/* FILENAME: vfs_open.bt */
#include <linux/path.h>
#include <linux/dcache.h>
kprobe:vfs_open
{
printf("open path: %s\n", str(((struct path *)arg0)->dentry->d_name.name));
}
Since struct path and struct dentry are defined in the path.h and dcache.h in the directory of /usr/src/kernels/4.18.0-348.7.1.el8_5.x86_64/include, I run this program on linux kernel version 4.18 in this way:
sudo bpftrace -I /usr/src/kernels/4.18.0-348.7.1.el8_5.x86_64/include/ -I /usr/src/kernels/4.18.0-348.7.1.el8_5.x86_64/arch/x86/include vfs_open.bt
But bpftrace always reports: "ERROR: Include headers with missing type definitions or install BTF information to your system."
Of course on kernel ver 4.18, there is no BTF support exists, but I have given the right include dir search path as above, why bpftrace still reports error? someone can help me?
I have checked all include file directories, but I still can not make it, oops!
I got the answer from Github, on my linux kernel 4.18, bpftrace command should be written in this way:
sudo BPFTRACE_KERNEL_SOURCE=/usr/src/kernels/4.18.0-348.7.1.el8_5.x86_64/ bpftrace vfs_open.bt