I found the tricks here. it is BPF_LD_ABS instruction.
On 2023/1/18 09:26, dongdwdw wrote:
Hi,
Hi Experts,
I am reading ebpf sample code recently. When I read socketx2_kern.c
socketx2_user.c, I got a question here.
__u64 proto = load_half(skb, 12);
I can not understand here: It means load 2 bytes from 12th bytes of
skb address ( it is a pointer of struct__skb_buff ).
struct __sk_buff {
__u32 len;
__u32 pkt_type;
__u32 mark;
__u32 queue_mapping;
__u32 protocol;
__u32 vlan_present;
__u32 vlan_tci;
__u32 vlan_proto;
******
}
But I found the structure as above. So the reading start point should
be at queue_mapping. But it actually reads protocol info here. *And I
did found the result is protocol info*. Why?
The v*alue of pkt_type, mark, and queue_mapping are all 0.* But when
to read starting from queue_mapping's offset, the info is about
protocol. It is a little tricky to me. I can not understand this. From
my pointview, the protocol info should start at 16 bytes.
Is there any background that is hidden from me? I search a lot and
cannot find any detailed info about this. Please help explain this.
Thanks so much.
