telemetryStart should have a stop mechanism other than signals

[josalem]

Currently, teletryStart is a fully blocking call. There appears to be no way to stop tracing without sending a signal that would cause perf_buffer__poll to return <0, .e.g., SIGSTOP or SIGCONT (based on the comments). This can race with the call to perf_buffer_poll which may not be on the stack when the signal arrives.

If you are trying to use this library in-process, it is difficult to control stopping as designed.

An Init->Start->Stop->Fini pattern would be useful for this library.

SysinternalsEBPF/telemetryLoader.c

Lines 1432 to 1470 in b9035cf

	while (running) {
	ret = perf_buffer__poll(pb, 1000);
	if (ret == 0) {
	// no events means we timed out
	timeouts++;
	if (timeouts > RESTART_TIMEOUT) {
	fprintf(stderr, "Event timeout occurred (no event for %d seconds). Reloading eBPF...\n", RESTART_TIMEOUT);
	timeouts = 0;
	telemetryCloseAll();
	if (!ebpfStart(ebpfConfig, filepath, procStartTime, eventCb, eventsLostCb, context, argv, fds, false)) {
	fprintf(stderr, "ebpfStart failed\n");
	break;
	}
	fprintf(stderr, "Reloaded eBPF due to event timeout\n");
	continue;
	}
	} else if (ret > 0) {
	// events were received and processed
	timeouts = 0;
	}
	#ifdef NDEBUG
	//
	// if we receive a SIGSTOP & SIGCONT, then perf_buffer__poll will return -1.
	// This is to be expected if the process is being debugged, but not otherwise.
	//
	if (ret < 0 && !signalInterrupt)
	running = false;
	#endif
	if (signalInterrupt) {
	signalInterrupt = false;
	telemetryReloadConfig();
	}
	if (isTesting) {
	if (i++ > STOPLOOP) break;
	}
	checkPerfErrors();
	}
	telemetryCloseAll();

[kesheldr]

Agreed. Will get to this in due course. Happy to take suggested code if you've prototyped something. :)