2

I've seen that for each type of ebpf program there is a different input (context) to the program. For example in the case of a BPF_PROG_TYPE_SOCKET_FILTER program a pointer to struct __sk_buff is passed as an argument. Where are defined the contexts for each program type ?

1 Answer 1

5

Where are defined the contexts for each program type?

There are defined in the kernel, generally in the kernel headers. The precise location depends on the program type. For example, __sk_buff is used by several program types and is defined in linux/bpf.h.

To find which context each program is expecting, you can look at BPF samples in the kernel or try to find the xxxx_convert_ctx_access for a given program type. These functions translate accesses to the context object into accesses to the actual kernel object (for example, __sk_buff is a mirror to sk_buff). As an example, XDP programs expect a context of type struct xdp_md.

As pointed out by @Qeole in comments, there's a blog post by Oracle, from January 2019, that lists the expected context for each program type.

6
  • 2
    Good answer. As a complement, this blog post lists the contexts for all the (then existing) program types and may be of interest.
    – Qeole
    Aug 27, 2019 at 12:50
  • Ah, great! I've added it to the answer. Thanks!
    – pchaigno
    Aug 27, 2019 at 13:01
  • In the article about BPF_PROG_TYPE_TRACEPOINT it's written "What context is provided? The context provided by the specific tracepoint; arguments and data types are associated with the tracepoint definition." Within /include/trace/events/syscalls.h there is TRACE_EVENT_FN(sys_enter, TP_PROTO(struct pt_regs *regs, long id), TP_ARGS(regs, id), TP_STRUCT__entry( __field( long, id ) __array( unsigned long, args, 6 ) ), .... Ho can I exactly understand which is the context?
    – Maicake
    Aug 27, 2019 at 15:06
  • And also. I've seen here github.com/torvalds/linux/blob/… there is bpf_raw_tracepoint_args defined which is used with raw_tracepoint programs. But I can't find the context for just tracepoint .
    – Maicake
    Aug 27, 2019 at 15:10
  • 1
    For tracepoints, the context structure is specific to each probe site (e.g., block:block_getrq and block:block_plug will have different context structures). See this StackOverflow answer for how to get the content of each structure. You will have to declare that structure yourself with the appropriate fields (though bcc does that for you).
    – pchaigno
    Aug 27, 2019 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.