projects/linux·blob master · refs

143 lines · 3.2 KiB

1#include <bpf/libbpf.h>
2#include <internal/xyarray.h>
3
4#include "bpf_skel/augmented_raw_syscalls.skel.h"
5#include "debug.h"
6#include "evlist.h"
7#include "parse-events.h"
8#include "trace_augment.h"
9
10static struct augmented_raw_syscalls_bpf *skel;
11static struct evsel *bpf_output;
12
13int augmented_syscalls__prepare(void)
14{
15 struct bpf_program *prog;
16 char buf[128];
17 int err;
18
19 skel = augmented_raw_syscalls_bpf__open();
20 if (!skel) {
21 pr_debug("Failed to open augmented syscalls BPF skeleton\n");
22 return -errno;
23 }
24
25 /*
26 * Disable attaching the BPF programs except for sys_enter and
27 * sys_exit that tail call into this as necessary.
28 */
29 bpf_object__for_each_program(prog, skel->obj) {
30 if (prog != skel->progs.sys_enter && prog != skel->progs.sys_exit)
31 bpf_program__set_autoattach(prog, /*autoattach=*/false);
32 }
33
34 err = augmented_raw_syscalls_bpf__load(skel);
35 if (err < 0) {
36 libbpf_strerror(err, buf, sizeof(buf));
37 pr_debug("Failed to load augmented syscalls BPF skeleton: %s\n", buf);
38 return err;
39 }
40
41 augmented_raw_syscalls_bpf__attach(skel);
42 return 0;
43}
44
45int augmented_syscalls__create_bpf_output(struct evlist *evlist)
46{
47 int err = parse_event(evlist, "bpf-output/no-inherit=1,name=__augmented_syscalls__/");
48
49 if (err) {
50 pr_err("ERROR: Setup BPF output event failed: %d\n", err);
51 return err;
52 }
53
54 bpf_output = evlist__last(evlist);
55 assert(evsel__name_is(bpf_output, "__augmented_syscalls__"));
56
57 return 0;
58}
59
60void augmented_syscalls__setup_bpf_output(void)
61{
62 struct perf_cpu cpu;
63 unsigned int i;
64
65 if (bpf_output == NULL)
66 return;
67
68 /*
69 * Set up the __augmented_syscalls__ BPF map to hold for each
70 * CPU the bpf-output event's file descriptor.
71 */
72 perf_cpu_map__for_each_cpu(cpu, i, bpf_output->core.cpus) {
73 int mycpu = cpu.cpu;
74
75 bpf_map__update_elem(skel->maps.__augmented_syscalls__,
76 &mycpu, sizeof(mycpu),
77 xyarray__entry(bpf_output->core.fd,
78 mycpu, 0),
79 sizeof(__u32), BPF_ANY);
80 }
81}
82
83int augmented_syscalls__set_filter_pids(unsigned int nr, pid_t *pids)
84{
85 bool value = true;
86 int err = 0;
87
88 if (skel == NULL)
89 return 0;
90
91 for (size_t i = 0; i < nr; ++i) {
92 err = bpf_map__update_elem(skel->maps.pids_filtered, &pids[i],
93 sizeof(*pids), &value, sizeof(value),
94 BPF_ANY);
95 if (err)
96 break;
97 }
98 return err;
99}
100
101int augmented_syscalls__get_map_fds(int *enter_fd, int *exit_fd, int *beauty_fd)
102{
103 if (skel == NULL)
104 return -1;
105
106 *enter_fd = bpf_map__fd(skel->maps.syscalls_sys_enter);
107 *exit_fd = bpf_map__fd(skel->maps.syscalls_sys_exit);
108 *beauty_fd = bpf_map__fd(skel->maps.beauty_map_enter);
109
110 if (*enter_fd < 0 || *exit_fd < 0 || *beauty_fd < 0) {
111 pr_err("Error: failed to get syscall or beauty map fd\n");
112 return -1;
113 }
114
115 return 0;
116}
117
118struct bpf_program *augmented_syscalls__unaugmented(void)
119{
120 return skel->progs.syscall_unaugmented;
121}
122
123struct bpf_program *augmented_syscalls__find_by_title(const char *name)
124{
125 struct bpf_program *pos;
126 const char *sec_name;
127
128 if (skel->obj == NULL)
129 return NULL;
130
131 bpf_object__for_each_program(pos, skel->obj) {
132 sec_name = bpf_program__section_name(pos);
133 if (sec_name && !strcmp(sec_name, name))
134 return pos;
135 }
136
137 return NULL;
138}
139
140void augmented_syscalls__cleanup(void)
141{
142 augmented_raw_syscalls_bpf__destroy(skel);
143}