My eBPF program as follows.
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>
#include "common.h"
char __license[] SEC("license") = "GPL";
SEC("sockops")
int bpf_sockops_cb(struct bpf_sock_ops *skops) {
u32 op;
int err;
err = bpf_core_read(&op, sizeof(op), &skops->op);
if (err) {
bpf_printk("errn");
}
bpf_printk("op1 = %u, op2 = %u n", op, skops->op);
return 0;
}
When I check the tracing output by cat /sys/kernel/debug/tracing/trace_pipe
, it shows that op1
!= op2
.
curl-1466326 [009] ....1 241519.609044: bpf_trace_printk: op1 = 3913290112, op2 = 3
curl-1466326 [009] ....1 241519.609048: bpf_trace_printk: op1 = 3913290112, op2 = 2
curl-1466326 [009] ....1 241519.609048: bpf_trace_printk: op1 = 3913290112, op2 = 1
curl-1466326 [009] ....1 241519.609049: bpf_trace_printk: op1 = 3913290112, op2 = 6
Why does op1
and op2
become different ?