On 7/22/15 1:10 PM, Michael Kerrisk (man-pages) wrote:
BPF maps are a generic data structure for storage of different
data types. A user process can create multiple maps (with
key/value-pairs being opaque bytes of data) and access them via
file descriptors. Differnt eBPF programs can access the same
maps in parallel. It's up to the user process and eBPF program
to decide what they store inside maps.
typo in 'Different'
eBPF program types
By picking prog_type, the program author selects a set of helper
functions that can be called from the eBPF program and the corre‐
sponding format of struct bpf_context (which is the data blob
passed into the eBPF program as the first argument). For exam‐
ple, programs loaded with a prog_type of
BPF_PROG_TYPE_SOCKET_FILTER may call the bpf_map_lookup_elem()
helper, whereas some other program types may not be able to
employ this helper. The set of functions available to eBPF pro‐
grams of a given type may increase in the future.
overall it's all correct, but today bpf_map_lookup_elem() is allowed
for all program types. May be change that to:
"BPF_PROG_TYPE_KPROBE may call the bpf_probe_read() helper"
since only type_kprobe programs can call it.
type_sockets/type_sched_* cannot.
The bpf_context argument is a pointer to a struct sk_buff.
Programs cannot access the fields of sk_buff directly.
Probably drop last sentence and replace 'sk_buff' with '__sk_buff'
in the first? Or for the first version we can drop both sentences.
The rest looks great. Thank you much!
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
