Eric Lee / smarc-fsl-linux-kernel

19 May, 2020

1 commit

  • 63841bc08   samples, bpf: Refactor kprobe tracing user progs with libbpf ... Browse Code ยป

    Currently, the kprobe BPF program attachment method for bpf_load is
    quite old. The implementation of bpf_load "directly" controls and
    manages(create, delete) the kprobe events of DEBUGFS. On the other hand,
    using using the libbpf automatically manages the kprobe event.
    (under bpf_link interface)

    By calling bpf_program__attach(_kprobe) in libbpf, the corresponding
    kprobe is created and the BPF program will be attached to this kprobe.
    To remove this, by simply invoking bpf_link__destroy will clean up the
    event.

    This commit refactors kprobe tracing programs (tracex{1~7}_user.c) with
    libbpf using bpf_link interface and bpf_program__attach.

    tracex2_kern.c, which tracks system calls (sys_*), has been modified to
    append prefix depending on architecture.

    Signed-off-by: Daniel T. Lee
    Signed-off-by: Daniel Borkmann
    Acked-by: Yonghong Song
    Link: https://lore.kernel.org/bpf/20200516040608.1377876-3-danieltimlee@gmail.com

    Daniel T. Lee