Hi.
First, I hope you are fine and the same for your relatives.
Normally, when BPF ring buffer are full, producers cannot write anymore and
need to wait for consumer to get some data.
As a consequence, calling bpf_ringbuf_reserve() from eBPF code returns NULL.
This contribution adds a new flag to make BPF ring buffer over writable.
When the buffer is full, the producer will over write the oldest data.
So, calling bpf_ringbuf_reserve() on an over writable BPF ring buffer never
returns NULL but consumer will loose some data.
This flag can be used to monitor lots of events, like all the syscalls done on
a given machine.
I tested it within a VM with the fourth patch which creates a "toy" eBPF
program:
you@home$ cd /path/to/iovisor/bcc
you@home$ git apply 0001-for-test-purpose-only-Add-toy-to-play-with-BPF-ring-.patch
you@home$ cd /path/to/linux/tools/lib/bpf
you@home$ make -j$(nproc)
you@home$ cp libbpf.a /path/to/iovisor/bcc/libbpf-tools/.output
you@home$ cd /path/to/iovisor/bcc/libbpf-tools/
you@home$ make -j toy
# Start your VM and copy toy executable inside it.
you@vm# ./share/toy
Press any key to begin consuming!
^Z
you@vm# for i in {1..16}; do true; done
you@vm# fg # Please press any key
8
9
10
11
12
13
14
15
16
^Z
you@vm# true && true
you@vm# fg
17
18
As you can see, the first eight events are overwritten.
If you any way to improve this contribution, feel free to share.
Francis Laniel (3):
bpf: Make ring buffer overwritable.
do not merge: Temporary fix for is_power_of_2.
libbpf: Make bpf ring buffer overwritable.
include/uapi/linux/bpf.h | 3 ++
kernel/bpf/ringbuf.c | 51 ++++++++++++++++++++++++++--------
tools/include/uapi/linux/bpf.h | 3 ++
tools/lib/bpf/libbpf.c | 2 +-
tools/lib/bpf/ringbuf.c | 35 ++++++++++++++++++++++-
5 files changed, 81 insertions(+), 13 deletions(-)
Best regards and thank you in advance.
--
2.25.1
