LDP
/
man-pages
mirror of https://github.com/mkerrisk/man-pages
0
1
Fork 0
Code Releases Activity

bpf.2: Use cBPF/eBPF consistently in the text 

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
This commit is contained in:
Michael Kerrisk 2015-06-04 13:11:19 +02:00
parent 896388c88a
commit 54513c009c
1 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
man2/bpf.2
View File

@ -37,12 +37,12 @@ The
system call performs a range of operations related to extended system call performs a range of operations related to extended
Berkeley Packet Filters. Berkeley Packet Filters.
Extended BPF (or eBPF) is similar to Extended BPF (or eBPF) is similar to
the original BPF (or classic BPF) used to filter network packets. the original ("classic") BPF (cBPF) used to filter network packets.
For both BPF and eBPF programs, For both cBPF and eBPF programs,
the kernel statically analyzes the programs before loading them, the kernel statically analyzes the programs before loading them,
in order to ensure that they cannot harm the running system. in order to ensure that they cannot harm the running system.
.P .P
eBPF extends classic BPF in multiple ways including the ability to call eBPF extends cBPF in multiple ways including the ability to call
in-kernel helper functions (via the in-kernel helper functions (via the
.B BPF_CALL .B BPF_CALL
opcode extension provided by eBPF) opcode extension provided by eBPF)
@ -59,29 +59,29 @@ just-in-time compiled into native code.
BPF maps are a generic data structure for storage of different data types. BPF maps are a generic data structure for storage of different data types.
A user process can create multiple maps (with key/value-pairs being A user process can create multiple maps (with key/value-pairs being
opaque bytes of data) and access them via file descriptors. opaque bytes of data) and access them via file descriptors.
BPF programs can access maps from inside the kernel in parallel. eBPF programs can access maps from inside the kernel in parallel.
It's up to the user process and BPF program to decide what they store It's up to the user process and eBPF program to decide what they store
inside maps. inside maps.
.P .P
BPF programs are similar to kernel modules. eBPF programs are similar to kernel modules.
They are loaded by the user They are loaded by the user
process and automatically unloaded when the process exits. process and automatically unloaded when the process exits.
Each BPF program is a set of instructions that is safe to run until Each program is a set of instructions that is safe to run until
its completion. its completion.
The in-kernel BPF verifier statically determines that the program An in-kernel verifier statically determines that the eBPF program
terminates and is safe to execute. terminates and is safe to execute.
During verification, the kernel increments reference counts for each of During verification, the kernel increments reference counts for each of
the maps that the eBPF program uses, the maps that the eBPF program uses,
so that the selected maps cannot be removed until the program is unloaded. so that the selected maps cannot be removed until the program is unloaded.
BPF programs can be attached to different events. eBPF programs can be attached to different events.
.\" FIXME: In the next sentence , "packets" are not "events". What .\" FIXME: In the next sentence , "packets" are not "events". What
.\" do you really mean to say here? ("the arrival of a network packet"?) .\" do you really mean to say here? ("the arrival of a network packet"?)
These events can be packets, tracing These events can be packets, tracing
events, and other types that may be added in the future. events, and other types that may be added in the future.
A new event triggers execution of the BPF program, which A new event triggers execution of the eBPF program, which
may store information about the event in the maps. may store information about the event in the maps.
Beyond storing data, BPF programs may call a fixed set of Beyond storing data, eBPF programs may call a fixed set of
in-kernel helper functions. in-kernel helper functions.
The same program can be attached to multiple events and different programs can The same program can be attached to multiple events and different programs can
access the same map: access the same map:
@ -126,7 +126,7 @@ Look up an element by key in a specified map and return the key
of the next element. of the next element.
.TP .TP
.B BPF_PROG_LOAD .B BPF_PROG_LOAD
Verify and load a BPF program. Verify and load an eBPF program.
.PP .PP
The The
.I attr .I attr
@ -518,7 +518,7 @@ be deleted automatically.
.B BPF_PROG_LOAD .B BPF_PROG_LOAD
The The
.B BPF_PROG_LOAD .B BPF_PROG_LOAD
command is used to load an extended BPF program into the kernel. command is used to load an eBPF program into the kernel.
.in +4n .in +4n
.nf .nf
@ -562,7 +562,7 @@ enum bpf_prog_type {
By picking By picking
.IR prog_type , .IR prog_type ,
the program author selects a set of helper functions that can be called from the program author selects a set of helper functions that can be called from
the BPF program and the corresponding format of the eBPF program and the corresponding format of
.I struct bpf_context .I struct bpf_context
(which is the data blob passed into the program as the first argument). (which is the data blob passed into the program as the first argument).
For example, programs loaded with For example, programs loaded with
@ -573,7 +573,7 @@ may call the
.BR bpf_map_lookup_elem () .BR bpf_map_lookup_elem ()
helper, helper,
whereas some future program types may not. whereas some future program types may not.
The set of functions available to BPF programs of a given type may increase The set of functions available to eBPF programs of a given type may increase
in the future. in the future.
Currently, the set of functions for Currently, the set of functions for
@ -655,10 +655,10 @@ not provide a log.
.RE .RE
.TP .TP
.B close(prog_fd) .B close(prog_fd)
will unload the BPF program. will unload the eBPF program.
.P .P
Maps are accessible from BPF programs and are used to exchange data between Maps are accessible from eBPF programs and are used to exchange data between
BPF programs and between BPF programs and user-space programs. eBPF programs and between eBPF programs and user-space programs.
Programs process various events (like kprobe, packets) and Programs process various events (like kprobe, packets) and
store their data into maps. store their data into maps.
User-space programs fetch data from the maps. User-space programs fetch data from the maps.
@ -776,7 +776,7 @@ For a successful call, the return value depends on the operation:
The new file descriptor associated with the BPF map. The new file descriptor associated with the BPF map.
.TP .TP
.B BPF_PROG_LOAD .B BPF_PROG_LOAD
The new file descriptor associated with the BPF program. The new file descriptor associated with the eBPF program.
.TP .TP
All other commands All other commands
Zero. Zero.
@ -836,7 +836,7 @@ For
.BR BPF_PROG_LOAD, .BR BPF_PROG_LOAD,
indicates an attempt to load an invalid program. indicates an attempt to load an invalid program.
BPF programs can be deemed BPF programs can be deemed
invalid due to unrecognized instructions, the use of reserved fields, jumps einvalid due to unrecognized instructions, the use of reserved fields, jumps
out of range, infinite loops or calls of unknown functions. out of range, infinite loops or calls of unknown functions.
.TP .TP
.BR EACCES .BR EACCES