You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When submitting a bpf_perf_output using PerfEventArray::output(&self, ...) from the attached eBPF Program, the userspace side's array never returns true for readable if the array element type has a size >= 8176 bytes. I checked this both under tokio and using the blocking API.
It's possible this is just a limitation of PerfEventArrays, but I wasn't able to find anything in the bpf documentation that outlines this; I was looking for something like the docs on the PerCpuArray, which mentions the 32KB size limit. I didn't find anything. So apologies if this is a limitation and not a bug. But the verifier doesn't complain, there is no crash, the eBPF program continues to run on every packet; if I add a print after the output call, it prints. So it seems like the kernel and the VM are happy, I'm just never seeing anything in userspace.
The text was updated successfully, but these errors were encountered:
dljsjr
changed the title
[bug] Userspace never receives events on a PerfEventArray if the element size is >= 8172 bytes
[bug] Userspace never receives events on a PerfEventArray if the element size is >= 8176 bytes
Aug 23, 2024
Description
When submitting a
bpf_perf_output
usingPerfEventArray::output(&self, ...)
from the attached eBPF Program, the userspace side's array never returnstrue
forreadable
if the array element type has a size >= 8176 bytes. I checked this both undertokio
and using the blocking API.It's possible this is just a limitation of PerfEventArrays, but I wasn't able to find anything in the
bpf
documentation that outlines this; I was looking for something like the docs on the PerCpuArray, which mentions the 32KB size limit. I didn't find anything. So apologies if this is a limitation and not a bug. But the verifier doesn't complain, there is no crash, the eBPF program continues to run on every packet; if I add a print after theoutput
call, it prints. So it seems like the kernel and the VM are happy, I'm just never seeing anything in userspace.Environment
Program type:
kprobe
Feature Detection info:
Kernel:
5.15.0-119-generic
/boot/config-5.15.0-119-generic
contents: config-5.15.0-119-generic.txtSteps to reproduce
A reproduction repository based on the template can be found here: https://github.com/dljsjr/undump-aya
With the constant as defined here: https://github.com/dljsjr/undump-aya/blob/main/undump-aya-common/src/lib.rs#L8, everything works as expected.
Switching to this version of the constant a few lines down: https://github.com/dljsjr/undump-aya/blob/main/undump-aya-common/src/lib.rs#L11, no events are ever received by the userspace program.
The text was updated successfully, but these errors were encountered: