{"action":"created","issue":{"url":"https://api.github.com/repos/iovisor/gobpf/issues/147","repository_url":"https://api.github.com/repos/iovisor/gobpf","labels_url":"https://api.github.com/repos/iovisor/gobpf/issues/147/labels{/name}","comments_url":"https://api.github.com/repos/iovisor/gobpf/issues/147/comments","events_url":"https://api.github.com/repos/iovisor/gobpf/issues/147/events","html_url":"https://github.com/iovisor/gobpf/pull/147","id":361491060,"node_id":"MDExOlB1bGxSZXF1ZXN0MjE2NDQ5NjE5","number":147,"title":"Use correct prefix for syscall probes","user":{"login":"tuxology","id":3373857,"node_id":"MDQ6VXNlcjMzNzM4NTc=","avatar_url":"https://avatars3.githubusercontent.com/u/3373857?v=4","gravatar_id":"","url":"https://api.github.com/users/tuxology","html_url":"https://github.com/tuxology","followers_url":"https://api.github.com/users/tuxology/followers","following_url":"https://api.github.com/users/tuxology/following{/other_user}","gists_url":"https://api.github.com/users/tuxology/gists{/gist_id}","starred_url":"https://api.github.com/users/tuxology/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tuxology/subscriptions","organizations_url":"https://api.github.com/users/tuxology/orgs","repos_url":"https://api.github.com/users/tuxology/repos","events_url":"https://api.github.com/users/tuxology/events{/privacy}","received_events_url":"https://api.github.com/users/tuxology/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2018-09-18T21:27:27Z","updated_at":"2018-10-01T09:58:38Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/iovisor/gobpf/pulls/147","html_url":"https://github.com/iovisor/gobpf/pull/147","diff_url":"https://github.com/iovisor/gobpf/pull/147.diff","patch_url":"https://github.com/iovisor/gobpf/pull/147.patch"},"body":"Kernel versions 4.17+ need `__x64__sys_` prefix for syscalls. So we patch the section names when necessary.\r\n\r\nFixes #146 \r\n\r\nTested with Kernel `v4.16` and Kernel `v4.18.5` and seems to work"},"comment":{"url":"https://api.github.com/repos/iovisor/gobpf/issues/comments/425852619","html_url":"https://github.com/iovisor/gobpf/pull/147#issuecomment-425852619","issue_url":"https://api.github.com/repos/iovisor/gobpf/issues/147","id":425852619,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNTg1MjYxOQ==","user":{"login":"calavera","id":1050,"node_id":"MDQ6VXNlcjEwNTA=","avatar_url":"https://avatars0.githubusercontent.com/u/1050?v=4","gravatar_id":"","url":"https://api.github.com/users/calavera","html_url":"https://github.com/calavera","followers_url":"https://api.github.com/users/calavera/followers","following_url":"https://api.github.com/users/calavera/following{/other_user}","gists_url":"https://api.github.com/users/calavera/gists{/gist_id}","starred_url":"https://api.github.com/users/calavera/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calavera/subscriptions","organizations_url":"https://api.github.com/users/calavera/orgs","repos_url":"https://api.github.com/users/calavera/repos","events_url":"https://api.github.com/users/calavera/events{/privacy}","received_events_url":"https://api.github.com/users/calavera/received_events","type":"User","site_admin":false},"created_at":"2018-10-01T09:58:38Z","updated_at":"2018-10-01T09:58:38Z","author_association":"CONTRIBUTOR","body":"> However, what i did by checking kernel version is not a good way now that I think of it - as the version string won't indicate 100% if the syscall names actually changed. My new plan is to actually go through `/proc/kallsyms` and then search for `__$ARCH_sys_$SYSCALL` pattern where `ARCH` is determined by what arch the program is running on and `$SYSCALL` is the syscall name that kprobe asked to be inserted.\r\n\r\nThat sounds like a good plan to me.\r\n\r\nI do like the idea of making the bpf program as portable as possible regarding syscall names :+1: "}}
{"actor":{"display_login":"calavera"}}