When submitting a bpf_perf_output using PerfEventArray::output(&self, ...) from the attached eBPF Program, the userspace side's array never returns true for readable if the array element type has a size >= 8176 bytes. I checked this both under tokio and using the blocking API.
It's possible this is just a limitation of PerfEventArrays, but I wasn't able to find anything in the bpf documentation that outlines this; I was looking for something like the docs on the PerCpuArray, which mentions the 32KB size limit. I didn't find anything. So apologies if this is a limitation and not a bug. But the verifier doesn't complain, there is no crash, the eBPF program continues to run on every packet; if I add a print after the output call, it prints. So it seems like the kernel and the VM are happy, I'm just never seeing anything in userspace.
Description
When submitting a
bpf_perf_output
usingPerfEventArray::output(&self, ...)
from the attached eBPF Program, the userspace side's array never returnstrue
forreadable
if the array element type has a size >= 8176 bytes. I checked this both undertokio
and using the blocking API.It's possible this is just a limitation of PerfEventArrays, but I wasn't able to find anything in the
bpf
documentation that outlines this; I was looking for something like the docs on the PerCpuArray, which mentions the 32KB size limit. I didn't find anything. So apologies if this is a limitation and not a bug. But the verifier doesn't complain, there is no crash, the eBPF program continues to run on every packet; if I add a print after theoutput
call, it prints. So it seems like the kernel and the VM are happy, I'm just never seeing anything in userspace.Environment
Program type:
kprobe
Feature Detection info:
Kernel:
5.15.0-119-generic
/boot/config-5.15.0-119-generic
contents: config-5.15.0-119-generic.txtSteps to reproduce
A reproduction repository based on the template can be found here: https://github.com/dljsjr/undump-aya
With the constant as defined here: https://github.com/dljsjr/undump-aya/blob/main/undump-aya-common/src/lib.rs#L8, everything works as expected.
Switching to this version of the constant a few lines down: https://github.com/dljsjr/undump-aya/blob/main/undump-aya-common/src/lib.rs#L11, no events are ever received by the userspace program.