526 questions
0
votes
0
answers
33
views
Storing a pointer to a MAP entry in a MAP
Is it possible to store a pointer to an MAP entry (PTR_TO_MAP) in another MAP and use it later, potentially in another eBPF program?
If not, what kind of support is needed for this to work?
I am ...
- 896
1
vote
1
answer
45
views
Writing an eBPF bound check using embedded assembly
I have a bound check statement that is optimized by clang and as a result verifier doesn't accept the program. I would like to write it using embedded assembly. I am not sure how to do it. I know that ...
- 896
0
votes
1
answer
69
views
Using kfunc defined in a loadable module by BPF program
I would like to define my own custom kfunc (in a loadable linux kernel module) that I can then use in a bpf program. I think I'm 99% there, but I'm stuck on loading the bpf program with bpftool. What ...
- 25
0
votes
1
answer
216
views
bpf_prog_query(BPF_CGROUP_DEVICE) failed: function not implemented
I am having a nixos system with BPF_SYSCALL disabled with below configurations:
[root@nixos:/sys/fs/cgroup]# zgrep BPF /proc/config.gz
CONFIG_BPF=y
CONFIG_HAVE_EBPF_JIT=y
...
0
votes
0
answers
103
views
eBPF transparent TCP interception and redirection
I am working on a project that will enable TCP traffic tunneling to remote networks and I have a few questions about my approach and specifically about the use of eBPF to transparently intercept ...
- 920
-1
votes
1
answer
58
views
Can only one specific PID be specified for bpf_program__attach_uprobe_opts?
I found that when using bpf_program__attach_uprobe_opts, it can only set one PID. Unless set to -1, it indicates all processes. Is there a way to set multiple PIDs? Or can it only be achieved through ...
- 9
0
votes
1
answer
100
views
Sleepable eBPF/XDP programs
Recently, I've been trying to work with BPF_ARENA. My objective is to use it on XDP programs. However, the following error appears when I try to use bpf_arena_alloc_pages:
program must be sleepable ...
- 71
2
votes
1
answer
146
views
How to write/attach a "device-bound" XDP program so that I can use XDP metadata kfuncs?
I want to use the kfunc bpf_xdp_metadata_rx_hash to get the flow hash in an XDP program as follows:
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
extern int ...
- 442
0
votes
0
answers
57
views
eBPF `bpf_core_read` returns incorrect value
My eBPF program as follows.
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>
#...
- 123
0
votes
1
answer
223
views
eBPF - Polling/waiting for userspace in XDP
In my eBPF XDP program, I want to receive a packet, send some information about the packet to userspace, and wait for a decision on what do to with the packet.
My code looks like this:
while (packet....
- 99
3
votes
0
answers
268
views
BPF custom kfunc : calling kernel function %s is not allowed
I am writing some codes for my thesis using ebpf and I need to create a custom kfunc to call within my bpf program. To do so I started by following the example here https://eunomia.dev/tutorials/43-...
- 31
1
vote
0
answers
175
views
When `BPF(eBPF)` traces the call stack, all user-mode functions are `[unknown]`. Why is this?
Experimental environment
┌──[[email protected]]-[/usr/share/bcc/tools]
└─$hostnamectl
Static hostname: vms99.liruilongs.github.io
Icon name: computer-vm
Chassis: ...
- 108
0
votes
2
answers
687
views
How to create a new kfunc and pass an entry from an eBPF map to it as an argument?
I am exploring kfunc feature of eBPF. I was wondering if it is possible to pass a pointer acquired from a map (e.g, an array) to a function I define in a custom kernel module which I mark as kfunc? I ...
- 896
0
votes
1
answer
134
views
How to retrieve a specific value from a structure in function arguments in an eBPF uprobe
I'm working on some eBPF and Redis-related tasks. However, I've run into some difficulties. When I attach a uprobe to the processCommand function in Redis, I want to retrieve some values from the ...
- 3
2
votes
1
answer
1k
views
How to use dynamic layers in yocto?
I am new to Yocto. I am using Yocto scarthgap release and have cloned poky. I wanted to add support for bcc and bpftrace, hence trying to add meta-clang layer.
The layer shows up for me
$ bitbake-...
- 8,378
2
votes
1
answer
480
views
How eBPF stack works
I am currently creating a XDP program where I have a bunch of function calls and, as such, the stack gets fuller as the program is executed.
However, I am confused as to how the stack size is measured....
- 71
1
vote
1
answer
228
views
Why does the verifier detect an infinite loop in this code?
This is my program:
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
struct
{
__uint(type, BPF_MAP_TYPE_ARRAY);
__type(key, __u32);
__type(value, __u64);
__uint(...
- 31
0
votes
1
answer
137
views
How to bpf_prog_test_run_opts to a program that extends xdp_dispatcher
This is somewhat a follow-up question from another post.
In the previous post, I had a problem where bpf_prog_test_run_opts would return errno 524 ENOTSUPP. From what I understood, it was due to the ...
- 71
0
votes
1
answer
105
views
Is there a BPF_MAP_LOOKUP_AND_UPDATE_ELEM syscall similar to BPF_MAP_LOOKUP_AND_DELETE_ELEM?
I would like to know if there is a syscall which can be used through libbpf to lookup a map and also update the contents of the map. My use case is to lookup and update an map type of ...
0
votes
1
answer
298
views
Is there a way to safely update an eBPF map with a spin lock held in the ebpf program?
I want to update an eBPF map in the code region where a spin lock on a different map is held.The user space code continuously polls for this map, so I don't want a map whose values are partially ...
0
votes
0
answers
177
views
How to uniquely identify uprobes when targeting multi threaded applications
I have an eBPF application that hooks malloc and mmap (via uprobes). The application targets a specific target application and as a result I do PID filtering using bpf_get_ns_current_pid_tgid (...
- 11
1
vote
1
answer
252
views
eBPF function with void return type : verifier question
I ran a sample ebpf code with void as return type and calling bpf_printk before returning. I was expecting this code to be rejected by the verifier. However, I was able to successfully load it into ...
- 89
0
votes
0
answers
74
views
My professor wanted me to use eBPF to find how the 802.11x WiFI headers are added on the device from the system what should I do here?
I reconfigured the kernel and made the enviroment ready, now how can I trace a certain source code function from a certain subset mac80211x?
Lets say I want to trace a function puts_wifi_header which ...
1
vote
0
answers
50
views
Kernel verifier complains when copying multiple UDP payload segments
I´m trying to implement a XDP/eBPF program that modifies the ingress packet in such a way that only application-relevant parts of UDP payload are kept from the ingress packet and forwarded to the ...
- 11
0
votes
0
answers
164
views
Detect and capture openconnect traffic using eBPF/XDP
I'm new to networking. I'm also learning the usage of eBPF. Currently I'm working on a project where I've to capture the inner packet of a openconnect traffic. This is my code:
https://github.com/...
- 857