Porting eBPF CO-RE to arm64 Leads to Fix the Kernel - Francis Laniel скачать в хорошем качестве

Porting eBPF CO-RE to arm64 Leads to Fix the Kernel - Francis Laniel

This talk will show how porting eBPF CO-RE libbpf-tools to arm64 using bpf2go led to fixing the kernel. After generating the needed files to run libbpf-tools on arm64 architecture, it was time to test them. All the compiled tools worked except one: execsnoop. This wasn't expected as execsnoop is surely one of the most known libbpf-tools, and it failed without printing any error message. The investigation led to the arm64 kernel code responsible for starting a new thread which reset all registers, thus forgetting the current syscall number and impeding their tracing. The bug was fixed upstream, and a workaround was proposed for older kernels. Whether you are just starting to learn about eBPF, you're looking for further material or you're a seasoned contributor to major eBPF projects, the eBPF & Cilium Community is here to support you. Join the community on Slack 24/7 for help with, and discussions about eBPF and Cilium: https://ebpf.io/slack. —- Cilium is an open source software for providing, securing and observing network connectivity between container workloads - cloud native, and fueled by the revolutionary Kernel technology eBPF. Learn more on the website: https://cilium.io/ Follow us on Twitter:   / ciliumproject   Download and contribute on Github: https://github.com/cilium/cilium —- eBPF is a revolutionary technology with origins in the Linux kernel that can run sandboxed programs in an operating system kernel. It is used to safely and efficiently extend the capabilities of the kernel without requiring to change kernel source code or load kernel modules. Learn more on the website: https://ebpf.io/ #ebpf #cilium #cloudnative