fix: move to new bpf api

[black-desk]

No description provided.

[CoelacanthusHex]

Should you also update https://github.com/springzfx/cgproxy/blob/master/execsnoop-kernel/aarch64/execsnoop_kern_skel.h ?

[black-desk]

Should you also update https://github.com/springzfx/cgproxy/blob/master/execsnoop-kernel/aarch64/execsnoop_kern_skel.h ?

I don't have any arm device TAT.

[darsvador]

@black-desk PTAL.

[darsvador]

I think the last argument of this function should be nullptr. The following image contains the old (libbpf version 0.8.1) definition perf_buffer_opts which is a size_t or callback functions.

[black-desk]

I look into libbpf source, seems like this opts just use to do a check, and not passed into __perf_buffer__new:

https://github.com/torvalds/linux/blob/c40e8341e3b3bb27e3a65b06b5b454626234c4f0/tools/lib/bpf/libbpf.c#L11606

this check will success when opts is nullptr:

https://github.com/torvalds/linux/blob/c40e8341e3b3bb27e3a65b06b5b454626234c4f0/tools/lib/bpf/libbpf_internal.h#L296-L300

so it will be fine whether pass opts or nullptr.

I have no idea why libbpf need this opts arg.

[adwinb]

Shall we fork this repo and maintain that one instead?
As far I appreciate springzfx's work, it seems s/he has had no activity on github for the last two years.

[opsiff]

execsnoop_kern_skel.h for aarch64(without test)
https://gist.github.com/opsiff/2ce709b98b2084090eadf7004ceea2cb

[springzfx]

Works for libbpf 1.x now. Thanks for your contribution.