On Wed, Aug 11, 2021 at 2:23 PM Martin KaFai Lau <kafai@xxxxxx> wrote: > Instead of adding tracepoints, the bpf fexit prog can be used here and > the bpf prog will have the sk, skb, and ret available (example in fexit_test.c). > Some tracepoints in this set can also be done with bpf fentry/fexit. > Does bpf fentry/fexit work for your use case? Well, kprobe works too in this perspective. The problem with kprobe or fexit is that there is no guarantee the function still exists in kernel during iteration. Kernel is free to delete or rename it. With tracepoint, even if ip_queue_xmit() were renamed, the same tracepoint must remain in the kernel. Thanks.
