Summary: The author encountered issues after upgrading to the new Ubuntu 24.04 kernel version 6.11 due to the FRED feature being enabled, adding 16 extra bytes to the kernel stack area. This affected their eBPF task iterator program, causing incorrect results. The FRED feature is a CPU privilege level optimization in Intel CPUs. The author implemented dynamic FRED detection in their eBPF code. Disabling FRED via kernel boot argument won’t remove the padding. The built-in bpf_core_* functions handle unexpected changes in newer kernel versions. The author shares code snippets and insights to help future eBPF developers navigate these challenges effectively.
https://tanelpoder.com/posts/ebpf-pt-regs-error-on-linux-blame-fred/