BPF:程序上下文的翻译 [英] BPF: translation of program contexts

问题描述

我查看了不同类型的BPF程序，并注意到对于不同的程序类型，上下文传递的方式也有所不同.

I was looking at the different types of BPF program, and noticed that for different program types the context is being passed differently.

示例:

1. 对于程序类型BPF_PROG_TYPE_SOCK_OPS，类型为 struct bpf_sock_ops_kern .但是，这种类型的BPF程序引用了

1. For program type BPF_PROG_TYPE_SOCK_OPS, an object of type struct bpf_sock_ops_kern is passed. However, the BPF program of this type takes a reference to struct bpf_sock_ops. Why is it done this way and where is the "translation" from bpf_sock_ops_kern to bpf_sock_ops?

对于程序类型BPF_PROG_TYPE_CGROUP_SKB，类型为 struct sk_buff (例如，在 __cgroup_bpf_run_filter_skb )，但BPF程序要求使用最小化版本

For program type BPF_PROG_TYPE_CGROUP_SKB, an object of type struct sk_buff is passed (e.g., in __cgroup_bpf_run_filter_skb), but the BPF program expects a minimized version, struct __sk_buff.

所以我看了 struct bpf_verifier_ops函数回调，但它们似乎仅调整BPF指令中的偏移量，因为BPF验证程序会调用它们.

So I looked at the struct bpf_verifier_ops function callbacks, but they seem to only adjust the offsets in BPF instructions, as they are called by the BPF verifier.

如果有人可以阐明BPF上下文的定义，我将感到非常高兴.谢谢.

I'd be glad if someone could shed light on how the BPF context is defined. Thanks.

推荐答案

镜像对象(例如 bpf_sock_ops_kern.sk 实际上不是这种情况.

The mirror objects (e.g., struct bpf_sock_ops) passed as argument expose a subset of the original object(s)'s fields to the BPF program. The mirror structure can also have fields from several different original structures; in that case, the mirror object serves as aggregate. Passing the original object(s) to the BPF program would also be misleading as the user could think they have access to all fields. For example, they could think they have access to bpf_sock_ops_kern.sk when that's actually not the case.

然后，验证程序在首次执行程序之前将对镜像对象的访问转换为对原始对象的访问.每种镜像对象都有一个转换功能(例如，

The verifier then converts accesses to the mirror object into accesses to the original object(s), before the program is executed for the first time. There's a conversion function for each type of mirror object (e.g., sock_ops_convert_ctx_access for the conversion of accesses to struct bpf_sock_ops). Then, for each field of the mirror object (i.e., for each offset), the conversion function rewrites the load or store instruction with the offset to the original field.

请注意，所有原始字段都可能不在同一对象中.例如，在镜像对象 struct bpf_sock_ops ，则在 bpf_sock_ops_kern.sk->skc_family .

Note that all original fields might not be in the same object. For example, in the mirror object struct bpf_sock_ops, the fields op and family are retrieved in bpf_sock_ops_kern.op and bpf_sock_ops_kern.sk->skc_family respectively.

这篇关于BPF:程序上下文的翻译的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！