我觀察到,如果我在尾部程序中寫(xiě)入環(huán)形緩沖區(qū)并從用戶空間讀取環(huán)形緩沖區(qū),尾部程序最終會(huì)被刪除。尾部程序不再出現(xiàn)在bpftool prog. bpftool map dump name jump_table說(shuō)它Found 0 elements;它最初有 1 個(gè)元素,尾部程序。這個(gè) BPF 程序由main_prog調(diào)用一個(gè)尾部程序組成。尾部程序?qū)懭?環(huán)形緩沖區(qū)。#include <linux/bpf.h>#include <bpf/bpf_helpers.h>struct bpf_map_def SEC("maps") flow_ring_buf = { .type = BPF_MAP_TYPE_RINGBUF, .max_entries = 1<<12};struct bpf_map_def SEC("maps") jump_table = { .type = BPF_MAP_TYPE_PROG_ARRAY, .key_size = sizeof(__u32), .value_size = sizeof(__u32), .max_entries = 1,};SEC("xdp")int main_prog(struct xdp_md *ctx) { bpf_tail_call(ctx, &jump_table, 0); bpf_printk("Tail call failed"); return XDP_PASS;}SEC("xdp_2")int tail_prog(struct xdp_md *ctx) { __u32 num = 0; bpf_ringbuf_output(&flow_ring_buf, &num, sizeof(__u32), 0); return XDP_PASS;}char _license[] SEC("license") = "GPL";這個(gè) Go 程序加載程序和映射并從環(huán)形緩沖區(qū)讀?。簆ackage mainimport "C"import ( "errors" "github.com/cilium/ebpf" "github.com/cilium/ebpf/ringbuf" "github.com/vishvananda/netlink" "log")type bpfObjects struct { MainProg *ebpf.Program `ebpf:"main_prog"` TailProg *ebpf.Program `ebpf:"tail_prog"` JumpTable *ebpf.Map `ebpf:"jump_table"` FlowRingBuf *ebpf.Map `ebpf:"flow_ring_buf"`}func main() { var objects bpfObjects spec, err := ebpf.LoadCollectionSpec("test.o") if err != nil { log.Fatalln("ebpf.LoadCollectionSpec", err) } if err := spec.LoadAndAssign(&objects, nil); err != nil { log.Fatalln("ebpf.LoadAndAssign", err) } // Update the jump table with the tail prog if err = objects.JumpTable.Update(uint32(0), uint32(objects.TailProg.FD()), ebpf.UpdateAny); err != nil { log.Fatalln("Update prog_array", err) } link, err := netlink.LinkByName("enp0s8") if err != nil { log.Fatalln("netlink.LinkByName", err) }當(dāng)我向接口發(fā)送流量時(shí)遇到了問(wèn)題。reader.Read()從不返回錯(cuò)誤并且返回的Record對(duì)象有0. 因?yàn)樘D(zhuǎn)表是空的,所以尾調(diào)用失敗,我bpf_printk在內(nèi)核日志中看到了輸出。如果注釋掉下面的代碼A并將其替換為無(wú)限等待,例如select {},我不會(huì)遇到問(wèn)題
從環(huán)形緩沖區(qū)讀取時(shí)刪除 BPF 尾部程序
千萬(wàn)里不及你
2022-11-08 16:28:55