diff options
Diffstat (limited to '')
-rw-r--r-- | tools/perf/examples/bpf/5sec.c | 51 | ||||
-rw-r--r-- | tools/perf/examples/bpf/augmented_raw_syscalls.c | 294 | ||||
-rw-r--r-- | tools/perf/examples/bpf/augmented_syscalls.c | 169 | ||||
-rw-r--r-- | tools/perf/examples/bpf/empty.c | 3 | ||||
-rw-r--r-- | tools/perf/examples/bpf/etcsnoop.c | 76 | ||||
-rw-r--r-- | tools/perf/examples/bpf/hello.c | 9 | ||||
-rw-r--r-- | tools/perf/examples/bpf/sys_enter_openat.c | 33 |
7 files changed, 0 insertions, 635 deletions
diff --git a/tools/perf/examples/bpf/5sec.c b/tools/perf/examples/bpf/5sec.c deleted file mode 100644 index 65c4ff6892d9..000000000000 --- a/tools/perf/examples/bpf/5sec.c +++ /dev/null @@ -1,51 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 -/* - Description: - - . Disable strace like syscall tracing (--no-syscalls), or try tracing - just some (-e *sleep). - - . Attach a filter function to a kernel function, returning when it should - be considered, i.e. appear on the output. - - . Run it system wide, so that any sleep of >= 5 seconds and < than 6 - seconds gets caught. - - . Ask for callgraphs using DWARF info, so that userspace can be unwound - - . While this is running, run something like "sleep 5s". - - . If we decide to add tv_nsec as well, then it becomes: - - int probe(hrtimer_nanosleep, rqtp->tv_sec rqtp->tv_nsec)(void *ctx, int err, long sec, long nsec) - - I.e. add where it comes from (rqtp->tv_nsec) and where it will be - accessible in the function body (nsec) - - # perf trace --no-syscalls -e tools/perf/examples/bpf/5sec.c/call-graph=dwarf/ - 0.000 perf_bpf_probe:func:(ffffffff9811b5f0) tv_sec=5 - hrtimer_nanosleep ([kernel.kallsyms]) - __x64_sys_nanosleep ([kernel.kallsyms]) - do_syscall_64 ([kernel.kallsyms]) - entry_SYSCALL_64 ([kernel.kallsyms]) - __GI___nanosleep (/usr/lib64/libc-2.26.so) - rpl_nanosleep (/usr/bin/sleep) - xnanosleep (/usr/bin/sleep) - main (/usr/bin/sleep) - __libc_start_main (/usr/lib64/libc-2.26.so) - _start (/usr/bin/sleep) - ^C# - - Copyright (C) 2018 Red Hat, Inc., Arnaldo Carvalho de Melo <acme@redhat.com> -*/ - -#include <bpf/bpf.h> - -#define NSEC_PER_SEC 1000000000L - -int probe(hrtimer_nanosleep, rqtp)(void *ctx, int err, long long sec) -{ - return sec / NSEC_PER_SEC == 5ULL; -} - -license(GPL); diff --git a/tools/perf/examples/bpf/augmented_raw_syscalls.c b/tools/perf/examples/bpf/augmented_raw_syscalls.c deleted file mode 100644 index b80437971d80..000000000000 --- a/tools/perf/examples/bpf/augmented_raw_syscalls.c +++ /dev/null @@ -1,294 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 -/* - * Augment the raw_syscalls tracepoints with the contents of the pointer arguments. - * - * Test it with: - * - * perf trace -e tools/perf/examples/bpf/augmented_raw_syscalls.c cat /etc/passwd > /dev/null - * - * This exactly matches what is marshalled into the raw_syscall:sys_enter - * payload expected by the 'perf trace' beautifiers. - * - * For now it just uses the existing tracepoint augmentation code in 'perf - * trace', in the next csets we'll hook up these with the sys_enter/sys_exit - * code that will combine entry/exit in a strace like way. - */ - -#include <unistd.h> -#include <linux/limits.h> -#include <linux/socket.h> -#include <pid_filter.h> - -/* bpf-output associated map */ -bpf_map(__augmented_syscalls__, PERF_EVENT_ARRAY, int, u32, __NR_CPUS__); - -/* - * string_args_len: one per syscall arg, 0 means not a string or don't copy it, - * PATH_MAX for copying everything, any other value to limit - * it a la 'strace -s strsize'. - */ -struct syscall { - bool enabled; - u16 string_args_len[6]; -}; - -bpf_map(syscalls, ARRAY, int, struct syscall, 512); - -/* - * What to augment at entry? - * - * Pointer arg payloads (filenames, etc) passed from userspace to the kernel - */ -bpf_map(syscalls_sys_enter, PROG_ARRAY, u32, u32, 512); - -/* - * What to augment at exit? - * - * Pointer arg payloads returned from the kernel (struct stat, etc) to userspace. - */ -bpf_map(syscalls_sys_exit, PROG_ARRAY, u32, u32, 512); - -struct syscall_enter_args { - unsigned long long common_tp_fields; - long syscall_nr; - unsigned long args[6]; -}; - -struct syscall_exit_args { - unsigned long long common_tp_fields; - long syscall_nr; - long ret; -}; - -struct augmented_arg { - unsigned int size; - int err; - char value[PATH_MAX]; -}; - -pid_filter(pids_filtered); - -struct augmented_args_payload { - struct syscall_enter_args args; - union { - struct { - struct augmented_arg arg, arg2; - }; - struct sockaddr_storage saddr; - }; -}; - -// We need more tmp space than the BPF stack can give us -bpf_map(augmented_args_tmp, PERCPU_ARRAY, int, struct augmented_args_payload, 1); - -static inline struct augmented_args_payload *augmented_args_payload(void) -{ - int key = 0; - return bpf_map_lookup_elem(&augmented_args_tmp, &key); -} - -static inline int augmented__output(void *ctx, struct augmented_args_payload *args, int len) -{ - /* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */ - return perf_event_output(ctx, &__augmented_syscalls__, BPF_F_CURRENT_CPU, args, len); -} - -static inline -unsigned int augmented_arg__read_str(struct augmented_arg *augmented_arg, const void *arg, unsigned int arg_len) -{ - unsigned int augmented_len = sizeof(*augmented_arg); - int string_len = probe_read_str(&augmented_arg->value, arg_len, arg); - - augmented_arg->size = augmented_arg->err = 0; - /* - * probe_read_str may return < 0, e.g. -EFAULT - * So we leave that in the augmented_arg->size that userspace will - */ - if (string_len > 0) { - augmented_len -= sizeof(augmented_arg->value) - string_len; - augmented_len &= sizeof(augmented_arg->value) - 1; - augmented_arg->size = string_len; - } else { - /* - * So that username notice the error while still being able - * to skip this augmented arg record - */ - augmented_arg->err = string_len; - augmented_len = offsetof(struct augmented_arg, value); - } - - return augmented_len; -} - -SEC("!raw_syscalls:unaugmented") -int syscall_unaugmented(struct syscall_enter_args *args) -{ - return 1; -} - -/* - * These will be tail_called from SEC("raw_syscalls:sys_enter"), so will find in - * augmented_args_tmp what was read by that raw_syscalls:sys_enter and go - * on from there, reading the first syscall arg as a string, i.e. open's - * filename. - */ -SEC("!syscalls:sys_enter_connect") -int sys_enter_connect(struct syscall_enter_args *args) -{ - struct augmented_args_payload *augmented_args = augmented_args_payload(); - const void *sockaddr_arg = (const void *)args->args[1]; - unsigned int socklen = args->args[2]; - unsigned int len = sizeof(augmented_args->args); - - if (augmented_args == NULL) - return 1; /* Failure: don't filter */ - - if (socklen > sizeof(augmented_args->saddr)) - socklen = sizeof(augmented_args->saddr); - - probe_read(&augmented_args->saddr, socklen, sockaddr_arg); - - return augmented__output(args, augmented_args, len + socklen); -} - -SEC("!syscalls:sys_enter_sendto") -int sys_enter_sendto(struct syscall_enter_args *args) -{ - struct augmented_args_payload *augmented_args = augmented_args_payload(); - const void *sockaddr_arg = (const void *)args->args[4]; - unsigned int socklen = args->args[5]; - unsigned int len = sizeof(augmented_args->args); - - if (augmented_args == NULL) - return 1; /* Failure: don't filter */ - - if (socklen > sizeof(augmented_args->saddr)) - socklen = sizeof(augmented_args->saddr); - - probe_read(&augmented_args->saddr, socklen, sockaddr_arg); - - return augmented__output(args, augmented_args, len + socklen); -} - -SEC("!syscalls:sys_enter_open") -int sys_enter_open(struct syscall_enter_args *args) -{ - struct augmented_args_payload *augmented_args = augmented_args_payload(); - const void *filename_arg = (const void *)args->args[0]; - unsigned int len = sizeof(augmented_args->args); - - if (augmented_args == NULL) - return 1; /* Failure: don't filter */ - - len += augmented_arg__read_str(&augmented_args->arg, filename_arg, sizeof(augmented_args->arg.value)); - - return augmented__output(args, augmented_args, len); -} - -SEC("!syscalls:sys_enter_openat") -int sys_enter_openat(struct syscall_enter_args *args) -{ - struct augmented_args_payload *augmented_args = augmented_args_payload(); - const void *filename_arg = (const void *)args->args[1]; - unsigned int len = sizeof(augmented_args->args); - - if (augmented_args == NULL) - return 1; /* Failure: don't filter */ - - len += augmented_arg__read_str(&augmented_args->arg, filename_arg, sizeof(augmented_args->arg.value)); - - return augmented__output(args, augmented_args, len); -} - -SEC("!syscalls:sys_enter_rename") -int sys_enter_rename(struct syscall_enter_args *args) -{ - struct augmented_args_payload *augmented_args = augmented_args_payload(); - const void *oldpath_arg = (const void *)args->args[0], - *newpath_arg = (const void *)args->args[1]; - unsigned int len = sizeof(augmented_args->args), oldpath_len; - - if (augmented_args == NULL) - return 1; /* Failure: don't filter */ - - oldpath_len = augmented_arg__read_str(&augmented_args->arg, oldpath_arg, sizeof(augmented_args->arg.value)); - len += oldpath_len + augmented_arg__read_str((void *)(&augmented_args->arg) + oldpath_len, newpath_arg, sizeof(augmented_args->arg.value)); - - return augmented__output(args, augmented_args, len); -} - -SEC("!syscalls:sys_enter_renameat") -int sys_enter_renameat(struct syscall_enter_args *args) -{ - struct augmented_args_payload *augmented_args = augmented_args_payload(); - const void *oldpath_arg = (const void *)args->args[1], - *newpath_arg = (const void *)args->args[3]; - unsigned int len = sizeof(augmented_args->args), oldpath_len; - - if (augmented_args == NULL) - return 1; /* Failure: don't filter */ - - oldpath_len = augmented_arg__read_str(&augmented_args->arg, oldpath_arg, sizeof(augmented_args->arg.value)); - len += oldpath_len + augmented_arg__read_str((void *)(&augmented_args->arg) + oldpath_len, newpath_arg, sizeof(augmented_args->arg.value)); - - return augmented__output(args, augmented_args, len); -} - -SEC("raw_syscalls:sys_enter") -int sys_enter(struct syscall_enter_args *args) -{ - struct augmented_args_payload *augmented_args; - /* - * We start len, the amount of data that will be in the perf ring - * buffer, if this is not filtered out by one of pid_filter__has(), - * syscall->enabled, etc, with the non-augmented raw syscall payload, - * i.e. sizeof(augmented_args->args). - * - * We'll add to this as we add augmented syscalls right after that - * initial, non-augmented raw_syscalls:sys_enter payload. - */ - unsigned int len = sizeof(augmented_args->args); - struct syscall *syscall; - - if (pid_filter__has(&pids_filtered, getpid())) - return 0; - - augmented_args = augmented_args_payload(); - if (augmented_args == NULL) - return 1; - - probe_read(&augmented_args->args, sizeof(augmented_args->args), args); - - /* - * Jump to syscall specific augmenter, even if the default one, - * "!raw_syscalls:unaugmented" that will just return 1 to return the - * unagmented tracepoint payload. - */ - bpf_tail_call(args, &syscalls_sys_enter, augmented_args->args.syscall_nr); - - // If not found on the PROG_ARRAY syscalls map, then we're filtering it: - return 0; -} - -SEC("raw_syscalls:sys_exit") -int sys_exit(struct syscall_exit_args *args) -{ - struct syscall_exit_args exit_args; - - if (pid_filter__has(&pids_filtered, getpid())) - return 0; - - probe_read(&exit_args, sizeof(exit_args), args); - /* - * Jump to syscall specific return augmenter, even if the default one, - * "!raw_syscalls:unaugmented" that will just return 1 to return the - * unagmented tracepoint payload. - */ - bpf_tail_call(args, &syscalls_sys_exit, exit_args.syscall_nr); - /* - * If not found on the PROG_ARRAY syscalls map, then we're filtering it: - */ - return 0; -} - -license(GPL); diff --git a/tools/perf/examples/bpf/augmented_syscalls.c b/tools/perf/examples/bpf/augmented_syscalls.c deleted file mode 100644 index 524fdb8534b3..000000000000 --- a/tools/perf/examples/bpf/augmented_syscalls.c +++ /dev/null @@ -1,169 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 -/* - * Augment syscalls with the contents of the pointer arguments. - * - * Test it with: - * - * perf trace -e tools/perf/examples/bpf/augmented_syscalls.c cat /etc/passwd > /dev/null - * - * It'll catch some openat syscalls related to the dynamic linked and - * the last one should be the one for '/etc/passwd'. - * - * This matches what is marshalled into the raw_syscall:sys_enter payload - * expected by the 'perf trace' beautifiers, and can be used by them, that will - * check if perf_sample->raw_data is more than what is expected for each - * syscalls:sys_{enter,exit}_SYSCALL tracepoint, uing the extra data as the - * contents of pointer arguments. - */ - -#include <stdio.h> -#include <linux/socket.h> - -/* bpf-output associated map */ -bpf_map(__augmented_syscalls__, PERF_EVENT_ARRAY, int, u32, __NR_CPUS__); - -struct syscall_exit_args { - unsigned long long common_tp_fields; - long syscall_nr; - long ret; -}; - -struct augmented_filename { - unsigned int size; - int reserved; - char value[256]; -}; - -#define augmented_filename_syscall(syscall) \ -struct augmented_enter_##syscall##_args { \ - struct syscall_enter_##syscall##_args args; \ - struct augmented_filename filename; \ -}; \ -int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args) \ -{ \ - struct augmented_enter_##syscall##_args augmented_args = { .filename.reserved = 0, }; \ - unsigned int len = sizeof(augmented_args); \ - probe_read(&augmented_args.args, sizeof(augmented_args.args), args); \ - augmented_args.filename.size = probe_read_str(&augmented_args.filename.value, \ - sizeof(augmented_args.filename.value), \ - args->filename_ptr); \ - if (augmented_args.filename.size < sizeof(augmented_args.filename.value)) { \ - len -= sizeof(augmented_args.filename.value) - augmented_args.filename.size; \ - len &= sizeof(augmented_args.filename.value) - 1; \ - } \ - /* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */ \ - return perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, \ - &augmented_args, len); \ -} \ -int syscall_exit(syscall)(struct syscall_exit_args *args) \ -{ \ - return 1; /* 0 as soon as we start copying data returned by the kernel, e.g. 'read' */ \ -} - -struct syscall_enter_openat_args { - unsigned long long common_tp_fields; - long syscall_nr; - long dfd; - char *filename_ptr; - long flags; - long mode; -}; - -augmented_filename_syscall(openat); - -struct syscall_enter_open_args { - unsigned long long common_tp_fields; - long syscall_nr; - char *filename_ptr; - long flags; - long mode; -}; - -augmented_filename_syscall(open); - -struct syscall_enter_inotify_add_watch_args { - unsigned long long common_tp_fields; - long syscall_nr; - long fd; - char *filename_ptr; - long mask; -}; - -augmented_filename_syscall(inotify_add_watch); - -struct statbuf; - -struct syscall_enter_newstat_args { - unsigned long long common_tp_fields; - long syscall_nr; - char *filename_ptr; - struct stat *statbuf; -}; - -augmented_filename_syscall(newstat); - -#ifndef _K_SS_MAXSIZE -#define _K_SS_MAXSIZE 128 -#endif - -#define augmented_sockaddr_syscall(syscall) \ -struct augmented_enter_##syscall##_args { \ - struct syscall_enter_##syscall##_args args; \ - struct sockaddr_storage addr; \ -}; \ -int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args) \ -{ \ - struct augmented_enter_##syscall##_args augmented_args; \ - unsigned long addrlen = sizeof(augmented_args.addr); \ - probe_read(&augmented_args.args, sizeof(augmented_args.args), args); \ -/* FIXME_CLANG_OPTIMIZATION_THAT_ACCESSES_USER_CONTROLLED_ADDRLEN_DESPITE_THIS_CHECK */ \ -/* if (addrlen > augmented_args.args.addrlen) */ \ -/* addrlen = augmented_args.args.addrlen; */ \ -/* */ \ - probe_read(&augmented_args.addr, addrlen, args->addr_ptr); \ - /* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */ \ - return perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, \ - &augmented_args, \ - sizeof(augmented_args) - sizeof(augmented_args.addr) + addrlen);\ -} \ -int syscall_exit(syscall)(struct syscall_exit_args *args) \ -{ \ - return 1; /* 0 as soon as we start copying data returned by the kernel, e.g. 'read' */ \ -} - -struct sockaddr; - -struct syscall_enter_bind_args { - unsigned long long common_tp_fields; - long syscall_nr; - long fd; - struct sockaddr *addr_ptr; - unsigned long addrlen; -}; - -augmented_sockaddr_syscall(bind); - -struct syscall_enter_connect_args { - unsigned long long common_tp_fields; - long syscall_nr; - long fd; - struct sockaddr *addr_ptr; - unsigned long addrlen; -}; - -augmented_sockaddr_syscall(connect); - -struct syscall_enter_sendto_args { - unsigned long long common_tp_fields; - long syscall_nr; - long fd; - void *buff; - long len; - unsigned long flags; - struct sockaddr *addr_ptr; - long addr_len; -}; - -augmented_sockaddr_syscall(sendto); - -license(GPL); diff --git a/tools/perf/examples/bpf/empty.c b/tools/perf/examples/bpf/empty.c deleted file mode 100644 index 7d7fb0c9fe76..000000000000 --- a/tools/perf/examples/bpf/empty.c +++ /dev/null @@ -1,3 +0,0 @@ -#include <bpf/bpf.h> - -license(GPL); diff --git a/tools/perf/examples/bpf/etcsnoop.c b/tools/perf/examples/bpf/etcsnoop.c deleted file mode 100644 index e81b535346c0..000000000000 --- a/tools/perf/examples/bpf/etcsnoop.c +++ /dev/null @@ -1,76 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 -/* - * Augment the filename syscalls with the contents of the filename pointer argument - * filtering only those that do not start with /etc/. - * - * Test it with: - * - * perf trace -e tools/perf/examples/bpf/augmented_syscalls.c cat /etc/passwd > /dev/null - * - * It'll catch some openat syscalls related to the dynamic linked and - * the last one should be the one for '/etc/passwd'. - * - * This matches what is marshalled into the raw_syscall:sys_enter payload - * expected by the 'perf trace' beautifiers, and can be used by them unmodified, - * which will be done as that feature is implemented in the next csets, for now - * it will appear in a dump done by the default tracepoint handler in 'perf trace', - * that uses bpf_output__fprintf() to just dump those contents, as done with - * the bpf-output event associated with the __bpf_output__ map declared in - * tools/perf/include/bpf/stdio.h. - */ - -#include <stdio.h> - -/* bpf-output associated map */ -bpf_map(__augmented_syscalls__, PERF_EVENT_ARRAY, int, u32, __NR_CPUS__); - -struct augmented_filename { - int size; - int reserved; - char value[64]; -}; - -#define augmented_filename_syscall_enter(syscall) \ -struct augmented_enter_##syscall##_args { \ - struct syscall_enter_##syscall##_args args; \ - struct augmented_filename filename; \ -}; \ -int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args) \ -{ \ - char etc[6] = "/etc/"; \ - struct augmented_enter_##syscall##_args augmented_args = { .filename.reserved = 0, }; \ - probe_read(&augmented_args.args, sizeof(augmented_args.args), args); \ - augmented_args.filename.size = probe_read_str(&augmented_args.filename.value, \ - sizeof(augmented_args.filename.value), \ - args->filename_ptr); \ - if (__builtin_memcmp(augmented_args.filename.value, etc, 4) != 0) \ - return 0; \ - /* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */ \ - return perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, \ - &augmented_args, \ - (sizeof(augmented_args) - sizeof(augmented_args.filename.value) + \ - augmented_args.filename.size)); \ -} - -struct syscall_enter_openat_args { - unsigned long long common_tp_fields; - long syscall_nr; - long dfd; - char *filename_ptr; - long flags; - long mode; -}; - -augmented_filename_syscall_enter(openat); - -struct syscall_enter_open_args { - unsigned long long common_tp_fields; - long syscall_nr; - char *filename_ptr; - long flags; - long mode; -}; - -augmented_filename_syscall_enter(open); - -license(GPL); diff --git a/tools/perf/examples/bpf/hello.c b/tools/perf/examples/bpf/hello.c deleted file mode 100644 index cf3c2fdc7f79..000000000000 --- a/tools/perf/examples/bpf/hello.c +++ /dev/null @@ -1,9 +0,0 @@ -#include <stdio.h> - -int syscall_enter(openat)(void *args) -{ - puts("Hello, world\n"); - return 0; -} - -license(GPL); diff --git a/tools/perf/examples/bpf/sys_enter_openat.c b/tools/perf/examples/bpf/sys_enter_openat.c deleted file mode 100644 index c4481c390d23..000000000000 --- a/tools/perf/examples/bpf/sys_enter_openat.c +++ /dev/null @@ -1,33 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 -/* - * Hook into 'openat' syscall entry tracepoint - * - * Test it with: - * - * perf trace -e tools/perf/examples/bpf/sys_enter_openat.c cat /etc/passwd > /dev/null - * - * It'll catch some openat syscalls related to the dynamic linked and - * the last one should be the one for '/etc/passwd'. - * - * The syscall_enter_openat_args can be used to get the syscall fields - * and use them for filtering calls, i.e. use in expressions for - * the return value. - */ - -#include <bpf/bpf.h> - -struct syscall_enter_openat_args { - unsigned long long unused; - long syscall_nr; - long dfd; - char *filename_ptr; - long flags; - long mode; -}; - -int syscall_enter(openat)(struct syscall_enter_openat_args *args) -{ - return 1; -} - -license(GPL); |