Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-29 06:12:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

samples/bpf: Use kyscall instead of kprobe in syscall tracing program

Browse Source 
Syscall tracing using kprobe is quite unstable. Since it uses the exact
name of the kernel function, the program might broke due to the rename
of a function. The problem can also be caused by a changes in the
arguments of the function to which the kprobe connects.

In this commit, ksyscall is used instead of kprobe. By using ksyscall,
libbpf will detect the appropriate kernel function name.
(e.g. sys_write -> __s390_sys_write). This eliminates the need to worry
about which wrapper function to attach in order to parse arguments.

In addition, ksyscall provides more fine method with attaching system
call, the coarse SYSCALL helper at trace_common.h can be removed.

Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20221224071527.2292-2-danieltimlee@gmail.com
This commit is contained in:
Daniel T. Lee 2022-12-24 16:15:22 +09:00 committed by Andrii Nakryiko
parent 30465003ad
commit 1d0c5f6f3d
7 changed files with 12 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
samples/bpf/map_perf_test_kern.c
View File

@ -11,7 +11,6 @@
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>
#include "trace_common.h"
#define MAX_ENTRIES 1000
#define MAX_NR_CPUS 1024
@ -102,7 +101,7 @@ struct {
__uint(max_entries, MAX_ENTRIES);
} lru_hash_lookup_map SEC(".maps");
SEC("kprobe/" SYSCALL(sys_getuid))
SEC("ksyscall/getuid")
int stress_hmap(struct pt_regs *ctx)
{
u32 key = bpf_get_current_pid_tgid();
@ -120,7 +119,7 @@ int stress_hmap(struct pt_regs *ctx)
return 0;
}
SEC("kprobe/" SYSCALL(sys_geteuid))
SEC("ksyscall/geteuid")
int stress_percpu_hmap(struct pt_regs *ctx)
{
u32 key = bpf_get_current_pid_tgid();
@ -137,7 +136,7 @@ int stress_percpu_hmap(struct pt_regs *ctx)
return 0;
}
SEC("kprobe/" SYSCALL(sys_getgid))
SEC("ksyscall/getgid")
int stress_hmap_alloc(struct pt_regs *ctx)
{
u32 key = bpf_get_current_pid_tgid();
@ -154,7 +153,7 @@ int stress_hmap_alloc(struct pt_regs *ctx)
return 0;
}
SEC("kprobe/" SYSCALL(sys_getegid))
SEC("ksyscall/getegid")
int stress_percpu_hmap_alloc(struct pt_regs *ctx)
{
u32 key = bpf_get_current_pid_tgid();
@ -171,7 +170,7 @@ int stress_percpu_hmap_alloc(struct pt_regs *ctx)
return 0;
}
SEC("kprobe/" SYSCALL(sys_connect))
SEC("ksyscall/connect")
int stress_lru_hmap_alloc(struct pt_regs *ctx)
{
struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1_CORE(ctx);
@ -251,7 +250,7 @@ done:
return 0;
}
SEC("kprobe/" SYSCALL(sys_gettid))
SEC("ksyscall/gettid")
int stress_lpm_trie_map_alloc(struct pt_regs *ctx)
{
union {
@ -273,7 +272,7 @@ int stress_lpm_trie_map_alloc(struct pt_regs *ctx)
return 0;
}
SEC("kprobe/" SYSCALL(sys_getpgid))
SEC("ksyscall/getpgid")
int stress_hash_map_lookup(struct pt_regs *ctx)
{
u32 key = 1, i;
@ -286,7 +285,7 @@ int stress_hash_map_lookup(struct pt_regs *ctx)
return 0;
}
SEC("kprobe/" SYSCALL(sys_getppid))
SEC("ksyscall/getppid")
int stress_array_map_lookup(struct pt_regs *ctx)
{
u32 key = 1, i;

3
samples/bpf/test_current_task_under_cgroup_kern.c
View File

@ -10,7 +10,6 @@
#include <linux/version.h>
#include <bpf/bpf_helpers.h>
#include <uapi/linux/utsname.h>
#include "trace_common.h"
struct {
__uint(type, BPF_MAP_TYPE_CGROUP_ARRAY);
@ -27,7 +26,7 @@ struct {
} perf_map SEC(".maps");
/* Writes the last PID that called sync to a map at index 0 */
SEC("kprobe/" SYSCALL(sys_sync))
SEC("ksyscall/sync")
int bpf_prog1(struct pt_regs *ctx)
{
u64 pid = bpf_get_current_pid_tgid();

1
samples/bpf/test_map_in_map_kern.c
View File

@ -13,7 +13,6 @@
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>
#include "trace_common.h"
#define MAX_NR_PORTS 65536

3
samples/bpf/test_probe_write_user_kern.c
View File

@ -11,7 +11,6 @@
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>
#include "trace_common.h"
struct {
__uint(type, BPF_MAP_TYPE_HASH);
@ -28,7 +27,7 @@ struct {
* This example sits on a syscall, and the syscall ABI is relatively stable
* of course, across platforms, and over time, the ABI may change.
*/
SEC("kprobe/" SYSCALL(sys_connect))
SEC("ksyscall/connect")
int bpf_prog1(struct pt_regs *ctx)
{
struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1_CORE(ctx);

13
samples/bpf/trace_common.h
View File

@ -1,13 +0,0 @@
// SPDX-License-Identifier: GPL-2.0
#ifndef __TRACE_COMMON_H
#define __TRACE_COMMON_H
#ifdef __x86_64__
#define SYSCALL(SYS) "__x64_" __stringify(SYS)
#elif defined(__s390x__)
#define SYSCALL(SYS) "__s390x_" __stringify(SYS)
#else
#define SYSCALL(SYS) __stringify(SYS)
#endif
#endif

3
samples/bpf/trace_output_kern.c
View File

@ -2,7 +2,6 @@
#include <linux/version.h>
#include <uapi/linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include "trace_common.h"
struct {
__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
@ -11,7 +10,7 @@ struct {
__uint(max_entries, 2);
} my_map SEC(".maps");
SEC("kprobe/" SYSCALL(sys_write))
SEC("ksyscall/write")
int bpf_prog1(struct pt_regs *ctx)
{
struct S {

3
samples/bpf/tracex2_kern.c
View File

@ -10,7 +10,6 @@
#include <uapi/linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include "trace_common.h"
struct {
__uint(type, BPF_MAP_TYPE_HASH);
@ -78,7 +77,7 @@ struct {
__uint(max_entries, 1024);
} my_hist_map SEC(".maps");
SEC("kprobe/" SYSCALL(sys_write))
SEC("ksyscall/write")
int bpf_prog3(struct pt_regs *ctx)
{
long write_size = PT_REGS_PARM3(ctx);