tetragon: Wire extra process event tail call to tracepoint sensor

before:
  generic_tracepoint_process_event   3878 insns

now:
  generic_tracepoint_process_event_2 2925 insns
  generic_tracepoint_process_event   2501 insns

Signed-off-by: Jiri Olsa <jolsa@kernel.org>

Author: olsajiri

bpf/process/bpf_generic_tracepoint.c

@@ -22,6 +22,7 @@ int generic_tracepoint_filter(void *ctx);
 int generic_tracepoint_arg(void *ctx);
 int generic_tracepoint_actions(void *ctx);
 int generic_tracepoint_output(void *ctx);
+int generic_tracepoint_process_event_2(void *ctx);
 
 struct {
 	__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
@@ -35,6 +36,9 @@ struct {
 		[TAIL_CALL_ARGS] = (void *)&generic_tracepoint_arg,
 		[TAIL_CALL_ACTIONS] = (void *)&generic_tracepoint_actions,
 		[TAIL_CALL_SEND] = (void *)&generic_tracepoint_output,
+#ifndef __LARGE_BPF_PROG
+		[TAIL_CALL_PROCESS_2] = (void *)&generic_tracepoint_process_event_2,
+#endif
 	},
 };
 
@@ -260,12 +264,26 @@ generic_tracepoint_event(struct generic_tracepoint_event_arg *ctx)
 	return 0;
 }
 
+#ifdef __LARGE_BPF_PROG
+__attribute__((section("tracepoint"), used)) int
+generic_tracepoint_process_event(void *ctx)
+{
+	return generic_process_event(ctx, (struct bpf_map_def *)&tp_calls, __READ_ARG_ALL);
+}
+#else
 __attribute__((section("tracepoint"), used)) int
 generic_tracepoint_process_event(void *ctx)
 {
 	return generic_process_event(ctx, (struct bpf_map_def *)&tp_calls, __READ_ARG_ALL);
 }
 
+__attribute__((section("tracepoint"), used)) int
+generic_tracepoint_process_event_2(void *ctx)
+{
+	return generic_process_event(ctx, (struct bpf_map_def *)&tp_calls, __READ_ARG_2);
+}
+#endif
+
 __attribute__((section("tracepoint"), used)) int
 generic_tracepoint_filter(void *ctx)
 {

pkg/sensors/tracing/tracepoint_test.go

@@ -444,23 +444,23 @@ func TestLoadTracepointSensor(t *testing.T) {
 	}
 
 	var sensorMaps = []tus.SensorMap{
+		// generic_tracepoint_output
+		{Name: "tcpmon_map", Progs: []uint{5}},
+	}
+
+	if config.EnableLargeProgs() {
 		// all programs
-		{Name: "process_call_heap", Progs: []uint{0, 1, 2, 3, 4, 5}},
+		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "process_call_heap", Progs: []uint{0, 1, 2, 3, 4, 5}})
 
 		// all but generic_tracepoint_output
-		{Name: "tp_calls", Progs: []uint{0, 1, 2, 3, 4}},
+		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "tp_calls", Progs: []uint{0, 1, 2, 3, 4}})
 
 		// all but generic_tracepoint_event,generic_tracepoint_filter
-		{Name: "retprobe_map", Progs: []uint{1, 2}},
-
-		// generic_tracepoint_output
-		{Name: "tcpmon_map", Progs: []uint{5}},
+		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "retprobe_map", Progs: []uint{1, 2}})
 
 		// all kprobe but generic_tracepoint_filter
-		{Name: "config_map", Progs: []uint{0, 2}},
-	}
+		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "config_map", Progs: []uint{0, 2}})
 
-	if config.EnableLargeProgs() {
 		// shared with base sensor
 		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "execve_map", Progs: []uint{3, 4, 5}})
 
@@ -474,11 +474,25 @@ func TestLoadTracepointSensor(t *testing.T) {
 			sensorMaps = append(sensorMaps, tus.SensorMap{Name: "tg_conf_map", Progs: []uint{0}})
 		}
 	} else {
+		sensorProgs = append(sensorProgs, tus.SensorProg{Name: "generic_tracepoint_process_event_2", Type: ebpf.TracePoint})
+
+		// all programs
+		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "process_call_heap", Progs: []uint{0, 1, 2, 3, 4, 5, 6}})
+
+		// all but generic_tracepoint_output
+		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "tp_calls", Progs: []uint{0, 1, 2, 3, 4, 6}})
+
+		// all but generic_tracepoint_event,generic_tracepoint_filter
+		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "retprobe_map", Progs: []uint{1, 2, 6}})
+
+		// all kprobe but generic_tracepoint_filter
+		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "config_map", Progs: []uint{0, 2, 6}})
+
 		// shared with base sensor
 		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "execve_map", Progs: []uint{3}})
 
 		// only generic_tracepoint_event*
-		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "buffer_heap_map", Progs: []uint{2}})
+		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "buffer_heap_map", Progs: []uint{2, 6}})
 
 		sensorMaps = append(sensorMaps, tus.SensorMap{Name: "tg_conf_map", Progs: []uint{0}})
 	}