I've seen that for each type of ebpf program there is a different input (context) to the program. For example in the case of a BPF_PROG_TYPE_SOCKET_FILTER program a pointer to struct __sk_buff is passed as an argument. Where are defined the contexts for each program type ?
Where are defined the contexts for each program type?
There are defined in the kernel, generally in the kernel headers. The precise location depends on the program type. For example, __sk_buff
is used by several program types and is defined in linux/bpf.h
.
To find which context each program is expecting, you can look at BPF samples in the kernel or try to find the xxxx_convert_ctx_access
for a given program type. These functions translate accesses to the context object into accesses to the actual kernel object (for example, __sk_buff
is a mirror to sk_buff
). As an example, XDP programs expect a context of type struct xdp_md
.
As pointed out by @Qeole in comments, there's a blog post by Oracle, from January 2019, that lists the expected context for each program type.