I've seen that for each type of ebpf program there is a different input (context) to the program. For example in the case of a BPF_PROG_TYPE_SOCKET_FILTER program a pointer to struct __sk_buff is passed as an argument. Where are defined the contexts for each program type ?
1 Answer
Where are defined the contexts for each program type?
There are defined in the kernel, generally in the kernel headers. The precise location depends on the program type. For example, __sk_buff
is used by several program types and is defined in linux/bpf.h
.
To find which context each program is expecting, you can look at BPF samples in the kernel or try to find the xxxx_convert_ctx_access
for a given program type. These functions translate accesses to the context object into accesses to the actual kernel object (for example, __sk_buff
is a mirror to sk_buff
). As an example, XDP programs expect a context of type struct xdp_md
.
As pointed out by @Qeole in comments, there's a blog post by Oracle, from January 2019, that lists the expected context for each program type.
-
2Good answer. As a complement, this blog post lists the contexts for all the (then existing) program types and may be of interest.– QeoleAug 27, 2019 at 12:50
-
-
In the article about BPF_PROG_TYPE_TRACEPOINT it's written "What context is provided? The context provided by the specific tracepoint; arguments and data types are associated with the tracepoint definition." Within /include/trace/events/syscalls.h there is TRACE_EVENT_FN(sys_enter, TP_PROTO(struct pt_regs *regs, long id), TP_ARGS(regs, id), TP_STRUCT__entry( __field( long, id ) __array( unsigned long, args, 6 ) ), .... Ho can I exactly understand which is the context?– MaicakeAug 27, 2019 at 15:06
-
And also. I've seen here github.com/torvalds/linux/blob/… there is bpf_raw_tracepoint_args defined which is used with raw_tracepoint programs. But I can't find the context for just tracepoint .– MaicakeAug 27, 2019 at 15:10
-
1For tracepoints, the context structure is specific to each probe site (e.g.,
block:block_getrq
andblock:block_plug
will have different context structures). See this StackOverflow answer for how to get the content of each structure. You will have to declare that structure yourself with the appropriate fields (though bcc does that for you).– pchaignoAug 27, 2019 at 15:44