• Y
    bpf: add support for sys_enter_* and sys_exit_* tracepoints · cf5f5cea
    Yonghong Song 提交于
    Currently, bpf programs cannot be attached to sys_enter_* and sys_exit_*
    style tracepoints. The iovisor/bcc issue #748
    (https://github.com/iovisor/bcc/issues/748) documents this issue.
    For example, if you try to attach a bpf program to tracepoints
    syscalls/sys_enter_newfstat, you will get the following error:
       # ./tools/trace.py t:syscalls:sys_enter_newfstat
       Ioctl(PERF_EVENT_IOC_SET_BPF): Invalid argument
       Failed to attach BPF to tracepoint
    
    The main reason is that syscalls/sys_enter_* and syscalls/sys_exit_*
    tracepoints are treated differently from other tracepoints and there
    is no bpf hook to it.
    
    This patch adds bpf support for these syscalls tracepoints by
      . permitting bpf attachment in ioctl PERF_EVENT_IOC_SET_BPF
      . calling bpf programs in perf_syscall_enter and perf_syscall_exit
    
    The legality of bpf program ctx access is also checked.
    Function trace_event_get_offsets returns correct max offset for each
    specific syscall tracepoint, which is compared against the maximum offset
    access in bpf program.
    Signed-off-by: NYonghong Song <yhs@fb.com>
    Acked-by: NAlexei Starovoitov <ast@kernel.org>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    cf5f5cea
trace_syscalls.c 19.8 KB