Is there a reason why map.increment() internally copies the key into a stack variable? When building a key inline, it uses double the stack space and incurs the cost of a copy. For u64 keys this is fi

1. How do I attach `BPF_PROG_TYPE_SCHED_CLS`/`classifier` BPF programs to specific data path(i.e. ingress or egress) using libbpf ? I found some comments related in the source: ``` The **BPF_F_INGRESS

I still digging into this issue, and have hacked memleak/bcc to show addresses when they cant be resolved. In other places, I'm seeing jit complied java stack frames showing up alongside C ones, which

Hi, I’m just starting to come to grips with bcc & perf-map-agent for introspecting java on linux, with the goal of identifying what appears to be an off-heap memory leak (using memleak). I appear to b

We are pleased to announce the Call for Proposals (CFP) for the Networking and BPF track at the 2021 edition of the Linux Plumbers Conference (LPC), which is planned to be held in Dublin, Ireland, on

Hi, when I looked into the runqlen script yesterday, I found that, sadly, I misunderstood the "queue length" all the time not only the "length" part but also the "queue" part. Queue ===== Only CFS run

Hi! Is it possible to pass full ethernet packet from XDP to user-mode app using BCC? I wrote C code like this: BPF_PERF_OUTPUT(captured_data); int capture(struct xdp_md *ctx) { captured_data.perf_subm

I'v read this blog post https://facebookmicrosites.github.io/bpf/blog/2020/02/19/bpf-portability-and-co-re.html And want to apply this technique to my program: extern u32 LINUX_KERNEL_VERSION __kconfi

Hi, I'm looking into BTF and it's use case. Based on the document I understood to run BPF programs across different kernel versions, it needs to build with libbpf which depends on the BTF information.

Hello, I was wondering if BCC implements the new BPF feature (as of kernel 5.10) to allow BPF programs to utilize both BPF tail calls and BPF subprograms. This behavior is described near the end of th

The other day I was in the process of porting a little libbpf application from Ubuntu 20 (Linux 5.4) to CentOS 8 (Linux 4.18). This program uses tracepoint:tcp:tcp_send_reset. Here's the relevant BPF

Hi *, I managed to setup adeb on a pixel4 with custom kernel compiled as suggested by adeb's README. The setup is working fine for some BCC tools, as vfsstat but a few as opensnoop and the trace comma

Hi, I am trying to write a BPF perf event program to get CPU runq length. The Following is the code snippet. I am observing that a big integer (len is 2839296536 ) as queue length in trace output for

Bcc has funclatency.py which support get function latency for the user program, using pid_tgid as the key. But when it comes to a program was written by golang which supports coroutine(goroutine), it

Hi all. Currently debugging a very strange behaviour with eBPF hash maps and was wondering if anyone else has run into a similar issue? I am using libbpf-rs with BPF CO-RE and my kernel version is 5.9

Hello Yonghong, all, I'm curious about a verifier workaround that Yonghong provided two years ago, in this thread. Brendan Gregg was asking about accessing stack buffers through a register with a vari

Hello, [Warning ⚠] Do you understand how to built bpf.file for snort on fedora? Thank you in advance, I hope the success, Regards. Dorian Rosse Téléchargez Outlook pour Android

I'm currently working on a python script to trace the nvme driver. I'm hitting a performance bottleneck on the event callback in python and am looking for the best way (or maybe a quick and dirty way)

Hi all, I am trying to find a way to represent wildcards in BPF Map Keys? I could not find anything relevant to that, does anyone know anything further. Are there any efforts towards that functionalit

Hi all, I am learning about ebpf and the bcc tools/library. I have a question about dynamic uprobe of C++ code. I have been able to attach a uprobe successfully by looking up the mangled symbol name.