Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: move to new bpf api #47

Closed
wants to merge 1 commit into from
Closed

fix: move to new bpf api #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 13 additions & 12 deletions execsnoop-kernel/execsnoop_kern.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,18 +34,19 @@ struct syscalls_exit_execve_args {
long ret;
};

struct bpf_map_def SEC("maps") records = {
.type = BPF_MAP_TYPE_HASH,
.key_size = sizeof(pid_t),
.value_size = sizeof(struct event),
.max_entries = 10240,
};
struct bpf_map_def SEC("maps") perf_events = {
.type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
.key_size = sizeof(u32),
.value_size = sizeof(u32),
.max_entries = 128,
};
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 10240);
__type(key, pid_t);
__type(value, struct event);
} records SEC(".maps");

struct {
__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
__uint(max_entries, 128);
__type(key, u32);
__type(value, u32);
} perf_events SEC(".maps");

SEC("tracepoint/syscalls/sys_enter_execve")
int syscall_enter_execve(struct syscalls_enter_execve_args *ctx){
Expand Down
11 changes: 8 additions & 3 deletions execsnoop-kernel/execsnoop_share.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,10 +64,15 @@ int execsnoop() {
return err;
}

pb_opts.sz = sizeof(pb_opts);

main_loop:
pb_opts.sample_cb = handle_event;
pb_opts.lost_cb = handle_lost_events;
pb = perf_buffer__new(bpf_map__fd(obj->maps.perf_events), PERF_BUFFER_PAGES, &pb_opts);
pb = perf_buffer__new(bpf_map__fd(obj->maps.perf_events),
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the last argument of this function should be nullptr. The following image contains the old (libbpf version 0.8.1) definition perf_buffer_opts which is a size_t or callback functions.
0.8.1

Copy link
Author

@black-desk black-desk Oct 11, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I look into libbpf source, seems like this opts just use to do a check, and not passed into __perf_buffer__new:

https://github.com/torvalds/linux/blob/c40e8341e3b3bb27e3a65b06b5b454626234c4f0/tools/lib/bpf/libbpf.c#L11606

this check will success when opts is nullptr:

https://github.com/torvalds/linux/blob/c40e8341e3b3bb27e3a65b06b5b454626234c4f0/tools/lib/bpf/libbpf_internal.h#L296-L300

so it will be fine whether pass opts or nullptr.

I have no idea why libbpf need this opts arg.

PERF_BUFFER_PAGES,
handle_event,
handle_lost_events,
nullptr,
&pb_opts);
err = libbpf_get_error(pb);
if (err) {
printf("failed to setup perf_buffer: %d\n", err);
Expand Down
Loading