40 questions
- Bountied 0
- Unanswered
- Frequent
- Score
- Trending
- Week
- Month
- Unanswered (my tags)
0
votes
1
answer
180
views
why sys_enter_execve get program name through bpf_get_current_comm
I am developing eBPF programming. Sometimes I cannot get the program name using execve, but I can use execv and syscall (SYS_execve,...). The specific code is as follows:
ebpf code
static u32 ...
0
votes
1
answer
90
views
Adding condition for comparing Guid on breakpoint using Visual Studio 2022
I am still learning debugging tools on Visual Studio 2022. How do you use the conditional option on breakpoint to compare values with Guid.
I want to use the capabilities of debugging tools in order ...
0
votes
1
answer
138
views
Can I see on debug / breakpoint / tracepoint on how much times a method run using Visual Studio 2022
I have a custom attribute class. The custom attribute runs on every request. Since my requests are async. I want to know how many times my method on custom attribute runs.
Is there a way to count the ...
2
votes
0
answers
195
views
Syscall tracepoints missing in custom 5.15 aarch64 android kernel for Pixel 6
I recompiled a custom 5.15 kernel for my Android Pixel 6 phone with Android 13 with event tracing enabled (especially syscall tracepoints).
After booting, the kernel does not have the /sys/kernel/...
2
votes
1
answer
108
views
Visual Studio Debugger: Is it possible to add Tracepoints with a common action?
I am adding tracepoints for debugging in Visual Studio 2022 with a common action.
(In my case: "{TimeSpan.FromTicks(DateTime.Now.Ticks).TotalSeconds}")
Instead of copy-pasting in the same ...
0
votes
1
answer
160
views
Using a program of type raw_tracepoint to trace sched_wakeup,bpf verifies that task_struct *p is empty
I used the program type tracepoint, tracepoint /sched/sched_wakeup, and the function parameter tracepoint format。But I changed the raw_tracepoint type, it is not useful, error:loading objects: field ...
0
votes
0
answers
308
views
modpost: "__tracepoint_sched_switch" was exported without definition
I am trying to build a kernel module(.ko) to trace context switch of system. So I use the sched_switch tracepoint and want to register my function to it. But When I build my code, there are some ...
0
votes
1
answer
624
views
How to bpf_probe_read_str all ctx->argv elements in kernel space and forward it to the userspace?
I am new to eBPF and currently trying to send all the executed commands with arguments in the userspace using a perf map.
I manage to send most of my data, but not the one accessed with ...
0
votes
0
answers
395
views
Tracing with eBPF tracepoint "netif_receive_skb" for multiple NICs
I am trying to capture incoming packets with tracepoint events in the net category. As per this blog, netif_receive_skb seems to be a suitable tracepoint (one of the earliest points in the networking ...
2
votes
1
answer
764
views
Extracting UDP packet payload with eBPF tracepoints using libbpf
I am trying to retrieve the payload of UDP packets using tracepoint netif_receive_skb at the receiver. The goal is to get the packet payload and send it to userspace for further processing.
Method 1:
...
1
vote
1
answer
205
views
Incorrect address displayed by bpf_printk
I have a eBPF function that is attached to the page_fault_user tracepoint.
struct trace_event_raw_x86_exceptions {
struct trace_entry ent;
long unsigned int address;
long unsigned int ip;
...
0
votes
1
answer
991
views
tracepoint/syscalls/sys_enter_execve missing args
I use cilium-ebpf to write some simple monitoring programs. Currently I want to use tracepoint/syscalls/sys_enter_execve to get argv. but I am having problems with missing arguments.
The following is ...
0
votes
1
answer
2k
views
error mounting "/sys/kernel/debug/tracing" to rootfs
I'm using ebpf in container environment to trace several kernel tracepoints.
Part of the code is shown beloew:
SEC("tp/sched/sched_wakeup")
int handle__sched_wakeup(struct ...
4
votes
1
answer
4k
views
How to get bpftool to attach a program to a tracepoint?
I have the following simple eBPF program:
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
struct sys_enter_execve_ctx {
unsigned short common_type;
unsigned char common_flags;
...
2
votes
2
answers
2k
views
eBPF vs non-eBPF tracepoint/kprobes
As per this document (amongst others): https://blogs.oracle.com/linux/post/taming-tracepoints-in-the-linux-kernel
It is possible using both eBPF and other kernel-provided mechanisms to register ...