I think that I need kprobe, map_update_elem and map_delete_elem are defined in kernel space. Thank You, Raffaele Il giorno gio 2 ago 2018 alle ore 17:39 Sunny Klair <[email protected]> ha scritto: > > You likely want uprobes if your function is defined in userspace, not kprobes > (which are for functions defined in kernel space). > > relevant link: > http://www.brendangregg.com/blog/2015-06-28/linux-ftrace-uprobe.html > > - Sunny > > On Thu, Aug 2, 2018 at 11:36 AM, Raffaele Sommese <[email protected]> > wrote: >> >> Hello, >> I have tried to use kprobe but it fails when I try to attach a kprobe >> on that function with this error: raise Exception("Failed to attach >> BPF to kprobe") >> I use b.attach_kprobe(event="map_update_elem", fn_name="hello") for >> the attaching, and int hello(struct pt_regs *ctx,struct bpf_map *map) >> as bpf function. >> (I use basically the code of hello_perf_output.py example right now). >> Is this the right way? Or I can attach my ebpf program only to syscall? >> Thank You, >> Raffaele >> Il giorno mer 1 ago 2018 alle ore 17:08 Y Song <[email protected]> ha >> scritto: >> > >> > On Wed, Aug 1, 2018 at 2:36 AM, Raffaele Sommese <[email protected]> >> > wrote: >> > > Hello everybody, >> > > I was looking for a similar mechanism, >> > > I need to trace an event on map update/delete, I have tried with >> > > tracepoint but I can recover only the file descriptor of map and I >> > > need the map id too (or the map name). >> > > Is there some other solution to trace this event and recover this data? >> > >> > bpf tracepoints have been removed from recent linux so the you need to >> > use kprobe to trace update/delete. >> > >> > typical map_update_elem and map_delete_elem first argument is >> > 'struct bpf_map *map', you can get name and id from there: >> > >> > struct bpf_map { >> > /* The first two cachelines with read-mostly members of which some >> > * are also accessed in fast-path (e.g. ops, max_entries). >> > */ >> > const struct bpf_map_ops *ops ____cacheline_aligned; >> > struct bpf_map *inner_map_meta; >> > #ifdef CONFIG_SECURITY >> > void *security; >> > #endif >> > enum bpf_map_type map_type; >> > u32 key_size; >> > u32 value_size; >> > u32 max_entries; >> > u32 map_flags; >> > u32 pages; >> > u32 id; >> > int numa_node; >> > u32 btf_key_type_id; >> > u32 btf_value_type_id; >> > struct btf *btf; >> > bool unpriv_array; >> > /* 55 bytes hole */ >> > >> > /* The 3rd and 4th cacheline with misc members to avoid false >> > sharing >> > * particularly with refcounting. >> > */ >> > struct user_struct *user ____cacheline_aligned; >> > atomic_t refcnt; >> > atomic_t usercnt; >> > struct work_struct work; >> > char name[BPF_OBJ_NAME_LEN]; >> > }; >> > >> > >> > > I prefer to avoid to modify the kernel code. >> > > Thank You, >> > > Best Regards >> > > Raffaele >> > > Il giorno sab 17 feb 2018 alle ore 18:41 Jesper Dangaard Brouer via >> > > iovisor-dev <[email protected]> ha scritto: >> > >> >> > >> >> > >> >> > >> On Sat, 17 Feb 2018 13:49:22 +0000 Teng Qin via iovisor-dev >> > >> <[email protected]> wrote: >> > >> >> > >> > > We were looking for a mechanism transparent to the eBPF program, >> > >> > > though. >> > >> > > A possible rational is to have an hot-standby copy of the program >> > >> > > (including the state) in some other location, but I don't want my >> > >> > > dataplane to be aware of that. >> > >> > > Thanks, >> > >> > > >> > >> > > fulvio >> > >> > >> > >> > >> > >> > You could also (use another BPF program or ftrace) to trace the >> > >> > bpf_map_update_elem Tracepoint. But in that case you get all update >> > >> > calls >> > >> > and would need to filter for the one you are interested on your own:) >> > >> >> > >> That is a good idea. >> > >> >> > >> Try it out via perf-record to see if it contains what you need: >> > >> >> > >> $ perf record -e bpf:bpf_map_update_elem -a >> > >> >> > >> $ perf script >> > >> xdp_redirect_ma 2273 [011] 261187.968223: bpf:bpf_map_update_elem: >> > >> map type= ufd=4 key=[00 00 00 00] val=[07 00 00 00] >> > >> >> > >> >> > >> Looking at the above output and tracepoint kernel code, we should >> > >> extend that with a map_id to easily identify/filter what map you are >> > >> interested in. >> > >> >> > >> See patch below signature (not even compile tested). >> > >> >> > >> Example for attaching to tracepoints see: >> > >> samples/bpf/xdp_monitor_*.c >> > >> >> > >> -- >> > >> Best regards, >> > >> Jesper Dangaard Brouer >> > >> MSc.CS, Principal Kernel Engineer at Red Hat >> > >> LinkedIn: http://www.linkedin.com/in/brouer >> > >> >> > >> tracepoint: add map id to bpf tracepoints >> > >> >> > >> From: Jesper Dangaard Brouer <[email protected]> >> > >> >> > >> >> > >> --- >> > >> include/trace/events/bpf.h | 12 +++++++++--- >> > >> 1 file changed, 9 insertions(+), 3 deletions(-) >> > >> >> > >> diff --git a/include/trace/events/bpf.h b/include/trace/events/bpf.h >> > >> index 150185647e6b..e6479ba45261 100644 >> > >> --- a/include/trace/events/bpf.h >> > >> +++ b/include/trace/events/bpf.h >> > >> @@ -140,7 +140,7 @@ TRACE_EVENT(bpf_map_create, >> > >> __entry->flags = map->map_flags; >> > >> __entry->ufd = ufd; >> > >> ), >> > >> - >> > >> +// TODO also add map_id here >> > >> TP_printk("map type=%s ufd=%d key=%u val=%u max=%u flags=%x", >> > >> __print_symbolic(__entry->type, __MAP_TYPE_SYM_TAB), >> > >> __entry->ufd, __entry->size_key, __entry->size_value, >> > >> @@ -199,15 +199,18 @@ DECLARE_EVENT_CLASS(bpf_obj_map, >> > >> __field(u32, type) >> > >> __field(int, ufd) >> > >> __string(path, pname->name) >> > >> + __field(u32, map_id) >> > >> ), >> > >> >> > >> TP_fast_assign( >> > >> __assign_str(path, pname->name); >> > >> __entry->type = map->map_type; >> > >> __entry->ufd = ufd; >> > >> + __entry->map_id = map->id; >> > >> ), >> > >> >> > >> - TP_printk("map type=%s ufd=%d path=%s", >> > >> + TP_printk("map id=%u type=%s ufd=%d path=%s", >> > >> + __entry->map_id, >> > >> __print_symbolic(__entry->type, __MAP_TYPE_SYM_TAB), >> > >> __entry->ufd, __get_str(path)) >> > >> ); >> > >> @@ -244,6 +247,7 @@ DECLARE_EVENT_CLASS(bpf_map_keyval, >> > >> __dynamic_array(u8, val, map->value_size) >> > >> __field(bool, val_trunc) >> > >> __field(int, ufd) >> > >> + __field(u32, map_id) >> > >> ), >> > >> >> > >> TP_fast_assign( >> > >> @@ -255,9 +259,11 @@ DECLARE_EVENT_CLASS(bpf_map_keyval, >> > >> __entry->val_len = min(map->value_size, 16U); >> > >> __entry->val_trunc = map->value_size != >> > >> __entry->val_len; >> > >> __entry->ufd = ufd; >> > >> + __entry->map_id = map->id; >> > >> ), >> > >> >> > >> - TP_printk("map type=%s ufd=%d key=[%s%s] val=[%s%s]", >> > >> + TP_printk("map id=%d type=%s ufd=%d key=[%s%s] val=[%s%s]", >> > >> + __entry->map_id, >> > >> __print_symbolic(__entry->type, __MAP_TYPE_SYM_TAB), >> > >> __entry->ufd, >> > >> __print_hex(__get_dynamic_array(key), >> > >> __entry->key_len), >> > >> _______________________________________________ >> > >> iovisor-dev mailing list >> > >> [email protected] >> > >> https://lists.iovisor.org/mailman/listinfo/iovisor-dev >> > > >> > > >> > > >> > > -- >> > > ________________________________ >> > > Raffaele Sommese >> > > Mail:[email protected] >> > > About me:https://about.me/r4ffy >> > > Gpg Key:http://www.r4ffy.info/Openpgp.asc >> > > GPG key ID: 0x830b1428cf91db2a on http://pgp.mit.edu:11371/ >> > > >> > > >> > > >> >> >> >> -- >> ________________________________ >> Raffaele Sommese >> Mail:[email protected] >> About me:https://about.me/r4ffy >> Gpg Key:http://www.r4ffy.info/Openpgp.asc >> GPG key ID: 0x830b1428cf91db2a on http://pgp.mit.edu:11371/ >> >> >> >
-- ________________________________ Raffaele Sommese Mail:[email protected] About me:https://about.me/r4ffy Gpg Key:http://www.r4ffy.info/Openpgp.asc GPG key ID: 0x830b1428cf91db2a on http://pgp.mit.edu:11371/ -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#1416): https://lists.iovisor.org/g/iovisor-dev/message/1416 Mute This Topic: https://lists.iovisor.org/mt/21386293/21656 Group Owner: [email protected] Unsubscribe: https://lists.iovisor.org/g/iovisor-dev/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
