ในวันที่ อ. 2 พ.ย. 2021 21:31 น. Eelco Chaudron <echaudro@...> เขียนว่า:

#bcc

Thanks, I was looking at BCC to solve this in the wrappers, but you are right, as simple BPF_TABLE() solved it. //Eelco

#bcc

You can check return value of map.ringbuf_reserve(). If the reservation failed, you can notify user space through map, another side channel ringbuf, perf buf, etc. Depending on your program type and p

#bcc

Thought I added the #bcc tag but I no longer see it :( So just in case, it's not clear, this is with BCC.

#bcc

I am happy to take a look at the code and see if I can improve it at all. Thanks, Donald.

#bcc

This is a good question. In earlier bpf days, the key MUST be from stack. Otherwise, the verifier will fail. Nowadays, things become better and keys can be from verifier recognizable memory regions (s

#bcc

Is there a reason why map.increment() internally copies the key into a stack variable? When building a key inline, it uses double the stack space and incurs the cost of a copy. For u64 keys this is fi

#bcc

<federico.parola@...> wrote: Thanks, Federico and others. Maybe one of you can add it to the reference_guide.md? We do have events.perf_submit there. Thanks!

#bcc

Hi, the virtual function you are looking for is perf_submit_skb(): https://github.com/iovisor/bcc/blob/c8de00e1746e242cdcd68b4673a083bb467cd35e/src/cc/export/helpers.h#L193 Strangely it is not documen

#bcc

Hi! Is it possible to pass full ethernet packet from XDP to user-mode app using BCC? I wrote C code like this: BPF_PERF_OUTPUT(captured_data); int capture(struct xdp_md *ctx) { captured_data.perf_subm

#bcc

"Daniel Xu" <dxu@...> writes: Yeah, that's a RHEL version number (RHEL8.2 in this case, as seen by the "el8_2" bit). Which means that as far as features are concerned, the 4.18 version number is

#bcc

What distro are you using? Your distro probably backported BTF support. Daniel

#bcc

Thank you for confirming! Go it. I'm following the discussion thread and patch. Thank you so much for your time.

#bcc

Yes, correct. Yes, you can, if you have vmlinux image with DWARF information in it. You can use pahole tool like this to add .BTF section to vmlinux image: pahole -J <path-to-vmlinux-image> You most p

#bcc

Thanks Andrii, for detailed answer. Yes you are right, I'm looking for CO-RE. Basically I'm trying to build the eBPF program which can run on any linux kernel version using libbpf What I understood fr

#bcc

"Andrii Nakryiko" <andrii.nakryiko@...> writes: Yeah, that looks like a RHEL/CentOS kernel version number, which means the 4.18 bit is mostly fiction at this point (at least as far as BPF is con

#bcc

/sys/kernel/btf/vmlinux appeared in 5.4 kernel (upstream version). If you see it on 4.18, that means someone backported the changes. But for BPF CO-RE (which I assume is what you are referring to) to

#bcc

bg.salunke09@... asked: The basic support appears to have been added by commit e83b9f55448afce3fe1abcd1d10db9584f8042a6 Author: Andrii Nakryiko <andriin@...> Date: Tue Apr 2 09:49:50 2019 -07

#bcc

Hi, I'm looking into BTF and it's use case. Based on the document I understood to run BPF programs across different kernel versions, it needs to build with libbpf which depends on the BTF information.

#bcc

Hi all, I am learning about ebpf and the bcc tools/library. I have a question about dynamic uprobe of C++ code. I have been able to attach a uprobe successfully by looking up the mangled symbol name.

#bcc