On 8/15/20 12:57 PM, Lior Ribak wrote:
Currently, in bpf_load.c, the function write_kprobe_events sets
the function name to probe as the probe name.
Even though it's valid to set one kprobe on enter and another on exit,
bpf_load.c won't handle it, and will return an error 'File exists'.
Add a prefix to the event name to indicate if it's on enter or exit,
so both an enter and an exit kprobes can be attached.
Only bpf_load.c change and no users here. So do you imply that
use use this piece code in your own environment some how? But in
that case, not sure whether this patch is necessary or not.
The change here is for legacy bpf_load which may go away in the future.
I understand this is for debugfs based kprobe_events where current
libbpf does not support. But if possible, you should upgrade to use
fd-based kprobe which is introduced roughly in/around 4.17 and libbpf
has proper support.
Signed-off-by: Lior Ribak <liorribak@xxxxxxxxx>
---
samples/bpf/bpf_load.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/samples/bpf/bpf_load.c b/samples/bpf/bpf_load.c
index c5ad528f046e..69102358e91a 100644
--- a/samples/bpf/bpf_load.c
+++ b/samples/bpf/bpf_load.c
@@ -184,18 +184,24 @@ static int load_and_attach(const char *event, struct bpf_insn *prog, int size)
#ifdef __x86_64__
if (strncmp(event, "sys_", 4) == 0) {
- snprintf(buf, sizeof(buf), "%c:__x64_%s __x64_%s",
- is_kprobe ? 'p' : 'r', event, event);
+ if (is_kprobe)
+ event_prefix = "__x64_enter_";
+ else
+ event_prefix = "__x64_exit_";
+ snprintf(buf, sizeof(buf), "%c:%s%s __x64_%s",
+ is_kprobe ? 'p' : 'r', event_prefix, event, event);
err = write_kprobe_events(buf);
- if (err >= 0) {
+ if (err >= 0)
need_normal_check = false;
- event_prefix = "__x64_";
- }
}
#endif
if (need_normal_check) {
- snprintf(buf, sizeof(buf), "%c:%s %s",
- is_kprobe ? 'p' : 'r', event, event);
+ if (is_kprobe)
+ event_prefix = "enter_";
+ else
+ event_prefix = "exit_";
+ snprintf(buf, sizeof(buf), "%c:%s%s %s",
+ is_kprobe ? 'p' : 'r', event_prefix, event, event);
err = write_kprobe_events(buf);
if (err < 0) {
printf("failed to create kprobe '%s' error '%s'\n",
