Em Thu, Aug 10, 2023 at 11:48:51AM -0700, Ian Rogers escreveu:
> Previously a BPF event of augmented_raw_syscalls.c could be used to
> enable augmentation of syscalls by perf trace. As BPF events are no
> longer supported, switch to using a BPF skeleton which when attached
> explicitly opens the sysenter and sysexit tracepoints.
>
> The dump map is removed as debugging wasn't supported by the
> augmentation and bpf_printk can be used when necessary.
>
> Remove tools/perf/examples/bpf/augmented_raw_syscalls.c so that the
> rename/migration to a BPF skeleton captures that this was the source.
> +#ifdef HAVE_BPF_SKEL
> + trace.skel = augmented_raw_syscalls_bpf__open();
> + if (!trace.skel) {
> + pr_debug("Failed to open augmented syscalls BPF skeleton");
> + } else {
> + /*
> + * Disable attaching the BPF programs except for sys_enter and
> + * sys_exit that tail call into this as necessary.
> + */
> + bpf_program__set_autoattach(trace.skel->progs.syscall_unaugmented,
> + /*autoattach=*/false);
> + bpf_program__set_autoattach(trace.skel->progs.sys_enter_connect,
> + /*autoattach=*/false);
> + bpf_program__set_autoattach(trace.skel->progs.sys_enter_sendto,
> + /*autoattach=*/false);
> + bpf_program__set_autoattach(trace.skel->progs.sys_enter_open,
> + /*autoattach=*/false);
> + bpf_program__set_autoattach(trace.skel->progs.sys_enter_openat,
> + /*autoattach=*/false);
> + bpf_program__set_autoattach(trace.skel->progs.sys_enter_rename,
> + /*autoattach=*/false);
> + bpf_program__set_autoattach(trace.skel->progs.sys_enter_renameat,
> + /*autoattach=*/false);
> + bpf_program__set_autoattach(trace.skel->progs.sys_enter_perf_event_open,
> + /*autoattach=*/false);
> + bpf_program__set_autoattach(trace.skel->progs.sys_enter_clock_nanosleep,
> + /*autoattach=*/false);
> +
> + err = augmented_raw_syscalls_bpf__load(trace.skel);
>
So I converted the above to:
struct bpf_program *prog;
bpf_object__for_each_program(prog, trace.skel->obj) {
if (prog != trace.skel->progs.sys_enter && prog != trace.skel->progs.sys_exit)
bpf_program__set_autoattach(prog, /*autoattach=*/false);
}
So that we don't have to add new lines disabling attachment when adding
support for other pointer receiving syscalls.
- Arnaldo
