ebpf
ebpf copied to clipboard
cilium
ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
We're having problems with our CI, where tests fairly often fail with exit code 42. That error is generated when the VM doesn't output anything and no success file is...
I see failure in running [kprobe example](https://github.com/cilium/ebpf/tree/master/examples/kprobe) for aarch64 kernel version `4.19.113` ``` GOOS=linux GOARCH=arm64 go build -o ebpf-kprobe ./ebpf-kprobe 2021/03/25 22:03:40 error while loading objects: field KprobeExecve: program kprobe_execve:...
Both the FDs need to remain open for the link lifetime. See https://github.com/cilium/ebpf/blob/v0.14.0/link/perf_event.go#L89
[This test](https://github.com/cilium/ebpf/blob/master/link/uprobe_test.go#L338) should pass once this get fixed
**Describe the bug** Currently, the `(*ProgramInfo).MapIDs()`'s bool return value is simply determined by `pi.ids != nil`, `pi.ids` being allocated when `NrMapIds > 0`. The `NrMapIds` field will always be zero...
[LoadPinnedLink](https://github.com/cilium/ebpf/blob/master/link/link.go#L43) doesn't expose [RawLinkInfo](https://github.com/cilium/ebpf/blob/master/link/link.go#L96) like LoadPinnedRawLink (deprecated). The RawLinkInfo already has type, id and programID fields and we can add more type-specific information later to this structure like ifindex for...
As raised by @etherandrius: https://cilium.slack.com/archives/CKC55JL8L/p1618310807065500. Currently, the group prefix for entries in `kprobe_events` is [hardcoded to `ebpf_`](https://github.com/cilium/ebpf/blob/dccbd5364e5b55091d649c1d2a1de0e1b2ff5522/link/kprobe.go#L166), resulting in identifiers like `ebpf_aabbccdd`. This might prove inflexible in some environments where...
Once a user has discovered `bpf2go` they usually need to figure out where to get headers from. We can remove this pain point by shipping common headers via a `go:embed`...
libbpf has added support for weak symbols, which end up in ELF with an STB_WEAK binding. libbpf commits that might be relevant due to mentioning STB_WEAK: - https://github.com/torvalds/linux/commit/166750bc1dd256b2184b22588fb9fe6d3fbb93ae (adds LINUX_KERNEL_VERSION)...
For https://github.com/cilium/cilium/issues/11014, we're looking for a safe and fast way to make decisions in the Cilium code around (BPF-related) kernel features. Currently, we rely on `bpftool` for some things, some...