Hacker News Reader

Comment by lallysingh | Hacker News Reader

EBPF is honestly the first thing to try before writing a module.

I'm glad to see you used a VM. That's the first step in the right direction. Others have mentioned that you should've used printk(), which is true.

I'll mention that you can also run the kernel in a debugger: https://www.kernel.org/doc/html/latest/dev-tools/gdb-kernel-...

View on HN

I hadn't considered eBPF because I needed some pretty obscure information from the kernel internals (i.e. the addresses of the `struct file`s) and I didn't realize eBPF was as capable as it is. Another commenter suggested trying it, though, so I'm checking it out now!

I did use printk for debugging, but I (incorrectly) assumed it could block. Another commenter pointed out that this is not the case. TIL!

The gdb link looks very helpful and I'll try that next time. Thanks for linking that.

Yeah, my mind immediately went to eBPF too.

"But when BPF got extended, it allowed users to add code that is executed by the kernel in a safe manner in various points of its execution, not only in the network code."

Where would you look for a list of what you can do with eBPF and how? (I think maybe I’m searching for a list of hook points?) I keep seeing tantalizing hints about all of the things it lets you do, but the tutorials I’ve seen only seem to cover networking and tracing.

(The project I have in mind at the moment is making a bindfs-like filesystem without FUSE, but I’ve had a few different ideas where eBPF seemed like it might have been a good fit if I could figure it out.)

There are 1-2 good books on it. I've skimmed them via O'reilly Safari when I needed something in the past.

https://github.com/iovisor/bcc/blob/master/docs/reference_gu... lists the hook points where BPF code can be attached. Also take a look at https://blogs.oracle.com/linux/notes-on-bpf-1 (there are follow-ups - https://blogs.oracle.com/linux/notes-on-bpf-7 has the links at the bottom) and from the Linux source, https://github.com/torvalds/linux/blob/master/include/uapi/l.... https://docs.cilium.io/en/latest/bpf/ is an extensive reference but with an emphasis on the network-related areas (xdp, tc).

Reply on news.ycombinator.com