This commit is contained in:
yunwei37
2023-10-21 12:45:33 +00:00
parent b90b3389e3
commit 25c5ca632f
2 changed files with 39 additions and 27 deletions

View File

@@ -9,12 +9,14 @@
char _license[] SEC("license") = "GPL"; char _license[] SEC("license") = "GPL";
struct { struct
{
__uint(type, BPF_MAP_TYPE_USER_RINGBUF); __uint(type, BPF_MAP_TYPE_USER_RINGBUF);
__uint(max_entries, 256 * 1024); __uint(max_entries, 256 * 1024);
} user_ringbuf SEC(".maps"); } user_ringbuf SEC(".maps");
struct { struct
{
__uint(type, BPF_MAP_TYPE_RINGBUF); __uint(type, BPF_MAP_TYPE_RINGBUF);
__uint(max_entries, 256 * 1024); __uint(max_entries, 256 * 1024);
} kernel_ringbuf SEC(".maps"); } kernel_ringbuf SEC(".maps");
@@ -48,7 +50,8 @@ int kill_exit(struct trace_event_raw_sys_exit *ctx)
{ {
long num_samples; long num_samples;
int err = 0; int err = 0;
// receive data from userspace
num_samples = bpf_user_ringbuf_drain(&user_ringbuf, do_nothing_cb, NULL, 0); num_samples = bpf_user_ringbuf_drain(&user_ringbuf, do_nothing_cb, NULL, 0);
return 0; return 0;

View File

@@ -20,25 +20,27 @@ static int write_samples(struct user_ring_buffer *ringbuf)
struct user_sample *entry; struct user_sample *entry;
entry = user_ring_buffer__reserve(ringbuf, sizeof(*entry)); entry = user_ring_buffer__reserve(ringbuf, sizeof(*entry));
if (!entry) { if (!entry)
{
err = -errno; err = -errno;
goto done; goto done;
} }
entry->i = getpid(); entry->i = getpid();
strcpy(entry->comm, "hello"); strcpy(entry->comm, "hello");
int read = snprintf(entry->comm, sizeof(entry->comm), "%u", i); int read = snprintf(entry->comm, sizeof(entry->comm), "%u", i);
if (read <= 0) { if (read <= 0)
/* Assert on the error path to avoid spamming logs with {
* mostly success messages. /* Assert on the error path to avoid spamming logs with
*/ * mostly success messages.
err = read; */
user_ring_buffer__discard(ringbuf, entry); err = read;
goto done; user_ring_buffer__discard(ringbuf, entry);
} goto done;
}
user_ring_buffer__submit(ringbuf, entry); user_ring_buffer__submit(ringbuf, entry);
done: done:
drain_current_samples(); drain_current_samples();
@@ -58,7 +60,7 @@ static void sig_handler(int sig)
exiting = true; exiting = true;
} }
struct user_ring_buffer *user_ringbuf = NULL; struct user_ring_buffer *user_ringbuf = NULL;
static int handle_event(void *ctx, void *data, size_t data_sz) static int handle_event(void *ctx, void *data, size_t data_sz)
{ {
@@ -71,8 +73,8 @@ static int handle_event(void *ctx, void *data, size_t data_sz)
tm = localtime(&t); tm = localtime(&t);
strftime(ts, sizeof(ts), "%H:%M:%S", tm); strftime(ts, sizeof(ts), "%H:%M:%S", tm);
printf("%-8s %-5s %-16s %-7d\n", printf("%-8s %-5s %-16s %-7d\n",
ts, "SIGN", e->comm, e->pid); ts, "SIGN", e->comm, e->pid);
write_samples(user_ringbuf); write_samples(user_ringbuf);
return 0; return 0;
} }
@@ -92,7 +94,8 @@ int main(int argc, char **argv)
/* Load and verify BPF application */ /* Load and verify BPF application */
skel = user_ringbuf_bpf__open(); skel = user_ringbuf_bpf__open();
if (!skel) { if (!skel)
{
fprintf(stderr, "Failed to open and load BPF skeleton\n"); fprintf(stderr, "Failed to open and load BPF skeleton\n");
return 1; return 1;
} }
@@ -102,21 +105,24 @@ int main(int argc, char **argv)
/* Load & verify BPF programs */ /* Load & verify BPF programs */
err = user_ringbuf_bpf__load(skel); err = user_ringbuf_bpf__load(skel);
if (err) { if (err)
{
fprintf(stderr, "Failed to load and verify BPF skeleton\n"); fprintf(stderr, "Failed to load and verify BPF skeleton\n");
goto cleanup; goto cleanup;
} }
/* Attach tracepoints */ /* Attach tracepoints */
err = user_ringbuf_bpf__attach(skel); err = user_ringbuf_bpf__attach(skel);
if (err) { if (err)
{
fprintf(stderr, "Failed to attach BPF skeleton\n"); fprintf(stderr, "Failed to attach BPF skeleton\n");
goto cleanup; goto cleanup;
} }
/* Set up ring buffer polling */ /* Set up ring buffer polling */
rb = ring_buffer__new(bpf_map__fd(skel->maps.kernel_ringbuf), handle_event, NULL, NULL); rb = ring_buffer__new(bpf_map__fd(skel->maps.kernel_ringbuf), handle_event, NULL, NULL);
if (!rb) { if (!rb)
{
err = -1; err = -1;
fprintf(stderr, "Failed to create ring buffer\n"); fprintf(stderr, "Failed to create ring buffer\n");
goto cleanup; goto cleanup;
@@ -127,15 +133,18 @@ int main(int argc, char **argv)
/* Process events */ /* Process events */
printf("%-8s %-5s %-16s %-7s %-7s %s\n", printf("%-8s %-5s %-16s %-7s %-7s %s\n",
"TIME", "EVENT", "COMM", "PID", "PPID", "FILENAME/EXIT CODE"); "TIME", "EVENT", "COMM", "PID", "PPID", "FILENAME/EXIT CODE");
while (!exiting) { while (!exiting)
{
err = ring_buffer__poll(rb, 100 /* timeout, ms */); err = ring_buffer__poll(rb, 100 /* timeout, ms */);
/* Ctrl-C will cause -EINTR */ /* Ctrl-C will cause -EINTR */
if (err == -EINTR) { if (err == -EINTR)
{
err = 0; err = 0;
break; break;
} }
if (err < 0) { if (err < 0)
{
printf("Error polling perf buffer: %d\n", err); printf("Error polling perf buffer: %d\n", err);
break; break;
} }