bcc: I want to send the file absolute path to golang, but it is over 512 bytes

[xiaonuoz]

Hi there,
Since I need to handle this path in golang, I need to use BPF_PERF_OUTPUT, and I may not be able to use BPF_HASH to store its file path

	#include <asm/ptrace.h>
	#include <linux/fs.h>

	struct readfile_event_t {
		u64 id;
		char file_name[30][50];
	};

	BPF_PERF_OUTPUT(watch_readfile_events);

	int trace_vfs_read(struct pt_regs *ctx, struct file *file, char __user *buf, size_t count, loff_t *pos)
	{
		struct readfile_event_t event = {};

		event.id = bpf_get_current_pid_tgid();

		struct dentry *de;
		de = file->f_path.dentry;

		int i;
		#pragma unroll
		for (i = 0; i < 30; i++) {
			struct dentry *parent;
			parent = de->d_parent;
			if (de == parent || parent == NULL) {
				break;
			}
			bpf_probe_read_kernel_str(&event.file_name[i], 50, (void *)de->d_name.name);
			de =de->d_parent;
		}
		watch_readfile_events.perf_submit(ctx, &event, sizeof(event));

		return 0;
	}

[chenhengqi]

You can use a PERCPU_ARRAY to workaround this limitation.