Re: [PATCH 4/4] perf bpf: Automatically create bpf-output event __bpf_stdout__

[Arnaldo Carvalho de Melo]

Em Fri, Apr 08, 2016 at 03:07:25PM +0000, Wang Nan escreveu:
>  struct bpf_map_def SEC("maps") __bpf_stdout__ = {
>         .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
>         .key_size = sizeof(int),
>         .value_size = sizeof(u32),
>         .max_entries = __NR_CPUS__,
>  };
> 
>  static inline int __attribute__((always_inline))
>  func(void *ctx, int type)
>  {
> 	char output_str[] = "Raise a BPF event!";
> 	char err_str[] = "BAD %d\n";
> 	int err;
> 
>         err = perf_event_output(ctx, &channel, get_smp_processor_id(),

I had to change channel here to __bpf_stdout__, then it works :-)

> 			        &output_str, sizeof(output_str));
> 	if (err)
> 		trace_printk(err_str, sizeof(err_str), err);
>         return 1;

Asking for strace-like output for 'nanosleep', the function hooked:

[root@jouet bpf]# trace -e nanosleep --ev test_bpf_stdout.c usleep 1
     0.007 ( 0.007 ms): usleep/729 nanosleep(rqtp: 0x7ffc5bbc5fe0) ...
     0.007 (         ): __bpf_stdout__:Raise a BPF event!..)
     0.008 (         ): perf_bpf_probe:func_begin:(ffffffff81112460))
     0.069 (         ): __bpf_stdout__:Raise a BPF event!..)
     0.070 (         ): perf_bpf_probe:func_end:(ffffffff81112460 <- ffffffff81003d92))
     0.072 ( 0.072 ms): usleep/729  ... [continued]: nanosleep()) = 0
[root@jouet bpf]# 

Ok, merged those, now lets see how all this mixes with callchains...

- Arnaldo