Stack Overflow
Stack Overflow

Questions tagged [libbpf]

53 questions
1
vote
0 answers

Read highmemory page address in a BPF program

Could someone provide a replacement for kmap_load_page(page) or kmap_atomic(page) so that page memory can be read with an offset, i.e. how can the following be done in the BPF program? struct request *req; struct bio *bio = req->bio; struct bio_vec…
randomcoder
  • 11
  • 2
1
vote
2 answers

how to access to bpf map which was made by user program in the kernel program (kernel context)?

Let's suppose there are two programs (User program and Kernel program). User program made bpf map by api bpf_create_map_name() and it returns fd. With this fd, I can access the map by syscalls (e.g., bpf_map_update(fd, ..)). But I can do this only…
Dusol
  • 47
  • 8
1
vote
1 answer

Unable to fetch data using bpf_map_lookup_elem()

I am trying to write a code for XDP where a user space program will populate a bpf map and then later the Kernel will look into the map. For creating the map I have added a SEC(".maps") in the bpf_obj file that will get loaded into the kernel.…
Rishab
  • 73
  • 4
0
votes
0 answers

managing bpf links in uprobe handler with multiple target functions and links

Requirement is attaching tmultiple target functions for the same uprobe handler. With bpftool generated skeleton code, attaching uprobe gives multiple links but skeleton data structure doesn't have prior information. how to manage this with skeleton…
nullptr
  • 5
  • 3
0
votes
0 answers

use ringbuf and perfbuf depending on kernel version dynamically

We are trying to support older kernel version with perf_buff vs. also newer kernel version with ring_buff. With some kernel guarding, we could try to compile time. We wanted to have BPF_CORE feature to avoid different kernel version maintenance…
nullptr
  • 5
  • 3
0
votes
2 answers

atomic operations in bpf kernel program (does bpf support linux kernel native atomic operations)

Does bpf support atomic_t and atomic_{add,inc,read} variants of linux kernel. Variable gets modified by diff bpf kernel handler. Tried following kernel bpf, some compiler error which i dont understand. Any limitations are there on bpf atomic…
nullptr
  • 5
  • 3
0
votes
0 answers

Use bpf_program__attach_uprobe() API multiple times with the same program instance, but different target functions

We are trying to port an existing bcc solution to libbpf + c. The problem is we need to support older kernels too i.e. at least 5.5. Functionality: uprobe for user executable with function pattern etc i.e. need bpf_program__attach_uprobe_multi …
nullptr
  • 5
  • 3
0
votes
1 answer

eBPF: Properly passing fixed length strings from userspace using eBPF array maps

I have a BPF_MAP_TYPE_ARRAY map that stores instances of this struct: struct target_d_name { unsigned long int len; char name[PID_LEN_MAX]; //PID_LEN_MAX = 8, it is a macro }; Here is the map definition: struct { …
vykt
  • 3
  • 2
0
votes
1 answer

libbpf: Error in bpf_create_map_xattr(flow_table):Invalid argument(-22). Retrying without BTF

I am trying to use BPF_MAP_TYPE_ARRAY for tracking new connections and want to maintain a map with tuples and new connection details. I am using libbpf framework However, the map creation does not work when either of the key or value is a…
hundredmiles
  • 61
  • 6
0
votes
0 answers

sockmap/sockhash redirection increases memory consumption

I created a POC based on the blog post from cloudflare SOCKMAP - TCP splicing of the future. In the meanwhile I refactored my redirection to bpf_sk_redirect_hash I use iperf and sar to measure the performance/load on the system. What I notice, if…
Joerg-Christian Boehme
  • 1
  • 2
0
votes
0 answers

How can I simulate the ring_buffer__add functionality when using a perf buffer?

In multiple eBPF programs, we might define a separate perf event buffer map for each one, similar to a ring buffer. Each of these perf event buffer maps would then have its own map file descriptor (fd). In user space, we interact with these maps…
Chen
  • 1
  • 1
0
votes
0 answers

how attach only specific bpf kernel programs (with skeleton code)

I understand how to attach specific bpf kernel program using libbpf code. user space program has total control on programs and maps etc. but how to achieve the same with Auto generated boilerplate bpf code i.e xxx_bpf_attach. use case , attach only…
nullptr
  • 5
  • 3
0
votes
1 answer

how to deal with this libbpf: Error in bpf_create_map_xattr(queue_map):Invalid argument(-22)

I use libbpf write a bpf program to watch the file open action. I used BPF_MAP_TYPE_QUEUE to pass the pathname. It seem worked, but not normally. libbpf: elf: skipping unrecognized data section(8) .rodata.str1.16 libbpf: elf: skipping unrecognized…
deadpool
  • 3
  • 1
0
votes
0 answers

Sending data from BPF to user space side and waiting for it's analysis result

I'm currently trying to write a fanotify wannabe program using libbpf + bpf LSM hooks. What I'm trying to achieve here is to intercept a LSM event(for example lsm.s/file_open) and to send event data to user space side. On user-side I'd do some…
egorbigboss
  • 1
  • 1
0
votes
1 answer

How to get the entire skb data content instead of the address in eBPF/libbpf?

I'm writing code in libbpf to get the entire data packet content (not address) by funtion bpf_probe_read_kernel. For example, bpf_probe_read_kernel(my_struct, 512, skb->data); But there's an error: invalid mem access 'inv' which probably tells me…
Vic
  • 1
1
2
3 4