So You Want to Write Memory with eBPF?
Talkat Cilium + eBPF Day North America 2024 · on Tuesday, 2024-11-12· at 16:30· Salt Palace | Level 1 | Grand Ballroom B·
summary
Implemented W3C trace context propagation for OpenTelemetry Go using eBPF and prototype code actually writes into user memory but runs into kernel lockdown: bpf_probe_write_user works functionally but is discouraged and restricted. Explored a proposed bpf_probe_write_user_registered and the new BPF arena (kernel 6.9) but Go heap mapping breaks. Network approaches include a TCP-options prototype and an SK_MSG + tc flow that works except when traffic is encrypted; classic LD_PRELOAD interception also remains a viable fallback.
AI-written summary · about
chapters (16)
- 0:00Writing memory with eBPF
- 1:04Write user space memory with eBPF
- 2:08Distributed tracing challenges
- 3:56Automate tracing in Go with eBPF
- 6:02bpf_probe_write_user helper
- 7:29Alternative kernel helpers
- 8:34BPF Arena solution
- 10:18Re-evaluate memory writing
- 10:59Network context propagation
- 12:44Inject trace context at HTTP
- 14:53Non-eBPF solutions
- 15:37Library interpositioning
- 17:02BPFtime user space eBPF
- 18:26Challenges with eBPF
- 19:29Future of memory writing
- 20:11Open questions and support
