentry = BPF_CORE_READ(file, f_path.dentry);
    d_name = BPF_CORE_READ(dentry, d_name);
 
    // Check if accessing /etc/shadow
    bpf_probe_read_kernel_str(&fname, sizeof(fname), d_name.name);
 
    if (__builtin_memcmp(fname, "shadow", 6) != 0)
        return 0;  // Not shadow file, allow
 
    u32 pid = bpf_get_current_pid_tgid() >> 32;
 
    // Check if PID is in allowed list
    u8 *allowed = bpf_map_lookup_elem(&allowed_pids, &pid);
    if (allowed)
        return 0;  // Allowed
 
    // Block access - return EPERM
    bpf_printk("Blocked access to shadow by pid=%u\n", pid);
    return -EPERM;
}
 
char LICENSE[] SEC("license") = "GPL";

// deny_exec.bpf.c — Cho phép chỉ specific binaries được run
SEC("lsm/bprm_check_security")
int BPF_PROG(check_exec, struct linux_binprm *bprm)
{
    char filename[256];
    u8  comm[16];
    u32 pid = bpf_get_current_pid_tgid() >> 32;
 
    // Get the binary being executed
    bpf_probe_read_kernel_str(&filename, sizeof(filename),
        BPF_CORE_READ(bprm, filename));
 
    bpf_get_current_comm(&comm, sizeof(comm));
 
    // Block execution of certain tools by non-root
    if (__builtin_memcmp(filename, "/usr/bin/nc", 11) == 0) {
        uid_t uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
        if (uid != 0) {
            bpf_printk("Blocked: pid=%u comm=%s tried to exec nc\n",
                       pid, comm);
            return -EPERM;
        }
    }
 
    return 0;
}

// Trong userspace — restrict syscalls cho process này
#include <linux/seccomp.h>
#include <linux/filter.h>
#include <sys/prctl.h>
 
static void apply_seccomp_filter(void)
{
    struct sock_filter filter[] = {
        // Load architecture
        BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
                 offsetof(struct seccomp_data, arch)),
        // Allow only x86-64
        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, AUDIT_ARCH_X86_64, 1, 0),
        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL),
 
        // Load syscall number
        BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
                 offsetof(struct seccomp_data, nr)),
 
        // Allow read, write, exit, exit_group, brk
        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_read, 4, 0),
        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_write, 3, 0),
        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_exit, 2, 0),
        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_exit_group, 1, 0),
        // Kill everything else
        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL),
        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
    };
 
    struct sock_fprog prog = {
        .len    = (unsigned short)(sizeof(filter) / sizeof(filter[0])),
        .filter = filter,
    };
 
    prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
    prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
}

// BUG: Missing bounds check
SEC("xdp")
int bad_program(struct xdp_md *ctx)
{
    void *data     = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;
 
    struct ethhdr *eth = data;
    // BUG: không check bounds trước khi access eth->h_proto
    __u16 proto = eth->h_proto;  // VERIFIER REJECTS THIS
    return XDP_PASS;
}
 
// FIX: Add bounds check
SEC("xdp")
int good_program(struct xdp_md *ctx)
{
    void *data     = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;
 
    struct ethhdr *eth = data;
    // Check: eth + sizeof(*eth) <= data_end
    if ((void *)(eth + 1) > data_end)
        return XDP_PASS;
 
    __u16 proto = eth->h_proto;  // OK!
    return XDP_PASS;
}

// Với CO-RE, thay vì trực tiếp:
// u32 dport = sk->__sk_common.skc_dport;  // BAD: offset hardcoded
 
// Dùng BPF_CORE_READ:
u32 dport = BPF_CORE_READ(sk, __sk_common.skc_dport);
// Tại load time, libbpf sẽ:
// 1. Đọc BTF của kernel hiện tại
// 2. Tính offset thực của skc_dport trong kernel này
// 3. Patch instruction để dùng offset đúng
// -> Program chạy đúng trên mọi kernel version có BTF

// Đọc field từ kernel struct (CO-RE safe)
u32 pid = BPF_CORE_READ(task, pid);
 
// Đọc nested struct
u32 dport = BPF_CORE_READ(sk, __sk_common.skc_dport);
 
// Check nếu field tồn tại (cross-version compatibility)
if (bpf_core_field_exists(struct task_struct, on_cpu)) {
    // Kernel có field này
    bool on_cpu = BPF_CORE_READ(task, on_cpu);
}
 
// Đọc string
char filename[256];
BPF_CORE_READ_STR_INTO(&filename, bprm, filename);

// Generated skeleton (program.skel.h) — simplified
struct program_bpf {
    struct {
        struct bpf_object *obj;
        struct bpf_program *trace_execve;  // BPF program
    } progs;
    struct {
        struct bpf_map *events;            // BPF map
        struct bpf_map *config;
    } maps;
    struct {
        struct bpf_link *trace_execve;     // Link to hook
    } links;
};
 
// API:
struct program_bpf *skel;
skel = program_bpf__open();        // Open (before load)
// Modify maps/progs before load:
skel->rodata->config_value = 42;
program_bpf__load(skel);           // Load into kernel
program_bpf__attach(skel);         // Attach to hooks
program_bpf__destroy(skel);        // Cleanup

// Trong BPF program — khai báo global config
const volatile u32 min_duration_ns = 0;
const volatile bool filter_by_comm = false;
 
SEC("tracepoint/syscalls/sys_enter_execve")
int trace_execve(...)
{
    u64 duration = get_duration();
    if (min_duration_ns && duration < min_duration_ns)
        return 0;  // Skip short-lived processes
    // ...
}

// Trong userspace — set trước khi load
skel = program_bpf__open();
skel->rodata->min_duration_ns = 100 * 1000 * 1000;  // 100ms
skel->rodata->filter_by_comm = true;
program_bpf__load(skel);

// Admin: tạo BPF token và gắn vào BPF filesystem mount
// user có thể mount BPF FS với specific permissions:
// mount -t bpf none /sys/fs/bpf -o delegate_cmds=prog_load:map_create
 
// Unprivileged user: sử dụng token để load BPF program
int token_fd = open("/sys/fs/bpf", O_RDONLY);
LIBBPF_OPTS(bpf_prog_load_opts, opts,
    .token_fd = token_fd,
);
bpf_prog_load(prog_type, insns, insns_cnt, &opts);

// Kernel side: allocate từ arena
struct {
    __uint(type, BPF_MAP_TYPE_ARENA);
    __uint(max_entries, 1 << 20);  // 1MB arena
} arena SEC(".maps");
 
SEC("xdp")
int xdp_with_arena(struct xdp_md *ctx)
{
    // arena_alloc tự quản lý memory trong arena
    void *buf = bpf_arena_alloc_pages(&arena, NULL, 1, NUMA_NO_NODE, 0);
    if (!buf)
        return XDP_PASS;
 
    // Write data directly to arena — visible to userspace
    // ...
    return XDP_PASS;
}

// Minimal BPF scheduler skeleton
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
 
// Simple FIFO scheduler
struct {
    __uint(type, BPF_MAP_TYPE_QUEUE);
    __uint(max_entries, 4096);
    __type(value, u32);  // task PID
} runq SEC(".maps");
 
// Called when task becomes runnable
void BPF_STRUCT_OPS(sched_enqueue, struct task_struct *p, u64 enq_flags)
{
    s32 pid = p->pid;
    bpf_map_push_elem(&runq, &pid, 0);
}
 
// Called to select next task to run
void BPF_STRUCT_OPS(sched_dispatch, s32 cpu, struct task_struct *prev)
{
    s32 pid;
    if (bpf_map_pop_elem(&runq, &pid) == 0) {
        struct task_struct *p = bpf_task_from_pid(pid);
        if (p) {
            scx_bpf_dispatch(p, SCX_DSQ_LOCAL, SCX_SLICE_DFL, 0);
            bpf_task_release(p);
        }
    }
}
 
// Scheduler metadata
SEC(".struct_ops.link")
struct sched_ext_ops my_sched = {
    .enqueue  = (void *)sched_enqueue,
    .dispatch = (void *)sched_dispatch,
    .name     = "my_fifo_scheduler",
};
 
char LICENSE[] SEC("license") = "GPL";

// Thay vì check mọi return value
struct iphdr *ip = data + sizeof(struct ethhdr);
if ((void *)(ip + 1) > data_end)
    return XDP_PASS;
 
// Với BPF exceptions (future simplification):
// bpf_exception_throw() thoát khỏi program ngay lập tức
// (hiện đang trong development)