Set up beauty_map, load it to BPF, in such format: if argument No.3 is a
struct of size 32 bytes (of syscall number 114) beauty_map[114][2] = 32;
if argument No.3 is a string (of syscall number 114) beauty_map[114][2] =
1;
if argument No.3 is a buffer, its size is indicated by argument No.4 (of
syscall number 114) beauty_map[114][2] = -4; /* -1 ~ -6, we'll read this
buffer size in BPF */
Signed-off-by: Howard Chu <howardchu95@gmail.com>
---
tools/perf/builtin-trace.c | 106 +++++++++++++++++++++++++++++++++++++
1 file changed, 106 insertions(+)
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 97076b962688..e7e8c89d9538 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -113,6 +113,7 @@ struct syscall_arg_fmt {
bool show_zero;
#ifdef HAVE_LIBBPF_SUPPORT
const struct btf_type *type;
+ int type_id; /* used in btf_dump */
#endif
};
@@ -926,6 +927,23 @@ static void syscall_arg_fmt__cache_btf_enum(struct syscall_arg_fmt *arg_fmt, str
arg_fmt->type = btf__type_by_id(btf, id);
}
+static int syscall_arg_fmt__cache_btf_struct(struct syscall_arg_fmt *arg_fmt, struct btf *btf, char *type)
+{
+ int id;
+
+ if (arg_fmt->type != NULL)
+ return -1;
+
+ id = btf__find_by_name(btf, type);
+ if (id < 0)
+ return -1;
+
+ arg_fmt->type = btf__type_by_id(btf, id);
+ arg_fmt->type_id = id;
+
+ return 0;
+}
+
static bool syscall_arg__strtoul_btf_enum(char *bf, size_t size, struct syscall_arg *arg, u64 *val)
{
const struct btf_type *bt = arg->fmt->type;
@@ -3520,6 +3538,83 @@ static int trace__bpf_prog_sys_exit_fd(struct trace *trace, int id)
return sc ? bpf_program__fd(sc->bpf_prog.sys_exit) : bpf_program__fd(trace->skel->progs.syscall_unaugmented);
}
+static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int key, unsigned int *beauty_array)
+{
+ struct tep_format_field *field;
+ struct syscall *sc = trace__syscall_info(trace, NULL, key);
+ const struct btf_type *bt;
+ char *struct_offset, *tmp, name[32];
+ bool can_augment = false;
+ int i, cnt;
+
+ if (sc == NULL)
+ return -1;
+
+ trace__load_vmlinux_btf(trace);
+ if (trace->btf == NULL)
+ return -1;
+
+ for (i = 0, field = sc->args; field; ++i, field = field->next) {
+ struct_offset = strstr(field->type, "struct ");
+
+ if (field->flags & TEP_FIELD_IS_POINTER && struct_offset) { /* struct */
+ struct_offset += 7;
+
+ /* for 'struct foo *', we only want 'foo' */
+ for (tmp = struct_offset, cnt = 0; *tmp != ' ' && *tmp != '\0'; ++tmp, ++cnt) {
+ }
+
+ strncpy(name, struct_offset, cnt);
+ name[cnt] = '\0';
+
+ /* cache struct's btf_type and type_id */
+ if (syscall_arg_fmt__cache_btf_struct(&sc->arg_fmt[i], trace->btf, name))
+ continue;
+
+ bt = sc->arg_fmt[i].type;
+ beauty_array[i] = bt->size;
+ can_augment = true;
+ } else if (field->flags & TEP_FIELD_IS_POINTER && /* string */
+ strcmp(field->type, "const char *") == 0 &&
+ (strstr(field->name, "name") ||
+ strstr(field->name, "path") ||
+ strstr(field->name, "file") ||
+ strstr(field->name, "root") ||
+ strstr(field->name, "key") ||
+ strstr(field->name, "special") ||
+ strstr(field->name, "type") ||
+ strstr(field->name, "description"))) {
+ beauty_array[i] = 1;
+ can_augment = true;
+ } else if (field->flags & TEP_FIELD_IS_POINTER && /* buffer */
+ strstr(field->type, "char *") &&
+ (strstr(field->name, "buf") ||
+ strstr(field->name, "val") ||
+ strstr(field->name, "msg"))) {
+ int j;
+ struct tep_format_field *field_tmp;
+
+ /* find the size of the buffer that appears in pairs with buf */
+ for (j = 0, field_tmp = sc->args; field_tmp; ++j, field_tmp = field_tmp->next) {
+ if (!(field_tmp->flags & TEP_FIELD_IS_POINTER) && /* only integers */
+ (strstr(field_tmp->name, "count") ||
+ strstr(field_tmp->name, "siz") || /* size, bufsiz */
+ (strstr(field_tmp->name, "len") && strcmp(field_tmp->name, "filename")))) {
+ /* filename's got 'len' in it, we don't want that */
+ beauty_array[i] = -(j + 1);
+ can_augment = true;
+ break;
+ }
+ }
+ }
+ }
+
+ if (can_augment)
+ return 0;
+
+ return -1;
+}
+
static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace, struct syscall *sc)
{
struct tep_format_field *field, *candidate_field;
@@ -3624,7 +3719,9 @@ static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace)
{
int map_enter_fd = bpf_map__fd(trace->skel->maps.syscalls_sys_enter);
int map_exit_fd = bpf_map__fd(trace->skel->maps.syscalls_sys_exit);
+ int beauty_map_fd = bpf_map__fd(trace->skel->maps.beauty_map_enter);
int err = 0;
+ unsigned int beauty_array[6];
for (int i = 0; i < trace->sctbl->syscalls.nr_entries; ++i) {
int prog_fd, key = syscalltbl__id_at_idx(trace->sctbl, i);
@@ -3643,6 +3740,15 @@ static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace)
err = bpf_map_update_elem(map_exit_fd, &key, &prog_fd, BPF_ANY);
if (err)
break;
+
+ /* use beauty_map to tell BPF how many bytes to collect, set beauty_map's value here */
+ memset(beauty_array, 0, sizeof(beauty_array));
+ err = trace__bpf_sys_enter_beauty_map(trace, key, (unsigned int *)beauty_array);
+ if (err)
+ continue;
+ err = bpf_map_update_elem(beauty_map_fd, &key, beauty_array, BPF_ANY);
+ if (err)
+ break;
}
/*
--
2.45.2On Thu, Aug 15, 2024 at 09:36:19AM +0800, Howard Chu wrote:
> Set up beauty_map, load it to BPF, in such format: if argument No.3 is a
> struct of size 32 bytes (of syscall number 114) beauty_map[114][2] = 32;
>
> if argument No.3 is a string (of syscall number 114) beauty_map[114][2] =
> 1;
>
> if argument No.3 is a buffer, its size is indicated by argument No.4 (of
> syscall number 114) beauty_map[114][2] = -4; /* -1 ~ -6, we'll read this
> buffer size in BPF */
>
> Signed-off-by: Howard Chu <howardchu95@gmail.com>
> ---
> tools/perf/builtin-trace.c | 106 +++++++++++++++++++++++++++++++++++++
> 1 file changed, 106 insertions(+)
>
> diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> index 97076b962688..e7e8c89d9538 100644
> --- a/tools/perf/builtin-trace.c
> +++ b/tools/perf/builtin-trace.c
> @@ -113,6 +113,7 @@ struct syscall_arg_fmt {
> bool show_zero;
> #ifdef HAVE_LIBBPF_SUPPORT
> const struct btf_type *type;
> + int type_id; /* used in btf_dump */
> #endif
> };
>
> @@ -926,6 +927,23 @@ static void syscall_arg_fmt__cache_btf_enum(struct syscall_arg_fmt *arg_fmt, str
> arg_fmt->type = btf__type_by_id(btf, id);
> }
>
> +static int syscall_arg_fmt__cache_btf_struct(struct syscall_arg_fmt *arg_fmt, struct btf *btf, char *type)
> +{
> + int id;
> +
> + if (arg_fmt->type != NULL)
> + return -1;
> +
> + id = btf__find_by_name(btf, type);
> + if (id < 0)
> + return -1;
> +
> + arg_fmt->type = btf__type_by_id(btf, id);
> + arg_fmt->type_id = id;
> +
> + return 0;
> +}
> +
> static bool syscall_arg__strtoul_btf_enum(char *bf, size_t size, struct syscall_arg *arg, u64 *val)
> {
> const struct btf_type *bt = arg->fmt->type;
> @@ -3520,6 +3538,83 @@ static int trace__bpf_prog_sys_exit_fd(struct trace *trace, int id)
> return sc ? bpf_program__fd(sc->bpf_prog.sys_exit) : bpf_program__fd(trace->skel->progs.syscall_unaugmented);
> }
>
> +static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int key, unsigned int *beauty_array)
> +{
> + struct tep_format_field *field;
> + struct syscall *sc = trace__syscall_info(trace, NULL, key);
> + const struct btf_type *bt;
> + char *struct_offset, *tmp, name[32];
> + bool can_augment = false;
> + int i, cnt;
> +
> + if (sc == NULL)
> + return -1;
> +
> + trace__load_vmlinux_btf(trace);
> + if (trace->btf == NULL)
> + return -1;
> +
> + for (i = 0, field = sc->args; field; ++i, field = field->next) {
> + struct_offset = strstr(field->type, "struct ");
> +
> + if (field->flags & TEP_FIELD_IS_POINTER && struct_offset) { /* struct */
> + struct_offset += 7;
> +
> + /* for 'struct foo *', we only want 'foo' */
> + for (tmp = struct_offset, cnt = 0; *tmp != ' ' && *tmp != '\0'; ++tmp, ++cnt) {
> + }
> +
> + strncpy(name, struct_offset, cnt);
> + name[cnt] = '\0';
> +
> + /* cache struct's btf_type and type_id */
> + if (syscall_arg_fmt__cache_btf_struct(&sc->arg_fmt[i], trace->btf, name))
> + continue;
> +
> + bt = sc->arg_fmt[i].type;
> + beauty_array[i] = bt->size;
> + can_augment = true;
> + } else if (field->flags & TEP_FIELD_IS_POINTER && /* string */
> + strcmp(field->type, "const char *") == 0 &&
> + (strstr(field->name, "name") ||
> + strstr(field->name, "path") ||
> + strstr(field->name, "file") ||
> + strstr(field->name, "root") ||
> + strstr(field->name, "key") ||
> + strstr(field->name, "special") ||
> + strstr(field->name, "type") ||
> + strstr(field->name, "description"))) {
> + beauty_array[i] = 1;
> + can_augment = true;
> + } else if (field->flags & TEP_FIELD_IS_POINTER && /* buffer */
> + strstr(field->type, "char *") &&
> + (strstr(field->name, "buf") ||
> + strstr(field->name, "val") ||
> + strstr(field->name, "msg"))) {
> + int j;
> + struct tep_format_field *field_tmp;
> +
> + /* find the size of the buffer that appears in pairs with buf */
> + for (j = 0, field_tmp = sc->args; field_tmp; ++j, field_tmp = field_tmp->next) {
> + if (!(field_tmp->flags & TEP_FIELD_IS_POINTER) && /* only integers */
> + (strstr(field_tmp->name, "count") ||
> + strstr(field_tmp->name, "siz") || /* size, bufsiz */
> + (strstr(field_tmp->name, "len") && strcmp(field_tmp->name, "filename")))) {
> + /* filename's got 'len' in it, we don't want that */
> + beauty_array[i] = -(j + 1);
> + can_augment = true;
> + break;
> + }
> + }
> + }
> + }
> +
> + if (can_augment)
> + return 0;
> +
> + return -1;
> +}
> +
> static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace, struct syscall *sc)
> {
> struct tep_format_field *field, *candidate_field;
> @@ -3624,7 +3719,9 @@ static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace)
> {
> int map_enter_fd = bpf_map__fd(trace->skel->maps.syscalls_sys_enter);
> int map_exit_fd = bpf_map__fd(trace->skel->maps.syscalls_sys_exit);
> + int beauty_map_fd = bpf_map__fd(trace->skel->maps.beauty_map_enter);
At this point we still don't have that, right? I.e. building with this
patch, without the ones following it in your series, I get:
builtin-trace.c: In function ‘trace__init_syscalls_bpf_prog_array_maps’:
builtin-trace.c:3723:58: error: ‘struct <anonymous>’ has no member named ‘beauty_map_enter’
3723 | int beauty_map_fd = bpf_map__fd(trace->skel->maps.beauty_map_enter);
| ^
CC /tmp/build/perf-tools-next/tests/code-reading.o
CC /tmp/build/perf-tools-next/trace/beauty/clone.o
make[3]: *** [/home/acme/git/perf-tools-next/tools/build/Makefile.build:105: /tmp/build/perf-tools-next/builtin-trace.o] Error 1
make[3]: *** Waiting for unfinished jobs....
So we need to squash the patch that introduces beauty_map_enter in the
augmented_raw_syscalls.bpf.c file to this one, so that we keep things
bisectable, I'll try to do that.
- Arnaldo
On Thu, Aug 22, 2024 at 02:49:41PM -0300, Arnaldo Carvalho de Melo wrote:
> On Thu, Aug 15, 2024 at 09:36:19AM +0800, Howard Chu wrote:
> > @@ -3624,7 +3719,9 @@ static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace)
> > {
> > int map_enter_fd = bpf_map__fd(trace->skel->maps.syscalls_sys_enter);
> > int map_exit_fd = bpf_map__fd(trace->skel->maps.syscalls_sys_exit);
> > + int beauty_map_fd = bpf_map__fd(trace->skel->maps.beauty_map_enter);
> At this point we still don't have that, right? I.e. building with this
> patch, without the ones following it in your series, I get:
> builtin-trace.c: In function ‘trace__init_syscalls_bpf_prog_array_maps’:
> builtin-trace.c:3723:58: error: ‘struct <anonymous>’ has no member named ‘beauty_map_enter’
> 3723 | int beauty_map_fd = bpf_map__fd(trace->skel->maps.beauty_map_enter);
> | ^
> CC /tmp/build/perf-tools-next/tests/code-reading.o
> CC /tmp/build/perf-tools-next/trace/beauty/clone.o
> make[3]: *** [/home/acme/git/perf-tools-next/tools/build/Makefile.build:105: /tmp/build/perf-tools-next/builtin-trace.o] Error 1
> make[3]: *** Waiting for unfinished jobs....
>
> So we need to squash the patch that introduces beauty_map_enter in the
> augmented_raw_syscalls.bpf.c file to this one, so that we keep things
> bisectable, I'll try to do that.
So just this did the trick, I'll remove it from the later patch in your
series:
- Arnaldo
diff --git a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
index 0acbd74e8c760956..c885673f416dff39 100644
--- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
+++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
@@ -79,6 +79,13 @@ struct pids_filtered {
__uint(max_entries, 64);
} pids_filtered SEC(".maps");
+struct beauty_map_enter {
+ __uint(type, BPF_MAP_TYPE_HASH);
+ __type(key, int);
+ __type(value, __u32[6]);
+ __uint(max_entries, 512);
+} beauty_map_enter SEC(".maps");
+
/*
* Desired design of maximum size and alignment (see RFC2553)
*/
On Thu, Aug 22, 2024 at 02:53:22PM -0300, Arnaldo Carvalho de Melo wrote:
> On Thu, Aug 22, 2024 at 02:49:41PM -0300, Arnaldo Carvalho de Melo wrote:
> > On Thu, Aug 15, 2024 at 09:36:19AM +0800, Howard Chu wrote:
> > > @@ -3624,7 +3719,9 @@ static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace)
> > > {
> > > int map_enter_fd = bpf_map__fd(trace->skel->maps.syscalls_sys_enter);
> > > int map_exit_fd = bpf_map__fd(trace->skel->maps.syscalls_sys_exit);
> > > + int beauty_map_fd = bpf_map__fd(trace->skel->maps.beauty_map_enter);
>
> > At this point we still don't have that, right? I.e. building with this
> > patch, without the ones following it in your series, I get:
>
> > builtin-trace.c: In function ‘trace__init_syscalls_bpf_prog_array_maps’:
> > builtin-trace.c:3723:58: error: ‘struct <anonymous>’ has no member named ‘beauty_map_enter’
> > 3723 | int beauty_map_fd = bpf_map__fd(trace->skel->maps.beauty_map_enter);
> > | ^
> > CC /tmp/build/perf-tools-next/tests/code-reading.o
> > CC /tmp/build/perf-tools-next/trace/beauty/clone.o
> > make[3]: *** [/home/acme/git/perf-tools-next/tools/build/Makefile.build:105: /tmp/build/perf-tools-next/builtin-trace.o] Error 1
> > make[3]: *** Waiting for unfinished jobs....
> >
> > So we need to squash the patch that introduces beauty_map_enter in the
> > augmented_raw_syscalls.bpf.c file to this one, so that we keep things
> > bisectable, I'll try to do that.
>
> So just this did the trick, I'll remove it from the later patch in your
> series:
But then you added syscall_arg_fmt__cache_btf_struct() ifdef'ed by
HAVE_LIBBPF_SUPPORT to then use it on trace__bpf_sys_enter_beauty_map())
that is ifdef'ed by HAVE_BPF_SKEL, so when building with
BUILD_BPF_SKEL=0 we get this splat:
CC /tmp/build/perf-tools-next/builtin-trace.o
AR /tmp/build/perf-tools-next/libperf-util.a
builtin-trace.c:930:12: error: ‘syscall_arg_fmt__cache_btf_struct’ defined but not used [-Werror=unused-function]
930 | static int syscall_arg_fmt__cache_btf_struct(struct syscall_arg_fmt *arg_fmt, struct btf *btf, char *type)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
GEN /tmp/build/perf-tools-next/python/perf.cpython-312-x86_64-linux-gnu.so
cc1: all warnings being treated as errors
make[3]: *** [/home/acme/git/perf-tools-next/tools/build/Makefile.build:105: /tmp/build/perf-tools-next/builtin-trace.o] Error 1
make[2]: *** [Makefile.perf:762: /tmp/build/perf-tools-next/perf-in.o] Error 2
make[1]: *** [Makefile.perf:292: sub-make] Error 2
make: *** [Makefile:119: install-bin] Error 2
make: Leaving directory '/home/acme/git/perf-tools-next/tools/perf'
⬢[acme@toolbox perf-tools-next]$
I'm moving syscall_arg_fmt__cache_btf_struct() to the same block where
trace__bpf_sys_enter_beauty_map() is.
> - Arnaldo
>
> diff --git a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
> index 0acbd74e8c760956..c885673f416dff39 100644
> --- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
> +++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
> @@ -79,6 +79,13 @@ struct pids_filtered {
> __uint(max_entries, 64);
> } pids_filtered SEC(".maps");
>
> +struct beauty_map_enter {
> + __uint(type, BPF_MAP_TYPE_HASH);
> + __type(key, int);
> + __type(value, __u32[6]);
> + __uint(max_entries, 512);
> +} beauty_map_enter SEC(".maps");
> +
> /*
> * Desired design of maximum size and alignment (see RFC2553)
> */
On Fri, Aug 23, 2024 at 5:09 AM Arnaldo Carvalho de Melo
<acme@kernel.org> wrote:
>
> On Thu, Aug 22, 2024 at 02:53:22PM -0300, Arnaldo Carvalho de Melo wrote:
> > On Thu, Aug 22, 2024 at 02:49:41PM -0300, Arnaldo Carvalho de Melo wrote:
> > > On Thu, Aug 15, 2024 at 09:36:19AM +0800, Howard Chu wrote:
> > > > @@ -3624,7 +3719,9 @@ static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace)
> > > > {
> > > > int map_enter_fd = bpf_map__fd(trace->skel->maps.syscalls_sys_enter);
> > > > int map_exit_fd = bpf_map__fd(trace->skel->maps.syscalls_sys_exit);
> > > > + int beauty_map_fd = bpf_map__fd(trace->skel->maps.beauty_map_enter);
> >
> > > At this point we still don't have that, right? I.e. building with this
> > > patch, without the ones following it in your series, I get:
> >
> > > builtin-trace.c: In function ‘trace__init_syscalls_bpf_prog_array_maps’:
> > > builtin-trace.c:3723:58: error: ‘struct <anonymous>’ has no member named ‘beauty_map_enter’
> > > 3723 | int beauty_map_fd = bpf_map__fd(trace->skel->maps.beauty_map_enter);
> > > | ^
> > > CC /tmp/build/perf-tools-next/tests/code-reading.o
> > > CC /tmp/build/perf-tools-next/trace/beauty/clone.o
> > > make[3]: *** [/home/acme/git/perf-tools-next/tools/build/Makefile.build:105: /tmp/build/perf-tools-next/builtin-trace.o] Error 1
> > > make[3]: *** Waiting for unfinished jobs....
> > >
> > > So we need to squash the patch that introduces beauty_map_enter in the
> > > augmented_raw_syscalls.bpf.c file to this one, so that we keep things
> > > bisectable, I'll try to do that.
> >
> > So just this did the trick, I'll remove it from the later patch in your
> > series:
Okay, making every patch buildable on their own, I see, didn't know
that's the rule, sorry (separating hunks is a little too hard for me).
Will do that in the future.
>
> But then you added syscall_arg_fmt__cache_btf_struct() ifdef'ed by
> HAVE_LIBBPF_SUPPORT to then use it on trace__bpf_sys_enter_beauty_map())
> that is ifdef'ed by HAVE_BPF_SKEL, so when building with
> BUILD_BPF_SKEL=0 we get this splat:
>
> CC /tmp/build/perf-tools-next/builtin-trace.o
> AR /tmp/build/perf-tools-next/libperf-util.a
> builtin-trace.c:930:12: error: ‘syscall_arg_fmt__cache_btf_struct’ defined but not used [-Werror=unused-function]
> 930 | static int syscall_arg_fmt__cache_btf_struct(struct syscall_arg_fmt *arg_fmt, struct btf *btf, char *type)
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> GEN /tmp/build/perf-tools-next/python/perf.cpython-312-x86_64-linux-gnu.so
> cc1: all warnings being treated as errors
> make[3]: *** [/home/acme/git/perf-tools-next/tools/build/Makefile.build:105: /tmp/build/perf-tools-next/builtin-trace.o] Error 1
> make[2]: *** [Makefile.perf:762: /tmp/build/perf-tools-next/perf-in.o] Error 2
> make[1]: *** [Makefile.perf:292: sub-make] Error 2
> make: *** [Makefile:119: install-bin] Error 2
> make: Leaving directory '/home/acme/git/perf-tools-next/tools/perf'
> ⬢[acme@toolbox perf-tools-next]$
>
> I'm moving syscall_arg_fmt__cache_btf_struct() to the same block where
> trace__bpf_sys_enter_beauty_map() is.
Yes exactly, I did it in my branch as well.
Thanks,
Howard
>
> > - Arnaldo
> >
> > diff --git a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
> > index 0acbd74e8c760956..c885673f416dff39 100644
> > --- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
> > +++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
> > @@ -79,6 +79,13 @@ struct pids_filtered {
> > __uint(max_entries, 64);
> > } pids_filtered SEC(".maps");
> >
> > +struct beauty_map_enter {
> > + __uint(type, BPF_MAP_TYPE_HASH);
> > + __type(key, int);
> > + __type(value, __u32[6]);
> > + __uint(max_entries, 512);
> > +} beauty_map_enter SEC(".maps");
> > +
> > /*
> > * Desired design of maximum size and alignment (see RFC2553)
> > */
© 2016 - 2026 Red Hat, Inc.