|
Re: Question about inet_set_socket_state trace point
Hi Ragalahari,
In your code you seem to not check for "old state" when you're heading to decrement. It looks like you are adding 1 and then immediately subtracting 1 in the same condition. That might
Hi Ragalahari,
In your code you seem to not check for "old state" when you're heading to decrement. It looks like you are adding 1 and then immediately subtracting 1 in the same condition. That might
|
By
Tristan Mayfield
·
#1918
·
|
|
Question about inet_set_socket_state trace point
Hi everyone,
I am using inet_set_socket_state trace point to get current establish connection count
Here, incrementing counter value in BPF map when new state is TCP_ESTABLISHED and decrementing
Hi everyone,
I am using inet_set_socket_state trace point to get current establish connection count
Here, incrementing counter value in BPF map when new state is TCP_ESTABLISHED and decrementing
|
By
Raga lahari
·
#1917
·
|
|
Re: [vagrant] accept PR to bring iovisor/vagrant to ubuntu 20.04 (from ubuntu 14.04)
Sure I can accept a PR.
By
Brenden Blanco
·
#1916
·
|
|
[vagrant] accept PR to bring iovisor/vagrant to ubuntu 20.04 (from ubuntu 14.04)
I have to create a test-environment (based on vagrant) the last couple of days and i've done this with ubuntu 20.04 as base image.
Is the repository https://github.com/iovisor/vagrant still active?
If
I have to create a test-environment (based on vagrant) the last couple of days and i've done this with ubuntu 20.04 as base image.
Is the repository https://github.com/iovisor/vagrant still active?
If
|
By
github@...
·
#1915
·
|
|
Re: Tracepoint/Kprobe for tracking inbound connections
you can attach kprobe in 'tcp_conn_request" for inbound connection
--
forrest0579@...
you can attach kprobe in 'tcp_conn_request" for inbound connection
--
forrest0579@...
|
By
Forrest Chen
·
#1914
·
|
|
Re: Tracepoint/Kprobe for tracking inbound connections
Maybe you can use sk_local_storage? You can attach a piece of
information to the socket during TCP_SYN_RECV and later on during
TCP_ESTABLISHED to check that data, and you can delete that data
Maybe you can use sk_local_storage? You can attach a piece of
information to the socket during TCP_SYN_RECV and later on during
TCP_ESTABLISHED to check that data, and you can delete that data
|
By
Yonghong Song
·
#1913
·
|
|
Tracepoint/Kprobe for tracking inbound connections
Hi,
I am looking for tracking inbound connections on a system using tracepoints/kprobes.
I was checking "trace_inet_sock_set_state", with which we can track the state changes during connection
Hi,
I am looking for tracking inbound connections on a system using tracepoints/kprobes.
I was checking "trace_inet_sock_set_state", with which we can track the state changes during connection
|
By
Kanthi P
·
#1912
·
|
|
Re: Load BPF program at boot-time?
It is possible. See the patch below:
https://lore.kernel.org/bpf/20200819042759.51280-1-alexei.starovoitov@.../
I tried to load a BPF program and pin it in bpffs system. The system could
be
It is possible. See the patch below:
https://lore.kernel.org/bpf/20200819042759.51280-1-alexei.starovoitov@.../
I tried to load a BPF program and pin it in bpffs system. The system could
be
|
By
Yonghong Song
·
#1911
·
|
|
Load BPF program at boot-time?
Hi,
Is it possible to load a BPF program at boot time?
What I'm trying to achieve is to trace every single call to a certain
function since the kernel starts, without missing anything.
More
Hi,
Is it possible to load a BPF program at boot time?
What I'm trying to achieve is to trace every single call to a certain
function since the kernel starts, without missing anything.
More
|
By
Shung-Hsi Yu
·
#1910
·
|
|
Re: Reading Pinned maps in eBPF Programs
It's expected right now. BTF started out as purely debug information,
but got elevated into pretty much a mandatory thing for modern BPF
applications. We've talked about making .BTF emitted without
It's expected right now. BTF started out as purely debug information,
but got elevated into pretty much a mandatory thing for modern BPF
applications. We've talked about making .BTF emitted without
|
By
Andrii Nakryiko
·
#1909
·
|
|
Re: Reading Pinned maps in eBPF Programs
Interestingly enough adding just -g in my Makefile built the BPF programs and allowed the BTF section to be found and properly loaded. My BPF program was loaded and is running properly with my desired
Interestingly enough adding just -g in my Makefile built the BPF programs and allowed the BTF section to be found and properly loaded. My BPF program was loaded and is running properly with my desired
|
By
Ian
·
#1908
·
|
|
Re: Reading Pinned maps in eBPF Programs
[...]
Ok, this is a very different issue than the kernel missing BTF. libbpf
is complaining that your opensnoop.bpf.o itself is missing BTF. And
right, BTF is required to parse map definitions
[...]
Ok, this is a very different issue than the kernel missing BTF. libbpf
is complaining that your opensnoop.bpf.o itself is missing BTF. And
right, BTF is required to parse map definitions
|
By
Andrii Nakryiko
·
#1907
·
|
|
Re: Reading Pinned maps in eBPF Programs
Hello,
Here is the libbpf Logs at all levels for the open snoop program when using the pinned option for a map. This was tested on Linux Kernel v5.4 with libbpf 0.0.9, 0.1.0, and the current version.
Hello,
Here is the libbpf Logs at all levels for the open snoop program when using the pinned option for a map. This was tested on Linux Kernel v5.4 with libbpf 0.0.9, 0.1.0, and the current version.
|
By
Ian
·
#1906
·
|
|
Re: Reading Pinned maps in eBPF Programs
Check example [0] for how to set custom logging callback and print all
libbpf logs (including those at DEBUG level of verbosity).
[0]
Check example [0] for how to set custom logging callback and print all
libbpf logs (including those at DEBUG level of verbosity).
[0]
|
By
Andrii Nakryiko
·
#1905
·
|
|
Re: Reading Pinned maps in eBPF Programs
Hey Andrii,
I tried using the same BPF program with the declarative pinning of maps with Libbpf v.0.0.9, v.0.1.0 and the current master branch under commit 7bc52e6. All of these had the same error
Hey Andrii,
I tried using the same BPF program with the declarative pinning of maps with Libbpf v.0.0.9, v.0.1.0 and the current master branch under commit 7bc52e6. All of these had the same error
|
By
Ian
·
#1904
·
|
|
Re: Reading Pinned maps in eBPF Programs
<mayfieldtristan@...> wrote:
Which version of libbpf are you seeing this on? We've had bugs in
libbpf where we'd attempt to load kernel BTF unnecessarily, but I
believe we've fixed all those
<mayfieldtristan@...> wrote:
Which version of libbpf are you seeing this on? We've had bugs in
libbpf where we'd attempt to load kernel BTF unnecessarily, but I
believe we've fixed all those
|
By
Andrii Nakryiko
·
#1903
·
|
|
Re: Reading Pinned maps in eBPF Programs
[...]
I don't see anything needing kernel BTF in there, so if libbpf still
fails on not being able to load kernel BTF, that might be a bug in
libbpf. Can you please double-check this with the latest
[...]
I don't see anything needing kernel BTF in there, so if libbpf still
fails on not being able to load kernel BTF, that might be a bug in
libbpf. Can you please double-check this with the latest
|
By
Andrii Nakryiko
·
#1902
·
|
|
Re: Reading Pinned maps in eBPF Programs
I wanted to chime in and mention that I've seen the BTF error before when trying to declare maps the way shown in
I wanted to chime in and mention that I've seen the BTF error before when trying to declare maps the way shown in
|
By
Tristan Mayfield
·
#1901
·
|
|
Re: Reading Pinned maps in eBPF Programs
Hello! Sorry for the wait, I just started back at uni and things are a little bit crazy around here!
Anyways, this is the source code for my version of open snoop. Which is what I have been testing
Hello! Sorry for the wait, I just started back at uni and things are a little bit crazy around here!
Anyways, this is the source code for my version of open snoop. Which is what I have been testing
|
By
Ian
·
#1900
·
|
|
Re: Reading Pinned maps in eBPF Programs
Your BPF code must be relying on CO-RE. I can check if you can show me
your BPF source code.
The pinning and map definition itself doesn't rely on CO-RE and thus
doesn't need kernel BTF.
Your BPF code must be relying on CO-RE. I can check if you can show me
your BPF source code.
The pinning and map definition itself doesn't rely on CO-RE and thus
doesn't need kernel BTF.
|
By
Andrii Nakryiko
·
#1899
·
|