836 questions
- Bountied 0
- Unanswered
- Frequent
- Score
- Trending
- Week
- Month
- Unanswered (my tags)
-1
votes
0
answers
20
views
Share data between eBPF program and userspace for network load balancing [closed]
I'm learning eBPF and I want to use it for connection load balancing. Let's say I have two threads sharing the same socket with SO_REUSEPORT and SO_ATTACH_REUSEPORT_EBPF. I managed to attach an eBPF ...
0
votes
0
answers
48
views
eBPF XDP - how to attach a bfp program to a interface - bpf_xdp_attach is undefined
I wrote an XDP program in C that saves every packet, except some blocked ones, into a ring buffer map, which is sent to userspace. I also made an xdp_loader program in C++ that loads the XDP program ...
2
votes
1
answer
46
views
BPF_LINK_CREATE with BPF_LINK_TYPE_XDP + target_ifindex returns -EINVAL
BPF_LINK_CREATE with BPF_LINK_TYPE_XDP + target_ifindex returns -EINVAL on Ubuntu 24.04 HWE (6.14.0-36-generic, i40e).
Documentation
I’m trying to attach an XDP program to a NIC using BPF_LINK_CREATE ...
1
vote
0
answers
52
views
TLS Handshake disappearing when modifying it with eBPF (TC egress)
I have two k8s pods that communicate using TLS. I am loading an eBPF TC code on the egress of the sender pod. This code adds 28 bytes to the optional space of the TCP headers after TCP options. If I ...
0
votes
1
answer
143
views
Manual strstr implementation in eBPF on kernel level
I am trying to implement a manual implementation of strstr in eBPF but cannot get past verifier.
Before starting, I know there is an existing bpf_strstr() implementation, but it's on 6.17+ linux ...
1
vote
1
answer
37
views
BPF LSM: bpf_task_storage_get expects a trusted pointer
I'm working on an LSM BPF program and running into an issue with bpf_task_storage_get. Here’s a minimal example that works:
struct provenance_structure {
__u8 to_trace;
struct bpf_spin_lock ...
1
vote
1
answer
100
views
How to get parent process full path in sched_process_fork tracepoint using ebpf?
Below is the code attached to sched_process_fork tracepoint for tracking process forks.
// fork.bpf.c
// clang -O2 -target bpf -c fork.bpf.c -o fork.bpf.o
#include <linux/bpf.h>
#include <...
0
votes
0
answers
40
views
Storing a pointer to a MAP entry in a MAP
Is it possible to store a pointer to an MAP entry (PTR_TO_MAP) in another MAP and use it later, potentially in another eBPF program?
If not, what kind of support is needed for this to work?
I am ...
2
votes
0
answers
419
views
bpftool missing from linux-tools-6.14.0-32-generic package on Ubuntu 24.04 LTS [closed]
I'm running Ubuntu 24.04 LTS with kernel 6.14.0-32-generic and trying to use bpftool for eBPF dev. After some struggling in setting up, I realized that the linux-tools-6.14.0-32-generic package is ...
1
vote
1
answer
54
views
Writing an eBPF bound check using embedded assembly
I have a bound check statement that is optimized by clang and as a result verifier doesn't accept the program. I would like to write it using embedded assembly. I am not sure how to do it. I know that ...
-4
votes
1
answer
54
views
Can we attach a ebpf program after tcp reordering? What mechanism should we use any ready examples folks?
Can we attach a ebpf program after tcp reordering? What mechanism should we use any ready examples folks?
We tried at tc level but see problems of packets not being ordered/assembled as expected!
...
1
vote
1
answer
147
views
How to collect filename from eBPF hook while file is creating?
Can somebody help me with retrieving name of file using eBPF when file is creating?
What I’ve done:
We have 2 funcs (helper and Kfunc) for collecting filepath from struct path:
bpf_d_path & ...
2
votes
0
answers
125
views
L1d Cache miss and L1d cache ref counts are way off as shown by perf stat
Wrote an eBPF code to count cache refs and miss of a target process. The program seems to work, albeit the counts dont match even closely to the perf stat output. I am assuming there is some issue ...
2
votes
1
answer
91
views
ebpf helper func "bpf_probe_write_user" return error (-14)
I was attempting Experiment 2 specified on the site, which involves modifying the first parameter (the file path of the executed program) in the sys_enter_execvfunction. However, when I called ...
0
votes
0
answers
49
views
Matching uretprobe to uprobe
I was trying to write a simple bpftrace script to check if (Tcl) functions call themselves recursively and I got unexpected results. To investigate, I simplified the script to:
uprobe:/usr/lib64/...