anolasc13 at gmail.com
Fri Sep 23 17:31:55 UTC 2022
The tracee call BPF_MAP_LOOKUP_ELEM with map_fd, and tracer get the map_fd.
Fds are process-scoped. For example, a bpf obj with id 4 would have fd 5 in
tracee process and fd 6 in tracer process. I found that it cannot do some
operation with the tracee map_fd like bpf_obj_pin, bpf_obj_get_info_by_fd
in tracer process.
One of the possible way to solve is use bpf_obj_pin in tracee process.
On Sat, 24 Sep 2022 at 1:16 AM Dmitry V. Levin <ldv at altlinux.org> wrote:
> On Fri, Sep 23, 2022 at 11:59:37PM +0800, SuHsueyu wrote:
> > Like the BEGIN_BPF_CMD_DECODER(BPF_MAP_LOOKUP_ELEM) in src/bpf.c, the
> > parameter "struct BPF_MAP_LOOKUP_ELEM_struct attr" have a field map_fd
> OK, but I still don't follow, what do you mean when you are saying that
> union bpf_attr.map_fd "may differ under tracee and tracer"?
> Strace-devel mailing list
> Strace-devel at lists.strace.io
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Strace-devel