file_trace.patch

diff -pruN linux-2.6.34.8-orig/fs/open.c linux-2.6.34.8/fs/open.c
--- linux-2.6.34.8-orig/fs/open.c	2011-01-07 00:08:33.000000000 +0100
+++ linux-2.6.34.8/fs/open.c	2013-07-04 16:25:49.924835000 +0200
@@ -33,6 +33,14 @@
 
 #include "internal.h"
 
+#ifdef CONFIG_FILE_TRACER
+#include <linux/xattr.h>
+#include <trace/trace_file.h>
+
+DEFINE_TRACE(file_open);
+DEFINE_TRACE(file_close);
+#endif
+
 int vfs_statfs(struct dentry *dentry, struct kstatfs *buf)
 {
 	int retval = -ENODEV;
@@ -1041,8 +1049,20 @@ void fd_install(unsigned int fd, struct
 
 EXPORT_SYMBOL(fd_install);
 
+#ifdef CONFIG_FILE_TRACER
+int check_file_trace_xattr(struct file *f)
+{
+	ssize_t attr_len = vfs_getxattr(f->f_dentry, "user.file_trace", NULL, 0);
+	return attr_len > 0;
+}
+#endif
+
+
 long do_sys_open(int dfd, const char __user *filename, int flags, int mode)
 {
+#ifdef CONFIG_FILE_TRACER
+	int trace = 0;
+#endif
 	char *tmp = getname(filename);
 	int fd = PTR_ERR(tmp);
 
@@ -1056,6 +1076,15 @@ long do_sys_open(int dfd, const char __u
 			} else {
 				fsnotify_open(f->f_path.dentry);
 				fd_install(fd, f);
+#ifdef CONFIG_FILE_TRACER
+				/* Checking xattr for file tracing. */
+			    trace = check_file_trace_xattr(f);
+			    /* Set flag in file's private data. */
+			    f->do_trace_file = trace;
+				if (trace) {
+				    trace_file_open(tmp, flags, mode, fd);
+				}
+#endif
 			}
 		}
 		putname(tmp);
@@ -1138,6 +1167,9 @@ SYSCALL_DEFINE1(close, unsigned int, fd)
 	struct files_struct *files = current->files;
 	struct fdtable *fdt;
 	int retval;
+#ifdef CONFIG_FILE_TRACER
+	int trace = 0;
+#endif
 
 	spin_lock(&files->file_lock);
 	fdt = files_fdtable(files);
@@ -1146,6 +1178,9 @@ SYSCALL_DEFINE1(close, unsigned int, fd)
 	filp = fdt->fd[fd];
 	if (!filp)
 		goto out_unlock;
+#ifdef CONFIG_FILE_TRACER
+	trace = filp->do_trace_file;
+#endif
 	rcu_assign_pointer(fdt->fd[fd], NULL);
 	FD_CLR(fd, fdt->close_on_exec);
 	__put_unused_fd(files, fd);
@@ -1159,6 +1194,10 @@ SYSCALL_DEFINE1(close, unsigned int, fd)
 		     retval == -ERESTART_RESTARTBLOCK))
 		retval = -EINTR;
 
+#ifdef CONFIG_FILE_TRACER
+	if (trace)
+		trace_file_close(fd, -retval);
+#endif
 	return retval;
 
 out_unlock:
diff -pruN linux-2.6.34.8-orig/fs/read_write.c linux-2.6.34.8/fs/read_write.c
--- linux-2.6.34.8-orig/fs/read_write.c	2011-01-07 00:08:33.000000000 +0100
+++ linux-2.6.34.8/fs/read_write.c	2013-07-05 10:58:07.256387000 +0200
@@ -21,6 +21,14 @@
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 
+#ifdef CONFIG_FILE_TRACER
+#include <trace/trace_file.h>
+
+DEFINE_TRACE(file_lseek);
+DEFINE_TRACE(file_read);
+DEFINE_TRACE(file_write);
+#endif
+
 const struct file_operations generic_ro_fops = {
 	.llseek		= generic_file_llseek,
 	.read		= do_sync_read,
@@ -152,12 +160,17 @@ SYSCALL_DEFINE3(lseek, unsigned int, fd,
 	off_t retval;
 	struct file * file;
 	int fput_needed;
+#ifdef CONFIG_FILE_TRACER
+	int trace = 0;
+#endif
 
 	retval = -EBADF;
 	file = fget_light(fd, &fput_needed);
 	if (!file)
 		goto bad;
-
+#ifdef CONFIG_FILE_TRACER
+	trace = file->do_trace_file;
+#endif
 	retval = -EINVAL;
 	if (origin <= SEEK_MAX) {
 		loff_t res = vfs_llseek(file, offset, origin);
@@ -167,6 +180,11 @@ SYSCALL_DEFINE3(lseek, unsigned int, fd,
 	}
 	fput_light(file, fput_needed);
 bad:
+#ifdef CONFIG_FILE_TRACER
+	if (trace) {
+		trace_file_lseek(fd, offset, file->f_mode, retval);
+	}
+#endif
 	return retval;
 }
 
@@ -179,12 +197,17 @@ SYSCALL_DEFINE5(llseek, unsigned int, fd
 	struct file * file;
 	loff_t offset;
 	int fput_needed;
+#ifdef CONFIG_FILE_TRACER
+	int trace = 0;
+#endif
 
 	retval = -EBADF;
 	file = fget_light(fd, &fput_needed);
 	if (!file)
 		goto bad;
-
+#ifdef CONFIG_FILE_TRACER
+	trace = file->do_trace_file;
+#endif
 	retval = -EINVAL;
 	if (origin > SEEK_MAX)
 		goto out_putf;
@@ -201,6 +224,11 @@ SYSCALL_DEFINE5(llseek, unsigned int, fd
 out_putf:
 	fput_light(file, fput_needed);
 bad:
+#ifdef CONFIG_FILE_TRACER
+	if (trace) {
+		trace_file_lseek(fd, offset, file->f_mode, retval);
+	}
+#endif
 	return retval;
 }
 #endif
@@ -376,11 +404,22 @@ SYSCALL_DEFINE3(read, unsigned int, fd,
 	struct file *file;
 	ssize_t ret = -EBADF;
 	int fput_needed;
+#ifdef CONFIG_FILE_TRACER
+	int trace = 0;
+#endif
 
 	file = fget_light(fd, &fput_needed);
 	if (file) {
 		loff_t pos = file_pos_read(file);
+#ifdef CONFIG_FILE_TRACER
+		trace = file->do_trace_file;
+#endif
 		ret = vfs_read(file, buf, count, &pos);
+#ifdef CONFIG_FILE_TRACER
+		if (trace) {
+			trace_file_read(fd, count, ret, buf);
+		}
+#endif
 		file_pos_write(file, pos);
 		fput_light(file, fput_needed);
 	}
@@ -394,11 +433,22 @@ SYSCALL_DEFINE3(write, unsigned int, fd,
 	struct file *file;
 	ssize_t ret = -EBADF;
 	int fput_needed;
+#ifdef CONFIG_FILE_TRACER
+	int trace = 0;
+#endif
 
 	file = fget_light(fd, &fput_needed);
 	if (file) {
 		loff_t pos = file_pos_read(file);
+#ifdef CONFIG_FILE_TRACER
+		trace = file->do_trace_file;
+#endif
 		ret = vfs_write(file, buf, count, &pos);
+#ifdef CONFIG_FILE_TRACER
+		if (trace) {
+			trace_file_write(fd, count, ret, buf);
+		}
+#endif
 		file_pos_write(file, pos);
 		fput_light(file, fput_needed);
 	}
diff -pruN linux-2.6.34.8-orig/include/linux/fs.h linux-2.6.34.8/include/linux/fs.h
--- linux-2.6.34.8-orig/include/linux/fs.h	2011-01-07 00:08:33.000000000 +0100
+++ linux-2.6.34.8/include/linux/fs.h	2013-07-04 11:46:04.896032000 +0200
@@ -947,6 +947,9 @@ struct file {
 #ifdef CONFIG_DEBUG_WRITECOUNT
 	unsigned long f_mnt_write_state;
 #endif
+#ifdef CONFIG_FILE_TRACER
+	int do_trace_file;
+#endif
 };
 extern spinlock_t files_lock;
 #define file_list_lock() spin_lock(&files_lock);
diff -pruN linux-2.6.34.8-orig/include/trace/trace_file.h linux-2.6.34.8/include/trace/trace_file.h
--- linux-2.6.34.8-orig/include/trace/trace_file.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.34.8/include/trace/trace_file.h	2013-07-04 11:16:08.955946000 +0200
@@ -0,0 +1,27 @@
+#ifndef _TRACE_TRACE_FILE_H
+#define _TRACE_TRACE_FILE_H
+
+#include <linux/fs.h>
+#include <linux/tracepoint.h>
+
+DECLARE_TRACE(file_open,
+        TP_PROTO(char *filename, int flags, int mode, int arg),
+        TP_ARGS(filename, flags, mode, arg));
+               
+DECLARE_TRACE(file_close,
+        TP_PROTO(int fd, int retval),
+        TP_ARGS(fd, retval));
+        
+DECLARE_TRACE(file_lseek,
+        TP_PROTO(int fd, int offset, int mode, int arg),
+        TP_ARGS(fd, offset, mode, arg));
+        
+DECLARE_TRACE(file_read,
+        TP_PROTO(int fd, int buf_size, int arg, char __user *buf),
+        TP_ARGS(fd, buf_size, arg, buf));
+        
+DECLARE_TRACE(file_write,
+        TP_PROTO(int fd, int buf_size, int arg, const char __user *buf),
+        TP_ARGS(fd, buf_size, arg, buf));
+    
+#endif
diff -pruN linux-2.6.34.8-orig/kernel/trace/Kconfig linux-2.6.34.8/kernel/trace/Kconfig
--- linux-2.6.34.8-orig/kernel/trace/Kconfig	2011-01-07 00:08:33.000000000 +0100
+++ linux-2.6.34.8/kernel/trace/Kconfig	2013-07-05 19:30:09.627235000 +0200
@@ -8,6 +8,9 @@ config USER_STACKTRACE_SUPPORT
 
 config NOP_TRACER
 	bool
+	
+config FILE_TRACER
+	bool
 
 config HAVE_FTRACE_NMI_ENTER
 	bool
@@ -90,6 +93,7 @@ config TRACING
 	select STACKTRACE if STACKTRACE_SUPPORT
 	select TRACEPOINTS
 	select NOP_TRACER
+	select FILE_TRACER
 	select BINARY_PRINTF
 	select EVENT_TRACING
 
diff -pruN linux-2.6.34.8-orig/kernel/trace/Makefile linux-2.6.34.8/kernel/trace/Makefile
--- linux-2.6.34.8-orig/kernel/trace/Makefile	2011-01-07 00:08:33.000000000 +0100
+++ linux-2.6.34.8/kernel/trace/Makefile	2013-06-25 19:37:56.996307000 +0200
@@ -36,6 +36,7 @@ obj-$(CONFIG_IRQSOFF_TRACER) += trace_ir
 obj-$(CONFIG_PREEMPT_TRACER) += trace_irqsoff.o
 obj-$(CONFIG_SCHED_TRACER) += trace_sched_wakeup.o
 obj-$(CONFIG_NOP_TRACER) += trace_nop.o
+obj-$(CONFIG_FILE_TRACER) += trace_file.o
 obj-$(CONFIG_STACK_TRACER) += trace_stack.o
 obj-$(CONFIG_MMIOTRACE) += trace_mmiotrace.o
 obj-$(CONFIG_BOOT_TRACER) += trace_boot.o
diff -pruN linux-2.6.34.8-orig/kernel/trace/trace_file.c linux-2.6.34.8/kernel/trace/trace_file.c
--- linux-2.6.34.8-orig/kernel/trace/trace_file.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.34.8/kernel/trace/trace_file.c	2013-07-05 19:15:55.391194000 +0200
@@ -0,0 +1,283 @@
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/debugfs.h>
+#include <linux/kallsyms.h>
+#include <linux/uaccess.h>
+#include <linux/ftrace.h>
+#include <linux/slab.h>
+
+#include <trace/trace_file.h>
+
+#include "trace.h"
+
+#define MAX_VALUES_IN_LINE  16
+/*
+ * Buffer size:
+ * +11: "READ_DATA" / "WRITE_DATA"
+ * +11: pid + space
+ * +(MAX_VALUES_IN_LINE * 3): data byte + space
+ * +5: \0 + "safety buffer"
+ */
+#define BUFFER_SIZE     (10 + 11 + (MAX_VALUES_IN_LINE) * 3 + 5)
+
+static struct trace_array      *ctx_trace;
+static int __read_mostly       file_trace_enabled;
+
+static inline int minimum(int a, int b) { return (a < b ? a : b); }
+
+/**
+ * Prints a line of data.
+ * @buf - buffer containing data to print.
+ * @count - number of bytes to print.
+ * @is_read - indicates whether data was read or written.
+ */
+static void print_data_line(char *buf, int count, int is_read)
+{
+    char *name = is_read ? "READ_DATA" : "WRITE_DATA";
+    /* Buffer for entire line. */
+    char *buffer = (char *) kmalloc(BUFFER_SIZE * sizeof(char), GFP_KERNEL);
+    int len = 0;
+    int i;
+    
+    len += sprintf(buffer, "%d %s", current->pid, name);
+    for (i = 0; i < count; ++i) {
+        len += sprintf(buffer + len, " %02x", buf[i]);
+    }
+    trace_printk("%s\n", buffer);
+    kfree(buffer);
+}
+
+/**
+ * Prints all lines of data. May also print error message if an error occurs
+ * when reading data from user space.
+ * @buf - buffer containing data to print.
+ * @arg - number of bytes to print.
+ * @is_read - indicates whether data was read or written.
+ */
+static void print_data(const char __user *buf, int arg, int is_read)
+{
+    char *error_name = is_read ? "READ_DATA_FAULT" : "WRITE_DATA_FAULT";
+    int offset = 0;
+    char *buffer = (char *)
+            kmalloc(MAX_VALUES_IN_LINE * sizeof(char), GFP_KERNEL);
+    if (buffer == NULL) {
+        trace_printk("%s\n", error_name);
+        return;
+    }
+    
+    while (offset < arg) {
+        int count = minimum(arg - offset, MAX_VALUES_IN_LINE);
+        if (copy_from_user((void *) buffer, buf + offset, count)) {
+            trace_printk("%s\n", error_name);
+            goto free_buffer;
+        }
+        print_data_line(buffer, count, is_read);
+        offset += count;
+    }
+free_buffer:
+    kfree(buffer);
+}
+
+static void probe_file_open(char *filename, int flags, int mode, int arg)
+{
+    if (!file_trace_enabled)
+        return;
+
+    if (arg >= 0) {
+        trace_printk("%d OPEN %s %#x %#o SUCCESS %d\n",
+            current->pid, filename, flags, mode, arg);
+    } else {
+        trace_printk("%d OPEN %s %#x %#o ERR %d\n",
+            current->pid, filename, flags, mode, -arg);
+    }
+}
+
+static void probe_file_close(int fd, int retval)
+{
+    if (!file_trace_enabled)
+        return;
+
+    if (retval == 0) {
+        trace_printk("%d CLOSE %d SUCCESS\n",
+            current->pid, fd);
+    } else {
+        trace_printk("%d CLOSE %d ERR %d\n",
+            current->pid, fd, retval);
+    }
+}
+
+static void probe_file_lseek(int fd, int offset, int mode, int arg)
+{
+    if (!file_trace_enabled)
+        return;
+
+    if (arg > 0) {
+        trace_printk("%d LSEEK %d %d %d SUCCESS %d\n",
+            current->pid, fd, offset, mode, arg);
+    } else {
+        trace_printk("%d LSEEK %d %d %d ERR %d\n",
+            current->pid, fd, offset, mode, -arg);
+    }
+}
+
+static void probe_file_read(int fd, int buf_size, int arg, char __user *buf)
+{
+    if (!file_trace_enabled)
+        return;
+
+    if (arg > 0) {
+        trace_printk("%d READ %d %d SUCCESS %d\n",
+            current->pid, fd, buf_size, arg);
+        print_data(buf, arg, 1);
+    } else if (arg == 0) {
+        trace_printk("%d READ %d %d EOF\n",
+            current->pid, fd, buf_size);
+    }
+    else {
+        trace_printk("%d READ %d %d ERR %d\n",
+            current->pid, fd, buf_size, -arg);
+    }
+}
+
+static void probe_file_write(int fd, int buf_size, int arg,
+    const char __user *buf)
+{
+    if (!file_trace_enabled)
+        return;
+
+    if (arg >= 0) {
+        trace_printk("%d WRITE %d %d SUCCESS %d\n",
+            current->pid, fd, buf_size, arg);
+        if (arg > 0)
+            print_data(buf, buf_size, 0);
+    }
+    else {
+        trace_printk("%d WRITE %d %d ERR %d\n",
+            current->pid, fd, buf_size, -arg);
+        if (buf_size > 0)
+            print_data(buf, buf_size, 0);
+        else if (buf_size < 0)
+            trace_printk("WRITE_DATA_FAULT\n");
+            
+    }
+}
+
+static void reset_file_trace(struct trace_array *tr)
+{
+    tr->time_start = ftrace_now(tr->cpu);
+    tracing_reset_online_cpus(tr);
+}
+
+static int file_trace_register(void)
+{
+    int ret;
+
+    ret = register_trace_file_open(probe_file_open);
+    if (ret)
+        goto fail_open;
+       
+    ret = register_trace_file_close(probe_file_close);
+    if (ret)
+        goto fail_close;
+    
+    ret = register_trace_file_lseek(probe_file_lseek);
+    if (ret)
+        goto fail_lseek;
+    
+    ret = register_trace_file_read(probe_file_read);
+    if (ret)
+        goto fail_read;
+    
+    ret = register_trace_file_write(probe_file_write);
+    if (ret)
+        goto fail_write;
+
+    return ret;
+    
+fail_write:
+    unregister_trace_file_read(probe_file_read);
+fail_read:
+    unregister_trace_file_lseek(probe_file_lseek);
+fail_lseek:
+    unregister_trace_file_close(probe_file_close);
+fail_close:
+    unregister_trace_file_open(probe_file_open);
+fail_open:
+    return ret;
+}
+
+static void file_trace_unregister(void)
+{
+    unregister_trace_file_open(probe_file_open);
+    unregister_trace_file_close(probe_file_close);
+    unregister_trace_file_lseek(probe_file_lseek);
+    unregister_trace_file_read(probe_file_read);
+    unregister_trace_file_write(probe_file_write);
+}
+
+static void file_trace_start(void)
+{
+    file_trace_register();
+}
+
+static void file_trace_stop(void)
+{
+    file_trace_unregister();
+}
+
+void file_trace_stop_cmdline_record(void)
+{
+    file_trace_stop();
+}
+
+static void file_start_trace(struct trace_array *tr)
+{
+    reset_file_trace(tr);
+    file_trace_start();
+    file_trace_enabled = 1;
+}
+
+static void file_stop_trace(struct trace_array *tr)
+{
+    file_trace_enabled = 0;
+    file_trace_stop();
+}
+
+static int file_trace_init(struct trace_array *tr)
+{
+    ctx_trace = tr;
+
+    file_start_trace(tr);
+    return 0;
+}
+
+static void file_trace_reset(struct trace_array *tr)
+{
+    file_stop_trace(tr);
+}
+
+/**
+ * struct tracer - a specific tracer and its callbacks to interact with debugfs
+ * @name: the name chosen to select it on the available_tracers file
+ * @init: called when one switches to this tracer (echo name > current_tracer)
+ * @reset: called when one switches to another tracer
+ * ... There is no need to handle other callbacks.
+ */
+static struct tracer file_trace __read_mostly =
+{
+    .name       = "file_trace",
+    .init       = file_trace_init,
+    .reset      = file_trace_reset,
+};
+
+__init static int init_file_trace(void)
+{
+    int ret = 0;
+    ret = file_trace_register();
+    if (ret) {
+        return ret;
+    }
+    return register_tracer(&file_trace);
+}
+
+device_initcall(init_file_trace);