linux/tools/perf/examples/bpf/augmented_syscalls.c

// SPDX-License-Identifier: GPL-2.0
/*
 * Augment the openat syscall with the contents of the filename pointer argument.
 *
 * Test it with:
 *
 * perf trace -e tools/perf/examples/bpf/augmented_syscalls.c cat /etc/passwd > /dev/null
 *
 * It'll catch some openat syscalls related to the dynamic linked and
 * the last one should be the one for '/etc/passwd'.
 *
 * This matches what is marshalled into the raw_syscall:sys_enter payload
 * expected by the 'perf trace' beautifiers, and can be used by them unmodified,
 * which will be done as that feature is implemented in the next csets, for now
 * it will appear in a dump done by the default tracepoint handler in 'perf trace',
 * that uses bpf_output__fprintf() to just dump those contents, as done with
 * the bpf-output event associated with the __bpf_output__ map declared in
 * tools/perf/include/bpf/stdio.h.
 */

#include <stdio.h>

struct bpf_map SEC("maps") __augmented_syscalls__ = {
       .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
       .key_size = sizeof(int),
       .value_size = sizeof(u32),
       .max_entries = __NR_CPUS__,
};

struct augmented_filename {
	int	size;
	int	reserved;
	char	value[256];
};

struct syscall_enter_openat_args {
	unsigned long long common_tp_fields;
	long		   syscall_nr;
	long		   dfd;
	char		   *filename_ptr;
	long		   flags;
	long		   mode;
};

struct augmented_enter_openat_args {
	struct syscall_enter_openat_args args;
	struct augmented_filename	 filename;
};

int syscall_enter(openat)(struct syscall_enter_openat_args *args)
{
	struct augmented_enter_openat_args augmented_args = { .filename.reserved = 0, };

	probe_read(&augmented_args.args, sizeof(augmented_args.args), args);
	augmented_args.filename.size = probe_read_str(&augmented_args.filename.value,
						      sizeof(augmented_args.filename.value),
						      args->filename_ptr);
	perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU,
			  &augmented_args,
			  sizeof(augmented_args) - sizeof(augmented_args.filename.value) + augmented_args.filename.size);
	return 0;
}

struct syscall_enter_open_args {
	unsigned long long common_tp_fields;
	long		   syscall_nr;
	char		   *filename_ptr;
	long		   flags;
	long		   mode;
};

struct augmented_enter_open_args {
	struct syscall_enter_open_args args;
	struct augmented_filename      filename;
};

int syscall_enter(open)(struct syscall_enter_open_args *args)
{
	struct augmented_enter_open_args augmented_args = { .filename.reserved = 0, };

	probe_read(&augmented_args.args, sizeof(augmented_args.args), args);
	augmented_args.filename.size = probe_read_str(&augmented_args.filename.value,
						      sizeof(augmented_args.filename.value),
						      args->filename_ptr);
	perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU,
			  &augmented_args,
			  sizeof(augmented_args) - sizeof(augmented_args.filename.value) + augmented_args.filename.size);
	return 0;
}

struct syscall_enter_inotify_add_watch_args {
	unsigned long long common_tp_fields;
	long		   syscall_nr;
	long		   fd;
	char		   *pathname_ptr;
	long		   mask;
};

struct augmented_enter_inotify_add_watch_args {
	struct syscall_enter_inotify_add_watch_args args;
	struct augmented_filename		    pathname;
};

int syscall_enter(inotify_add_watch)(struct syscall_enter_inotify_add_watch_args *args)
{
	struct augmented_enter_inotify_add_watch_args augmented_args = { .pathname.reserved = 0, };

	probe_read(&augmented_args.args, sizeof(augmented_args.args), args);
	augmented_args.pathname.size = probe_read_str(&augmented_args.pathname.value,
						      sizeof(augmented_args.pathname.value),
						      args->pathname_ptr);
	perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU,
			  &augmented_args,
			  sizeof(augmented_args) - sizeof(augmented_args.pathname.value) + augmented_args.pathname.size);
	return 0;
}

license(GPL);