• D
    bpf: add event output helper for notifications/sampling/logging · bd570ff9
    Daniel Borkmann 提交于
    This patch adds a new helper for cls/act programs that can push events
    to user space applications. For networking, this can be f.e. for sampling,
    debugging, logging purposes or pushing of arbitrary wake-up events. The
    idea is similar to a43eec30 ("bpf: introduce bpf_perf_event_output()
    helper") and 39111695 ("samples: bpf: add bpf_perf_event_output example").
    
    The eBPF program utilizes a perf event array map that user space populates
    with fds from perf_event_open(), the eBPF program calls into the helper
    f.e. as skb_event_output(skb, &my_map, BPF_F_CURRENT_CPU, raw, sizeof(raw))
    so that the raw data is pushed into the fd f.e. at the map index of the
    current CPU.
    
    User space can poll/mmap/etc on this and has a data channel for receiving
    events that can be post-processed. The nice thing is that since the eBPF
    program and user space application making use of it are tightly coupled,
    they can define their own arbitrary raw data format and what/when they
    want to push.
    
    While f.e. packet headers could be one part of the meta data that is being
    pushed, this is not a substitute for things like packet sockets as whole
    packet is not being pushed and push is only done in a single direction.
    Intention is more of a generically usable, efficient event pipe to applications.
    Workflow is that tc can pin the map and applications can attach themselves
    e.g. after cls/act setup to one or multiple map slots, demuxing is done by
    the eBPF program.
    
    Adding this facility is with minimal effort, it reuses the helper
    introduced in a43eec30 ("bpf: introduce bpf_perf_event_output() helper")
    and we get its functionality for free by overloading its BPF_FUNC_ identifier
    for cls/act programs, ctx is currently unused, but will be made use of in
    future. Example will be added to iproute2's BPF example files.
    Signed-off-by: NDaniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: NAlexei Starovoitov <ast@kernel.org>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    bd570ff9
bpf_trace.c 11.3 KB