On Wed, Aug 30, 2023 at 01:29:18PM -0700, Alexei Starovoitov wrote: > On Wed, Aug 30, 2023 at 12:04 PM Jiri Olsa <olsajiri@xxxxxxxxx> wrote: > > > > On Wed, Aug 30, 2023 at 02:35:49PM -0400, Song Liu wrote: > > > On Wed, Aug 30, 2023 at 9:27 AM Jiri Olsa <olsajiri@xxxxxxxxx> wrote: > > > > > > > > On Wed, Aug 30, 2023 at 11:35:02AM +0200, Jiri Olsa wrote: > > > > > Recent commit [1] broken d_path test, because now filp_close is not > > > > > called directly from sys_close, but eventually later when the file > > > > > is finally released. > > > > > > > > > > I can't see any other solution than to hook filp_flush function and > > > > > that also means we need to add it to btf_allowlist_d_path list, so > > > > > it can use the d_path helper. > > > > > > > > > > But it's probably not very stable because filp_flush is static so it > > > > > could be potentially inlined. > > > > > > > > looks like llvm makes it inlined (from CI) > > > > > > > > Error: #68/1 d_path/basic > > > > libbpf: prog 'prog_close': failed to find kernel BTF type ID of 'filp_flush': -3 > > > > > > > > jirka > > > > > > I played with it for a bit, but haven't got a good solution. Maybe we should > > > just remove the test for close()? > > > > I was thinking the same.. also we have some example with filp_close in bpftrace > > docs, I think we'll need to add some note with explanation in there > > Maybe use __x64_sys_close in the test and recommend bpftrace scripts > to do the same? we need struct file pointer as an argument, __x64_sys_close has pt_regs pointer jirka
