• Arnaldo Carvalho de Melo's avatar
    perf bpf: Do not attach a BPF prog to a tracepoint if its name starts with ! · 2620b7e3
    Arnaldo Carvalho de Melo authored
    With BPF_MAP_TYPE_PROG_ARRAY + bpf_tail_call() we want to have BPF
    programs, i.e. functions in a object file that perf's BPF loader
    shouldn't try to attach to anything, i.e. "!syscalls:sys_enter_open"
    should just stay there, not be attached to a tracepoint with that name,
    it'll be used by, for instance, 'perf trace' to associate with syscalls
    that copy, in addition to the syscall raw args, a filename pointed by
    the first arg, i.e. multiple syscalls that need copying the same pointer
    arg in the same way, as a filename, for instance, will share the same
    BPF program/function.
    
    Right now when perf's BPF loader sees a function with a name
    "sys:name" it'll look for a tracepoint and will associate that BPF
    program with it, say:
    
      SEC("raw_syscalls:sys_enter")
      int sys_enter(struct syscall_enter_args *args)
      {
         //SNIP
      }
    
    Will crate a perf_evsel tracepoint event and then associate with it that
    BPF program.
    
    This convention at some point will switch to the one used by the BPF
    loader in libbpf, but to experiment with BPF_MAP_TYPE_PROG_ARRAY in
    'perf trace' lets do this, that will not require changing too much
    stuff.
    
    Cc: Adrian Hunter <adrian.hunter@intel.com>
    Cc: Jiri Olsa <jolsa@kernel.org>
    Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Link: https://lkml.kernel.org/n/tip-lk6dasjr1yf9rtvl292b2hpc@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
    2620b7e3
parse-events.c 67 KB