Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx> writes: >> However, assuming it *is* possible, my larger point was that we >> shouldn't add just a 'logging struct', but rather a 'common options >> struct' which can be extended further as needed. And if it is *not* >> possible to add new arguments to a syscall like you're proposing, my >> suggestion above would be a different way to achieve basically the same >> (at the cost of having to specify the maximum reserved space in advance). >> > > yeah-yeah, I agree, it's less a "logging attr", more of "common attr > across all commands". Right, great. I think we are broadly in agreement with where we want to go with this, actually :) Let's see if anyone else chimes in; otherwise I guess I can incorporate something along these lines in the next version of this series. I'm going on vacation at the end of this week, though, so I will most likely not be able to carry it to completion before then; but at least I can post something for someone else to pick up (or if no one does it can wait until I get back). [...] > Yeah, ignore my initial rambling. One can do that (detecting > truncationg) without any extra "feedback" from bpf syscall, but I > think returning filled length is probably a better approach and > doesn't hamper any other aspects. OK, sure, makes sense. [...] >> > Also adopting these packet-like messages is not as straightforward >> > through BPF code, as now you can't just construct a single log line >> > with few calls to bpf_log(). >> >> Why not? bpf_log() could just transparently write the four bytes of >> header (TYPE_STRING, followed by strlen(msg)) into the buffer before the >> string? And in the future, an enhanced version could take (say) an error >> ID as another parameter and transparently add that as a separate message. > > I mean when you construct one error message with few printf-like > functions. We do have that in libbpf, but I haven't checked the > verifier code. Basically, assuming one bpf_log() call is a complete > "message" might not be true. Ah, I see what you mean. I guess that could be worked around with a flag or something, but I'll concede that in that case it's less of an obvious drop-in replacement :) -Toke
