[nicholasberlin]

Summary

A kretprobe cannot read the open function arguments at return. This PR adds an entry kprobe that saves the open_flags pointer. The return probe uses that pointer and removes the saved state. The loader supports both do_filp_open() and do_file_open() and loads the entry probe only for QQ_FILE_ACCESS.

If entry state is unavailable, the probe uses file flags. Those flags can lack O_CREAT, O_EXCL, O_NOCTTY and O_TRUNC; the manual states this limit. The live tests now require creation and truncation flags in kprobe mode. The saved state contains only the argument that this feature uses.

Validation

• At commit 5d2fe18dbb85, the source audit passed. Compared with ba7b1bc1041b, changes are limited to the approved comments. Executable C tokens are unchanged.
• The new full build and VM run was cancelled for these comment-only changes. The earlier complete results below apply to ba7b1bc1041b.

Earlier results, before these comment changes:

• Rebased on main at 1e0279c0da62.
• At commit ba7b1bc1041b, the C and BPF build passed with -Werror and WITH_BTFHUB=y, including Go programs.
• At commit ba7b1bc1041b, the full eBPF suite passed in the krun test image on Ubuntu 26.04 kernel 7.0.0-42-generic with fentry and with -K, and on kernel 5.15.0-139-generic.
• At commit ba7b1bc1041b, the guests used 512 MiB of RAM and KVM.
• At commit ba7b1bc1041b, the VM runs required the filesystem fixture with QUARK_TEST_FS_REQUIRED=1.

Earlier results, before this rebase:

• At commit a61bf7f3e005, the C and BPF build passed with -Werror.
• At commit a61bf7f3e005, the full eBPF suite passed with krun on Ubuntu 26.04 kernel 7.0.0-42-generic with fentry and with -K, and on kernel 5.15.0-139-generic.
• The VM runs at a61bf7f3e005 required the filesystem fixture with QUARK_TEST_FS_REQUIRED=1.
• At previous commit 612adc228941, mandoc -Tlint -Wall passed for the changed pages. All quark manual references exist at that commit.

Stack

part 10 of 19

Depends on #494 (part 9).

Derived from original #477 and the loader changes in original #478.