lkml.org 
[lkml]   [2019]   [Jul]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 011/107] perf augmented_raw_syscalls: Add handler for "openat"
    Date
    From: Arnaldo Carvalho de Melo <acme@redhat.com>

    I.e. for a syscall that has its second argument being a string, its
    difficult these days to find 'open' being used in the wild :-)

    Cc: Adrian Hunter <adrian.hunter@intel.com>
    Cc: Jiri Olsa <jolsa@kernel.org>
    Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Link: https://lkml.kernel.org/n/tip-yf3kbzirqrukd3fb2sp5qx4p@git.kernel.org
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    ---
    tools/perf/builtin-trace.c | 1 +
    .../perf/examples/bpf/augmented_raw_syscalls.c | 17 +++++++++++++++++
    2 files changed, 18 insertions(+)

    diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
    index 872c9cc982a5..a681b8c2ee4e 100644
    --- a/tools/perf/builtin-trace.c
    +++ b/tools/perf/builtin-trace.c
    @@ -836,6 +836,7 @@ static struct syscall_fmt {
    .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ },
    [2] = { .scnprintf = SCA_OPEN_FLAGS, /* flags */ }, }, },
    { .name = "openat",
    + .bpf_prog_name = { .sys_enter = "!syscalls:sys_enter_openat", },
    .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ },
    [2] = { .scnprintf = SCA_OPEN_FLAGS, /* flags */ }, }, },
    { .name = "perf_event_open",
    diff --git a/tools/perf/examples/bpf/augmented_raw_syscalls.c b/tools/perf/examples/bpf/augmented_raw_syscalls.c
    index c66474a6ccf4..661936f90fe0 100644
    --- a/tools/perf/examples/bpf/augmented_raw_syscalls.c
    +++ b/tools/perf/examples/bpf/augmented_raw_syscalls.c
    @@ -131,6 +131,23 @@ int sys_enter_open(struct syscall_enter_args *args)
    return perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, augmented_args, len);
    }

    +SEC("!syscalls:sys_enter_openat")
    +int sys_enter_openat(struct syscall_enter_args *args)
    +{
    + int key = 0;
    + struct augmented_args_filename *augmented_args = bpf_map_lookup_elem(&augmented_filename_map, &key);
    + const void *filename_arg = (const void *)args->args[1];
    + unsigned int len = sizeof(augmented_args->args);
    +
    + if (augmented_args == NULL)
    + return 1; /* Failure: don't filter */
    +
    + len += augmented_filename__read(&augmented_args->filename, filename_arg, sizeof(augmented_args->filename.value));
    +
    + /* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */
    + return perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, augmented_args, len);
    +}
    +
    SEC("raw_syscalls:sys_enter")
    int sys_enter(struct syscall_enter_args *args)
    {
    --
    2.21.0
    \
     
     \ /
      Last update: 2019-07-30 05:03    [W:4.234 / U:0.204 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site