blocks|key|1284974|text|内核代码对BPF程序有一个显式调用。例如，我们可以检查Amazon+ENA驱动程序中的XDP钩子|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1284975|xdp_prog+=+READ_ONCE(rx_ring->xdp_bpf_prog);

if+(!xdp_prog)
++++goto+out;

verdict+=+bpf_prog_run_xdp(xdp_prog,+xdp);|code-block|syntax|javascript|1284976|它首先检查是否加载了BPF程序；也就是说，rx_ring->xdp_bpf_prog不是空的。然后以struct+xdf_buff对象作为参数(此处命名为xdp+)运行BPF程序。其余代码处理来自BPF程序的返回代码(verdict)。|style|CODE|1284977|您可以为所有BPF程序类型找到相同的逻辑。|1284978|entityMap|0|LINK|mutability|MUTABLE|url|https://elixir.bootlin.com/linux/v5.18.1/source/drivers/net/ethernet/amazon/ena/ena_netdev.c#L377^0|R|L|0|0|0|L|L|1E|F|25|3|31|7|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@$A|X|B|Y|1|Z]]|C|$]]|$1|D|3|E|5|F|7|10|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|11|8|@$A|12|B|13|K|L]|$A|14|B|15|K|L]|$A|16|B|17|K|L]|$A|18|B|19|K|L]]|9|@]|C|$]]|$1|M|3|N|5|6|7|1A|8|@]|9|@]|C|$]]|$1|O|3|-4|5|6|7|1B|8|@]|9|@]|C|$]]]|P|$Q|$5|R|S|T|C|$U|V]]]]

There's an explicit call to the BPF program from the kernel code. For example, we can check <a href="https://elixir.bootlin.com/linux/v5.18.1/source/drivers/net/ethernet/amazon/ena/ena_netdev.c#L377" rel="nofollow noreferrer">the XDP hook in the Amazon ENA driver</a>:
<pre><code>xdp_prog = READ_ONCE(rx_ring-&gt;xdp_bpf_prog);

if (!xdp_prog)
 goto out;

verdict = bpf_prog_run_xdp(xdp_prog, xdp);
</code></pre>
It first checks if a BPF program is loaded; i.e., <code>rx_ring-&gt;xdp_bpf_prog</code> is not NULL. And it then runs that BPF program with the <code>struct xdf_buff</code> object as argument (named <code>xdp</code> here). The rest of the code handles the return code (<code>verdict</code>) from the BPF program.
You can find the same sort of logic for all BPF program types.

blocks|key|194610|text|皮吉诺的回答很好。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|194611|作为补充，还有一些其他eBPF程序类型，您没有预定义的钩子和调用。例如，对内核中的每个函数都没有明确的调用，在内核中可以附加一个k探头。在这种情况下，可能有一些不同的机制在发挥作用：|194612|当注册一个k探针时，K探针会复制被探测的指令，并将被探测指令的第一个字节替换为断点指令(例如，int3+on+i386和x86_64)。|blockquote|194613|此断点用于将CPU重定向到探测-+这里有更多的细节。这也是在BPF程序附加到k探针的情况下发生的情况。|offset|length|194614|entityMap|0|LINK|mutability|MUTABLE|url|https://www.kernel.org/doc/html/v5.18/trace/kprobes.html#how-does-a-kprobe-work^0|0|0|0|H|8|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|A|$]]|$1|G|3|H|5|6|7|V|8|@]|9|@$I|W|J|X|1|Y]]|A|$]]|$1|K|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

pchaigno's answer is good.
As a complement, there are some other eBPF program types for which you don't have pre-defined hooks and calls. For example, you do not have an explicit call for every function in the kernel where you could attach a kprobe. In such case, some different mechanisms may be at play:
<blockquote>
When a kprobe is registered, Kprobes makes a copy of the probed instruction and replaces the first byte(s) of the probed instruction with a breakpoint instruction (e.g., int3 on i386 and x86_64).
</blockquote>
This breakpoint is used to redirect the CPU to the probe - <a href="https://www.kernel.org/doc/html/v5.18/trace/kprobes.html#how-does-a-kprobe-work" rel="nofollow noreferrer">more details here</a>. This is what happens as well in the case of BPF programs attached to kprobes.

blocks|key|1285023|text|(很好的答案:)作为对重新探测的补充:就像前面说过的那样，它们也可以用int3+(在x86上)代替指令；用gdb来观察是很好的。但是，它们在函数开始时就这样做了；调用的蹦床替换了返回地址。您可以很容易地在一个小的测试程序中看到这一点，它会打印带有或不使用重探针的堆栈。您会注意到堆栈无法正确读取(至少由backtrace(...)读取)。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1285024|通常情况下，复测会很好。但是，请记住，它们篡改堆栈(以一种意外的方式)。至少在使用g%2B%2B时，当被探测的被调用方引发在调用方中处理的异常时，它们会中断异常处理。|1285025|entityMap^0|47|E|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@$9|K|A|L|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|M|8|@]|D|@]|E|$]]|$1|H|3|-4|5|6|7|N|8|@]|D|@]|E|$]]]|I|$]]

Great answers :)
As a complement about retprobes: Like said before, they also work by replacing instructions with int3 (on x86); it is nice to watch with gdb.
However, they do this at the beginning of the function; the called trampoline replaces the return address. You can easily see this in a small test program, which prints the stack with and without the retprobe being active.
You'll notice that the stack cannot be read correctly (at least by <code>backtrace(...)</code>).
Usually, retprobes work well. However, keep in mind that they tamper with the stack (in an unexpected way). At least with g++, they break exception handling when the probed callee raises an exception that is handled in the caller.

I'm new to eBPF, and I know that eBPF is event-driven, which means after we register the hook point, the hook function will be executed when such an event happens. So I wonder how the program can jump to the hook function?

How the triggered event cause the program jump to the hook point?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我是eBPF的新手，我知道eBPF是事件驱动的，这意味着在注册钩点之后，钩子函数将在发生这种事件时被执行。所以我想知道程序怎么能跳到钩子函数？

问触发事件如何导致程序跳转到挂钩点？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问触发事件如何导致程序跳转到挂钩点？EN