On Tue, Oct 8, 2024 at 2:02 AM Hou Tao <houtao@xxxxxxxxxxxxxxx> wrote: > > + > +SEC("?fentry/" SYS_PREFIX "sys_nanosleep") > +int BPF_PROG(pure_dynptr_key) ... > +SEC("?fentry/" SYS_PREFIX "sys_nanosleep") > +int BPF_PROG(mixed_dynptr_key) ... > +SEC("?fentry/" SYS_PREFIX "sys_nanosleep") > +int BPF_PROG(multiple_dynptr_key) attaching to syscalls with pid filtering is ok-ish, but it's a few unnecessary steps. Use tracing prog for non-sleepable and syscall prog for sleepable and bpf_prog_run() it. More predictable and no need for a pid filter.