pkg/gadgets: Do not link syscall open() for opensnoop on arm64.
arm64 does not define open() syscall, only openat().
This commit is an adaption of iovisor/bcc:
("libbpf-tools/opensnoop: disable open on aarch64")
@@ -25,6 +25,7 @@ import (
"errors"
"fmt"
"os"
+ "runtime"
"unsafe"
"github.com/cilium/ebpf"
@@ -114,11 +115,14 @@ func (t *Tracer) start() error {
return fmt.Errorf("failed to load ebpf program: %w", err)
}
+ // arm64 does not defined an open() syscall, only openat().
+ if runtime.GOARCH != "arm64" {
openEnter, err := link.Tracepoint("syscalls", "sys_enter_open", t.objs.TracepointSyscallsSysEnterOpen, nil)
if err != nil {
return fmt.Errorf("error opening tracepoint: %w", err)
}
t.openEnterLink = openEnter
+ }
openAtEnter, err := link.Tracepoint("syscalls", "sys_enter_openat", t.objs.TracepointSyscallsSysEnterOpenat, nil)
if err != nil {
@@ -126,11 +130,13 @@ func (t *Tracer) start() error {
}
t.openAtEnterLink = openAtEnter
+ if runtime.GOARCH != "arm64" {
openExit, err := link.Tracepoint("syscalls", "sys_exit_open", t.objs.TracepointSyscallsSysExitOpen, nil)
if err != nil {
return fmt.Errorf("error opening tracepoint: %w", err)
}
t.openExitLink = openExit
+ }
openAtExit, err := link.Tracepoint("syscalls", "sys_exit_openat", t.objs.TracepointSyscallsSysExitOpenat, nil)
if err != nil {
