我使用perf对ebpf函数进行采样,但是我使用bpf_ktime_get_ns获取系统当前秒数发现为负值,不知道为什么
SEC("perf_event")
int do_perf_event(struct bpf_perf_event_data *ctx) {
u32 tgid = 0;
u32 pid = 0;
u64 id = bpf_get_current_pid_tgid();
pid = id;
if ( pid == 0 )
return 0;
tgid = id >> 32;
//create map key
struct key_t key = {0};
key.pid =tgid;
u64 ts = bpf_ktime_get_ns();
key.ntime= ts;
bpf_perf_event_output((struct pt_regs *)ctx, &output_events, BPF_F_CURRENT_CPU, &key, sizeof(key));
return 0;
}
reader, err := perf.NewReader(objs.bpfMaps.OutputEvents, 10000 * int(unsafe.Sizeof(bpfSchedEventT{})))
for {
record, err := reader.Read()
var event bpfSchedEventT
if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.LittleEndian, &event); err != nil {
continue
}
fmt.Println(event.Pid,event.Ntime)
}
pid bpf_ktime_get_ns 2304287 -4952501534609899520 2304287 -4951917187129409536 2304287 -4909853600282312704 2304287 -4909930153779396608 2304287 -4909776359590461440 2304287 -4909124929015775232 2305278 -4908938351341469696 2134146 -4909027119725543424 4026847 -4908622722784821248
不知道为什么时间是负数
当我把u64放在上面时
struct key_t { u64 ntime; u32 pid; };