Re: [PATCH net-next v2 1/2] bpf: add support for sys_enter_* and sys_exit_* tracepoints

On 8/3/17 1:08 AM, Peter Zijlstra wrote:

On Wed, Aug 02, 2017 at 10:28:27PM -0700, Yonghong Song wrote:

quoted

Currently, bpf programs cannot be attached to sys_enter_* and sys_exit_*
style tracepoints. The iovisor/bcc issue #748
(https://github.com/iovisor/bcc/issues/748) documents this issue.
For example, if you try to attach a bpf program to tracepoints
syscalls/sys_enter_newfstat, you will get the following error:
    # ./tools/trace.py t:syscalls:sys_enter_newfstat
    Ioctl(PERF_EVENT_IOC_SET_BPF): Invalid argument
    Failed to attach BPF to tracepoint

The main reason is that syscalls/sys_enter_* and syscalls/sys_exit_*
tracepoints are treated differently from other tracepoints and there
is no bpf hook to it.

This patch adds bpf support for these syscalls tracepoints by
   . permitting bpf attachment in ioctl PERF_EVENT_IOC_SET_BPF
   . calling bpf programs in perf_syscall_enter and perf_syscall_exit

Signed-off-by: Yonghong Song <redacted>

Ack for the perf bits, but you should've Cc'ed steve too I suppose.

Thanks, Peter. This is first time I posted for tracing related changes.
Will for sure remember this next time.

There is a build error:
======
   kernel/events/core.c: In function 'perf_event_set_bpf_prog':

quoted

kernel/events/core.c:8073:18: error: implicit declaration of function 'is_syscall_trace_event' [-Werror=implicit-function-declaration]

     is_syscall_tp = is_syscall_trace_event(event->tp_event);
======

Will address this and send another patch soon.