[Bpf] Re: perf_event_output payload capture flags?

[Yonghong Song <[e-mail]>]

On 7/25/24 6:42 PM, Michael Agun wrote:
> Are the perf_event_output flags (and what the event blob looks like) documented? Especially for the program type specific perf_event_output functions.

The documentation is in uapi/linux/bpf.h header.

https://github.com/torvalds/linux/blob/master/include/uapi/linux/bpf.h#L2353-L2397

  *         The *flags* are used to indicate the index in *map* for which
  *         the value must be put, masked with **BPF_F_INDEX_MASK**.
  *         Alternatively, *flags* can be set to **BPF_F_CURRENT_CPU**
  *         to indicate that the index of the current CPU core should be
  *         used.

>
> I've seen notes in (cilium) code passing payload lengths in the flags, and am specifically interested in how the event blob is constructed for perf events with payload capture.

Could you share more details about 'passing payload lengths in the flags'?
AFAIK, networking bpf_perf_event_output() actually utilizes bpf_event_output_data(),
in which 'flags' semantics has the same meaning as the above.

>
>
> Thanks,
> Michael