I'm curios to know how bpf_probe_read is able to read user-mode memory
in the face of page faulting.
I know in the helper it disables page faulting, but what does that mean?
If the memory the probe is trying to read is paged out then how does
my probe work?
It seems bpf_probe_read is best
Imagine I have a per-cpu perf ring buffer for all my cpus.
Now I have two eBPF programs.
In both these eBPF programs I do bpf_update_elem(myFD, ,
, BPF_ANY)
Will this mean that multiple eBPF programs will be able to write their
data into a single buffer (of course associated with cpu).
This
On Sun, Feb 16, 2020 at 5:09 PM Hayden Livingston
wrote:
>
> Thanks. I had to re-read your reply and the kernel code multiple
> times, but I think I get it now. Please confirm.
>
> It is this call is made by user mode code:
>
> fd = bpf_create_map(BPF_MAP_TYPE_PERF_EVENT_ARRAY, /*key_size*/
>
Thanks. I had to re-read your reply and the kernel code multiple
times, but I think I get it now. Please confirm.
It is this call is made by user mode code:
fd = bpf_create_map(BPF_MAP_TYPE_PERF_EVENT_ARRAY, /*key_size*/
sizeof(int), /*value_size*/ sizeof(int), NUM_POSSIBLE_CPUS, 0);
key is
PERF_EVENT_OUTPUT map is to hold per cpu ring buffers created by
perf_event_open.
That is why its typical size is the number of cpus on the host.
On Sun, Feb 16, 2020 at 1:52 AM Hayden Livingston
wrote:
>
> I'm very confused why BCC creates a map of number of processors for
> the perf_events
I'm very confused why BCC creates a map of number of processors for
the perf_events output map.
I can imagine it being 1 since all it does is act as a kernel-user
mode intermediary and it is true that the code cannot be preempted.
Or if it can be preempted then I can imagine that since there
