Also the binary need to be still running when doing symbolization.

errno 2 (ENOENT) means file does not exist. You can add additional print to check whether the file truly exists or not. <iovisor-dev@...> wrote:

From: Daniel Borkmann <daniel@...> Date: Wed, 16 Aug 2017 00:12:58 +0200 Applied, nice work Edward.

Acked-by: Daniel Borkmann <daniel@...>

State of a register doesn't matter if it wasn't read in reaching an exit; a write screens off all reads downstream of it from all explored_states upstream of it. This allows us to prune many more

So it does. Of course testing didn't spot this, because caller_saved[i] == i currently. Yeah, I'll replace it with a comment, like the other one. Thanks for review :) -Ed

[...] Ah, I oversaw that earlier, this needs to be: s/i/caller_saved[i]/ We could leave this for clarity, but ... [...] caller_saved[i] ... then it should be here as well. Other option is to leave

State of a register doesn't matter if it wasn't read in reaching an exit; a write screens off all reads downstream of it from all explored_states upstream of it. This allows us to prune many more

Yes, I forgot about LD_ABS. I'll fix it and spin a v2. -Ed

Awesome work! [...] Don't we need the same in check_ld_abs() since we treat it similar to a function call? [...]

State of a register doesn't matter if it wasn't read in reaching an exit; a write screens off all reads downstream of it from all explored_states upstream of it. This allows us to prune many more

Hi Wenxian, I've tried -g, -ggdb, -gdwarf, -no-omit-frame-pointer (per the DEBUGGING section of the profile(8) man page.) to compile spin respectively, as well as a various combination of them. But

Have you tried to compile spin.cc with -g para? Thanks, Wenxian

Hi there, I am trying out bcc tools from http://github.com/iovisor/bcc, more specificaly profile.py and offcputime.py. However in the tracing result, user functions are shown as "[unknown]", whereas

Hi Mauricio, It sounds like you're trying to implement wildcard matching over a hash map. Using all the keys would be an exact match, whereas using a subset of the keys would mean wildcarding the

Dear All, We are implementing an eBPF program that uses a multi-key map, we create a structure containing all the fields used as keys. This approach works good until we perform operations on the map

Sorry about that! I'm out on vacation today and neglected to send a note asking for somebody to fill in. Hopefully y'all figured out what was going on. -Brenden

Happening today? Brendan

From: Daniel Borkmann <daniel@...> Date: Tue, 08 Aug 2017 02:46:16 +0200 Series applied, thanks everyone!

Been testing and reviewing the series over the last several days, looks reasonable to me as far as I can tell. Thanks for all the hard work on unifying this, Edward! Acked-by: Daniel Borkmann