Arnaldo Carvalho de Melo 79ef68c7e1 perf augmented_syscalls: Start collecting pathnames in the BPF program ... This is the start of having the raw_syscalls:sys_enter BPF handler collecting pointer arguments, namely pathnames, and with two syscalls that have that pointer in different arguments, "open" as it as its first argument, "openat" as the second. With this in place the existing beautifiers in 'perf trace' works, those args are shown instead of just the pointer that comes with the syscalls tracepoints. This also serves to show and document pitfalls in the process of using just that place in the kernel (raw_syscalls:sys_enter) plus tables provided by userspace to collect syscall pointer arguments. One is the need to use a barrier, as suggested by Edward, to avoid clang optimizations that make the kernel BPF verifier to refuse loading our pointer contents collector. The end result should be a generic eBPF program that works in all architectures, with the differences amongst archs resolved by the userspace component, 'perf trace', that should get all its tables created automatically from the kernel components where they are defined, via string table constructors for things not expressed in BTF/DWARF (enums, structs, etc), and otherwise using those observability files (BTF). Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: David Ahern <dsahern@gmail.com> Cc: Edward Cree <ecree@solarflare.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Martin KaFai Lau <kafai@fb.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Wang Nan <wangnan0@huawei.com> Cc: Yonghong Song <yhs@fb.com> Link: https://lkml.kernel.org/n/tip-37dz54pmotgpnwg9tb6zuk9j@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>		2018-11-05 12:41:10 -03:00
..
5sec.c	perf bpf: Add probe() helper to reduce kprobes boilerplate	2018-05-15 14:31:24 -03:00
augmented_raw_syscalls.c	perf augmented_syscalls: Start collecting pathnames in the BPF program	2018-11-05 12:41:10 -03:00
augmented_syscalls.c	perf augmented_syscalls: Avoid optimization to pass older BPF validators	2018-09-03 15:29:53 -03:00
empty.c	perf bpf: Add license(NAME) helper	2018-05-15 14:31:24 -03:00
etcsnoop.c	perf trace: Add a etcsnoop.c augmented syscalls eBPF utility	2018-08-30 15:52:19 -03:00
hello.c	perf bpf: Add bpf/stdio.h wrapper to bpf_perf_event_output function	2018-08-08 15:55:55 -03:00
sys_enter_openat.c	perf bpf: Add 'syscall_enter' probe helper for syscall enter tracepoints	2018-08-08 15:55:44 -03:00