Hi all, I am learning about ebpf and the bcc tools/library. I have a question about dynamic uprobe of C++ code. I have been able to attach a uprobe successfully by looking up the mangled symbol name.

#bcc

I don't think golang can interrupt thread while it's being executed in the kernel. So from the golang perspective I wouldn't worry, the kernel will execute both kprobe and corresponding kretprobe befo

#bcc #pragma

Thanks for reply. It seems fexit it a new feature and I'm using linux v4.15, so fexit can't help here. kretprobe with kprobe is an option and I've found a lot examples in bbc, but I am also wondering

#bcc #pragma

You can't do it reliably with kretprobe. kretprobe is executed right before the function is exiting, by that time all the registers that contained input parameters could have been used for something e

#bcc #pragma

When using kprobe in bcc, I can get param directly like `int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state)` But it seems not to work in kretprobe, I've found that I can get fi

#bcc #pragma

No, HASH_OF_MAPS allows arbitrary-sized keys, just like normal HASHMAP. Libbpf recently got a support for nicer map-in-map declaration and initialization, you might want to check it out: [0]. [0] http

#bcc

Thanks for the suggestion, now I feel more confident about this solution. However, I have still problems with the map-in-map type: is it possible to use a map which has as key the 4 tcp-session identi

#bcc

Your approach seems okay. You can use two maps or use map-in-map. Using batch operation from user space should speedup the deletion operation.

#bcc

Hi everybody, I am writing this email to ask for an opinion about how to address the following problem. Lately, I have been trying to develop an eBPF program that extracts some per-flow values and sto

#bcc

<ys114321=gmail.com@...> wrote: I see the issue now. ip_hdr(skb) eventually transforms to static inline unsigned char *skb_network_header(const struct sk_buff *skb) { return skb->head +

#bcc

You did not show the code which actually caused the problem. There must be code after "if ( (ip_Hdr.protocol != IPPROTO_TCP)) return 0;" . You may need bpf_probe_read() for memory accesses there.

#bcc

Hello - I am looking to trace ip_forward_finish. The intent is to trace latency of all TCP connections going through a linux based gateway router. Hence thought of tracing ip_forward_finish kernel fun

#bcc

https://android.googlesource.com/platform/external/adeb/+/master/BCC.md is a way to already use bcc on android. I also have a WIP branch of bpftrace that supports bionic libc, for Android.

#bcc #android

Does bcc have an adaptation plan for the Android platform?

#bcc #android