gistfile1.txt

// /sys/fs/bpf/tc/globals/perf_map
// records traces from BPF, using the snapshot_* functions, read by userland tcpdump-style;
// note this is implicitly per-CPU (the "size" of the perf map is the max number of CPUs)
DECLARE_GLOBAL_MAP(perf_map, BPF_MAP_TYPE_PERF_EVENT_ARRAY, sizeof(int), sizeof(u_int32_t), 8);

kfn void
_snapshot(int type, void *ctx, u_char *sp, void *ep, u_int16_t len) {
  u_int64_t flags = BPF_F_CURRENT_CPU;

  struct perf_meta_packet meta =
    {
     .magic = PP_MAGIC,
     .type = type,
     .flags = 0,
     .len = (u_int16_t)((u_char *)ep - sp),
    };
  
  if(len == 0) {
    len = meta.len;
  }

  if(len > meta.len) {
    len = meta.len;
  }
  
  flags |= (u_int64_t)len << 32;

  perf_event_output(ctx, &perf_map, flags, &meta, sizeof(meta));
}

Hello. In the blog entry (on fly.io) that pointed me to this gist, you wrote:

(If you’re just looking to play around with this stuff, by the way, I can give you a Dockerfile that will get you a janky build environment, which is how I did my BPF development before I started using perf, which I couldn’t get working under macOS Docker).

Just curious if you still had something like that dockerfile handy, or could point me to something similar? I'm someone who did a fair amount of Linux networking work in the late 90s and early 2000s, and am now trying to catch up on what I missed, too.