summaryrefslogtreecommitdiffstats
path: root/tools/perf/examples
diff options
context:
space:
mode:
authorArnaldo Carvalho de Melo <acme@redhat.com>2018-12-12 13:39:24 -0300
committerArnaldo Carvalho de Melo <acme@redhat.com>2018-12-18 12:23:58 -0300
commitb27b38ed9427b32e0194e03281e3a79dd49887b2 (patch)
tree3c8c4f6feb94f36f7237f88d111e384dd5b953ab /tools/perf/examples
parent0df50e0b0e0f315c0d5e2ce8556aafe1403b4a4b (diff)
downloadlinux-b27b38ed9427b32e0194e03281e3a79dd49887b2.tar.gz
linux-b27b38ed9427b32e0194e03281e3a79dd49887b2.tar.bz2
linux-b27b38ed9427b32e0194e03281e3a79dd49887b2.zip
perf trace: Implement syscall filtering in augmented_syscalls
Just another map, this time an BPF_MAP_TYPE_ARRAY, stating with one bool per syscall, stating if it should be filtered or not. So, with a pre-built augmented_raw_syscalls.o file, we use: # perf trace -e open*,augmented_raw_syscalls.o 0.000 ( 0.016 ms): DNS Res~er #37/29652 openat(dfd: CWD, filename: /etc/hosts, flags: CLOEXEC ) = 138 187.039 ( 0.048 ms): gsd-housekeepi/2436 openat(dfd: CWD, filename: /etc/fstab, flags: CLOEXEC ) = 11 187.348 ( 0.041 ms): gsd-housekeepi/2436 openat(dfd: CWD, filename: /proc/self/mountinfo, flags: CLOEXEC ) = 11 188.793 ( 0.036 ms): gsd-housekeepi/2436 openat(dfd: CWD, filename: /proc/self/mountinfo, flags: CLOEXEC ) = 11 189.803 ( 0.029 ms): gsd-housekeepi/2436 openat(dfd: CWD, filename: /proc/self/mountinfo, flags: CLOEXEC ) = 11 190.774 ( 0.027 ms): gsd-housekeepi/2436 openat(dfd: CWD, filename: /proc/self/mountinfo, flags: CLOEXEC ) = 11 284.620 ( 0.149 ms): DataStorage/3076 openat(dfd: CWD, filename: /home/acme/.mozilla/firefox/ina67tev.default/SiteSecurityServiceState.txt, flags: CREAT|TRUNC|WRONLY, mode: IRUGO|IWUSR|IWGRP) = 167 ^C# What is it that this gsd-housekeeping thingy needs to open /proc/self/mountinfo four times periodically? :-) This map will be extended to tell per-syscall parameters, i.e. how many bytes to copy per arg, using the function signature to get the types and then the size of those types, via BTF. Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Wang Nan <wangnan0@huawei.com> Link: https://lkml.kernel.org/n/tip-cy222g9ucvnym3raqvxp0hpg@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Diffstat (limited to 'tools/perf/examples')
-rw-r--r--tools/perf/examples/bpf/augmented_raw_syscalls.c26
1 files changed, 25 insertions, 1 deletions
diff --git a/tools/perf/examples/bpf/augmented_raw_syscalls.c b/tools/perf/examples/bpf/augmented_raw_syscalls.c
index 74ce7574073d..bb3dcc4ec256 100644
--- a/tools/perf/examples/bpf/augmented_raw_syscalls.c
+++ b/tools/perf/examples/bpf/augmented_raw_syscalls.c
@@ -26,6 +26,13 @@ struct bpf_map SEC("maps") __augmented_syscalls__ = {
.max_entries = __NR_CPUS__,
};
+struct bpf_map SEC("maps") syscalls = {
+ .type = BPF_MAP_TYPE_ARRAY,
+ .key_size = sizeof(int),
+ .value_size = sizeof(bool),
+ .max_entries = 512,
+};
+
struct syscall_enter_args {
unsigned long long common_tp_fields;
long syscall_nr;
@@ -56,6 +63,7 @@ int sys_enter(struct syscall_enter_args *args)
struct syscall_enter_args args;
struct augmented_filename filename;
} augmented_args;
+ bool *enabled;
unsigned int len = sizeof(augmented_args);
const void *filename_arg = NULL;
@@ -63,6 +71,10 @@ int sys_enter(struct syscall_enter_args *args)
return 0;
probe_read(&augmented_args.args, sizeof(augmented_args.args), args);
+
+ enabled = bpf_map_lookup_elem(&syscalls, &augmented_args.args.syscall_nr);
+ if (enabled == NULL || !*enabled)
+ return 0;
/*
* Yonghong and Edward Cree sayz:
*
@@ -131,7 +143,19 @@ int sys_enter(struct syscall_enter_args *args)
SEC("raw_syscalls:sys_exit")
int sys_exit(struct syscall_exit_args *args)
{
- return !pid_filter__has(&pids_filtered, getpid());
+ struct syscall_exit_args exit_args;
+ bool *enabled;
+
+ if (pid_filter__has(&pids_filtered, getpid()))
+ return 0;
+
+ probe_read(&exit_args, sizeof(exit_args), args);
+
+ enabled = bpf_map_lookup_elem(&syscalls, &exit_args.syscall_nr);
+ if (enabled == NULL || !*enabled)
+ return 0;
+
+ return 1;
}
license(GPL);