System and method for making a program compatible across multiple-versions of operating systems
A method for making a program compatible across multiple-versions of Operation Systems (OS) is disclosed. The method includes receiving the program to be attached to function. Next, the method includes compiling the received program using macro to make it agnostic to OS version. The macro includes a conditional branching feature for determining type of syscall based on flag information from a shared map for attaching the program in different OS versions. Thereafter, the method includes attaching the program to the OS based on the determined type of syscall. In one scenario, the program is attached to a first function if the determined type of syscall is of a first type. In another scenario, the program is attached to a second function if the determined type of syscall is of a second type.
1 . A system for making a program compatible across multiple-versions of operating systems for tracing and observing functions, the system comprises:
a receiver module to receive the program to be attached to a function;
a program compilation module to compile the received program using a macro to make the program agnostic to operating system version, wherein the macro includes a conditional branching feature for determining type of supported syscall based on flag information from a shared map for attaching the program in different operating system versions; and
a program attachment module to attach the program in the operating system based on the determined type of syscall,
wherein the program is attached to a first function if the determined type of syscall is of a first type, and
wherein the program is attached to a second function if the determined type of syscall is of a second type.
2 . The system of claim 1 , wherein the shared map corresponds to a bpf map that includes the flag information indicative of the type of syscall.
3 . The system of claim 1 , wherein the type of syscall comprises at least one of: legacy syscall and wrapped syscall.
4 . The system of claim 1 , wherein the program attachment module adds an entry indicative of the second function in the shared map.
5 . The system of claim 1 , wherein the macro further includes an internal helper function for processing of the program with syscall arguments to ensure compatibility.
6 . The system of claim 1 , wherein the program compilation module forms a unified program, via the compilation using the macro, that invokes the program when attached in the function.
7 . The system of claim 1 ,
wherein the first function corresponds to a non-wrapped function, and
wherein the second function corresponds to a wrapped function.
8 . The system of claim 1 ,
wherein the operating system is a Linux operating system,
wherein the program is an extended Berkeley Packet Filter (eBPF) program, and
wherein the function is at least one of: a kernel function and a user space function.
9 . A method for making a program compatible across multiple-versions of operating systems for tracing and observing functions, the method comprises:
receiving the program to be attached to a function;
compiling the received program using a macro to make the program agnostic to operating system version, wherein the macro includes a conditional branching feature for determining type of supported syscall based on flag information from a shared map for attaching the program in different operating system versions; and
attaching the program in the operating system based on the determined type of syscall,
wherein the program is attached to a first function if the determined type of syscall is of a first type, and
wherein the program is attached to a second function if the determined type of syscall is of a second type.
10 . The method of claim 9 ,
wherein the shared map corresponds to a bpf map that includes the flag information indicative of the type of syscall, and
wherein the type of syscall comprises at least one of: legacy syscall and wrapped syscall.
11 . The method of claim 9 , further comprises adding an entry indicative of the second function in the shared map.
12 . The method of claim 9 , wherein the macro further includes an internal helper function for processing of the program with syscall arguments to ensure compatibility.
13 . The method of claim 9 , further comprises forming an unified program, via the compilation using the macro, that invokes the program when attached to the function.
14 . The method of claim 9 ,
wherein the first function corresponds to a non-wrapped function, and
wherein the second function corresponds to a wrapped function.
15 . The method of claim 9 ,
wherein the operating system is a Linux operating system,
wherein the program is an extended Berkeley Packet Filter (eBPF) program, and
wherein the function is at least one of: a kernel function and a user space function.
16 . A computer program product comprising at least one non-transitory computer-readable storage medium having computer-executable program code portions stored therein for making a program compatible across multiple-versions of operating systems for tracing and observing functions, the computer program product configured to:
receive the program to be attached to a function;
compile the received program using a macro to make the program agnostic to operating system version, wherein the macro includes a conditional branching feature for determining type of supported syscall based on flag information from a shared map for attaching the program in different operating system versions; and
attach the program in the operating system based on the determined type of syscall,
wherein the program is attached to a first function if the determined type of syscall is of a first type, and
wherein the program is attached to a second function if the determined type of syscall is of a second type.
17 . The computer program product of claim 16 , further comprises adding an entry indicative of the second function in the shared map,
wherein the shared map corresponds to a bpf map that includes the flag information indicative of the type of syscall, and
wherein the type of syscall comprises at least one of: legacy syscall and wrapped syscall.
18 . The computer program product of claim 16 , further comprises forming a unified program, via the compilation using the macro, that invokes the program when attached in the function, wherein the macro further includes an internal helper function for processing of the program with syscall arguments to ensure compatibility.
19 . The computer program product of claim 16 ,
wherein the first function corresponds to a non-wrapped function, and
wherein the second function corresponds to a wrapped function.
20 . The computer program product of claim 16 ,
wherein the operating system is a Linux operating system,
wherein the program is an extended Berkeley Packet Filter (eBPF) program, and
wherein the function is at least one of: a kernel function and a user space function.