Hi! Is it possible to pass full ethernet packet from XDP to user-mode app using BCC? I wrote C code like this: BPF_PERF_OUTPUT(captured_data); int capture(struct xdp_md *ctx) { captured_data.perf_subm

I'v read this blog post https://facebookmicrosites.github.io/bpf/blog/2020/02/19/bpf-portability-and-co-re.html And want to apply this technique to my program: extern u32 LINUX_KERNEL_VERSION __kconfi

Hi, I'm looking into BTF and it's use case. Based on the document I understood to run BPF programs across different kernel versions, it needs to build with libbpf which depends on the BTF information.

Hello, I was wondering if BCC implements the new BPF feature (as of kernel 5.10) to allow BPF programs to utilize both BPF tail calls and BPF subprograms. This behavior is described near the end of th

The other day I was in the process of porting a little libbpf application from Ubuntu 20 (Linux 5.4) to CentOS 8 (Linux 4.18). This program uses tracepoint:tcp:tcp_send_reset. Here's the relevant BPF

Hi *, I managed to setup adeb on a pixel4 with custom kernel compiled as suggested by adeb's README. The setup is working fine for some BCC tools, as vfsstat but a few as opensnoop and the trace comma

Hi, I am trying to write a BPF perf event program to get CPU runq length. The Following is the code snippet. I am observing that a big integer (len is 2839296536 ) as queue length in trace output for

Bcc has funclatency.py which support get function latency for the user program, using pid_tgid as the key. But when it comes to a program was written by golang which supports coroutine(goroutine), it

Hi all. Currently debugging a very strange behaviour with eBPF hash maps and was wondering if anyone else has run into a similar issue? I am using libbpf-rs with BPF CO-RE and my kernel version is 5.9

Hello Yonghong, all, I'm curious about a verifier workaround that Yonghong provided two years ago, in this thread. Brendan Gregg was asking about accessing stack buffers through a register with a vari

Hello, [Warning ⚠] Do you understand how to built bpf.file for snort on fedora? Thank you in advance, I hope the success, Regards. Dorian Rosse Téléchargez Outlook pour Android

I'm currently working on a python script to trace the nvme driver. I'm hitting a performance bottleneck on the event callback in python and am looking for the best way (or maybe a quick and dirty way)

Hi all, I am trying to find a way to represent wildcards in BPF Map Keys? I could not find anything relevant to that, does anyone know anything further. Are there any efforts towards that functionalit

Hi all, I am learning about ebpf and the bcc tools/library. I have a question about dynamic uprobe of C++ code. I have been able to attach a uprobe successfully by looking up the mangled symbol name.

G'Day all, I have colleagues working on BCC Python tools (e.g., the recent enhancement of tcpconnect.py) and I'm wondering, given libbpf tools, what our advice should be. - Should we keep both Python

Hello everyone! I am experiencing some issues with the execveat tracepoints, and was wondering if others could reproduce it or help me understand what I am doing wrong. On Arch Linux (kernel 5.9.1, pe

Does the LLVM version used by bcc matter, for packaging purposes? I assume bcc includes some static libraries from LLVM, so I'm curious if the older versions are acceptable. For instance, on ubuntu 16

Thanks a lot, Yonghong. From your response: 1. How can I make a kernel function use the return value of a eBPF program/function? 2. An KProbes related question: from an old article https://lwn.net/Art

Hello BPF community, I am looking for a way to move a user space program's disk I/O scheduling related logic down to kernel space, and then have the new kernel logic communicate with the user space pr

Hi, I am looking for tracking inbound connections on a system using tracepoints/kprobes. I was checking "trace_inet_sock_set_state", with which we can track the state changes during connection establi