Leon Hwang

failed to `--output-skb`

4

```bash # ./pwru --output-skb 2021/11/25 16:47:00 Loading objects: field KprobeSkb1: program kprobe_skb_1: load program: invalid argument: BPF_STX uses reserved fields processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states...

Support for linux/mipsle

4

I want to cross-compile dlv to linux/mipsle. `GOOS=linux GOARCH="mipsle" GOMIPS="softfloat" go build -o ~/go/bin/dlv-mipsle ~/go/src/github.com/derekparker/delve/cmd/dlv/*.go \# github.com/derekparker/delve/pkg/proc ../../go/src/github.com/derekparker/delve/pkg/proc/disasm.go:11:14: undefined: ArchInst`

1. Use `log` to show timestamp. 2. Show function time cost.

feat: Support pcap-filter expression for pcap mode

1

Fix #474 It's better to use pcap-filter expression to filter packets like tcpdump instead of `--port` like options. There are two ways to use pcap-filter: 1. `./bin/ecapture tls -m pcap...

link: link types are missing in gentypes

1

By referencing `bpftool link`, there are two missing functions: `LinkGetNextID()` and `NewLinkFromID()`. Then, when I want to implement them, `LinkGetNextIdAttr`, `LinkGetNextID()` and `LinkGetFDByID()` are missing in `sys/types.go` generated by `gentypes`....

Fix get_func_ip for --filter-trace-tc

6

Fix #293 . `bpf_get_func_ip()` is supported since 5.15 kernel. - [bpf: Add bpf_get_func_ip helper for tracing programs](https://github.com/torvalds/linux/commit/9b99edcae5c80c8fb9f8e7149bae528c9e610a72) As a result, we have to figure out a way to avoid `bpf_get_func_ip()`....

Support tracing XDP

12

Fix #239 Support tracing XDP Add an option --filter-trace-xdp to trace all XDP progs on host by fentry-ing on the progs, like the way tracing tc-bpf https://github.com/Asphaltt/pwru/commit/2347755900fffe100ab9eebaa180bb9f482df6fb. The diff from...

Refactor code of attaching kprobe and attaching skb-tracking kprobe. Signed-off-by: Leon Hwang

fix: Get bpf prog entry func name from insns

1

It is possible to get wrong entry func name of bpf prog when there is info of multiple bpf progs in the BTF. Instead, get the very first symbol from...