When using kprobe in bcc, I can get param directly like `int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state)` But it seems not to work in kretprobe, I've found that I can get

The BPF UAPI header file <linux/bpf.h> includes <linux/types.h>, which gives BPF-programs access to types e.g. __u32, __u64, __u8, etc. On Ubuntu/Debian when compiling with clang option[1] "-target

Hi, I am trying to attach the same TC eBPF program instance to both host and container interfaces. So some of the maps need to be qualified with the netns id. I was wondering if there is a way to

Hello Tristan! That is the same path I found when debugging with strace! I think I also saw a missing comm string during my tests (with printk from BCC), but I would have to reproduce it again to be

Alessandro, I figured out that it's non-deterministic. So sometimes certain commands (git, awk, rm, uname, etc.) will have an openat with no filename, but other times they will. I ran these commands

I ran the same test with strace. One of the file data points that doesn't show up is this: bpftrace: sys_enter_openat mode:0 filename: (93911401193582) strace: openat(AT_FDCWD,

Hello Tristan, thanks for spending the time to check this out! One thing I forgot to mention is that I can verify with strace that the filename parameter is always present. I initially suspected

I don't have an answer, but I verified this with the following bpftrace script and using the action of switching to zsh/oh-my-zsh from

Hello everyone, I'll start with some backstory first: I wrote my own BPF library to trace functions/syscalls and yesterday I noticed that I am sometimes receiving broken openat() tracepoint data.

Hello, I am trying a port mirroring use case that basically mirrors traffic from host1 to host2. On host 1 I have two interfaces eth0 and eth1 and have configured vxlan interface on eth1. I have used

Hi, Lately, I've been working on in-kernel traffic analysis with eBPF and the newest features released in the latest kernel versions (queue/stack, batch operations,...). For some reason, I couldn't

Thanks, fetch_and_add would be more appropriate to my use-case

You cannot use the return value. A recent llvm should return an error if you try to use it. There is some preliminary work to have more atomic operations in the BPF ISA.

Hi Jesper and Quentin, Nice, I checked that logic. If I understand it right, that implementation would also need few operations to be atomic, for example the window movements(whenever R and B are

Thanks Andrii. __sync_fetch_and_add doesn't seem to work as expected, it is adding the increment, but it is returning the wrong value. I am actually hitting the same issue mentioned here:

2020-06-16 14:18 UTC+0200 ~ Jesper Dangaard Brouer <brouer@...> Hi Jesper, Kanthi, This token bucket implementation was realised in the context of a research project (BEBA), for which the OPP

Hi Kanthi and Quentin, You mention token counter as the use-case, for somehow ratelimiting (TCP connections in your case?). That reminds me that Quentin implemented[1] a two-color

You should use __sync_fetch_and_add() for both cases, and then yes, you won't lose any update. You probably would want __sync_add_and_fetch() to get the counter after update, but that's not supported

Thanks Song and Andrii for the response. Use-case is global rate-limiting for incoming TCP connections. And we want to implement the token bucket algorithm using XDP for this purpose. So we are

Replying here again for the record since you posted the same question on the k8s slack. Kubectl trace replaces $container_pid so you can access the pid folder in the host proc. it’s not specific