mirror of https://github.com/mkerrisk/man-pages
bpf.2: Use cBPF/eBPF consistently in the text
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
This commit is contained in:
Michael Kerrisk
parent
896388c88a
commit
54513c009c
40
man2/bpf.2
40
man2/bpf.2
|
|
@ -37,12 +37,12 @@ The
|
|||
system call performs a range of operations related to extended
|
||||
Berkeley Packet Filters.
|
||||
Extended BPF (or eBPF) is similar to
|
||||
the original BPF (or classic BPF) used to filter network packets.
|
||||
For both BPF and eBPF programs,
|
||||
the original ("classic") BPF (cBPF) used to filter network packets.
|
||||
For both cBPF and eBPF programs,
|
||||
the kernel statically analyzes the programs before loading them,
|
||||
in order to ensure that they cannot harm the running system.
|
||||
.P
|
||||
eBPF extends classic BPF in multiple ways including the ability to call
|
||||
eBPF extends cBPF in multiple ways including the ability to call
|
||||
in-kernel helper functions (via the
|
||||
.B BPF_CALL
|
||||
opcode extension provided by eBPF)
|
||||
|
|
@ -59,29 +59,29 @@ just-in-time compiled into native code.
|
|||
BPF maps are a generic data structure for storage of different data types.
|
||||
A user process can create multiple maps (with key/value-pairs being
|
||||
opaque bytes of data) and access them via file descriptors.
|
||||
BPF programs can access maps from inside the kernel in parallel.
|
||||
It's up to the user process and BPF program to decide what they store
|
||||
eBPF programs can access maps from inside the kernel in parallel.
|
||||
It's up to the user process and eBPF program to decide what they store
|
||||
inside maps.
|
||||
.P
|
||||
BPF programs are similar to kernel modules.
|
||||
eBPF programs are similar to kernel modules.
|
||||
They are loaded by the user
|
||||
process and automatically unloaded when the process exits.
|
||||
Each BPF program is a set of instructions that is safe to run until
|
||||
Each program is a set of instructions that is safe to run until
|
||||
its completion.
|
||||
The in-kernel BPF verifier statically determines that the program
|
||||
An in-kernel verifier statically determines that the eBPF program
|
||||
terminates and is safe to execute.
|
||||
During verification, the kernel increments reference counts for each of
|
||||
the maps that the eBPF program uses,
|
||||
so that the selected maps cannot be removed until the program is unloaded.
|
||||
|
||||
BPF programs can be attached to different events.
|
||||
eBPF programs can be attached to different events.
|
||||
.\" FIXME: In the next sentence , "packets" are not "events". What
|
||||
.\" do you really mean to say here? ("the arrival of a network packet"?)
|
||||
These events can be packets, tracing
|
||||
events, and other types that may be added in the future.
|
||||
A new event triggers execution of the BPF program, which
|
||||
A new event triggers execution of the eBPF program, which
|
||||
may store information about the event in the maps.
|
||||
Beyond storing data, BPF programs may call a fixed set of
|
||||
Beyond storing data, eBPF programs may call a fixed set of
|
||||
in-kernel helper functions.
|
||||
The same program can be attached to multiple events and different programs can
|
||||
access the same map:
|
||||
|
|
@ -126,7 +126,7 @@ Look up an element by key in a specified map and return the key
|
|||
of the next element.
|
||||
.TP
|
||||
.B BPF_PROG_LOAD
|
||||
Verify and load a BPF program.
|
||||
Verify and load an eBPF program.
|
||||
.PP
|
||||
The
|
||||
.I attr
|
||||
|
|
@ -518,7 +518,7 @@ be deleted automatically.
|
|||
.B BPF_PROG_LOAD
|
||||
The
|
||||
.B BPF_PROG_LOAD
|
||||
command is used to load an extended BPF program into the kernel.
|
||||
command is used to load an eBPF program into the kernel.
|
||||
|
||||
.in +4n
|
||||
.nf
|
||||
|
|
@ -562,7 +562,7 @@ enum bpf_prog_type {
|
|||
By picking
|
||||
.IR prog_type ,
|
||||
the program author selects a set of helper functions that can be called from
|
||||
the BPF program and the corresponding format of
|
||||
the eBPF program and the corresponding format of
|
||||
.I struct bpf_context
|
||||
(which is the data blob passed into the program as the first argument).
|
||||
For example, programs loaded with
|
||||
|
|
@ -573,7 +573,7 @@ may call the
|
|||
.BR bpf_map_lookup_elem ()
|
||||
helper,
|
||||
whereas some future program types may not.
|
||||
The set of functions available to BPF programs of a given type may increase
|
||||
The set of functions available to eBPF programs of a given type may increase
|
||||
in the future.
|
||||
|
||||
Currently, the set of functions for
|
||||
|
|
@ -655,10 +655,10 @@ not provide a log.
|
|||
.RE
|
||||
.TP
|
||||
.B close(prog_fd)
|
||||
will unload the BPF program.
|
||||
will unload the eBPF program.
|
||||
.P
|
||||
Maps are accessible from BPF programs and are used to exchange data between
|
||||
BPF programs and between BPF programs and user-space programs.
|
||||
Maps are accessible from eBPF programs and are used to exchange data between
|
||||
eBPF programs and between eBPF programs and user-space programs.
|
||||
Programs process various events (like kprobe, packets) and
|
||||
store their data into maps.
|
||||
User-space programs fetch data from the maps.
|
||||
|
|
@ -776,7 +776,7 @@ For a successful call, the return value depends on the operation:
|
|||
The new file descriptor associated with the BPF map.
|
||||
.TP
|
||||
.B BPF_PROG_LOAD
|
||||
The new file descriptor associated with the BPF program.
|
||||
The new file descriptor associated with the eBPF program.
|
||||
.TP
|
||||
All other commands
|
||||
Zero.
|
||||
|
|
@ -836,7 +836,7 @@ For
|
|||
.BR BPF_PROG_LOAD,
|
||||
indicates an attempt to load an invalid program.
|
||||
BPF programs can be deemed
|
||||
invalid due to unrecognized instructions, the use of reserved fields, jumps
|
||||
einvalid due to unrecognized instructions, the use of reserved fields, jumps
|
||||
out of range, infinite loops or calls of unknown functions.
|
||||
.TP
|
||||
.BR EACCES
|
||||
|
|
|
|||
Loading…
Reference in New Issue