4 ms·

EBPF is honestly the first thing to try before writing a module. I'm glad to see you used a VM. That's the first step in the right direction. Others have men

EBPF is honestly the first thing to try before writing a module. I'm glad to see you used a VM. That's the first step in the right direction. Others have mentioned that you should've used printk(), which is true. I'll mention that you can also run the kernel in a debugger: https://www.kernel.org/doc/html/latest/dev-tools/gdb-kernel-debugging.html https://www.kernel.org/doc/html/latest/dev-tools/gdb-kernel-...

ksml 6y ago
I hadn't considered eBPF because I needed some pretty obscure information from the kernel internals (i.e. the addresses of the `struct file`s) and I didn't realize eBPF was as capable as it is. Another commenter suggested trying it, though, so I'm checking it out now! I did use printk for debugging, but I (incorrectly) assumed it could block. Another commenter pointed out that this is not the case. TIL! The gdb link looks very helpful and I'll try that next time. Thanks for linking that.
- PeterCorless 6y ago
  Yeah, my mind immediately went to eBPF too. "But when BPF got extended, it allowed users to add code that is executed by the kernel in a safe manner in various points of its execution, not only in the network code." Read more here: https://thenewstack.io/how-io_uring-and-ebpf-will-revolutionize-programming-in-linux/ https://thenewstack.io/how-io_uring-and-ebpf-will-revolution...
wolfgang42 6y ago
Where would you look for a list of what you can do with eBPF and how? (I think maybe I’m searching for a list of hook points?) I keep seeing tantalizing hints about all of the things it lets you do, but the tutorials I’ve seen only seem to cover networking and tracing. (The project I have in mind at the moment is making a bindfs-like filesystem without FUSE, but I’ve had a few different ideas where eBPF seemed like it might have been a good fit if I could figure it out.)
- lallysingh 6y ago
  There are 1-2 good books on it. I've skimmed them via O'reilly Safari when I needed something in the past.
- dmitris 6y ago
  https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md https://github.com/iovisor/bcc/blob/master/docs/reference_gu... lists the hook points where BPF code can be attached. Also take a look at https://blogs.oracle.com/linux/notes-on-bpf-1 https://blogs.oracle.com/linux/notes-on-bpf-1 (there are follow-ups - https://blogs.oracle.com/linux/notes-on-bpf-7 https://blogs.oracle.com/linux/notes-on-bpf-7 has the links at the bottom) and from the Linux source, https://github.com/torvalds/linux/blob/master/include/uapi/linux/bpf.h#L162-L202 https://github.com/torvalds/linux/blob/master/include/uapi/l.... https://docs.cilium.io/en/latest/bpf/ https://docs.cilium.io/en/latest/bpf/ is an extensive reference but with an emphasis on the network-related areas (xdp, tc).

ksml 6y ago

I hadn't considered eBPF because I needed some pretty obscure information from the kernel internals (i.e. the addresses of the `struct file`s) and I didn't realize eBPF was as capable as it is. Another commenter suggested trying it, though, so I'm checking it out now! I did use printk for debugging, but I (incorrectly) assumed it could block. Another commenter pointed out that this is not the case. TIL! The gdb link looks very helpful and I'll try that next time. Thanks for linking that.

PeterCorless 6y ago
Yeah, my mind immediately went to eBPF too. "But when BPF got extended, it allowed users to add code that is executed by the kernel in a safe manner in various points of its execution, not only in the network code." Read more here: https://thenewstack.io/how-io_uring-and-ebpf-will-revolutionize-programming-in-linux/ https://thenewstack.io/how-io_uring-and-ebpf-will-revolution...

wolfgang42 6y ago

Where would you look for a list of what you can do with eBPF and how? (I think maybe I’m searching for a list of hook points?) I keep seeing tantalizing hints about all of the things it lets you do, but the tutorials I’ve seen only seem to cover networking and tracing. (The project I have in mind at the moment is making a bindfs-like filesystem without FUSE, but I’ve had a few different ideas where eBPF seemed like it might have been a good fit if I could figure it out.)

lallysingh 6y ago
There are 1-2 good books on it. I've skimmed them via O'reilly Safari when I needed something in the past.
dmitris 6y ago
https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md https://github.com/iovisor/bcc/blob/master/docs/reference_gu... lists the hook points where BPF code can be attached. Also take a look at https://blogs.oracle.com/linux/notes-on-bpf-1 https://blogs.oracle.com/linux/notes-on-bpf-1 (there are follow-ups - https://blogs.oracle.com/linux/notes-on-bpf-7 https://blogs.oracle.com/linux/notes-on-bpf-7 has the links at the bottom) and from the Linux source, https://github.com/torvalds/linux/blob/master/include/uapi/linux/bpf.h#L162-L202 https://github.com/torvalds/linux/blob/master/include/uapi/l.... https://docs.cilium.io/en/latest/bpf/ https://docs.cilium.io/en/latest/bpf/ is an extensive reference but with an emphasis on the network-related areas (xdp, tc).