1

I have basic question on ebpf behavior when multiple ebpf hooks are loaded(not using chaining) simultaneously in kernel. Are all of those hooks invoked? For example, I loaded my ebpf program which has cgroup_skb/ingress hook. The ebpf hooks functions loaded by my program are not getting invoked by kernel during packet ingress. When I list loaded programs on "Linux 5.13.0-30-generic", I see that systemd has already loaded cgroup_skb/ingress hooks by default. I do understand why these cgroup/skb hooks are loaded by systemd. My question is specifically on kernel's behavior when multiple hooks of same type(cgroup_skb/ingress) are loaded.

Jeelani Syed
  • 11
  • 1

1 Answers1

0

yes. All the hooks will be called. We need to attach it with "multi" keyword.

bpftool  prog load test1.o /sys/fs/bpf/test1 type cgroup/skb

bpftool cgroup attach /sys/fs/cgroup/mygrp   egress pinned /sys/fs/bpf/test1 multi

bpftool  prog load test2.o /sys/fs/bpf/test2 type cgroup/skb

bpftool cgroup attach /sys/fs/cgroup/mygrp   egress pinned /sys/fs/bpf/test2 multi

My simple program with different debug print statement (test2.c): SEC("cgroup/skb") int cgrp_dump_pkt(struct __sk_buff *skb) {

bpf_printk("welcome test 2");
return 1;

}

ping-446804 [000] d... 374792.037025: bpf_trace_printk: welcome test 1

ping-446804 [000] d... 374792.037038: bpf_trace_printk: welcome test 2

mohamed.hanif
  • 35
  • 5