bpf_dynptr_copy ?

[mattfysh]

hello, i'm writing a cgroup_skb program that uses a ringbuffer to output packets to userspace. i'm wondering how can i write packet data to the ringbuf without copying it through the ebpf stack?

I understand I'll need both bfp_dynptr_from_skb for the read side and bpf_ringbuf_reserve_dynptr for the write, but I'm having a hard time seeing how to copy between them

[danielocfb]

I am not familiar with dynptr/skb APIs, and generally that sounds more like a general BPF question than anything libbpf-rs specific. Would probably be best to check the kernel selftests for examples and if you can't find anything there to inquire with the BPF mailing list itself, at least that would be my recommendation.

[mattfysh]

thanks @danielocfb - i found this from the kernel mailing list: https://lore.kernel.org/bpf/CAJnrk1bSXgpPLK-e-fu6UyFypAY=EGmeDh-7ftj3ekMwf4DNuw@mail.gmail.com/ ... sounds like bpf_dynptr_copy was planned but not yet implemented

are there any examples of using libbpf-rs for pcap writing?

the hurdles i've found so far are related to packet sizes varying wildly on cgroup_skb types (eg. up to 10000 for jumbo frames) copying into the ebpf stack is not supported due to the 512 stack limit

i was previously using bpf_ringbuf_reserve but it requires statically known reserve size at compile time, so would only work by reserving 10000 each time, even for small packets of 20 or less bytes