[英]Why load_half is defined in bpf_helpers but it doesn't appear in filter.c?
If I understood "well" within tools/testing/selftests/bpf/bpf_helpers.h
bpf heleprs prototypes are defined. 如果我在tools/testing/selftests/bpf/bpf_helpers.h
了解“很好”,则将定义bpf heleprs原型。
If I want to now which helpers are usable with a specific program type I need to search within the results of 'func_proto(enum bpf_func_id func_id' kernel/ net/ drivers/
如果我现在想在特定程序类型中使用哪些助手,我需要在'func_proto(enum bpf_func_id func_id' kernel/ net/ drivers/
For example to check the helpers which a socket filter program can call I can read the following definition 例如,检查套接字过滤器程序可以调用的助手,我可以阅读以下定义
static const struct bpf_func_proto *
sock_filter_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
{
switch (func_id) {
/* inet and inet6 sockets are created in a process
* context so there is always a valid uid/gid
*/
case BPF_FUNC_get_current_uid_gid:
return &bpf_get_current_uid_gid_proto;
case BPF_FUNC_get_local_storage:
return &bpf_get_local_storage_proto;
default:
return bpf_base_func_proto(func_id);
}
}
QUESTIONS: 问题:
1)I can't see load_half
, but still I can call it from my socket filter program. 1)我看不到load_half
,但仍然可以从我的套接字过滤器程序中调用它。 Why? 为什么? 2) which is the difference between socket_filter
and sk_filter
? 2) socket_filter
和sk_filter
什么sk_filter
?
load_half()
is not a BPF helper. load_half()
不是BPF帮助器。 The file bpf_helpers.h
that you mentioned does declare the prototypes for the BPF helper functions, but it also contains other useful definitions such as the SEC()
or the bpf_printk()
macros. 您提到的文件bpf_helpers.h
确实声明了BPF帮助程序函数的原型,但它还包含其他有用的定义,例如SEC()
或bpf_printk()
宏。 In particular, it declares load_half()
with the following comment: 特别是,它使用以下注释声明load_half()
:
/* llvm builtin functions that eBPF C program may use to * emit BPF_LD_ABS and BPF_LD_IND instructions */ [...] unsigned long long load_half(void *skb, unsigned long long off) asm("llvm.bpf.load.half");
As you can read, load_half()
is an LLVM builtin, an assembly primitive supported by clang/LLVM which is wrapped as load_half()
for convenience. 如您load_half()
, load_half()
是LLVM内置的,这是clang / LLVM支持的程序集原语,为方便起见包装为load_half()
。 And because it is not a BPF helper, you will not see it when grepping for its prototype in the kernel. 并且由于它不是BPF帮助器,因此在内核中greping其原型时将看不到它。
The prefix sk_filter
is used for eBPF filters attached to sockets, in a similar fashion as what one can do with the legacy cBPF, to filter incoming packets. 前缀sk_filter
用于连接到套接字的eBPF过滤器,其过滤方式类似于对传统cBPF的处理方式,以过滤传入的数据包。 Although it may be confusing, you can see that sock_filter_is_valid_access
in kernel file net/core/filter.c
is used for cg_sock_verifier_ops
, which is associated in include/uapi/linux/bpf.h
to program type BPF_PROG_TYPE_CGROUP_SOCK_ADDR
. 虽然这可能是混乱的,你可以看到, sock_filter_is_valid_access
内核文件net/core/filter.c
用于cg_sock_verifier_ops
,这是在相关的include/uapi/linux/bpf.h
到类节目BPF_PROG_TYPE_CGROUP_SOCK_ADDR
。 So it refers to programs being used in cgroups to help (containerised) applications to bind and connect their sockets correctly. 因此,它指的是cgroup中用于帮助(容器化)应用程序正确绑定和连接其套接字的程序。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.