I ran the same test with strace. One of the file data points that doesn't show up is this: bpftrace: sys_enter_openat mode:0 filename: (93911401193582) strace: openat(AT_FDCWD,

Hello Tristan, thanks for spending the time to check this out! One thing I forgot to mention is that I can verify with strace that the filename parameter is always present. I initially suspected

I don't have an answer, but I verified this with the following bpftrace script and using the action of switching to zsh/oh-my-zsh from

Hello everyone, I'll start with some backstory first: I wrote my own BPF library to trace functions/syscalls and yesterday I noticed that I am sometimes receiving broken openat() tracepoint data.

Hello, I am trying a port mirroring use case that basically mirrors traffic from host1 to host2. On host 1 I have two interfaces eth0 and eth1 and have configured vxlan interface on eth1. I have used

Hi, Lately, I've been working on in-kernel traffic analysis with eBPF and the newest features released in the latest kernel versions (queue/stack, batch operations,...). For some reason, I couldn't

Thanks, fetch_and_add would be more appropriate to my use-case

You cannot use the return value. A recent llvm should return an error if you try to use it. There is some preliminary work to have more atomic operations in the BPF ISA.

Hi Jesper and Quentin, Nice, I checked that logic. If I understand it right, that implementation would also need few operations to be atomic, for example the window movements(whenever R and B are

Thanks Andrii. __sync_fetch_and_add doesn't seem to work as expected, it is adding the increment, but it is returning the wrong value. I am actually hitting the same issue mentioned here:

2020-06-16 14:18 UTC+0200 ~ Jesper Dangaard Brouer <brouer@...> Hi Jesper, Kanthi, This token bucket implementation was realised in the context of a research project (BEBA), for which the OPP

Hi Kanthi and Quentin, You mention token counter as the use-case, for somehow ratelimiting (TCP connections in your case?). That reminds me that Quentin implemented[1] a two-color

You should use __sync_fetch_and_add() for both cases, and then yes, you won't lose any update. You probably would want __sync_add_and_fetch() to get the counter after update, but that's not supported

Thanks Song and Andrii for the response. Use-case is global rate-limiting for incoming TCP connections. And we want to implement the token bucket algorithm using XDP for this purpose. So we are

Replying here again for the record since you posted the same question on the k8s slack. Kubectl trace replaces $container_pid so you can access the pid folder in the host proc. it’s not specific

Ok, that I can help with, then. What's the kernel version? Where I can find repro? Steps, etc. Basically, a bit more context would help, as I wasn't part of initial discussion.

<andrii.nakryiko@...> wrote: just running ./test_xdp_veth.sh on the latest bpf-next with the latest clang I see: BTF debug data section '.BTF' rejected: Invalid argument (22)! - Length:

<brouer@...> wrote: This is newer Clang recording that function is global, not static. libbpf is sanitizing BTF to remove this flag, if kernel doesn't support this. But given this is

(Cross-posting to iovisor-dev) Seeking input from BPF-llvm developers. How come Clang/LLVM 10+ is generating incompatible BTF-info in ELF file, and downgrading to LLVM-9 fixes the issue ? -- Best

Hello all, I am trying to retrieve the keys of an LPM Trie in my user space program (similar to https://github.com/iovisor/bcc/blob/master/examples/networking/xdp/xdp_macswap_count.py) however, I am