CC Dave Thank you. Due to Microsoft policies we avoid reading code with strong licensing (like GPL 2.0). Is there some other documentation of the flags, or could you explain them in words? Or is that the complete flags description (which is in other documentation) and I am misunderstanding the code below? https://github.com/cilium/cilium/blob/3fa44b59eef792e28f70b1fd23e3e17e426909f5/bpf/lib/dbg.h#L229 It looks to me here like the capture length is being OR'd into the flags. Any insights would be appreciated. Thanks, Michael ________________________________________ From: Yonghong Song <yonghong.song@xxxxxxxxx> Sent: Friday, July 26, 2024 9:58 AM To: Michael Agun <danielagun@xxxxxxxxxxxxx>; bpf@xxxxxxxxxxxxxxx <bpf@xxxxxxxxxxxxxxx>; bpf@xxxxxxxx <bpf@xxxxxxxx> Subject: [EXTERNAL] Re: perf_event_output payload capture flags? [You don't often get email from yonghong.song@xxxxxxxxx. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] On 7/25/24 6:42 PM, Michael Agun wrote: > Are the perf_event_output flags (and what the event blob looks like) documented? Especially for the program type specific perf_event_output functions. The documentation is in uapi/linux/bpf.h header. https://github.com/torvalds/linux/blob/master/include/uapi/linux/bpf.h#L2353-L2397 * The *flags* are used to indicate the index in *map* for which * the value must be put, masked with **BPF_F_INDEX_MASK**. * Alternatively, *flags* can be set to **BPF_F_CURRENT_CPU** * to indicate that the index of the current CPU core should be * used. > > I've seen notes in (cilium) code passing payload lengths in the flags, and am specifically interested in how the event blob is constructed for perf events with payload capture. Could you share more details about 'passing payload lengths in the flags'? AFAIK, networking bpf_perf_event_output() actually utilizes bpf_event_output_data(), in which 'flags' semantics has the same meaning as the above. > > > Thanks, > Michael
