On Sun, Oct 20, 2019 at 3:58 AM Toke Høiland-Jørgensen <toke@xxxxxxxxxx> wrote: > Great! I think it's probably more productive for everyone involved if I > just wait for you to get around to this, rather than try my own hand at > this. I'll go hash out the userspace management semantics of chain calls > in the meantime (using my kernel support patch), since that will surely > be needed anyway. No problem. Indirect calls are next on my todo list. Shouldn't take long. Right now I'm hacking accelerated kretprobes for tracing. I've shared first rough draft of patches with few folks and they quickly pointed out that the same logic can be used to create arbitrary call chains. To make kretprobe+bpf fast I'm replacing: call foo with prologue capture args call foo capture return call bpf_prog epilogue That "call foo" can be anything. Including another bpf prog. Patches are too rough for public review. I hope to get them cleaned up by the end of next week. Jesper request to capture both struct xdp_md and return value after prog returns will be possible soon. xdpdump before and after xdp prog.. here I come :)