Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Augment the openat syscall with the contents of the filename pointer argument.
4 *
5 * Test it with:
6 *
7 * perf trace -e tools/perf/examples/bpf/augmented_syscalls.c cat /etc/passwd > /dev/null
8 *
9 * It'll catch some openat syscalls related to the dynamic linked and
10 * the last one should be the one for '/etc/passwd'.
11 *
12 * This matches what is marshalled into the raw_syscall:sys_enter payload
13 * expected by the 'perf trace' beautifiers, and can be used by them unmodified,
14 * which will be done as that feature is implemented in the next csets, for now
15 * it will appear in a dump done by the default tracepoint handler in 'perf trace',
16 * that uses bpf_output__fprintf() to just dump those contents, as done with
17 * the bpf-output event associated with the __bpf_output__ map declared in
18 * tools/perf/include/bpf/stdio.h.
19 */
20
21#include <stdio.h>
22
23struct bpf_map SEC("maps") __augmented_syscalls__ = {
24 .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
25 .key_size = sizeof(int),
26 .value_size = sizeof(u32),
27 .max_entries = __NR_CPUS__,
28};
29
30struct syscall_enter_openat_args {
31 unsigned long long common_tp_fields;
32 long syscall_nr;
33 long dfd;
34 char *filename_ptr;
35 long flags;
36 long mode;
37};
38
39struct augmented_enter_openat_args {
40 struct syscall_enter_openat_args args;
41 char filename[64];
42};
43
44int syscall_enter(openat)(struct syscall_enter_openat_args *args)
45{
46 struct augmented_enter_openat_args augmented_args;
47
48 probe_read(&augmented_args.args, sizeof(augmented_args.args), args);
49 probe_read_str(&augmented_args.filename, sizeof(augmented_args.filename), args->filename_ptr);
50 perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU,
51 &augmented_args, sizeof(augmented_args));
52 return 1;
53}
54
55license(GPL);