GSoC: Way to get bpf obj

[Eugene Syromyatnikov]

On Thu, Aug 25, 2022 at 6:17 PM SuHsueyu <anolasc13 at gmail.com> wrote:
>
> Hello, I'm trying to retrieve info in BPF_MAP_UPDATE_ELEM. And I have
> noticed that the function fetch_bpf_obj_info is used to fetch info but
> not using the bpf syscall. I want to ask if it is right choice to
> retrieve the BPF obj info by using syscall bpf BPF_OBJ_GET_INFO_BY_FD?
> Or should I just use the function fetch_bpf_obj_info?

Well, depends on what objective you want to achieve.
fetch_bpf_obj_info() retrieves an existing object info struct from the
tracee's memory. If you want to get object information struct that we
do not have a hold of a (pertinent at the time of syscall) pointer in
tracee's memory, then we need to use the bpf syscall to get such
information from the kernel.

> --
> Strace-devel mailing list
> Strace-devel at lists.strace.io
> https://lists.strace.io/mailman/listinfo/strace-devel



-- 
Eugene Syromyatnikov
mailto:evgsyr at gmail.com
xmpp:esyr at jabber.{ru|org}