I am looking into kfunc mechanism and wrote a simple kernel module that exposes a kfunc which i try to call from ebpf code:

I want to deny file deletion on a linux machine if the filename starts by “t”.

As eBPF verifier is quite strict, it only allows functions with return value. Is there any way to stop the check of void return? Which function of verifier should I modify?

As eBPF verifier is quite strict, it only allows functions with return value. Is there any way to stop the check of void return? Which function of verifier should I modify?

I am looking at an eBPF sample code it has this

I need to use tracepoint tcp_v4_connect to populate ebpf struct __sk_buff, but I found only these events in my kernel 6.6 tracing directory: tcp:tcp_cong_state_set, tcp:tcp_bad_csum, tcp:tcp_probe, tcp:tcp_retransmit_synack, tcp:tcp_rcv_space_adjust, tcp:tcp_destroy_sock, tcp:tcp_receive_reset, tcp:tcp_send_reset, tcp:tcp_retransmit_skb

I need to read the payload of TCP packets. The following code always print an empty payload, even though payloadSize is greater than zero. What am I doing wrong?

I am eBPF newbie, for learning trying to tweak existing filetop from https://github.com/iovisor/bcc/blob/master/tools/filetop.py.