Hello,
I have tried to use kprobe but it fails when I try to attach a kprobe
on that function with this error: raise Exception("Failed to attach
BPF to kprobe")
I use b.attach_kprobe(event="map_update_elem", fn_name="hello") for
the attaching, and int hello(struct pt_regs *ctx,struct bpf_map *map)
as bpf function.
(I use basically the code of hello_perf_output.py example right now).
Is this the right way? Or I can attach my ebpf program only to syscall?
Thank You,
Raffaele
Il giorno mer 1 ago 2018 alle ore 17:08 Y Song <[email protected]> ha scritto:
>
> On Wed, Aug 1, 2018 at 2:36 AM, Raffaele Sommese <[email protected]> wrote:
> > Hello everybody,
> > I was looking for a similar mechanism,
> > I need to trace an event on map update/delete, I have tried with
> > tracepoint but I can recover only the file descriptor of map and I
> > need the map id too (or the map name).
> > Is there some other solution to trace this event and recover this data?
>
> bpf tracepoints have been removed from recent linux so the you need to
> use kprobe to trace update/delete.
>
> typical map_update_elem and map_delete_elem first argument is
> 'struct bpf_map *map', you can get name and id from there:
>
> struct bpf_map {
> /* The first two cachelines with read-mostly members of which some
> * are also accessed in fast-path (e.g. ops, max_entries).
> */
> const struct bpf_map_ops *ops ____cacheline_aligned;
> struct bpf_map *inner_map_meta;
> #ifdef CONFIG_SECURITY
> void *security;
> #endif
> enum bpf_map_type map_type;
> u32 key_size;
> u32 value_size;
> u32 max_entries;
> u32 map_flags;
> u32 pages;
> u32 id;
> int numa_node;
> u32 btf_key_type_id;
> u32 btf_value_type_id;
> struct btf *btf;
> bool unpriv_array;
> /* 55 bytes hole */
>
> /* The 3rd and 4th cacheline with misc members to avoid false sharing
> * particularly with refcounting.
> */
> struct user_struct *user ____cacheline_aligned;
> atomic_t refcnt;
> atomic_t usercnt;
> struct work_struct work;
> char name[BPF_OBJ_NAME_LEN];
> };
>
>
> > I prefer to avoid to modify the kernel code.
> > Thank You,
> > Best Regards
> > Raffaele
> > Il giorno sab 17 feb 2018 alle ore 18:41 Jesper Dangaard Brouer via
> > iovisor-dev <[email protected]> ha scritto:
> >>
> >>
> >>
> >> On Sat, 17 Feb 2018 13:49:22 +0000 Teng Qin via iovisor-dev
> >> <[email protected]> wrote:
> >>
> >> > > We were looking for a mechanism transparent to the eBPF program,
> >> > > though.
> >> > > A possible rational is to have an hot-standby copy of the program
> >> > > (including the state) in some other location, but I don't want my
> >> > > dataplane to be aware of that.
> >> > > Thanks,
> >> > >
> >> > > fulvio
> >> >
> >> >
> >> > You could also (use another BPF program or ftrace) to trace the
> >> > bpf_map_update_elem Tracepoint. But in that case you get all update calls
> >> > and would need to filter for the one you are interested on your own:)
> >>
> >> That is a good idea.
> >>
> >> Try it out via perf-record to see if it contains what you need:
> >>
> >> $ perf record -e bpf:bpf_map_update_elem -a
> >>
> >> $ perf script
> >> xdp_redirect_ma 2273 [011] 261187.968223: bpf:bpf_map_update_elem: map
> >> type= ufd=4 key=[00 00 00 00] val=[07 00 00 00]
> >>
> >>
> >> Looking at the above output and tracepoint kernel code, we should
> >> extend that with a map_id to easily identify/filter what map you are
> >> interested in.
> >>
> >> See patch below signature (not even compile tested).
> >>
> >> Example for attaching to tracepoints see:
> >> samples/bpf/xdp_monitor_*.c
> >>
> >> --
> >> Best regards,
> >> Jesper Dangaard Brouer
> >> MSc.CS, Principal Kernel Engineer at Red Hat
> >> LinkedIn: http://www.linkedin.com/in/brouer
> >>
> >> tracepoint: add map id to bpf tracepoints
> >>
> >> From: Jesper Dangaard Brouer <[email protected]>
> >>
> >>
> >> ---
> >> include/trace/events/bpf.h | 12 +++++++++---
> >> 1 file changed, 9 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/include/trace/events/bpf.h b/include/trace/events/bpf.h
> >> index 150185647e6b..e6479ba45261 100644
> >> --- a/include/trace/events/bpf.h
> >> +++ b/include/trace/events/bpf.h
> >> @@ -140,7 +140,7 @@ TRACE_EVENT(bpf_map_create,
> >> __entry->flags = map->map_flags;
> >> __entry->ufd = ufd;
> >> ),
> >> -
> >> +// TODO also add map_id here
> >> TP_printk("map type=%s ufd=%d key=%u val=%u max=%u flags=%x",
> >> __print_symbolic(__entry->type, __MAP_TYPE_SYM_TAB),
> >> __entry->ufd, __entry->size_key, __entry->size_value,
> >> @@ -199,15 +199,18 @@ DECLARE_EVENT_CLASS(bpf_obj_map,
> >> __field(u32, type)
> >> __field(int, ufd)
> >> __string(path, pname->name)
> >> + __field(u32, map_id)
> >> ),
> >>
> >> TP_fast_assign(
> >> __assign_str(path, pname->name);
> >> __entry->type = map->map_type;
> >> __entry->ufd = ufd;
> >> + __entry->map_id = map->id;
> >> ),
> >>
> >> - TP_printk("map type=%s ufd=%d path=%s",
> >> + TP_printk("map id=%u type=%s ufd=%d path=%s",
> >> + __entry->map_id,
> >> __print_symbolic(__entry->type, __MAP_TYPE_SYM_TAB),
> >> __entry->ufd, __get_str(path))
> >> );
> >> @@ -244,6 +247,7 @@ DECLARE_EVENT_CLASS(bpf_map_keyval,
> >> __dynamic_array(u8, val, map->value_size)
> >> __field(bool, val_trunc)
> >> __field(int, ufd)
> >> + __field(u32, map_id)
> >> ),
> >>
> >> TP_fast_assign(
> >> @@ -255,9 +259,11 @@ DECLARE_EVENT_CLASS(bpf_map_keyval,
> >> __entry->val_len = min(map->value_size, 16U);
> >> __entry->val_trunc = map->value_size != __entry->val_len;
> >> __entry->ufd = ufd;
> >> + __entry->map_id = map->id;
> >> ),
> >>
> >> - TP_printk("map type=%s ufd=%d key=[%s%s] val=[%s%s]",
> >> + TP_printk("map id=%d type=%s ufd=%d key=[%s%s] val=[%s%s]",
> >> + __entry->map_id,
> >> __print_symbolic(__entry->type, __MAP_TYPE_SYM_TAB),
> >> __entry->ufd,
> >> __print_hex(__get_dynamic_array(key), __entry->key_len),
> >> _______________________________________________
> >> iovisor-dev mailing list
> >> [email protected]
> >> https://lists.iovisor.org/mailman/listinfo/iovisor-dev
> >
> >
> >
> > --
> > ________________________________
> > Raffaele Sommese
> > Mail:[email protected]
> > About me:https://about.me/r4ffy
> > Gpg Key:http://www.r4ffy.info/Openpgp.asc
> > GPG key ID: 0x830b1428cf91db2a on http://pgp.mit.edu:11371/
> >
> >
> >
--
________________________________
Raffaele Sommese
Mail:[email protected]
About me:https://about.me/r4ffy
Gpg Key:http://www.r4ffy.info/Openpgp.asc
GPG key ID: 0x830b1428cf91db2a on http://pgp.mit.edu:11371/
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#1414): https://lists.iovisor.org/g/iovisor-dev/message/1414
Mute This Topic: https://lists.iovisor.org/mt/21386293/21656
Group Owner: [email protected]
Unsubscribe: https://lists.iovisor.org/g/iovisor-dev/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
