Search code examples
cbpfebpf

context for each type of ebpf program


I've seen that for each type of ebpf program there is a different input (context) to the program. For example in the case of a BPF_PROG_TYPE_SOCKET_FILTER program a pointer to struct __sk_buff is passed as an argument. Where are defined the contexts for each program type ?


Solution

  • Where are defined the contexts for each program type?

    There are defined in the kernel, generally in the kernel headers. The precise location depends on the program type. For example, __sk_buff is used by several program types and is defined in linux/bpf.h.

    To find which context each program is expecting, you can look at BPF samples in the kernel or try to find the xxxx_convert_ctx_access for a given program type. These functions translate accesses to the context object into accesses to the actual kernel object (for example, __sk_buff is a mirror to sk_buff). As an example, XDP programs expect a context of type struct xdp_md.

    As pointed out by @Qeole in comments, there's a blog post by Oracle, from January 2019, that lists the expected context for each program type.