diff options
| author | Daniel T. Lee <danieltimlee@gmail.com> | 2022-12-24 16:15:22 +0900 |
|---|---|---|
| committer | Andrii Nakryiko <andrii@kernel.org> | 2022-12-29 14:22:34 -0800 |
| commit | 1d0c5f6f3d1387ec9c3a379fb232c078f5838d55 (patch) | |
| tree | 3e4c4447088e9a1124e6e5ebe447479d1f094d2e /samples/bpf/test_probe_write_user_kern.c | |
| parent | 30465003ad776a922c32b2dac58db14f120f037e (diff) | |
| download | linux-1d0c5f6f3d1387ec9c3a379fb232c078f5838d55.tar.gz linux-1d0c5f6f3d1387ec9c3a379fb232c078f5838d55.tar.bz2 linux-1d0c5f6f3d1387ec9c3a379fb232c078f5838d55.zip | |
samples/bpf: Use kyscall instead of kprobe in syscall tracing program
Syscall tracing using kprobe is quite unstable. Since it uses the exact
name of the kernel function, the program might broke due to the rename
of a function. The problem can also be caused by a changes in the
arguments of the function to which the kprobe connects.
In this commit, ksyscall is used instead of kprobe. By using ksyscall,
libbpf will detect the appropriate kernel function name.
(e.g. sys_write -> __s390_sys_write). This eliminates the need to worry
about which wrapper function to attach in order to parse arguments.
In addition, ksyscall provides more fine method with attaching system
call, the coarse SYSCALL helper at trace_common.h can be removed.
Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20221224071527.2292-2-danieltimlee@gmail.com
Diffstat (limited to 'samples/bpf/test_probe_write_user_kern.c')
| -rw-r--r-- | samples/bpf/test_probe_write_user_kern.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/samples/bpf/test_probe_write_user_kern.c b/samples/bpf/test_probe_write_user_kern.c index 220a96438d75..d60cabaaf753 100644 --- a/samples/bpf/test_probe_write_user_kern.c +++ b/samples/bpf/test_probe_write_user_kern.c @@ -11,7 +11,6 @@ #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> #include <bpf/bpf_core_read.h> -#include "trace_common.h" struct { __uint(type, BPF_MAP_TYPE_HASH); @@ -28,7 +27,7 @@ struct { * This example sits on a syscall, and the syscall ABI is relatively stable * of course, across platforms, and over time, the ABI may change. */ -SEC("kprobe/" SYSCALL(sys_connect)) +SEC("ksyscall/connect") int bpf_prog1(struct pt_regs *ctx) { struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1_CORE(ctx); |