As per discussion on the channel, I'm trying to read packet data with a kernel program

It seems like the compiler is eliminating the line <div class="snippet-clipboard-c

Perf event output not reading packet data about ebpf HOT 1 CLOSED

cilium commented on May 29, 2024

Perf event output not reading packet data

from ebpf.

Comments (1)

lmb commented on May 29, 2024

It seems like the compiler is eliminating the line

flags |= (__u64) sample_size << 32;

for whatever reason:

$ llvm-objdump-9 -S elfs/send.o 

elfs/send.o:	file format ELF64-BPF


Disassembly of section xdp/send:

0000000000000000 xdp_send_prog:
       0:	61 12 00 00 00 00 00 00	r2 = *(u32 *)(r1 + 0)
       1:	61 13 04 00 00 00 00 00	r3 = *(u32 *)(r1 + 4)
       2:	3d 32 0c 00 00 00 00 00	if r2 >= r3 goto +12 <LBB0_2>
       3:	b7 04 00 00 ad de 00 00	r4 = 57005
       4:	6b 4a f8 ff 00 00 00 00	*(u16 *)(r10 - 8) = r4
       5:	1f 23 00 00 00 00 00 00	r3 -= r2
       6:	6b 3a fa ff 00 00 00 00	*(u16 *)(r10 - 6) = r3
       7:	bf a4 00 00 00 00 00 00	r4 = r10
       8:	07 04 00 00 f8 ff ff ff	r4 += -8
       9:	18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00	r2 = 0 ll
      11:	18 03 00 00 ff ff ff ff 00 00 00 00 00 00 00 00	r3 = 4294967295 ll
      13:	b7 05 00 00 04 00 00 00	r5 = 4
      14:	85 00 00 00 19 00 00 00	call 25

0000000000000078 LBB0_2:
      15:	b7 00 00 00 02 00 00 00	r0 = 2
      16:	95 00 00 00 00 00 00 00	exit

The line

      11:	18 03 00 00 ff ff ff ff 00 00 00 00 00 00 00 00	r3 = 4294967295 ll

means that the third argument (r3) is always set to 4294967295 which is just the decimal representation of 0xffffffff aka BPF_F_CURRENT_CPU. My suspicion is that there is some weirdness because sample_size is 16 bits wide, but then shifted left by 32 bits which always produces zero.

Try something like the following: