Orange Pi5 kernel

^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  1) // SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  3)  * Augment the filename syscalls with the contents of the filename pointer argument
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  4)  * filtering only those that do not start with /etc/.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  5)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  6)  * Test it with:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  7)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  8)  * perf trace -e tools/perf/examples/bpf/augmented_syscalls.c cat /etc/passwd > /dev/null
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  9)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10)  * It'll catch some openat syscalls related to the dynamic linked and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11)  * the last one should be the one for '/etc/passwd'.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13)  * This matches what is marshalled into the raw_syscall:sys_enter payload
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14)  * expected by the 'perf trace' beautifiers, and can be used by them unmodified,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15)  * which will be done as that feature is implemented in the next csets, for now
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16)  * it will appear in a dump done by the default tracepoint handler in 'perf trace',
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17)  * that uses bpf_output__fprintf() to just dump those contents, as done with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18)  * the bpf-output event associated with the __bpf_output__ map declared in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19)  * tools/perf/include/bpf/stdio.h.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) #include <stdio.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) /* bpf-output associated map */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) bpf_map(__augmented_syscalls__, PERF_EVENT_ARRAY, int, u32, __NR_CPUS__);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) struct augmented_filename {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) 	int	size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) 	int	reserved;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) 	char	value[64];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) #define augmented_filename_syscall_enter(syscall) 						\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) struct augmented_enter_##syscall##_args {			 				\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) 	struct syscall_enter_##syscall##_args	args;				 		\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) 	struct augmented_filename		filename;				 	\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) };												\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args)				\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) {												\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) 	char etc[6] = "/etc/";									\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) 	struct augmented_enter_##syscall##_args augmented_args = { .filename.reserved = 0, }; 	\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) 	probe_read(&augmented_args.args, sizeof(augmented_args.args), args);			\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) 	augmented_args.filename.size = probe_read_str(&augmented_args.filename.value, 		\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) 						      sizeof(augmented_args.filename.value), 	\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) 						      args->filename_ptr); 			\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) 	if (__builtin_memcmp(augmented_args.filename.value, etc, 4) != 0)			\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) 		return 0;									\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) 	/* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */	\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) 	return perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, 		\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) 				 &augmented_args,						\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) 				 (sizeof(augmented_args) - sizeof(augmented_args.filename.value) + \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) 				 augmented_args.filename.size));				\
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) struct syscall_enter_openat_args {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) 	unsigned long long common_tp_fields;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) 	long		   syscall_nr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) 	long		   dfd;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) 	char		   *filename_ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) 	long		   flags;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) 	long		   mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) augmented_filename_syscall_enter(openat);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) struct syscall_enter_open_args {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) 	unsigned long long common_tp_fields;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) 	long		   syscall_nr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) 	char		   *filename_ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) 	long		   flags;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) 	long		   mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) augmented_filename_syscall_enter(open);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) license(GPL);