Sample Header Ad - 728x90

eBPF `bpf_core_read` returns incorrect value

0 votes
1 answer
51 views
As @andy-dalton suggests. I changed type of err and initialized it. But it still outputs the same results. The modified code:
SEC("sockops")
int bpf_sockops_cb(struct bpf_sock_ops *skops) {
    u32 op = 0;

    long err;

    err = bpf_core_read(&op, sizeof(op), &skops->op);
    if (err) {
        bpf_printk("err code %ld\n", err);
    }

    bpf_printk("op1 = %u, op2 = %u \n", op, skops->op);

    return 0;
}
The outputs:
curl-286392   ....1 44631.729219: bpf_trace_printk: op1 = 3245625024, op2 = 3 

            curl-286392   ....1 44631.729223: bpf_trace_printk: op1 = 3245625024, op2 = 2 

            curl-286392   ....1 44631.729223: bpf_trace_printk: op1 = 3245625024, op2 = 1 

            curl-286392   ....1 44631.729224: bpf_trace_printk: op1 = 3245625024, op2 = 6
---------- My eBPF program as follows.
#include "vmlinux.h"
#include 
#include 
#include 
#include 
#include "common.h"

char __license[] SEC("license") = "GPL";

SEC("sockops")
int bpf_sockops_cb(struct bpf_sock_ops *skops) {
	u32 op;

    int err;

    err = bpf_core_read(&op, sizeof(op), &skops->op);
    if (err) {
        bpf_printk("err\n");
    }

    bpf_printk("op1 = %u, op2 = %u \n", op, skops->op);

	return 0;
}
When I check the tracing output by cat /sys/kernel/debug/tracing/trace_pipe, it shows that op1 != op2.
curl-1466326  ....1 241519.609044: bpf_trace_printk: op1 = 3913290112, op2 = 3 

            curl-1466326  ....1 241519.609048: bpf_trace_printk: op1 = 3913290112, op2 = 2 

            curl-1466326  ....1 241519.609048: bpf_trace_printk: op1 = 3913290112, op2 = 1 

            curl-1466326  ....1 241519.609049: bpf_trace_printk: op1 = 3913290112, op2 = 6
Why does op1 and op2 become different ?
Asked by maplgebra (121 rep)
Dec 9, 2024, 06:13 AM
Last activity: Dec 10, 2024, 03:22 AM