I've seen that for each type of ebpf program there is a different input (context) to the program. For example in the case of a BPF_PROG_TYPE_SOCKET_FILTER program a pointer to struct __sk_buff is passed as an argument. Where are defined the contexts for each program type ?
1 Answers
3
votes
Where are defined the contexts for each program type?
There are defined in the kernel, generally in the kernel headers. The precise location depends on the program type. For example, __sk_buff is used by several program types and is defined in linux/bpf.h.
To find which context each program is expecting, you can look at BPF samples in the kernel or try to find the xxxx_convert_ctx_access for a given program type. These functions translate accesses to the context object into accesses to the actual kernel object (for example, __sk_buff is a mirror to sk_buff). As an example, XDP programs expect a context of type struct xdp_md.
As pointed out by @Qeole in comments, there's a blog post by Oracle, from January 2019, that lists the expected context for each program type.
