-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'bpf-add-support-for-sys-enter-exit-tracepoints'
Yonghong Song says:
====================
bpf: add support for sys_{enter|exit}_* tracepoints
Currently, bpf programs cannot be attached to sys_enter_* and sys_exit_*
style tracepoints. The main reason is that syscalls/sys_enter_* and syscalls/sys_exit_*
tracepoints are treated differently from other tracepoints and there
is no bpf hook to it.
This patch set adds bpf support for these syscalls tracepoints and also
adds a test case for it.
Changelogs:
v3 -> v4:
- Check the legality of ctx offset access for syscall tracepoint as well.
trace_event_get_offsets will return correct max offset for each
specific syscall tracepoint.
- Use variable length array to avoid hardcode 6 as the maximum
arguments beyond syscall_nr.
v2 -> v3:
- Fix a build issue
v1 -> v2:
- Do not use TRACE_EVENT_FL_CAP_ANY to identify syscall tracepoint.
Instead use trace_event_call->class.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>- Loading branch information
Showing
6 changed files
with
206 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| /* Copyright (c) 2017 Facebook | ||
| * | ||
| * This program is free software; you can redistribute it and/or | ||
| * modify it under the terms of version 2 of the GNU General Public | ||
| * License as published by the Free Software Foundation. | ||
| */ | ||
| #include <uapi/linux/bpf.h> | ||
| #include "bpf_helpers.h" | ||
|
|
||
| struct syscalls_enter_open_args { | ||
| unsigned long long unused; | ||
| long syscall_nr; | ||
| long filename_ptr; | ||
| long flags; | ||
| long mode; | ||
| }; | ||
|
|
||
| struct syscalls_exit_open_args { | ||
| unsigned long long unused; | ||
| long syscall_nr; | ||
| long ret; | ||
| }; | ||
|
|
||
| struct bpf_map_def SEC("maps") enter_open_map = { | ||
| .type = BPF_MAP_TYPE_ARRAY, | ||
| .key_size = sizeof(u32), | ||
| .value_size = sizeof(u32), | ||
| .max_entries = 1, | ||
| }; | ||
|
|
||
| struct bpf_map_def SEC("maps") exit_open_map = { | ||
| .type = BPF_MAP_TYPE_ARRAY, | ||
| .key_size = sizeof(u32), | ||
| .value_size = sizeof(u32), | ||
| .max_entries = 1, | ||
| }; | ||
|
|
||
| static __always_inline void count(void *map) | ||
| { | ||
| u32 key = 0; | ||
| u32 *value, init_val = 1; | ||
|
|
||
| value = bpf_map_lookup_elem(map, &key); | ||
| if (value) | ||
| *value += 1; | ||
| else | ||
| bpf_map_update_elem(map, &key, &init_val, BPF_NOEXIST); | ||
| } | ||
|
|
||
| SEC("tracepoint/syscalls/sys_enter_open") | ||
| int trace_enter_open(struct syscalls_enter_open_args *ctx) | ||
| { | ||
| count((void *)&enter_open_map); | ||
| return 0; | ||
| } | ||
|
|
||
| SEC("tracepoint/syscalls/sys_exit_open") | ||
| int trace_enter_exit(struct syscalls_exit_open_args *ctx) | ||
| { | ||
| count((void *)&exit_open_map); | ||
| return 0; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| /* Copyright (c) 2017 Facebook | ||
| * | ||
| * This program is free software; you can redistribute it and/or | ||
| * modify it under the terms of version 2 of the GNU General Public | ||
| * License as published by the Free Software Foundation. | ||
| */ | ||
| #include <stdio.h> | ||
| #include <unistd.h> | ||
| #include <fcntl.h> | ||
| #include <stdlib.h> | ||
| #include <signal.h> | ||
| #include <linux/bpf.h> | ||
| #include <string.h> | ||
| #include <linux/perf_event.h> | ||
| #include <errno.h> | ||
| #include <assert.h> | ||
| #include <stdbool.h> | ||
| #include <sys/resource.h> | ||
| #include "libbpf.h" | ||
| #include "bpf_load.h" | ||
|
|
||
| /* This program verifies bpf attachment to tracepoint sys_enter_* and sys_exit_*. | ||
| * This requires kernel CONFIG_FTRACE_SYSCALLS to be set. | ||
| */ | ||
|
|
||
| static void verify_map(int map_id) | ||
| { | ||
| __u32 key = 0; | ||
| __u32 val; | ||
|
|
||
| if (bpf_map_lookup_elem(map_id, &key, &val) != 0) { | ||
| fprintf(stderr, "map_lookup failed: %s\n", strerror(errno)); | ||
| return; | ||
| } | ||
| if (val == 0) | ||
| fprintf(stderr, "failed: map #%d returns value 0\n", map_id); | ||
| } | ||
|
|
||
| int main(int argc, char **argv) | ||
| { | ||
| struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY}; | ||
| char filename[256]; | ||
| int fd; | ||
|
|
||
| setrlimit(RLIMIT_MEMLOCK, &r); | ||
| snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]); | ||
|
|
||
| if (load_bpf_file(filename)) { | ||
| fprintf(stderr, "%s", bpf_log_buf); | ||
| return 1; | ||
| } | ||
|
|
||
| /* current load_bpf_file has perf_event_open default pid = -1 | ||
| * and cpu = 0, which permits attached bpf execution on | ||
| * all cpus for all pid's. bpf program execution ignores | ||
| * cpu affinity. | ||
| */ | ||
| /* trigger some "open" operations */ | ||
| fd = open(filename, O_RDONLY); | ||
| if (fd < 0) { | ||
| fprintf(stderr, "open failed: %s\n", strerror(errno)); | ||
| return 1; | ||
| } | ||
| close(fd); | ||
|
|
||
| /* verify the map */ | ||
| verify_map(map_fd[0]); | ||
| verify_map(map_fd[1]); | ||
|
|
||
| return 0; | ||
| } |