samples/bpf: refactor syscall tracing programs using BPF_KSYSCALL macro

This commit refactors the syscall tracing programs by adopting the
BPF_KSYSCALL macro. This change aims to enhance the clarity and
simplicity of the BPF programs by reducing the complexity of argument
parsing from pt_regs.

Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
Link: https://lore.kernel.org/r/20230818090119.477441-9-danieltimlee@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/samples/bpf/test_map_in_map.bpf.c b/samples/bpf/test_map_in_map.bpf.c
index 1883559..9f030f9 100644 (file)
--- a/samples/bpf/test_map_in_map.bpf.c
+++ b/samples/bpf/test_map_in_map.bpf.c
@@ -103,19 +103,15 @@ static __always_inline int do_inline_hash_lookup(void *inner_map, u32 port)
        return result ? *result : -ENOENT;
 }
 
-SEC("kprobe/__sys_connect")
-int trace_sys_connect(struct pt_regs *ctx)
+SEC("ksyscall/connect")
+int BPF_KSYSCALL(trace_sys_connect, unsigned int fd, struct sockaddr_in6 *in6, int addrlen)
 {
-       struct sockaddr_in6 *in6;
        u16 test_case, port, dst6[8];
-       int addrlen, ret, inline_ret, ret_key = 0;
+       int ret, inline_ret, ret_key = 0;
        u32 port_key;
        void *outer_map, *inner_map;
        bool inline_hash = false;
 
-       in6 = (struct sockaddr_in6 *)PT_REGS_PARM2_CORE(ctx);
-       addrlen = (int)PT_REGS_PARM3_CORE(ctx);
-
        if (addrlen != sizeof(*in6))
                return 0;