1. How do I attach `BPF_PROG_TYPE_SCHED_CLS`/`classifier` BPF programs to specific data path(i.e. ingress or egress) using libbpf ? I found some comments related in the source: ``` The

Thanks for your help with this - and for the sketch of how to proceed with it. I'm going to look into the feasibility of fixing the frame pointer in the trampoline before attempting what you have

<ys114321=gmail.com@...> wrote: I briefly looked at the perf and kernel code and experimented with perf dwarf mode. It is possible for bpf to copy user stack to user space. You could

<bradley@...> wrote: The bpf stack unwinder is using the kernel one which is the frame pointer based and it may have issues with generated trampoline code which may mess up frame

I still digging into this issue, and have hacked memleak/bcc to show addresses when they cant be resolved. In other places, I'm seeing jit complied java stack frames showing up alongside C ones, which

The file perf-18047.map is there and from other parts of the stack trace I can see it being used to successfully resolve symbols. Thanks! On 7/4/21, 4:44 am, "Y Song" <ys114321@...>

<bradley@...> wrote: I have no experience with perf-map-agent, but the following is what I guess: [perf-18047.map] is used to find the mapping between address and symbol. What does

We are pleased to announce the Call for Proposals (CFP) for the Networking and BPF track at the 2021 edition of the Linux Plumbers Conference (LPC), which is planned to be held in Dublin, Ireland, on

Thanks for the suggestion. I found a tunable to keep the JNI shared library in memory after loading. As you can see below, it is no longer showing as deleted. 13238272 bytes in 404 allocations from

<bradley@...> wrote: I can see the file has been marked as deleted. 34603008 bytes in 33 allocations from stack [unknown] [jna9005484735610534564.tmp (deleted)]

Hi, I’m just starting to come to grips with bcc & perf-map-agent for introspecting java on linux, with the goal of identifying what appears to be an off-heap memory leak (using memleak). I

Hi Y Song, Loop is forbidden in BPF programs (although bounded loop is supported from linux-5.3, tracking down to NULL se->parent is un-bounded). Maybe it's worth trying to get the definition

Could you file an "issue" for the question? This issue, the questions/answers can be easily tracked. There are some answers in this issue: https://github.com/iovisor/bcc/issues/3093 To be accurate

<federico.parola@...> wrote: Thanks, Federico and others. Maybe one of you can add it to the reference_guide.md? We do have events.perf_submit there. Thanks!

Hi, the virtual function you are looking for is perf_submit_skb(): https://github.com/iovisor/bcc/blob/c8de00e1746e242cdcd68b4673a083bb467cd35e/src/cc/export/helpers.h#L193 Strangely it is not

Hi! Is it possible to pass full ethernet packet from XDP to user-mode app using BCC? I wrote C code like this: BPF_PERF_OUTPUT(captured_data); int capture(struct xdp_md *ctx) {

It will soon be part of bpf_helpers.h, but meanwhile just copy/paste it into your code. See https://patchwork.kernel.org/project/netdevbpf/patch/20210317200510.1354627-2-andrii@.../ >

I'v read this blog post https://facebookmicrosites.github.io/bpf/blog/2020/02/19/bpf-portability-and-co-re.html And want to apply this technique to my program:

"Daniel Xu" <dxu@...> writes: Yeah, that's a RHEL version number (RHEL8.2 in this case, as seen by the "el8_2" bit). Which means that as far as features are concerned, the 4.18 version number

What distro are you using? Your distro probably backported BTF support. Daniel