ebpf

Why ebpf program inside samples/bpf doesn't work?

由 时光毁灭记忆、已成空白 提交于 2019-12-24 18:31:20
问题 GOAL: write a new ebpf example within samples/bpf directory in the kernel source tree of 4.18.0, compile and execute it. PROBLEM: after compiling it when I run sudo ./mine it just terminates. mine_kern.c #include <uapi/linux/bpf.h> #include <uapi/linux/if_ether.h> #include <uapi/linux/ip.h> #include <linux/in.h> #include <linux/if_packet.h> #include "bpf_helpers.h" int icmp_filter(struct __sk_buff *skb){ int proto = load_byte(skb, ETH_HLEN + offsetof(struct iphdr, protocol)); if(proto ==

with attach_xdp, does flags control the mode?

由 让人想犯罪 __ 提交于 2019-12-24 01:15:30
问题 When I use xdp with eBPF, I figured I could use ip link to set mode. For example, ip link set dev eno1 xdpoffload obj xdp.o sec .text I wanted to know how that xdpoffload or generic or native mode is implemented in the code. So I was looking at other codes and I found something like : attach_xdp(device, fn, flags) I assume flags is the place where the flag for setting mode would go in? It would be great if someone could tell me if it's true and if it is, which numbers I could use to choose

Emulating “tcp” using bind/connect on udp sockets with SO_REUSEPORT?

由 自古美人都是妖i 提交于 2019-12-23 04:59:17
问题 I'm trying to write a comm module in C that can handle connected or unconnected sockets completly transparently. being lazy, I imagined I could bind() / connect() udp sockets to get "one socket per client" using udp and the send() / recv() primitives. the scheme is simple, I have a "server socket" bound on *:PORT with SO_REUSEPORT on which I recvfrom() . from there, I'm creating a new socket with the SO_REUSEPORT socket option and using the 'from' parameter infos to bind() to *:PORT and

BPF: translation of program contexts

由 南楼画角 提交于 2019-12-22 15:36:12
问题 I was looking at the different types of BPF program, and noticed that for different program types the context is being passed differently. Example: For program type BPF_PROG_TYPE_SOCK_OPS , an object of type struct bpf_sock_ops_kern is passed. However, the BPF program of this type takes a reference to struct bpf_sock_ops. Why is it done this way and where is the "translation" from bpf_sock_ops_kern to bpf_sock_ops ? For program type BPF_PROG_TYPE_CGROUP_SKB , an object of type struct sk_buff

Why I'm forced to use raw socket to write ebpf programs with BCC?

由 别说谁变了你拦得住时间么 提交于 2019-12-11 16:45:35
问题 GOAL: write an eBPF packet filter program that doesn't require high privileges. PROBLEM: from what I understood I have to use attach_raw_socket function to attach my filter to an interface. This functions invokes bpf_open_raw_sock libbpf function which open a raw_socket that requires high privileges (https://github.com/iovisor/bcc/blob/10dae9eac33287c1df9e6645933b608c2d2c5640/src/cc/libbpf.c#L674-L678). QUESTION: Is there a way to attach an ebpf filter to another socket type, like SOCK_DGRAM

Argument list too long to when loading an eBPF program via the bpf syscall

由 ↘锁芯ラ 提交于 2019-12-11 06:37:44
问题 I am trying to load an eBPF program via the bpf syscall in Go but am seeing an error returned from the syscall. In order to restrict the problem I am using the following minimal eBPF program, which does nothing: struct task_group {}; The important parts of the Go program are as follows: b, err := ioutil.ReadFile("bpf/bbf_tty.o") if err != nil { fmt.Print(err) } progType := BPF_PROG_TYPE_KPROBE insns := unsafe.Pointer(&b) insnCnt := len(b) lba := struct { progType uint32 pad0 [4]byte insnCnt

golang, ebpf and functions duration

由 一世执手 提交于 2019-12-08 02:01:05
问题 I'm playing with gobpf and have got an issue with calculating a duration of traced user-space function. I use bpf_ktime_get_ns() to read time and then trying to calculate delta, but got enormous numbers, though traced function sleeps just 1 second. Here is the tested C-program, which has a function called "ameba". #include <stdio.h> #include <strings.h> #include <stdlib.h> #include <time.h> #include <unistd.h> char * ameba(char * s1, char * s2); int main(void) { time_t rawtime; struct tm *

golang, ebpf and functions duration

由 梦想的初衷 提交于 2019-12-06 11:54:26
I'm playing with gobpf and have got an issue with calculating a duration of traced user-space function. I use bpf_ktime_get_ns() to read time and then trying to calculate delta, but got enormous numbers, though traced function sleeps just 1 second. Here is the tested C-program, which has a function called "ameba". #include <stdio.h> #include <strings.h> #include <stdlib.h> #include <time.h> #include <unistd.h> char * ameba(char * s1, char * s2); int main(void) { time_t rawtime; struct tm * timeinfo; time(&rawtime); timeinfo = localtime(&rawtime); printf("enter: %s", asctime (timeinfo)); printf

who creates map in BPF

由 与世无争的帅哥 提交于 2019-12-03 08:28:51
After reading man bpf and a few other sources of documentation, I was under impression that a map can be only created by user process. However the following small program seems to magically create bpf map: struct bpf_map_def SEC("maps") my_map = { .type = BPF_MAP_TYPE_ARRAY, .key_size = sizeof(u32), .value_size = sizeof(long), .max_entries = 10, }; SEC("sockops") int my_prog(struct bpf_sock_ops *skops) { u32 key = 1; long *value; ... value = bpf_map_lookup_elem(&my_map, &key); ... return 1; } So I load the program with the kernel's tools/bpf/bpftool and also verify that program is loaded: $

Can eBPF modify the return value or parameters of a syscall?

由 ╄→гoц情女王★ 提交于 2019-11-30 21:33:12
To simulate some behavior I would like to attach a probe to a syscall and modify the return value when certain parameters are passed. Alternatively, it would also be enough to modify the parameters of the function before they are processes. Is this possible with BPF? I believe that attaching eBPF to kprobes/kretprobes gives you read access to function arguments and return values, but that you cannot tamper with them. I am NOT 100% sure; good places to ask for confirmation would be the IO Visor project mailing list or IRC channel (#iovisor at irc.oftc.net). As an alternative solution, I know
订阅 ebpf