samples: bpf: Fix syscall_tp openat argument

This modification doesn't change behaviour of the syscall_tp
But such code is often used as a reference so it should be
correct anyway

Signed-off-by: Denys Zagorui <dzagorui@cisco.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20231019113521.4103825-1-dzagorui@cisco.com

diff --git a/samples/bpf/syscall_tp_kern.c b/samples/bpf/syscall_tp_kern.c
index 090fecfe641a94cc213b63fc6947a4cf8e2b821c..58fef969a60ef29ad065ecd572d02243acf49608 100644 (file)
--- a/samples/bpf/syscall_tp_kern.c
+++ b/samples/bpf/syscall_tp_kern.c
@@ -4,6 +4,7 @@
 #include <uapi/linux/bpf.h>
 #include <bpf/bpf_helpers.h>
 
+#if !defined(__aarch64__)
 struct syscalls_enter_open_args {
        unsigned long long unused;
        long syscall_nr;
@@ -11,6 +12,7 @@ struct syscalls_enter_open_args {
        long flags;
        long mode;
 };
+#endif
 
 struct syscalls_exit_open_args {
        unsigned long long unused;
@@ -18,6 +20,15 @@ struct syscalls_exit_open_args {
        long ret;
 };
 
+struct syscalls_enter_open_at_args {
+       unsigned long long unused;
+       long syscall_nr;
+       long long dfd;
+       long filename_ptr;
+       long flags;
+       long mode;
+};
+
 struct {
        __uint(type, BPF_MAP_TYPE_ARRAY);
        __type(key, u32);
@@ -54,14 +65,14 @@ int trace_enter_open(struct syscalls_enter_open_args *ctx)
 #endif
 
 SEC("tracepoint/syscalls/sys_enter_openat")
-int trace_enter_open_at(struct syscalls_enter_open_args *ctx)
+int trace_enter_open_at(struct syscalls_enter_open_at_args *ctx)
 {
        count(&enter_open_map);
        return 0;
 }
 
 SEC("tracepoint/syscalls/sys_enter_openat2")
-int trace_enter_open_at2(struct syscalls_enter_open_args *ctx)
+int trace_enter_open_at2(struct syscalls_enter_open_at_args *ctx)
 {
        count(&enter_open_map);
        return 0;