<ys114321=gmail.com@...> wrote: The reason for the failure is due spill/reload does not preserve the original register state for scalar value. Look at the kernel function: static bool

Hi; We're trying to integrate bcc as a package in buildroot with the configuration shown below: - Target board : Raspberry PI 3. - Toolchain : Arm ARM 2018.11 - LLVM 7.0.1 However, buildroot

Hi, I'm new to BPF. I'm trying to write a program that analyses the structure o= f DNS requests. I keep getting the following error (bellow) at a certain point in the code (bellow). The error only

Here a python 2 version.

I took a brief look. Indeed, it is very strange. I can see proper value of udp_len is stored into r10 - 40, but when it is retrieved later, the value became unkown.... I will try to experiment with

I tried to understand again this verifier error again and probably my previous post does not contain enough information. I understand that :93: (67) r0 <<= 32294: (c7) r0 s>>= 32295: (b7) r1 = 0296:

The be16 is to convert r3 with big endian encoding. If the host system is big endian, it will do nothing. Otherwise, it will convert from little endian to big endian. Yes, there is no documentation.

Hi Guys, My agenda for next meeting: 1) unifying and centralizing XDP statistics accounting [1]. 2) XDP resource management, User API [2]. 3) XDP meta data via btf (in kernel BTF registration). 4)

I suspect I fall in another issue with verifier. This code (taking from katran : I just changed data_size type to __u32): __attribute__((__always_inline__))static inline void ipv4_l4_csum(void

Does it mean that r3 is considered as be16 ? I do not understand why as I explicitly convert it in u16. This output language is a readable format of bpf bytecode, right ? Is there any documentation

Yonghong Song writes: I had run into similar issue when debugging some other rejection before JMP32 introduced when LLVM was generating similar sequences under defult 64-bit mode, but IIRC LLVM

This is caused by compiler optimizations. r3 get the value from memory, its value could be any one as permitted by the type. test is done by r2. We indeed get better range for r2

You should be able to do the work with C as well. Just use APIs from libbpf.h, e.g., bpf_prog_get_next_id, bpf_prog_get_fd_by_id, bpf_map_get_fd_by_id. Yes, we may miss bpf_map_get_next_id and

Hi All, Thank you for joining the call today. Here are my notes from the discussion. Thanks, Brenden === Discussion === Brenden: * Plan to tag release to coincide with kernel 5.0 Brendan: *

I'm playing with bcc to prototype an UDP load balancer. I'm facing an issue that I didn't succeed to understand... In my code I tried to validate my UDP packet using code like this : struct

Please join us tomorrow for our bi-weekly call. As usual, this meeting is open to everybody and completely optional. You might be interested to join if: You want to know what is going on in BPF

Thanks for that! I think those work because bcc has given utilities to do that. I am using C and we use libbpf to load programs and to do map operations. Do you know if we can achieve it in this way

In examples/cpp, we have UseExternalMap.cc, which gives an example of how to share maps between two processes with C++ interface. Basically, if you know the ID of the map in another application

Hi, I have two eBPF programs, each with its own user and kernel programs. One of the programs defines an eBPF map. How do I access this map from another eBPF kernel program? PS: I can pin the map and

Hi, I'm trying to access the packet content in tcp_transmit_skb using eBPF/BCC. I defined kprobe____tcp_transmit_skb/kretprobe____tcp_transmit_skb functions. Since in kretprobe we cannot access the