diff options
| author | Daniel T. Lee <danieltimlee@gmail.com> | 2020-05-16 07:06:05 +0300 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2020-05-19 18:12:53 +0300 |
| commit | 63841bc0833623ecd4f758ec055b543cf1bc56ba (patch) | |
| tree | c1a534f8aaa1f3ce52712e752fdfd425d77a1eb7 /samples/bpf/tracex2_kern.c | |
| parent | 0efdcefb00d768442efef21560ea4c44d481fa5c (diff) | |
| download | linux-63841bc0833623ecd4f758ec055b543cf1bc56ba.tar.xz | |
samples, bpf: Refactor kprobe tracing user progs with libbpf
Currently, the kprobe BPF program attachment method for bpf_load is
quite old. The implementation of bpf_load "directly" controls and
manages(create, delete) the kprobe events of DEBUGFS. On the other hand,
using using the libbpf automatically manages the kprobe event.
(under bpf_link interface)
By calling bpf_program__attach(_kprobe) in libbpf, the corresponding
kprobe is created and the BPF program will be attached to this kprobe.
To remove this, by simply invoking bpf_link__destroy will clean up the
event.
This commit refactors kprobe tracing programs (tracex{1~7}_user.c) with
libbpf using bpf_link interface and bpf_program__attach.
tracex2_kern.c, which tracks system calls (sys_*), has been modified to
append prefix depending on architecture.
Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20200516040608.1377876-3-danieltimlee@gmail.com
Diffstat (limited to 'samples/bpf/tracex2_kern.c')
| -rw-r--r-- | samples/bpf/tracex2_kern.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/samples/bpf/tracex2_kern.c b/samples/bpf/tracex2_kern.c index d865bb309bcb..cc5f94c098f8 100644 --- a/samples/bpf/tracex2_kern.c +++ b/samples/bpf/tracex2_kern.c @@ -10,6 +10,7 @@ #include <uapi/linux/bpf.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> +#include "trace_common.h" struct bpf_map_def SEC("maps") my_map = { .type = BPF_MAP_TYPE_HASH, @@ -77,7 +78,7 @@ struct bpf_map_def SEC("maps") my_hist_map = { .max_entries = 1024, }; -SEC("kprobe/sys_write") +SEC("kprobe/" SYSCALL(sys_write)) int bpf_prog3(struct pt_regs *ctx) { long write_size = PT_REGS_PARM3(ctx); |