Thanks. I don't know much about tracepoints but will look into this. I gather these are capable of the same rates as the tc hooks? Where would the context extracted from the packet in the BPF prog

Hi folks, We (Maciek and I) were on the call today, and were experiencing some audio/mic issues. We're looking for any documentation or usage models that people might have in flight already for BTF.

There's a tracepoint right before netdev_start_xmit() which is called trace_net_dev_start_xmit(). So you could combine sch_clsact egress with cls_bpf and a BPF prog on the tracepoint right before

Hello, I listened in on the IOVisor call today but wasn't sure if user questions and use cases where appropriate there so I started writing this... There are two things I was going to

2018-08-07 16:03 UTC-0700 ~ Yonghong Song <ys114321@...> Thanks for the changes! Best regards, Quentin

bpf_get_current_pid_tgid() This may not enough as different name spaces could have the same tgid. Could you add comparison for pidns.nsid as well? You also need to tell how user can find nsid inside

Quentin, Thanks a lot for your feedback, I think I'm getting closer to finish this one. I have included the changes suggested, let me know if there is anything else that needs to be changed or

Please join us tomorrow for our bi-weekly call. As usual, this meeting is open to everybody and completely optional. You might be interested to join if: You want to know what is going on in BPF

2018-08-006 22:55 UTC-0400 ~ cnb <cneirabustos@...> […] Hi Carlos, I just gave a look at the helper documentation. The text is supposed to be turned into a man page for users not familiar

<chaitanya.mgit@...> wrote: Only solutions i can think of is a) in insmod do the basic stuff, but block any memory allocs till BPF is loaded and in rmmod free the allocs, but dont exit yet,

I have defined a new tracepoint in my module and tried to attach to it. I am using the memleak.py script as a reference and extended it to check for leaks in my modules (using tracepoints defined by

This helper obtains the active namespace from current and returns pid, tgid, device major/minor and namespace id as seen from that ns, allowing to do pid filtering inside a container. Major and

Yes, this approach should work too. I am thinking whether we could do it with one invocation of trace.py...

I think that this way can be very tricky and platform depended, I have found another solution. If I attach my bpf program to bpf_map_new_fd with a kprobe and a kretprobe I can recover the mapping

Okay, the htab_map_update_elem is indeed called, but you cannot trace it. The following kernel code in kernel/bpf/syscall.c explained the reason: /* must increment bpf_prog_active to avoid

Thank you, right now I will try only to implement a solution for hashmap. I have detected a strange behavior for lookup I can receive the event when the map was looked, but for the updates, I don't

<chaitanya.mgit@...> wrote: Which tracepoint you tried to attach? For kernel memory, a few kmem tracepoints are attached in memleak. If you want to attach a tracepoint only defined by the

Please directly use the map lookup function for the specific map. For example, for hashmap, the verifier is smart enough to change the byte code to call the underlying hashmap map lookup

Hello again :) It seems that there is 2 function that can be traced inside the kernel, one is map_update_elem, and it is the syscall, the other one is the BPF helper. I have successful attach my ebpf

Will send to netdev. Thanks!