bpflbr: Show process info

Signed-off-by: Leon Hwang <[email protected]>

bpf/lbr.c

@@ -16,6 +16,9 @@ struct event {
     __s64 nr_bytes;
     __s64 func_ret;
     __u64 func_ip;
+    __u32 cpu;
+    __u32 pid;
+    __u8 comm[16];
 } __attribute__((packed));
 
 struct event lbr_events[1] SEC(".data.lbrs");
@@ -34,6 +37,9 @@ emit_lbr_event(void *ctx)
     bpf_get_func_ret(ctx, (void *) &retval); /* required 5.17 kernel. */
     event->func_ret = retval;
     event->func_ip = bpf_get_func_ip(ctx); /* required 5.17 kernel. */
+    event->cpu = cpu;
+    event->pid = bpf_get_current_pid_tgid() >> 32;
+    bpf_get_current_comm(event->comm, sizeof(event->comm));
 
     bpf_ringbuf_output(&events, event, sizeof(*event), 0);
 

internal/bpflbr/lbr.go

@@ -24,6 +24,9 @@ type Event struct {
 	NrBytes int64
 	Retval  int64
 	FuncIP  uintptr
+	CPU     uint32
+	Pid     uint32
+	Comm    [16]byte
 }
 
 func Run(reader *ringbuf.Reader, progs *bpfProgs, addr2line *Addr2Line, ksyms *Kallsyms, w io.Writer) error {
@@ -113,7 +116,8 @@ func Run(reader *ringbuf.Reader, progs *bpfProgs, addr2line *Addr2Line, ksyms *K
 			}
 		}
 
-		fmt.Fprintf(&sb, "Recv a record for %s with retval=%d :\n", targetName, event.Retval)
+		fmt.Fprintf(&sb, "Recv a record for %s with retval=%d/%#x cpu=%d process=(%d:%s) :\n",
+			targetName, event.Retval, uint64(event.Retval), event.CPU, event.Pid, nullTerminated(event.Comm[:]))
 		stack.output(&sb)
 		fmt.Fprintln(w, sb.String())
 

internal/bpflbr/string.go

@@ -0,0 +1,21 @@
+// Copyright 2024 Leon Hwang.
+// SPDX-License-Identifier: Apache-2.0
+
+package bpflbr
+
+import "unsafe"
+
+func nullTerminated(b []byte) string {
+	for i, c := range b {
+		if c == 0 {
+			b = b[:i]
+			break
+		}
+	}
+
+	if len(b) == 0 {
+		return ""
+	}
+
+	return unsafe.String(&b[0], len(b))
+}