The other day I was in the process of porting a little libbpf application from Ubuntu 20 (Linux 5.4) to CentOS 8 (Linux 4.18). This program uses tracepoint:tcp:tcp_send_reset. Here's the relevant BPF

Unfortunately, the value is defined in Makefile, ``` ifeq ($(CONFIG_KASAN_SW_TAGS), y) KASAN_SHADOW_SCALE_SHIFT := 4 else ifeq ($(CONFIG_KASAN_GENERIC), y) KASAN_SHADOW_SCALE_SHIFT :=

Take a look at bcc tool runqlen.py. Did you get abnormal len with runqlen.py?

Hi, I am trying to write a BPF perf event program to get CPU runq length. The Following is the code snippet. I am observing that a big integer (len is 2839296536 ) as queue length in trace output

Hi *, I managed to setup adeb on a pixel4 with custom kernel compiled as suggested by adeb's README. The setup is working fine for some BCC tools, as vfsstat but a few as opensnoop and the trace

Bcc has funclatency.py which support get function latency for the user program, using pid_tgid as the key. But when it comes to a program was written by golang which supports coroutine(goroutine), it

<williamfindlay@...> wrote: Does your key data structure have padding? Different padding values will cause different actual keys. If padding is not an issue in your case, could you

Hi all. Currently debugging a very strange behaviour with eBPF hash maps and was wondering if anyone else has run into a similar issue? I am using libbpf-rs with BPF CO-RE and my kernel

I think your above assessment is kind of correct. For any read/write to stack in bpf programs, the stack offset must be known so the verifier knows exactly what the program tries to do. For

I cannot remember details. Here, what "memset" did is to initialize related bytes in stack to 0. I guess maybe at that point bpf_probe_read_str requires an initialized memory? Right now,

For posterity, I think I can now answer my own question. I suspect things were different in 2018 (because otherwise I don’t see how the referenced exchange makes sense); here’s my understanding

Hello Yonghong, all, I'm curious about a verifier workaround that Yonghong provided two years ago, in this thread. Brendan Gregg was asking about accessing stack buffers through a register with a

Hello, [Warning ⚠] Do you understand how to built bpf.file for snort on fedora? Thank you in advance, I hope the success, Regards. Dorian Rosse Téléchargez Outlook pour Android

Hi, Ideally you’d want to do as much work in the kernel as possible. Passing that much data to user space is kind of mis using bpf. What kind of work are you doing that can only be done in user

<dimolianis.marinos@...> wrote: eBPF/XDP. Right, BPF does not have TCAM style maps. If you organize data structure properly, you may be able to use LPM.

I'm currently working on a python script to trace the nvme driver. I'm hitting a performance bottleneck on the event callback in python and am looking for the best way (or maybe a quick and dirty way)

Thanks for the response. LPM is actually the closest solution however I wanted a structure closer to the way TCAMs operate in which you can have wildcards also in the interim bits. I believe that

The closest map is lpm (trie) map. You may want to take a look.

Hi all, I am trying to find a way to represent wildcards in BPF Map Keys? I could not find anything relevant to that, does anyone know anything further. Are there any efforts towards that

Hi all, I am learning about ebpf and the bcc tools/library. I have a question about dynamic uprobe of C++ code. I have been able to attach a uprobe successfully by looking up the mangled symbol name.