libbpf-tools/syncsnoop: Add support for sync_file_range2 and arm_sync_file_range()

Some architectures like ppc64 don't use the sync_file_range syscall,
but sync_file_range2 instead and that makes syncsnoop fails on those
arches. Add support for it.

On some older kernel, this function was called arm_sync_file_range()
on arm architecture. Support this syscall too.

Fixes the following error:
libbpf: failed to determine tracepoint 'syscalls/sys_enter_sync_file_range' perf event ID: No such file or directory
libbpf: prog 'tracepoint__syscalls__sys_enter_sync_file_range': failed to create tracepoint 'syscalls/sys_enter_sync_file_range' perf event: No such file or directory
libbpf: prog 'tracepoint__syscalls__sys_enter_sync_file_range': failed to auto-attach: -2
failed to attach BPF object

Signed-off-by: Jerome Marchand <jmarchan@redhat.com>

Author: jeromemarchand

libbpf-tools/syncsnoop.bpf.c

@@ -52,6 +52,18 @@ void tracepoint__syscalls__sys_enter_sync_file_range(struct trace_event_raw_sys_
 	__syscall(ctx, SYS_SYNC_FILE_RANGE);
 }
 
+SEC("tracepoint/syscalls/sys_enter_sync_file_range2")
+void tracepoint__syscalls__sys_enter_sync_file_range2(struct trace_event_raw_sys_enter *ctx)
+{
+	__syscall(ctx, SYS_SYNC_FILE_RANGE2);
+}
+
+SEC("tracepoint/syscalls/sys_enter_arm_sync_file_range")
+void tracepoint__syscalls__sys_enter_arm_sync_file_range(struct trace_event_raw_sys_enter *ctx)
+{
+	__syscall(ctx, SYS_ARM_SYNC_FILE_RANGE);
+}
+
 SEC("tracepoint/syscalls/sys_enter_syncfs")
 void tracepoint__syscalls__sys_enter_syncfs(struct trace_event_raw_sys_enter *ctx)
 {

libbpf-tools/syncsnoop.c

@@ -10,6 +10,7 @@
 #include <bpf/libbpf.h>
 #include "syncsnoop.h"
 #include "syncsnoop.skel.h"
+#include "trace_helpers.h"
 
 #define PERF_BUFFER_PAGES       16
 #define PERF_POLL_TIMEOUT_MS    100
@@ -101,9 +102,22 @@ int main(int argc, char **argv)
 
 	libbpf_set_print(libbpf_print_fn);
 
-	obj = syncsnoop_bpf__open_and_load();
+	obj = syncsnoop_bpf__open();
 	if (!obj) {
-		fprintf(stderr, "failed to open and load BPF object\n");
+		fprintf(stderr, "failed to open BPF object\n");
+		return 1;
+	}
+
+	if (!tracepoint_exists("syscalls", "sys_enter_sync_file_range"))
+		bpf_program__set_autoload(obj->progs.tracepoint__syscalls__sys_enter_sync_file_range, false);
+	if (!tracepoint_exists("syscalls", "sys_enter_sync_file_range2"))
+		bpf_program__set_autoload(obj->progs.tracepoint__syscalls__sys_enter_sync_file_range2, false);
+	if (!tracepoint_exists("syscalls", "sys_enter_arm_sync_file_range"))
+		bpf_program__set_autoload(obj->progs.tracepoint__syscalls__sys_enter_arm_sync_file_range, false);
+
+	err = syncsnoop_bpf__load(obj);
+	if (err) {
+		fprintf(stderr, "failed to load BPF object\n");
 		return 1;
 	}
 

libbpf-tools/syncsnoop.h

@@ -11,6 +11,8 @@ enum sync_syscalls {
 	SYS_FDATASYNC,
 	SYS_MSYNC,
 	SYS_SYNC_FILE_RANGE,
+	SYS_SYNC_FILE_RANGE2,
+	SYS_ARM_SYNC_FILE_RANGE,
 	SYS_SYNCFS,
 	SYS_T_MAX,
 };
@@ -28,6 +30,8 @@ static const char *sys_names[] = {
 	"fdatasync",
 	"msync",
 	"sync_file_range",
+	"sync_file_range2",
+	"arm_sync_file_range",
 	"syncfs",
 	"N/A",
 };