xref: /linux/tools/perf/builtin-trace.c (revision ec714e371f22f716a04e6ecb2a24988c92b26911)
1 /*
2  * builtin-trace.c
3  *
4  * Builtin 'trace' command:
5  *
6  * Display a continuously updated trace of any workload, CPU, specific PID,
7  * system wide, etc.  Default format is loosely strace like, but any other
8  * event may be specified using --event.
9  *
10  * Copyright (C) 2012, 2013, 2014, 2015 Red Hat Inc, Arnaldo Carvalho de Melo <acme@redhat.com>
11  *
12  * Initially based on the 'trace' prototype by Thomas Gleixner:
13  *
14  * http://lwn.net/Articles/415728/ ("Announcing a new utility: 'trace'")
15  */
16 
17 #include "util/record.h"
18 #include <api/fs/tracing_path.h>
19 #ifdef HAVE_LIBBPF_SUPPORT
20 #include <bpf/bpf.h>
21 #include <bpf/libbpf.h>
22 #include <bpf/btf.h>
23 #endif
24 #include "util/bpf_map.h"
25 #include "util/rlimit.h"
26 #include "builtin.h"
27 #include "util/cgroup.h"
28 #include "util/color.h"
29 #include "util/config.h"
30 #include "util/debug.h"
31 #include "util/dso.h"
32 #include "util/env.h"
33 #include "util/event.h"
34 #include "util/evsel.h"
35 #include "util/evsel_fprintf.h"
36 #include "util/synthetic-events.h"
37 #include "util/evlist.h"
38 #include "util/evswitch.h"
39 #include "util/hashmap.h"
40 #include "util/mmap.h"
41 #include <subcmd/pager.h>
42 #include <subcmd/exec-cmd.h>
43 #include "util/machine.h"
44 #include "util/map.h"
45 #include "util/symbol.h"
46 #include "util/path.h"
47 #include "util/session.h"
48 #include "util/thread.h"
49 #include <subcmd/parse-options.h>
50 #include "util/strlist.h"
51 #include "util/intlist.h"
52 #include "util/thread_map.h"
53 #include "util/stat.h"
54 #include "util/tool.h"
55 #include "util/trace.h"
56 #include "util/util.h"
57 #include "trace/beauty/beauty.h"
58 #include "trace-event.h"
59 #include "util/parse-events.h"
60 #include "util/tracepoint.h"
61 #include "callchain.h"
62 #include "print_binary.h"
63 #include "string2.h"
64 #include "syscalltbl.h"
65 #include "../perf.h"
66 #include "trace_augment.h"
67 #include "dwarf-regs.h"
68 
69 #include <errno.h>
70 #include <inttypes.h>
71 #include <poll.h>
72 #include <signal.h>
73 #include <stdlib.h>
74 #include <string.h>
75 #include <linux/err.h>
76 #include <linux/filter.h>
77 #include <linux/kernel.h>
78 #include <linux/list_sort.h>
79 #include <linux/random.h>
80 #include <linux/stringify.h>
81 #include <linux/time64.h>
82 #include <linux/zalloc.h>
83 #include <fcntl.h>
84 #include <sys/sysmacros.h>
85 
86 #include <linux/ctype.h>
87 #include <perf/mmap.h>
88 #include <tools/libc_compat.h>
89 
90 #ifdef HAVE_LIBTRACEEVENT
91 #include <event-parse.h>
92 #endif
93 
94 #ifndef O_CLOEXEC
95 # define O_CLOEXEC		02000000
96 #endif
97 
98 #ifndef F_LINUX_SPECIFIC_BASE
99 # define F_LINUX_SPECIFIC_BASE	1024
100 #endif
101 
102 #define RAW_SYSCALL_ARGS_NUM	6
103 
104 /*
105  * strtoul: Go from a string to a value, i.e. for msr: MSR_FS_BASE to 0xc0000100
106  *
107  * We have to explicitely mark the direction of the flow of data, if from the
108  * kernel to user space or the other way around, since the BPF collector we
109  * have so far copies only from user to kernel space, mark the arguments that
110  * go that direction, so that we don´t end up collecting the previous contents
111  * for syscall args that goes from kernel to user space.
112  */
113 struct syscall_arg_fmt {
114 	size_t	   (*scnprintf)(char *bf, size_t size, struct syscall_arg *arg);
115 	bool	   (*strtoul)(char *bf, size_t size, struct syscall_arg *arg, u64 *val);
116 	unsigned long (*mask_val)(struct syscall_arg *arg, unsigned long val);
117 	void	   *parm;
118 	const char *name;
119 	u16	   nr_entries; // for arrays
120 	bool	   from_user;
121 	bool	   show_zero;
122 #ifdef HAVE_LIBBPF_SUPPORT
123 	const struct btf_type *type;
124 	int	   type_id; /* used in btf_dump */
125 #endif
126 };
127 
128 struct syscall_fmt {
129 	const char *name;
130 	const char *alias;
131 	struct {
132 		const char *sys_enter,
133 			   *sys_exit;
134 	}	   bpf_prog_name;
135 	struct syscall_arg_fmt arg[RAW_SYSCALL_ARGS_NUM];
136 	u8	   nr_args;
137 	bool	   errpid;
138 	bool	   timeout;
139 	bool	   hexret;
140 };
141 
142 struct trace {
143 	struct perf_env		host_env;
144 	struct perf_tool	tool;
145 	struct {
146 		/** Sorted sycall numbers used by the trace. */
147 		struct syscall  **table;
148 		/** Size of table. */
149 		size_t		table_size;
150 		struct {
151 			struct evsel *sys_enter,
152 				*sys_exit,
153 				*bpf_output;
154 		}		events;
155 	} syscalls;
156 #ifdef HAVE_LIBBPF_SUPPORT
157 	struct btf		*btf;
158 #endif
159 	struct record_opts	opts;
160 	struct evlist	*evlist;
161 	struct machine		*host;
162 	struct thread		*current;
163 	struct cgroup		*cgroup;
164 	u64			base_time;
165 	FILE			*output;
166 	unsigned long		nr_events;
167 	unsigned long		nr_events_printed;
168 	unsigned long		max_events;
169 	struct evswitch		evswitch;
170 	struct strlist		*ev_qualifier;
171 	struct {
172 		size_t		nr;
173 		int		*entries;
174 	}			ev_qualifier_ids;
175 	struct {
176 		size_t		nr;
177 		pid_t		*entries;
178 		struct bpf_map  *map;
179 	}			filter_pids;
180 	/*
181 	 * TODO: The map is from an ID (aka system call number) to struct
182 	 * syscall_stats. If there is >1 e_machine, such as i386 and x86-64
183 	 * processes, then the stats here will gather wrong the statistics for
184 	 * the non EM_HOST system calls. A fix would be to add the e_machine
185 	 * into the key, but this would make the code inconsistent with the
186 	 * per-thread version.
187 	 */
188 	struct hashmap		*syscall_stats;
189 	double			duration_filter;
190 	double			runtime_ms;
191 	unsigned long		pfmaj, pfmin;
192 	struct {
193 		u64		vfs_getname,
194 				proc_getname;
195 	} stats;
196 	unsigned int		max_stack;
197 	unsigned int		min_stack;
198 	enum trace_summary_mode	summary_mode;
199 	int			max_summary;
200 	int			raw_augmented_syscalls_args_size;
201 	bool			raw_augmented_syscalls;
202 	bool			fd_path_disabled;
203 	bool			sort_events;
204 	bool			not_ev_qualifier;
205 	bool			live;
206 	bool			full_time;
207 	bool			sched;
208 	bool			multiple_threads;
209 	bool			summary;
210 	bool			summary_only;
211 	bool			errno_summary;
212 	bool			failure_only;
213 	bool			show_comm;
214 	bool			print_sample;
215 	bool			show_tool_stats;
216 	bool			trace_syscalls;
217 	bool			libtraceevent_print;
218 	bool			kernel_syscallchains;
219 	s16			args_alignment;
220 	bool			show_tstamp;
221 	bool			show_duration;
222 	bool			show_zeros;
223 	bool			show_arg_names;
224 	bool			show_string_prefix;
225 	bool			force;
226 	bool			vfs_getname;
227 	bool			force_btf;
228 	bool			summary_bpf;
229 	int			trace_pgfaults;
230 	char			*perfconfig_events;
231 	struct {
232 		struct ordered_events	data;
233 		u64			last;
234 	} oe;
235 	const char		*uid_str;
236 };
237 
trace__load_vmlinux_btf(struct trace * trace __maybe_unused)238 static void trace__load_vmlinux_btf(struct trace *trace __maybe_unused)
239 {
240 #ifdef HAVE_LIBBPF_SUPPORT
241 	if (trace->btf != NULL)
242 		return;
243 
244 	trace->btf = btf__load_vmlinux_btf();
245 	if (verbose > 0) {
246 		fprintf(trace->output, trace->btf ? "vmlinux BTF loaded\n" :
247 						    "Failed to load vmlinux BTF\n");
248 	}
249 #endif
250 }
251 
252 struct tp_field {
253 	int offset;
254 	union {
255 		u64 (*integer)(struct tp_field *field, struct perf_sample *sample);
256 		void *(*pointer)(struct tp_field *field, struct perf_sample *sample);
257 	};
258 };
259 
260 #define TP_UINT_FIELD(bits) \
261 static u64 tp_field__u##bits(struct tp_field *field, struct perf_sample *sample) \
262 { \
263 	u##bits value; \
264 	memcpy(&value, sample->raw_data + field->offset, sizeof(value)); \
265 	return value;  \
266 }
267 
268 TP_UINT_FIELD(8);
269 TP_UINT_FIELD(16);
270 TP_UINT_FIELD(32);
271 TP_UINT_FIELD(64);
272 
273 #define TP_UINT_FIELD__SWAPPED(bits) \
274 static u64 tp_field__swapped_u##bits(struct tp_field *field, struct perf_sample *sample) \
275 { \
276 	u##bits value; \
277 	memcpy(&value, sample->raw_data + field->offset, sizeof(value)); \
278 	return bswap_##bits(value);\
279 }
280 
281 TP_UINT_FIELD__SWAPPED(16);
282 TP_UINT_FIELD__SWAPPED(32);
283 TP_UINT_FIELD__SWAPPED(64);
284 
__tp_field__init_uint(struct tp_field * field,int size,int offset,bool needs_swap)285 static int __tp_field__init_uint(struct tp_field *field, int size, int offset, bool needs_swap)
286 {
287 	field->offset = offset;
288 
289 	switch (size) {
290 	case 1:
291 		field->integer = tp_field__u8;
292 		break;
293 	case 2:
294 		field->integer = needs_swap ? tp_field__swapped_u16 : tp_field__u16;
295 		break;
296 	case 4:
297 		field->integer = needs_swap ? tp_field__swapped_u32 : tp_field__u32;
298 		break;
299 	case 8:
300 		field->integer = needs_swap ? tp_field__swapped_u64 : tp_field__u64;
301 		break;
302 	default:
303 		return -1;
304 	}
305 
306 	return 0;
307 }
308 
tp_field__init_uint(struct tp_field * field,struct tep_format_field * format_field,bool needs_swap)309 static int tp_field__init_uint(struct tp_field *field, struct tep_format_field *format_field, bool needs_swap)
310 {
311 	return __tp_field__init_uint(field, format_field->size, format_field->offset, needs_swap);
312 }
313 
tp_field__ptr(struct tp_field * field,struct perf_sample * sample)314 static void *tp_field__ptr(struct tp_field *field, struct perf_sample *sample)
315 {
316 	return sample->raw_data + field->offset;
317 }
318 
__tp_field__init_ptr(struct tp_field * field,int offset)319 static int __tp_field__init_ptr(struct tp_field *field, int offset)
320 {
321 	field->offset = offset;
322 	field->pointer = tp_field__ptr;
323 	return 0;
324 }
325 
tp_field__init_ptr(struct tp_field * field,struct tep_format_field * format_field)326 static int tp_field__init_ptr(struct tp_field *field, struct tep_format_field *format_field)
327 {
328 	return __tp_field__init_ptr(field, format_field->offset);
329 }
330 
331 struct syscall_tp {
332 	struct tp_field id;
333 	union {
334 		struct tp_field args, ret;
335 	};
336 };
337 
338 /*
339  * The evsel->priv as used by 'perf trace'
340  * sc:	for raw_syscalls:sys_{enter,exit} and syscalls:sys_{enter,exit}_SYSCALLNAME
341  * fmt: for all the other tracepoints
342  */
343 struct evsel_trace {
344 	struct syscall_tp	sc;
345 	struct syscall_arg_fmt  *fmt;
346 };
347 
evsel_trace__new(void)348 static struct evsel_trace *evsel_trace__new(void)
349 {
350 	return zalloc(sizeof(struct evsel_trace));
351 }
352 
evsel_trace__delete(struct evsel_trace * et)353 static void evsel_trace__delete(struct evsel_trace *et)
354 {
355 	if (et == NULL)
356 		return;
357 
358 	zfree(&et->fmt);
359 	free(et);
360 }
361 
362 /*
363  * Used with raw_syscalls:sys_{enter,exit} and with the
364  * syscalls:sys_{enter,exit}_SYSCALL tracepoints
365  */
__evsel__syscall_tp(struct evsel * evsel)366 static inline struct syscall_tp *__evsel__syscall_tp(struct evsel *evsel)
367 {
368 	struct evsel_trace *et = evsel->priv;
369 
370 	return &et->sc;
371 }
372 
evsel__syscall_tp(struct evsel * evsel)373 static struct syscall_tp *evsel__syscall_tp(struct evsel *evsel)
374 {
375 	if (evsel->priv == NULL) {
376 		evsel->priv = evsel_trace__new();
377 		if (evsel->priv == NULL)
378 			return NULL;
379 	}
380 
381 	return __evsel__syscall_tp(evsel);
382 }
383 
384 /*
385  * Used with all the other tracepoints.
386  */
__evsel__syscall_arg_fmt(struct evsel * evsel)387 static inline struct syscall_arg_fmt *__evsel__syscall_arg_fmt(struct evsel *evsel)
388 {
389 	struct evsel_trace *et = evsel->priv;
390 
391 	return et->fmt;
392 }
393 
evsel__syscall_arg_fmt(struct evsel * evsel)394 static struct syscall_arg_fmt *evsel__syscall_arg_fmt(struct evsel *evsel)
395 {
396 	struct evsel_trace *et = evsel->priv;
397 
398 	if (evsel->priv == NULL) {
399 		et = evsel->priv = evsel_trace__new();
400 
401 		if (et == NULL)
402 			return NULL;
403 	}
404 
405 	if (et->fmt == NULL) {
406 		const struct tep_event *tp_format = evsel__tp_format(evsel);
407 
408 		if (tp_format == NULL)
409 			goto out_delete;
410 
411 		et->fmt = calloc(tp_format->format.nr_fields, sizeof(struct syscall_arg_fmt));
412 		if (et->fmt == NULL)
413 			goto out_delete;
414 	}
415 
416 	return __evsel__syscall_arg_fmt(evsel);
417 
418 out_delete:
419 	evsel_trace__delete(evsel->priv);
420 	evsel->priv = NULL;
421 	return NULL;
422 }
423 
evsel__init_tp_uint_field(struct evsel * evsel,struct tp_field * field,const char * name)424 static int evsel__init_tp_uint_field(struct evsel *evsel, struct tp_field *field, const char *name)
425 {
426 	struct tep_format_field *format_field = evsel__field(evsel, name);
427 
428 	if (format_field == NULL)
429 		return -1;
430 
431 	return tp_field__init_uint(field, format_field, evsel->needs_swap);
432 }
433 
434 #define perf_evsel__init_sc_tp_uint_field(evsel, name) \
435 	({ struct syscall_tp *sc = __evsel__syscall_tp(evsel);\
436 	   evsel__init_tp_uint_field(evsel, &sc->name, #name); })
437 
evsel__init_tp_ptr_field(struct evsel * evsel,struct tp_field * field,const char * name)438 static int evsel__init_tp_ptr_field(struct evsel *evsel, struct tp_field *field, const char *name)
439 {
440 	struct tep_format_field *format_field = evsel__field(evsel, name);
441 
442 	if (format_field == NULL)
443 		return -1;
444 
445 	return tp_field__init_ptr(field, format_field);
446 }
447 
448 #define perf_evsel__init_sc_tp_ptr_field(evsel, name) \
449 	({ struct syscall_tp *sc = __evsel__syscall_tp(evsel);\
450 	   evsel__init_tp_ptr_field(evsel, &sc->name, #name); })
451 
evsel__delete_priv(struct evsel * evsel)452 static void evsel__delete_priv(struct evsel *evsel)
453 {
454 	zfree(&evsel->priv);
455 	evsel__delete(evsel);
456 }
457 
evsel__init_syscall_tp(struct evsel * evsel)458 static int evsel__init_syscall_tp(struct evsel *evsel)
459 {
460 	struct syscall_tp *sc = evsel__syscall_tp(evsel);
461 
462 	if (sc != NULL) {
463 		if (evsel__init_tp_uint_field(evsel, &sc->id, "__syscall_nr") &&
464 		    evsel__init_tp_uint_field(evsel, &sc->id, "nr"))
465 			return -ENOENT;
466 
467 		return 0;
468 	}
469 
470 	return -ENOMEM;
471 }
472 
evsel__init_augmented_syscall_tp(struct evsel * evsel,struct evsel * tp)473 static int evsel__init_augmented_syscall_tp(struct evsel *evsel, struct evsel *tp)
474 {
475 	struct syscall_tp *sc = evsel__syscall_tp(evsel);
476 
477 	if (sc != NULL) {
478 		struct tep_format_field *syscall_id = evsel__field(tp, "id");
479 		if (syscall_id == NULL)
480 			syscall_id = evsel__field(tp, "__syscall_nr");
481 		if (syscall_id == NULL ||
482 		    __tp_field__init_uint(&sc->id, syscall_id->size, syscall_id->offset, evsel->needs_swap))
483 			return -EINVAL;
484 
485 		return 0;
486 	}
487 
488 	return -ENOMEM;
489 }
490 
evsel__init_augmented_syscall_tp_args(struct evsel * evsel)491 static int evsel__init_augmented_syscall_tp_args(struct evsel *evsel)
492 {
493 	struct syscall_tp *sc = __evsel__syscall_tp(evsel);
494 
495 	return __tp_field__init_ptr(&sc->args, sc->id.offset + sizeof(u64));
496 }
497 
evsel__init_augmented_syscall_tp_ret(struct evsel * evsel)498 static int evsel__init_augmented_syscall_tp_ret(struct evsel *evsel)
499 {
500 	struct syscall_tp *sc = __evsel__syscall_tp(evsel);
501 
502 	return __tp_field__init_uint(&sc->ret, sizeof(u64), sc->id.offset + sizeof(u64), evsel->needs_swap);
503 }
504 
evsel__init_raw_syscall_tp(struct evsel * evsel,void * handler)505 static int evsel__init_raw_syscall_tp(struct evsel *evsel, void *handler)
506 {
507 	if (evsel__syscall_tp(evsel) != NULL) {
508 		if (perf_evsel__init_sc_tp_uint_field(evsel, id))
509 			return -ENOENT;
510 
511 		evsel->handler = handler;
512 		return 0;
513 	}
514 
515 	return -ENOMEM;
516 }
517 
perf_evsel__raw_syscall_newtp(const char * direction,void * handler)518 static struct evsel *perf_evsel__raw_syscall_newtp(const char *direction, void *handler)
519 {
520 	struct evsel *evsel = evsel__newtp("raw_syscalls", direction);
521 
522 	/* older kernel (e.g., RHEL6) use syscalls:{enter,exit} */
523 	if (IS_ERR(evsel))
524 		evsel = evsel__newtp("syscalls", direction);
525 
526 	if (IS_ERR(evsel))
527 		return NULL;
528 
529 	if (evsel__init_raw_syscall_tp(evsel, handler))
530 		goto out_delete;
531 
532 	return evsel;
533 
534 out_delete:
535 	evsel__delete_priv(evsel);
536 	return NULL;
537 }
538 
539 #define perf_evsel__sc_tp_uint(evsel, name, sample) \
540 	({ struct syscall_tp *fields = __evsel__syscall_tp(evsel); \
541 	   fields->name.integer(&fields->name, sample); })
542 
543 #define perf_evsel__sc_tp_ptr(evsel, name, sample) \
544 	({ struct syscall_tp *fields = __evsel__syscall_tp(evsel); \
545 	   fields->name.pointer(&fields->name, sample); })
546 
strarray__scnprintf_suffix(struct strarray * sa,char * bf,size_t size,const char * intfmt,bool show_suffix,int val)547 size_t strarray__scnprintf_suffix(struct strarray *sa, char *bf, size_t size, const char *intfmt, bool show_suffix, int val)
548 {
549 	int idx = val - sa->offset;
550 
551 	if (idx < 0 || idx >= sa->nr_entries || sa->entries[idx] == NULL) {
552 		size_t printed = scnprintf(bf, size, intfmt, val);
553 		if (show_suffix)
554 			printed += scnprintf(bf + printed, size - printed, " /* %s??? */", sa->prefix);
555 		return printed;
556 	}
557 
558 	return scnprintf(bf, size, "%s%s", sa->entries[idx], show_suffix ? sa->prefix : "");
559 }
560 
strarray__scnprintf(struct strarray * sa,char * bf,size_t size,const char * intfmt,bool show_prefix,int val)561 size_t strarray__scnprintf(struct strarray *sa, char *bf, size_t size, const char *intfmt, bool show_prefix, int val)
562 {
563 	int idx = val - sa->offset;
564 
565 	if (idx < 0 || idx >= sa->nr_entries || sa->entries[idx] == NULL) {
566 		size_t printed = scnprintf(bf, size, intfmt, val);
567 		if (show_prefix)
568 			printed += scnprintf(bf + printed, size - printed, " /* %s??? */", sa->prefix);
569 		return printed;
570 	}
571 
572 	return scnprintf(bf, size, "%s%s", show_prefix ? sa->prefix : "", sa->entries[idx]);
573 }
574 
__syscall_arg__scnprintf_strarray(char * bf,size_t size,const char * intfmt,struct syscall_arg * arg)575 static size_t __syscall_arg__scnprintf_strarray(char *bf, size_t size,
576 						const char *intfmt,
577 					        struct syscall_arg *arg)
578 {
579 	return strarray__scnprintf(arg->parm, bf, size, intfmt, arg->show_string_prefix, arg->val);
580 }
581 
syscall_arg__scnprintf_strarray(char * bf,size_t size,struct syscall_arg * arg)582 static size_t syscall_arg__scnprintf_strarray(char *bf, size_t size,
583 					      struct syscall_arg *arg)
584 {
585 	return __syscall_arg__scnprintf_strarray(bf, size, "%d", arg);
586 }
587 
588 #define SCA_STRARRAY syscall_arg__scnprintf_strarray
589 
syscall_arg__strtoul_strarray(char * bf,size_t size,struct syscall_arg * arg,u64 * ret)590 bool syscall_arg__strtoul_strarray(char *bf, size_t size, struct syscall_arg *arg, u64 *ret)
591 {
592 	return strarray__strtoul(arg->parm, bf, size, ret);
593 }
594 
syscall_arg__strtoul_strarray_flags(char * bf,size_t size,struct syscall_arg * arg,u64 * ret)595 bool syscall_arg__strtoul_strarray_flags(char *bf, size_t size, struct syscall_arg *arg, u64 *ret)
596 {
597 	return strarray__strtoul_flags(arg->parm, bf, size, ret);
598 }
599 
syscall_arg__strtoul_strarrays(char * bf,size_t size,struct syscall_arg * arg,u64 * ret)600 bool syscall_arg__strtoul_strarrays(char *bf, size_t size, struct syscall_arg *arg, u64 *ret)
601 {
602 	return strarrays__strtoul(arg->parm, bf, size, ret);
603 }
604 
syscall_arg__scnprintf_strarray_flags(char * bf,size_t size,struct syscall_arg * arg)605 size_t syscall_arg__scnprintf_strarray_flags(char *bf, size_t size, struct syscall_arg *arg)
606 {
607 	return strarray__scnprintf_flags(arg->parm, bf, size, arg->show_string_prefix, arg->val);
608 }
609 
strarrays__scnprintf(struct strarrays * sas,char * bf,size_t size,const char * intfmt,bool show_prefix,int val)610 size_t strarrays__scnprintf(struct strarrays *sas, char *bf, size_t size, const char *intfmt, bool show_prefix, int val)
611 {
612 	size_t printed;
613 	int i;
614 
615 	for (i = 0; i < sas->nr_entries; ++i) {
616 		struct strarray *sa = sas->entries[i];
617 		int idx = val - sa->offset;
618 
619 		if (idx >= 0 && idx < sa->nr_entries) {
620 			if (sa->entries[idx] == NULL)
621 				break;
622 			return scnprintf(bf, size, "%s%s", show_prefix ? sa->prefix : "", sa->entries[idx]);
623 		}
624 	}
625 
626 	printed = scnprintf(bf, size, intfmt, val);
627 	if (show_prefix)
628 		printed += scnprintf(bf + printed, size - printed, " /* %s??? */", sas->entries[0]->prefix);
629 	return printed;
630 }
631 
strarray__strtoul(struct strarray * sa,char * bf,size_t size,u64 * ret)632 bool strarray__strtoul(struct strarray *sa, char *bf, size_t size, u64 *ret)
633 {
634 	int i;
635 
636 	for (i = 0; i < sa->nr_entries; ++i) {
637 		if (sa->entries[i] && strncmp(sa->entries[i], bf, size) == 0 && sa->entries[i][size] == '\0') {
638 			*ret = sa->offset + i;
639 			return true;
640 		}
641 	}
642 
643 	return false;
644 }
645 
strarray__strtoul_flags(struct strarray * sa,char * bf,size_t size,u64 * ret)646 bool strarray__strtoul_flags(struct strarray *sa, char *bf, size_t size, u64 *ret)
647 {
648 	u64 val = 0;
649 	char *tok = bf, *sep, *end;
650 
651 	*ret = 0;
652 
653 	while (size != 0) {
654 		int toklen = size;
655 
656 		sep = memchr(tok, '|', size);
657 		if (sep != NULL) {
658 			size -= sep - tok + 1;
659 
660 			end = sep - 1;
661 			while (end > tok && isspace(*end))
662 				--end;
663 
664 			toklen = end - tok + 1;
665 		}
666 
667 		while (isspace(*tok))
668 			++tok;
669 
670 		if (isalpha(*tok) || *tok == '_') {
671 			if (!strarray__strtoul(sa, tok, toklen, &val))
672 				return false;
673 		} else
674 			val = strtoul(tok, NULL, 0);
675 
676 		*ret |= (1 << (val - 1));
677 
678 		if (sep == NULL)
679 			break;
680 		tok = sep + 1;
681 	}
682 
683 	return true;
684 }
685 
strarrays__strtoul(struct strarrays * sas,char * bf,size_t size,u64 * ret)686 bool strarrays__strtoul(struct strarrays *sas, char *bf, size_t size, u64 *ret)
687 {
688 	int i;
689 
690 	for (i = 0; i < sas->nr_entries; ++i) {
691 		struct strarray *sa = sas->entries[i];
692 
693 		if (strarray__strtoul(sa, bf, size, ret))
694 			return true;
695 	}
696 
697 	return false;
698 }
699 
syscall_arg__scnprintf_strarrays(char * bf,size_t size,struct syscall_arg * arg)700 size_t syscall_arg__scnprintf_strarrays(char *bf, size_t size,
701 					struct syscall_arg *arg)
702 {
703 	return strarrays__scnprintf(arg->parm, bf, size, "%d", arg->show_string_prefix, arg->val);
704 }
705 
706 #ifndef AT_FDCWD
707 #define AT_FDCWD	-100
708 #endif
709 
syscall_arg__scnprintf_fd_at(char * bf,size_t size,struct syscall_arg * arg)710 static size_t syscall_arg__scnprintf_fd_at(char *bf, size_t size,
711 					   struct syscall_arg *arg)
712 {
713 	int fd = arg->val;
714 	const char *prefix = "AT_FD";
715 
716 	if (fd == AT_FDCWD)
717 		return scnprintf(bf, size, "%s%s", arg->show_string_prefix ? prefix : "", "CWD");
718 
719 	return syscall_arg__scnprintf_fd(bf, size, arg);
720 }
721 
722 #define SCA_FDAT syscall_arg__scnprintf_fd_at
723 
724 static size_t syscall_arg__scnprintf_close_fd(char *bf, size_t size,
725 					      struct syscall_arg *arg);
726 
727 #define SCA_CLOSE_FD syscall_arg__scnprintf_close_fd
728 
syscall_arg__scnprintf_hex(char * bf,size_t size,struct syscall_arg * arg)729 size_t syscall_arg__scnprintf_hex(char *bf, size_t size, struct syscall_arg *arg)
730 {
731 	return scnprintf(bf, size, "%#lx", arg->val);
732 }
733 
syscall_arg__scnprintf_ptr(char * bf,size_t size,struct syscall_arg * arg)734 size_t syscall_arg__scnprintf_ptr(char *bf, size_t size, struct syscall_arg *arg)
735 {
736 	if (arg->val == 0)
737 		return scnprintf(bf, size, "NULL");
738 	return syscall_arg__scnprintf_hex(bf, size, arg);
739 }
740 
syscall_arg__scnprintf_int(char * bf,size_t size,struct syscall_arg * arg)741 size_t syscall_arg__scnprintf_int(char *bf, size_t size, struct syscall_arg *arg)
742 {
743 	return scnprintf(bf, size, "%d", arg->val);
744 }
745 
syscall_arg__scnprintf_long(char * bf,size_t size,struct syscall_arg * arg)746 size_t syscall_arg__scnprintf_long(char *bf, size_t size, struct syscall_arg *arg)
747 {
748 	return scnprintf(bf, size, "%ld", arg->val);
749 }
750 
syscall_arg__scnprintf_char_array(char * bf,size_t size,struct syscall_arg * arg)751 static size_t syscall_arg__scnprintf_char_array(char *bf, size_t size, struct syscall_arg *arg)
752 {
753 	// XXX Hey, maybe for sched:sched_switch prev/next comm fields we can
754 	//     fill missing comms using thread__set_comm()...
755 	//     here or in a special syscall_arg__scnprintf_pid_sched_tp...
756 	return scnprintf(bf, size, "\"%-.*s\"", arg->fmt->nr_entries ?: arg->len, arg->val);
757 }
758 
759 #define SCA_CHAR_ARRAY syscall_arg__scnprintf_char_array
760 
761 static const char *bpf_cmd[] = {
762 	"MAP_CREATE", "MAP_LOOKUP_ELEM", "MAP_UPDATE_ELEM", "MAP_DELETE_ELEM",
763 	"MAP_GET_NEXT_KEY", "PROG_LOAD", "OBJ_PIN", "OBJ_GET", "PROG_ATTACH",
764 	"PROG_DETACH", "PROG_TEST_RUN", "PROG_GET_NEXT_ID", "MAP_GET_NEXT_ID",
765 	"PROG_GET_FD_BY_ID", "MAP_GET_FD_BY_ID", "OBJ_GET_INFO_BY_FD",
766 	"PROG_QUERY", "RAW_TRACEPOINT_OPEN", "BTF_LOAD", "BTF_GET_FD_BY_ID",
767 	"TASK_FD_QUERY", "MAP_LOOKUP_AND_DELETE_ELEM", "MAP_FREEZE",
768 	"BTF_GET_NEXT_ID", "MAP_LOOKUP_BATCH", "MAP_LOOKUP_AND_DELETE_BATCH",
769 	"MAP_UPDATE_BATCH", "MAP_DELETE_BATCH", "LINK_CREATE", "LINK_UPDATE",
770 	"LINK_GET_FD_BY_ID", "LINK_GET_NEXT_ID", "ENABLE_STATS", "ITER_CREATE",
771 	"LINK_DETACH", "PROG_BIND_MAP",
772 };
773 static DEFINE_STRARRAY(bpf_cmd, "BPF_");
774 
775 static const char *fsmount_flags[] = {
776 	[1] = "CLOEXEC",
777 };
778 static DEFINE_STRARRAY(fsmount_flags, "FSMOUNT_");
779 
780 #include "trace/beauty/generated/fsconfig_arrays.c"
781 
782 static DEFINE_STRARRAY(fsconfig_cmds, "FSCONFIG_");
783 
784 static const char *epoll_ctl_ops[] = { "ADD", "DEL", "MOD", };
785 static DEFINE_STRARRAY_OFFSET(epoll_ctl_ops, "EPOLL_CTL_", 1);
786 
787 static const char *itimers[] = { "REAL", "VIRTUAL", "PROF", };
788 static DEFINE_STRARRAY(itimers, "ITIMER_");
789 
790 static const char *keyctl_options[] = {
791 	"GET_KEYRING_ID", "JOIN_SESSION_KEYRING", "UPDATE", "REVOKE", "CHOWN",
792 	"SETPERM", "DESCRIBE", "CLEAR", "LINK", "UNLINK", "SEARCH", "READ",
793 	"INSTANTIATE", "NEGATE", "SET_REQKEY_KEYRING", "SET_TIMEOUT",
794 	"ASSUME_AUTHORITY", "GET_SECURITY", "SESSION_TO_PARENT", "REJECT",
795 	"INSTANTIATE_IOV", "INVALIDATE", "GET_PERSISTENT",
796 };
797 static DEFINE_STRARRAY(keyctl_options, "KEYCTL_");
798 
799 static const char *whences[] = { "SET", "CUR", "END",
800 #ifdef SEEK_DATA
801 "DATA",
802 #endif
803 #ifdef SEEK_HOLE
804 "HOLE",
805 #endif
806 };
807 static DEFINE_STRARRAY(whences, "SEEK_");
808 
809 static const char *fcntl_cmds[] = {
810 	"DUPFD", "GETFD", "SETFD", "GETFL", "SETFL", "GETLK", "SETLK",
811 	"SETLKW", "SETOWN", "GETOWN", "SETSIG", "GETSIG", "GETLK64",
812 	"SETLK64", "SETLKW64", "SETOWN_EX", "GETOWN_EX",
813 	"GETOWNER_UIDS",
814 };
815 static DEFINE_STRARRAY(fcntl_cmds, "F_");
816 
817 static const char *fcntl_linux_specific_cmds[] = {
818 	"SETLEASE", "GETLEASE", "NOTIFY", "DUPFD_QUERY", [5] = "CANCELLK", "DUPFD_CLOEXEC",
819 	"SETPIPE_SZ", "GETPIPE_SZ", "ADD_SEALS", "GET_SEALS",
820 	"GET_RW_HINT", "SET_RW_HINT", "GET_FILE_RW_HINT", "SET_FILE_RW_HINT",
821 };
822 
823 static DEFINE_STRARRAY_OFFSET(fcntl_linux_specific_cmds, "F_", F_LINUX_SPECIFIC_BASE);
824 
825 static struct strarray *fcntl_cmds_arrays[] = {
826 	&strarray__fcntl_cmds,
827 	&strarray__fcntl_linux_specific_cmds,
828 };
829 
830 static DEFINE_STRARRAYS(fcntl_cmds_arrays);
831 
832 static const char *rlimit_resources[] = {
833 	"CPU", "FSIZE", "DATA", "STACK", "CORE", "RSS", "NPROC", "NOFILE",
834 	"MEMLOCK", "AS", "LOCKS", "SIGPENDING", "MSGQUEUE", "NICE", "RTPRIO",
835 	"RTTIME",
836 };
837 static DEFINE_STRARRAY(rlimit_resources, "RLIMIT_");
838 
839 static const char *sighow[] = { "BLOCK", "UNBLOCK", "SETMASK", };
840 static DEFINE_STRARRAY(sighow, "SIG_");
841 
842 static const char *clockid[] = {
843 	"REALTIME", "MONOTONIC", "PROCESS_CPUTIME_ID", "THREAD_CPUTIME_ID",
844 	"MONOTONIC_RAW", "REALTIME_COARSE", "MONOTONIC_COARSE", "BOOTTIME",
845 	"REALTIME_ALARM", "BOOTTIME_ALARM", "SGI_CYCLE", "TAI"
846 };
847 static DEFINE_STRARRAY(clockid, "CLOCK_");
848 
syscall_arg__scnprintf_access_mode(char * bf,size_t size,struct syscall_arg * arg)849 static size_t syscall_arg__scnprintf_access_mode(char *bf, size_t size,
850 						 struct syscall_arg *arg)
851 {
852 	bool show_prefix = arg->show_string_prefix;
853 	const char *suffix = "_OK";
854 	size_t printed = 0;
855 	int mode = arg->val;
856 
857 	if (mode == F_OK) /* 0 */
858 		return scnprintf(bf, size, "F%s", show_prefix ? suffix : "");
859 #define	P_MODE(n) \
860 	if (mode & n##_OK) { \
861 		printed += scnprintf(bf + printed, size - printed, "%s%s", #n, show_prefix ? suffix : ""); \
862 		mode &= ~n##_OK; \
863 	}
864 
865 	P_MODE(R);
866 	P_MODE(W);
867 	P_MODE(X);
868 #undef P_MODE
869 
870 	if (mode)
871 		printed += scnprintf(bf + printed, size - printed, "|%#x", mode);
872 
873 	return printed;
874 }
875 
876 #define SCA_ACCMODE syscall_arg__scnprintf_access_mode
877 
878 static size_t syscall_arg__scnprintf_filename(char *bf, size_t size,
879 					      struct syscall_arg *arg);
880 
881 #define SCA_FILENAME syscall_arg__scnprintf_filename
882 
883 // 'argname' is just documentational at this point, to remove the previous comment with that info
884 #define SCA_FILENAME_FROM_USER(argname) \
885 	  { .scnprintf	= SCA_FILENAME, \
886 	    .from_user	= true, }
887 
888 static size_t syscall_arg__scnprintf_buf(char *bf, size_t size, struct syscall_arg *arg);
889 
890 #define SCA_BUF syscall_arg__scnprintf_buf
891 
syscall_arg__scnprintf_pipe_flags(char * bf,size_t size,struct syscall_arg * arg)892 static size_t syscall_arg__scnprintf_pipe_flags(char *bf, size_t size,
893 						struct syscall_arg *arg)
894 {
895 	bool show_prefix = arg->show_string_prefix;
896 	const char *prefix = "O_";
897 	int printed = 0, flags = arg->val;
898 
899 #define	P_FLAG(n) \
900 	if (flags & O_##n) { \
901 		printed += scnprintf(bf + printed, size - printed, "%s%s%s", printed ? "|" : "", show_prefix ? prefix : "", #n); \
902 		flags &= ~O_##n; \
903 	}
904 
905 	P_FLAG(CLOEXEC);
906 	P_FLAG(NONBLOCK);
907 #undef P_FLAG
908 
909 	if (flags)
910 		printed += scnprintf(bf + printed, size - printed, "%s%#x", printed ? "|" : "", flags);
911 
912 	return printed;
913 }
914 
915 #define SCA_PIPE_FLAGS syscall_arg__scnprintf_pipe_flags
916 
917 #ifndef GRND_NONBLOCK
918 #define GRND_NONBLOCK	0x0001
919 #endif
920 #ifndef GRND_RANDOM
921 #define GRND_RANDOM	0x0002
922 #endif
923 
syscall_arg__scnprintf_getrandom_flags(char * bf,size_t size,struct syscall_arg * arg)924 static size_t syscall_arg__scnprintf_getrandom_flags(char *bf, size_t size,
925 						   struct syscall_arg *arg)
926 {
927 	bool show_prefix = arg->show_string_prefix;
928 	const char *prefix = "GRND_";
929 	int printed = 0, flags = arg->val;
930 
931 #define	P_FLAG(n) \
932 	if (flags & GRND_##n) { \
933 		printed += scnprintf(bf + printed, size - printed, "%s%s%s", printed ? "|" : "", show_prefix ? prefix : "", #n); \
934 		flags &= ~GRND_##n; \
935 	}
936 
937 	P_FLAG(RANDOM);
938 	P_FLAG(NONBLOCK);
939 #undef P_FLAG
940 
941 	if (flags)
942 		printed += scnprintf(bf + printed, size - printed, "%s%#x", printed ? "|" : "", flags);
943 
944 	return printed;
945 }
946 
947 #define SCA_GETRANDOM_FLAGS syscall_arg__scnprintf_getrandom_flags
948 
949 #ifdef HAVE_LIBBPF_SUPPORT
syscall_arg_fmt__cache_btf_enum(struct syscall_arg_fmt * arg_fmt,struct btf * btf,char * type)950 static void syscall_arg_fmt__cache_btf_enum(struct syscall_arg_fmt *arg_fmt, struct btf *btf, char *type)
951 {
952 	int id;
953 
954 	type = strstr(type, "enum ");
955 	if (type == NULL)
956 		return;
957 
958 	type += 5; // skip "enum " to get the enumeration name
959 
960 	id = btf__find_by_name(btf, type);
961 	if (id < 0)
962 		return;
963 
964 	arg_fmt->type = btf__type_by_id(btf, id);
965 }
966 
syscall_arg__strtoul_btf_enum(char * bf,size_t size,struct syscall_arg * arg,u64 * val)967 static bool syscall_arg__strtoul_btf_enum(char *bf, size_t size, struct syscall_arg *arg, u64 *val)
968 {
969 	const struct btf_type *bt = arg->fmt->type;
970 	struct btf *btf = arg->trace->btf;
971 	struct btf_enum *be = btf_enum(bt);
972 
973 	for (int i = 0; i < btf_vlen(bt); ++i, ++be) {
974 		const char *name = btf__name_by_offset(btf, be->name_off);
975 		int max_len = max(size, strlen(name));
976 
977 		if (strncmp(name, bf, max_len) == 0) {
978 			*val = be->val;
979 			return true;
980 		}
981 	}
982 
983 	return false;
984 }
985 
syscall_arg__strtoul_btf_type(char * bf,size_t size,struct syscall_arg * arg,u64 * val)986 static bool syscall_arg__strtoul_btf_type(char *bf, size_t size, struct syscall_arg *arg, u64 *val)
987 {
988 	const struct btf_type *bt;
989 	char *type = arg->type_name;
990 	struct btf *btf;
991 
992 	trace__load_vmlinux_btf(arg->trace);
993 
994 	btf = arg->trace->btf;
995 	if (btf == NULL)
996 		return false;
997 
998 	if (arg->fmt->type == NULL) {
999 		// See if this is an enum
1000 		syscall_arg_fmt__cache_btf_enum(arg->fmt, btf, type);
1001 	}
1002 
1003 	// Now let's see if we have a BTF type resolved
1004 	bt = arg->fmt->type;
1005 	if (bt == NULL)
1006 		return false;
1007 
1008 	// If it is an enum:
1009 	if (btf_is_enum(arg->fmt->type))
1010 		return syscall_arg__strtoul_btf_enum(bf, size, arg, val);
1011 
1012 	return false;
1013 }
1014 
btf_enum_scnprintf(const struct btf_type * type,struct btf * btf,char * bf,size_t size,int val)1015 static size_t btf_enum_scnprintf(const struct btf_type *type, struct btf *btf, char *bf, size_t size, int val)
1016 {
1017 	struct btf_enum *be = btf_enum(type);
1018 	const int nr_entries = btf_vlen(type);
1019 
1020 	for (int i = 0; i < nr_entries; ++i, ++be) {
1021 		if (be->val == val) {
1022 			return scnprintf(bf, size, "%s",
1023 					 btf__name_by_offset(btf, be->name_off));
1024 		}
1025 	}
1026 
1027 	return 0;
1028 }
1029 
1030 struct trace_btf_dump_snprintf_ctx {
1031 	char   *bf;
1032 	size_t printed, size;
1033 };
1034 
trace__btf_dump_snprintf(void * vctx,const char * fmt,va_list args)1035 static void trace__btf_dump_snprintf(void *vctx, const char *fmt, va_list args)
1036 {
1037 	struct trace_btf_dump_snprintf_ctx *ctx = vctx;
1038 
1039 	ctx->printed += vscnprintf(ctx->bf + ctx->printed, ctx->size - ctx->printed, fmt, args);
1040 }
1041 
btf_struct_scnprintf(const struct btf_type * type,struct btf * btf,char * bf,size_t size,struct syscall_arg * arg)1042 static size_t btf_struct_scnprintf(const struct btf_type *type, struct btf *btf, char *bf, size_t size, struct syscall_arg *arg)
1043 {
1044 	struct trace_btf_dump_snprintf_ctx ctx = {
1045 		.bf   = bf,
1046 		.size = size,
1047 	};
1048 	struct augmented_arg *augmented_arg = arg->augmented.args;
1049 	int type_id = arg->fmt->type_id, consumed;
1050 	struct btf_dump *btf_dump;
1051 
1052 	LIBBPF_OPTS(btf_dump_opts, dump_opts);
1053 	LIBBPF_OPTS(btf_dump_type_data_opts, dump_data_opts);
1054 
1055 	if (arg == NULL || arg->augmented.args == NULL)
1056 		return 0;
1057 
1058 	dump_data_opts.compact	  = true;
1059 	dump_data_opts.skip_names = !arg->trace->show_arg_names;
1060 
1061 	btf_dump = btf_dump__new(btf, trace__btf_dump_snprintf, &ctx, &dump_opts);
1062 	if (btf_dump == NULL)
1063 		return 0;
1064 
1065 	/* pretty print the struct data here */
1066 	if (btf_dump__dump_type_data(btf_dump, type_id, arg->augmented.args->value, type->size, &dump_data_opts) == 0)
1067 		return 0;
1068 
1069 	consumed = sizeof(*augmented_arg) + augmented_arg->size;
1070 	arg->augmented.args = ((void *)arg->augmented.args) + consumed;
1071 	arg->augmented.size -= consumed;
1072 
1073 	btf_dump__free(btf_dump);
1074 
1075 	return ctx.printed;
1076 }
1077 
trace__btf_scnprintf(struct trace * trace,struct syscall_arg * arg,char * bf,size_t size,int val,char * type)1078 static size_t trace__btf_scnprintf(struct trace *trace, struct syscall_arg *arg, char *bf,
1079 				   size_t size, int val, char *type)
1080 {
1081 	struct syscall_arg_fmt *arg_fmt = arg->fmt;
1082 
1083 	if (trace->btf == NULL)
1084 		return 0;
1085 
1086 	if (arg_fmt->type == NULL) {
1087 		// Check if this is an enum and if we have the BTF type for it.
1088 		syscall_arg_fmt__cache_btf_enum(arg_fmt, trace->btf, type);
1089 	}
1090 
1091 	// Did we manage to find a BTF type for the syscall/tracepoint argument?
1092 	if (arg_fmt->type == NULL)
1093 		return 0;
1094 
1095 	if (btf_is_enum(arg_fmt->type))
1096 		return btf_enum_scnprintf(arg_fmt->type, trace->btf, bf, size, val);
1097 	else if (btf_is_struct(arg_fmt->type) || btf_is_union(arg_fmt->type))
1098 		return btf_struct_scnprintf(arg_fmt->type, trace->btf, bf, size, arg);
1099 
1100 	return 0;
1101 }
1102 
1103 #else // HAVE_LIBBPF_SUPPORT
trace__btf_scnprintf(struct trace * trace __maybe_unused,struct syscall_arg * arg __maybe_unused,char * bf __maybe_unused,size_t size __maybe_unused,int val __maybe_unused,char * type __maybe_unused)1104 static size_t trace__btf_scnprintf(struct trace *trace __maybe_unused, struct syscall_arg *arg __maybe_unused,
1105 				   char *bf __maybe_unused, size_t size __maybe_unused, int val __maybe_unused,
1106 				   char *type __maybe_unused)
1107 {
1108 	return 0;
1109 }
1110 
syscall_arg__strtoul_btf_type(char * bf __maybe_unused,size_t size __maybe_unused,struct syscall_arg * arg __maybe_unused,u64 * val __maybe_unused)1111 static bool syscall_arg__strtoul_btf_type(char *bf __maybe_unused, size_t size __maybe_unused,
1112 					  struct syscall_arg *arg __maybe_unused, u64 *val __maybe_unused)
1113 {
1114 	return false;
1115 }
1116 #endif // HAVE_LIBBPF_SUPPORT
1117 
1118 #define STUL_BTF_TYPE syscall_arg__strtoul_btf_type
1119 
1120 #define STRARRAY(name, array) \
1121 	  { .scnprintf	= SCA_STRARRAY, \
1122 	    .strtoul	= STUL_STRARRAY, \
1123 	    .parm	= &strarray__##array, \
1124 	    .show_zero	= true, }
1125 
1126 #define STRARRAY_FLAGS(name, array) \
1127 	  { .scnprintf	= SCA_STRARRAY_FLAGS, \
1128 	    .strtoul	= STUL_STRARRAY_FLAGS, \
1129 	    .parm	= &strarray__##array, \
1130 	    .show_zero	= true, }
1131 
1132 #include "trace/beauty/eventfd.c"
1133 #include "trace/beauty/futex_op.c"
1134 #include "trace/beauty/futex_val3.c"
1135 #include "trace/beauty/mmap.c"
1136 #include "trace/beauty/mode_t.c"
1137 #include "trace/beauty/msg_flags.c"
1138 #include "trace/beauty/open_flags.c"
1139 #include "trace/beauty/perf_event_open.c"
1140 #include "trace/beauty/pid.c"
1141 #include "trace/beauty/sched_policy.c"
1142 #include "trace/beauty/seccomp.c"
1143 #include "trace/beauty/signum.c"
1144 #include "trace/beauty/socket_type.c"
1145 #include "trace/beauty/waitid_options.c"
1146 
1147 static const struct syscall_fmt syscall_fmts[] = {
1148 	{ .name	    = "access",
1149 	  .arg = { [1] = { .scnprintf = SCA_ACCMODE,  /* mode */ }, }, },
1150 	{ .name	    = "arch_prctl",
1151 	  .arg = { [0] = { .scnprintf = SCA_X86_ARCH_PRCTL_CODE, /* code */ },
1152 		   [1] = { .scnprintf = SCA_PTR, /* arg2 */ }, }, },
1153 	{ .name	    = "bind",
1154 	  .arg = { [0] = { .scnprintf = SCA_INT, /* fd */ },
1155 		   [1] = SCA_SOCKADDR_FROM_USER(umyaddr),
1156 		   [2] = { .scnprintf = SCA_INT, /* addrlen */ }, }, },
1157 	{ .name	    = "bpf",
1158 	  .arg = { [0] = STRARRAY(cmd, bpf_cmd),
1159 		   [1] = { .from_user = true /* attr */, }, } },
1160 	{ .name	    = "brk",	    .hexret = true,
1161 	  .arg = { [0] = { .scnprintf = SCA_PTR, /* brk */ }, }, },
1162 	{ .name     = "clock_gettime",
1163 	  .arg = { [0] = STRARRAY(clk_id, clockid), }, },
1164 	{ .name	    = "clock_nanosleep",
1165 	  .arg = { [2] = SCA_TIMESPEC_FROM_USER(req), }, },
1166 	{ .name	    = "clone",	    .errpid = true, .nr_args = 5,
1167 	  .arg = { [0] = { .name = "flags",	    .scnprintf = SCA_CLONE_FLAGS, },
1168 		   [1] = { .name = "child_stack",   .scnprintf = SCA_HEX, },
1169 		   [2] = { .name = "parent_tidptr", .scnprintf = SCA_HEX, },
1170 		   [3] = { .name = "child_tidptr",  .scnprintf = SCA_HEX, },
1171 		   [4] = { .name = "tls",	    .scnprintf = SCA_HEX, }, }, },
1172 	{ .name	    = "close",
1173 	  .arg = { [0] = { .scnprintf = SCA_CLOSE_FD, /* fd */ }, }, },
1174 	{ .name	    = "connect",
1175 	  .arg = { [0] = { .scnprintf = SCA_INT, /* fd */ },
1176 		   [1] = SCA_SOCKADDR_FROM_USER(servaddr),
1177 		   [2] = { .scnprintf = SCA_INT, /* addrlen */ }, }, },
1178 	{ .name	    = "epoll_ctl",
1179 	  .arg = { [1] = STRARRAY(op, epoll_ctl_ops), }, },
1180 	{ .name	    = "eventfd2",
1181 	  .arg = { [1] = { .scnprintf = SCA_EFD_FLAGS, /* flags */ }, }, },
1182 	{ .name     = "faccessat",
1183 	  .arg = { [0] = { .scnprintf = SCA_FDAT,	  /* dirfd */ },
1184 		   [1] = SCA_FILENAME_FROM_USER(pathname),
1185 		   [2] = { .scnprintf = SCA_ACCMODE,	  /* mode */ }, }, },
1186 	{ .name     = "faccessat2",
1187 	  .arg = { [0] = { .scnprintf = SCA_FDAT,	  /* dirfd */ },
1188 		   [1] = SCA_FILENAME_FROM_USER(pathname),
1189 		   [2] = { .scnprintf = SCA_ACCMODE,	  /* mode */ },
1190 		   [3] = { .scnprintf = SCA_FACCESSAT2_FLAGS, /* flags */ }, }, },
1191 	{ .name	    = "fchmodat",
1192 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, },
1193 	{ .name	    = "fchownat",
1194 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, },
1195 	{ .name	    = "fcntl",
1196 	  .arg = { [1] = { .scnprintf = SCA_FCNTL_CMD,  /* cmd */
1197 			   .strtoul   = STUL_STRARRAYS,
1198 			   .parm      = &strarrays__fcntl_cmds_arrays,
1199 			   .show_zero = true, },
1200 		   [2] = { .scnprintf =  SCA_FCNTL_ARG, /* arg */ }, }, },
1201 	{ .name	    = "flock",
1202 	  .arg = { [1] = { .scnprintf = SCA_FLOCK, /* cmd */ }, }, },
1203 	{ .name     = "fsconfig",
1204 	  .arg = { [1] = STRARRAY(cmd, fsconfig_cmds), }, },
1205 	{ .name     = "fsmount",
1206 	  .arg = { [1] = STRARRAY_FLAGS(flags, fsmount_flags),
1207 		   [2] = { .scnprintf = SCA_FSMOUNT_ATTR_FLAGS, /* attr_flags */ }, }, },
1208 	{ .name     = "fspick",
1209 	  .arg = { [0] = { .scnprintf = SCA_FDAT,	  /* dfd */ },
1210 		   [1] = SCA_FILENAME_FROM_USER(path),
1211 		   [2] = { .scnprintf = SCA_FSPICK_FLAGS, /* flags */ }, }, },
1212 	{ .name	    = "fstat", .alias = "newfstat", },
1213 	{ .name	    = "futex",
1214 	  .arg = { [1] = { .scnprintf = SCA_FUTEX_OP, /* op */ },
1215 		   [5] = { .scnprintf = SCA_FUTEX_VAL3, /* val3 */ }, }, },
1216 	{ .name	    = "futimesat",
1217 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, },
1218 	{ .name	    = "getitimer",
1219 	  .arg = { [0] = STRARRAY(which, itimers), }, },
1220 	{ .name	    = "getpid",	    .errpid = true, },
1221 	{ .name	    = "getpgid",    .errpid = true, },
1222 	{ .name	    = "getppid",    .errpid = true, },
1223 	{ .name	    = "getrandom",
1224 	  .arg = { [2] = { .scnprintf = SCA_GETRANDOM_FLAGS, /* flags */ }, }, },
1225 	{ .name	    = "getrlimit",
1226 	  .arg = { [0] = STRARRAY(resource, rlimit_resources), }, },
1227 	{ .name	    = "getsockopt",
1228 	  .arg = { [1] = STRARRAY(level, socket_level), }, },
1229 	{ .name	    = "gettid",	    .errpid = true, },
1230 	{ .name	    = "ioctl",
1231 	  .arg = {
1232 #if defined(__i386__) || defined(__x86_64__)
1233 /*
1234  * FIXME: Make this available to all arches.
1235  */
1236 		   [1] = { .scnprintf = SCA_IOCTL_CMD, /* cmd */ },
1237 		   [2] = { .scnprintf = SCA_HEX, /* arg */ }, }, },
1238 #else
1239 		   [2] = { .scnprintf = SCA_HEX, /* arg */ }, }, },
1240 #endif
1241 	{ .name	    = "kcmp",	    .nr_args = 5,
1242 	  .arg = { [0] = { .name = "pid1",	.scnprintf = SCA_PID, },
1243 		   [1] = { .name = "pid2",	.scnprintf = SCA_PID, },
1244 		   [2] = { .name = "type",	.scnprintf = SCA_KCMP_TYPE, },
1245 		   [3] = { .name = "idx1",	.scnprintf = SCA_KCMP_IDX, },
1246 		   [4] = { .name = "idx2",	.scnprintf = SCA_KCMP_IDX, }, }, },
1247 	{ .name	    = "keyctl",
1248 	  .arg = { [0] = STRARRAY(option, keyctl_options), }, },
1249 	{ .name	    = "kill",
1250 	  .arg = { [1] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, },
1251 	{ .name	    = "linkat",
1252 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, },
1253 	{ .name	    = "lseek",
1254 	  .arg = { [2] = STRARRAY(whence, whences), }, },
1255 	{ .name	    = "lstat", .alias = "newlstat", },
1256 	{ .name     = "madvise",
1257 	  .arg = { [0] = { .scnprintf = SCA_HEX,      /* start */ },
1258 		   [2] = { .scnprintf = SCA_MADV_BHV, /* behavior */ }, }, },
1259 	{ .name	    = "mkdirat",
1260 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, },
1261 	{ .name	    = "mknodat",
1262 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, },
1263 	{ .name	    = "mmap",	    .hexret = true,
1264 /* The standard mmap maps to old_mmap on s390x */
1265 #if defined(__s390x__)
1266 	.alias = "old_mmap",
1267 #endif
1268 	  .arg = { [2] = { .scnprintf = SCA_MMAP_PROT, .show_zero = true, /* prot */ },
1269 		   [3] = { .scnprintf = SCA_MMAP_FLAGS,	/* flags */
1270 			   .strtoul   = STUL_STRARRAY_FLAGS,
1271 			   .parm      = &strarray__mmap_flags, },
1272 		   [5] = { .scnprintf = SCA_HEX,	/* offset */ }, }, },
1273 	{ .name	    = "mount",
1274 	  .arg = { [0] = SCA_FILENAME_FROM_USER(devname),
1275 		   [3] = { .scnprintf = SCA_MOUNT_FLAGS, /* flags */
1276 			   .mask_val  = SCAMV_MOUNT_FLAGS, /* flags */ }, }, },
1277 	{ .name	    = "move_mount",
1278 	  .arg = { [0] = { .scnprintf = SCA_FDAT,	/* from_dfd */ },
1279 		   [1] = SCA_FILENAME_FROM_USER(pathname),
1280 		   [2] = { .scnprintf = SCA_FDAT,	/* to_dfd */ },
1281 		   [3] = SCA_FILENAME_FROM_USER(pathname),
1282 		   [4] = { .scnprintf = SCA_MOVE_MOUNT_FLAGS, /* flags */ }, }, },
1283 	{ .name	    = "mprotect",
1284 	  .arg = { [0] = { .scnprintf = SCA_HEX,	/* start */ },
1285 		   [2] = { .scnprintf = SCA_MMAP_PROT, .show_zero = true, /* prot */ }, }, },
1286 	{ .name	    = "mq_unlink",
1287 	  .arg = { [0] = SCA_FILENAME_FROM_USER(u_name), }, },
1288 	{ .name	    = "mremap",	    .hexret = true,
1289 	  .arg = { [3] = { .scnprintf = SCA_MREMAP_FLAGS, /* flags */ }, }, },
1290 	{ .name	    = "name_to_handle_at",
1291 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, },
1292 	{ .name	    = "nanosleep",
1293 	  .arg = { [0] = SCA_TIMESPEC_FROM_USER(req), }, },
1294 	{ .name	    = "newfstatat", .alias = "fstatat",
1295 	  .arg = { [0] = { .scnprintf = SCA_FDAT,	  /* dirfd */ },
1296 		   [1] = SCA_FILENAME_FROM_USER(pathname),
1297 		   [3] = { .scnprintf = SCA_FS_AT_FLAGS, /* flags */ }, }, },
1298 	{ .name	    = "open",
1299 	  .arg = { [1] = { .scnprintf = SCA_OPEN_FLAGS, /* flags */ }, }, },
1300 	{ .name	    = "open_by_handle_at",
1301 	  .arg = { [0] = { .scnprintf = SCA_FDAT,	/* dfd */ },
1302 		   [2] = { .scnprintf = SCA_OPEN_FLAGS, /* flags */ }, }, },
1303 	{ .name	    = "openat",
1304 	  .arg = { [0] = { .scnprintf = SCA_FDAT,	/* dfd */ },
1305 		   [2] = { .scnprintf = SCA_OPEN_FLAGS, /* flags */ }, }, },
1306 	{ .name	    = "perf_event_open",
1307 	  .arg = { [0] = SCA_PERF_ATTR_FROM_USER(attr),
1308 		   [2] = { .scnprintf = SCA_INT,	/* cpu */ },
1309 		   [3] = { .scnprintf = SCA_FD,		/* group_fd */ },
1310 		   [4] = { .scnprintf = SCA_PERF_FLAGS, /* flags */ }, }, },
1311 	{ .name	    = "pipe2",
1312 	  .arg = { [1] = { .scnprintf = SCA_PIPE_FLAGS, /* flags */ }, }, },
1313 	{ .name	    = "pkey_alloc",
1314 	  .arg = { [1] = { .scnprintf = SCA_PKEY_ALLOC_ACCESS_RIGHTS,	/* access_rights */ }, }, },
1315 	{ .name	    = "pkey_free",
1316 	  .arg = { [0] = { .scnprintf = SCA_INT,	/* key */ }, }, },
1317 	{ .name	    = "pkey_mprotect",
1318 	  .arg = { [0] = { .scnprintf = SCA_HEX,	/* start */ },
1319 		   [2] = { .scnprintf = SCA_MMAP_PROT, .show_zero = true, /* prot */ },
1320 		   [3] = { .scnprintf = SCA_INT,	/* pkey */ }, }, },
1321 	{ .name	    = "poll", .timeout = true, },
1322 	{ .name	    = "ppoll", .timeout = true, },
1323 	{ .name	    = "prctl",
1324 	  .arg = { [0] = { .scnprintf = SCA_PRCTL_OPTION, /* option */
1325 			   .strtoul   = STUL_STRARRAY,
1326 			   .parm      = &strarray__prctl_options, },
1327 		   [1] = { .scnprintf = SCA_PRCTL_ARG2, /* arg2 */ },
1328 		   [2] = { .scnprintf = SCA_PRCTL_ARG3, /* arg3 */ }, }, },
1329 	{ .name	    = "pread", .alias = "pread64", },
1330 	{ .name	    = "preadv", .alias = "pread", },
1331 	{ .name	    = "prlimit64",
1332 	  .arg = { [1] = STRARRAY(resource, rlimit_resources),
1333 		   [2] = { .from_user = true /* new_rlim */, }, }, },
1334 	{ .name	    = "pwrite", .alias = "pwrite64", },
1335 	{ .name	    = "readlinkat",
1336 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, },
1337 	{ .name	    = "recvfrom",
1338 	  .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, },
1339 	{ .name	    = "recvmmsg",
1340 	  .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, },
1341 	{ .name	    = "recvmsg",
1342 	  .arg = { [2] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, },
1343 	{ .name	    = "renameat",
1344 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* olddirfd */ },
1345 		   [2] = { .scnprintf = SCA_FDAT, /* newdirfd */ }, }, },
1346 	{ .name	    = "renameat2",
1347 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* olddirfd */ },
1348 		   [2] = { .scnprintf = SCA_FDAT, /* newdirfd */ },
1349 		   [4] = { .scnprintf = SCA_RENAMEAT2_FLAGS, /* flags */ }, }, },
1350 	{ .name	    = "rseq",
1351 	  .arg = { [0] = { .from_user = true /* rseq */, }, }, },
1352 	{ .name	    = "rt_sigaction",
1353 	  .arg = { [0] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, },
1354 	{ .name	    = "rt_sigprocmask",
1355 	  .arg = { [0] = STRARRAY(how, sighow), }, },
1356 	{ .name	    = "rt_sigqueueinfo",
1357 	  .arg = { [1] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, },
1358 	{ .name	    = "rt_tgsigqueueinfo",
1359 	  .arg = { [2] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, },
1360 	{ .name	    = "sched_setscheduler",
1361 	  .arg = { [1] = { .scnprintf = SCA_SCHED_POLICY, /* policy */ }, }, },
1362 	{ .name	    = "seccomp",
1363 	  .arg = { [0] = { .scnprintf = SCA_SECCOMP_OP,	   /* op */ },
1364 		   [1] = { .scnprintf = SCA_SECCOMP_FLAGS, /* flags */ }, }, },
1365 	{ .name	    = "select", .timeout = true, },
1366 	{ .name	    = "sendfile", .alias = "sendfile64", },
1367 	{ .name	    = "sendmmsg",
1368 	  .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, },
1369 	{ .name	    = "sendmsg",
1370 	  .arg = { [2] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, },
1371 	{ .name	    = "sendto",
1372 	  .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ },
1373 		   [4] = SCA_SOCKADDR_FROM_USER(addr), }, },
1374 	{ .name	    = "set_robust_list",
1375 	  .arg = { [0] = { .from_user = true /* head */, }, }, },
1376 	{ .name	    = "set_tid_address", .errpid = true, },
1377 	{ .name	    = "setitimer",
1378 	  .arg = { [0] = STRARRAY(which, itimers), }, },
1379 	{ .name	    = "setrlimit",
1380 	  .arg = { [0] = STRARRAY(resource, rlimit_resources),
1381 		   [1] = { .from_user = true /* rlim */, }, }, },
1382 	{ .name	    = "setsockopt",
1383 	  .arg = { [1] = STRARRAY(level, socket_level), }, },
1384 	{ .name	    = "socket",
1385 	  .arg = { [0] = STRARRAY(family, socket_families),
1386 		   [1] = { .scnprintf = SCA_SK_TYPE, /* type */ },
1387 		   [2] = { .scnprintf = SCA_SK_PROTO, /* protocol */ }, }, },
1388 	{ .name	    = "socketpair",
1389 	  .arg = { [0] = STRARRAY(family, socket_families),
1390 		   [1] = { .scnprintf = SCA_SK_TYPE, /* type */ },
1391 		   [2] = { .scnprintf = SCA_SK_PROTO, /* protocol */ }, }, },
1392 	{ .name	    = "stat", .alias = "newstat", },
1393 	{ .name	    = "statx",
1394 	  .arg = { [0] = { .scnprintf = SCA_FDAT,	 /* fdat */ },
1395 		   [2] = { .scnprintf = SCA_FS_AT_FLAGS, /* flags */ } ,
1396 		   [3] = { .scnprintf = SCA_STATX_MASK,	 /* mask */ }, }, },
1397 	{ .name	    = "swapoff",
1398 	  .arg = { [0] = SCA_FILENAME_FROM_USER(specialfile), }, },
1399 	{ .name	    = "swapon",
1400 	  .arg = { [0] = SCA_FILENAME_FROM_USER(specialfile), }, },
1401 	{ .name	    = "symlinkat",
1402 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, },
1403 	{ .name	    = "sync_file_range",
1404 	  .arg = { [3] = { .scnprintf = SCA_SYNC_FILE_RANGE_FLAGS, /* flags */ }, }, },
1405 	{ .name	    = "tgkill",
1406 	  .arg = { [2] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, },
1407 	{ .name	    = "tkill",
1408 	  .arg = { [1] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, },
1409 	{ .name     = "umount2", .alias = "umount",
1410 	  .arg = { [0] = SCA_FILENAME_FROM_USER(name), }, },
1411 	{ .name	    = "uname", .alias = "newuname", },
1412 	{ .name	    = "unlinkat",
1413 	  .arg = { [0] = { .scnprintf = SCA_FDAT,	  /* dfd */ },
1414 		   [1] = SCA_FILENAME_FROM_USER(pathname),
1415 		   [2] = { .scnprintf = SCA_FS_AT_FLAGS,  /* flags */ }, }, },
1416 	{ .name	    = "utimensat",
1417 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* dirfd */ }, }, },
1418 	{ .name	    = "wait4",	    .errpid = true,
1419 	  .arg = { [2] = { .scnprintf = SCA_WAITID_OPTIONS, /* options */ }, }, },
1420 	{ .name	    = "waitid",	    .errpid = true,
1421 	  .arg = { [3] = { .scnprintf = SCA_WAITID_OPTIONS, /* options */ }, }, },
1422 	{ .name	    = "write",
1423 	  .arg = { [1] = { .scnprintf = SCA_BUF /* buf */, .from_user = true, }, }, },
1424 };
1425 
syscall_fmt__cmp(const void * name,const void * fmtp)1426 static int syscall_fmt__cmp(const void *name, const void *fmtp)
1427 {
1428 	const struct syscall_fmt *fmt = fmtp;
1429 	return strcmp(name, fmt->name);
1430 }
1431 
__syscall_fmt__find(const struct syscall_fmt * fmts,const int nmemb,const char * name)1432 static const struct syscall_fmt *__syscall_fmt__find(const struct syscall_fmt *fmts,
1433 						     const int nmemb,
1434 						     const char *name)
1435 {
1436 	return bsearch(name, fmts, nmemb, sizeof(struct syscall_fmt), syscall_fmt__cmp);
1437 }
1438 
syscall_fmt__find(const char * name)1439 static const struct syscall_fmt *syscall_fmt__find(const char *name)
1440 {
1441 	const int nmemb = ARRAY_SIZE(syscall_fmts);
1442 	return __syscall_fmt__find(syscall_fmts, nmemb, name);
1443 }
1444 
__syscall_fmt__find_by_alias(const struct syscall_fmt * fmts,const int nmemb,const char * alias)1445 static const struct syscall_fmt *__syscall_fmt__find_by_alias(const struct syscall_fmt *fmts,
1446 							      const int nmemb, const char *alias)
1447 {
1448 	int i;
1449 
1450 	for (i = 0; i < nmemb; ++i) {
1451 		if (fmts[i].alias && strcmp(fmts[i].alias, alias) == 0)
1452 			return &fmts[i];
1453 	}
1454 
1455 	return NULL;
1456 }
1457 
syscall_fmt__find_by_alias(const char * alias)1458 static const struct syscall_fmt *syscall_fmt__find_by_alias(const char *alias)
1459 {
1460 	const int nmemb = ARRAY_SIZE(syscall_fmts);
1461 	return __syscall_fmt__find_by_alias(syscall_fmts, nmemb, alias);
1462 }
1463 
1464 /**
1465  * struct syscall
1466  */
1467 struct syscall {
1468 	/** @e_machine: The ELF machine associated with the entry. */
1469 	int e_machine;
1470 	/** @id: id value from the tracepoint, the system call number. */
1471 	int id;
1472 	struct tep_event    *tp_format;
1473 	int		    nr_args;
1474 	/**
1475 	 * @args_size: sum of the sizes of the syscall arguments, anything
1476 	 * after that is augmented stuff: pathname for openat, etc.
1477 	 */
1478 
1479 	int		    args_size;
1480 	struct {
1481 		struct bpf_program *sys_enter,
1482 				   *sys_exit;
1483 	}		    bpf_prog;
1484 	/** @is_exit: is this "exit" or "exit_group"? */
1485 	bool		    is_exit;
1486 	/**
1487 	 * @is_open: is this "open" or "openat"? To associate the fd returned in
1488 	 * sys_exit with the pathname in sys_enter.
1489 	 */
1490 	bool		    is_open;
1491 	/**
1492 	 * @nonexistent: Name lookup failed. Just a hole in the syscall table,
1493 	 * syscall id not allocated.
1494 	 */
1495 	bool		    nonexistent;
1496 	bool		    use_btf;
1497 	struct tep_format_field *args;
1498 	const char	    *name;
1499 	const struct syscall_fmt  *fmt;
1500 	struct syscall_arg_fmt *arg_fmt;
1501 };
1502 
1503 /*
1504  * We need to have this 'calculated' boolean because in some cases we really
1505  * don't know what is the duration of a syscall, for instance, when we start
1506  * a session and some threads are waiting for a syscall to finish, say 'poll',
1507  * in which case all we can do is to print "( ? ) for duration and for the
1508  * start timestamp.
1509  */
fprintf_duration(unsigned long t,bool calculated,FILE * fp)1510 static size_t fprintf_duration(unsigned long t, bool calculated, FILE *fp)
1511 {
1512 	double duration = (double)t / NSEC_PER_MSEC;
1513 	size_t printed = fprintf(fp, "(");
1514 
1515 	if (!calculated)
1516 		printed += fprintf(fp, "         ");
1517 	else if (duration >= 1.0)
1518 		printed += color_fprintf(fp, PERF_COLOR_RED, "%6.3f ms", duration);
1519 	else if (duration >= 0.01)
1520 		printed += color_fprintf(fp, PERF_COLOR_YELLOW, "%6.3f ms", duration);
1521 	else
1522 		printed += color_fprintf(fp, PERF_COLOR_NORMAL, "%6.3f ms", duration);
1523 	return printed + fprintf(fp, "): ");
1524 }
1525 
1526 /**
1527  * filename.ptr: The filename char pointer that will be vfs_getname'd
1528  * filename.entry_str_pos: Where to insert the string translated from
1529  *                         filename.ptr by the vfs_getname tracepoint/kprobe.
1530  * ret_scnprintf: syscall args may set this to a different syscall return
1531  *                formatter, for instance, fcntl may return fds, file flags, etc.
1532  */
1533 struct thread_trace {
1534 	u64		  entry_time;
1535 	bool		  entry_pending;
1536 	unsigned long	  nr_events;
1537 	unsigned long	  pfmaj, pfmin;
1538 	char		  *entry_str;
1539 	double		  runtime_ms;
1540 	size_t		  (*ret_scnprintf)(char *bf, size_t size, struct syscall_arg *arg);
1541         struct {
1542 		unsigned long ptr;
1543 		short int     entry_str_pos;
1544 		bool	      pending_open;
1545 		unsigned int  namelen;
1546 		char	      *name;
1547 	} filename;
1548 	struct {
1549 		int	      max;
1550 		struct file   *table;
1551 	} files;
1552 
1553 	struct hashmap *syscall_stats;
1554 };
1555 
syscall_id_hash(long key,void * ctx __maybe_unused)1556 static size_t syscall_id_hash(long key, void *ctx __maybe_unused)
1557 {
1558 	return key;
1559 }
1560 
syscall_id_equal(long key1,long key2,void * ctx __maybe_unused)1561 static bool syscall_id_equal(long key1, long key2, void *ctx __maybe_unused)
1562 {
1563 	return key1 == key2;
1564 }
1565 
alloc_syscall_stats(void)1566 static struct hashmap *alloc_syscall_stats(void)
1567 {
1568 	return hashmap__new(syscall_id_hash, syscall_id_equal, NULL);
1569 }
1570 
delete_syscall_stats(struct hashmap * syscall_stats)1571 static void delete_syscall_stats(struct hashmap *syscall_stats)
1572 {
1573 	struct hashmap_entry *pos;
1574 	size_t bkt;
1575 
1576 	if (syscall_stats == NULL)
1577 		return;
1578 
1579 	hashmap__for_each_entry(syscall_stats, pos, bkt)
1580 		zfree(&pos->pvalue);
1581 	hashmap__free(syscall_stats);
1582 }
1583 
thread_trace__new(struct trace * trace)1584 static struct thread_trace *thread_trace__new(struct trace *trace)
1585 {
1586 	struct thread_trace *ttrace =  zalloc(sizeof(struct thread_trace));
1587 
1588 	if (ttrace) {
1589 		ttrace->files.max = -1;
1590 		if (trace->summary) {
1591 			ttrace->syscall_stats = alloc_syscall_stats();
1592 			if (IS_ERR(ttrace->syscall_stats))
1593 				zfree(&ttrace);
1594 		}
1595 	}
1596 
1597 	return ttrace;
1598 }
1599 
1600 static void thread_trace__free_files(struct thread_trace *ttrace);
1601 
thread_trace__delete(void * pttrace)1602 static void thread_trace__delete(void *pttrace)
1603 {
1604 	struct thread_trace *ttrace = pttrace;
1605 
1606 	if (!ttrace)
1607 		return;
1608 
1609 	delete_syscall_stats(ttrace->syscall_stats);
1610 	ttrace->syscall_stats = NULL;
1611 	thread_trace__free_files(ttrace);
1612 	zfree(&ttrace->entry_str);
1613 	free(ttrace);
1614 }
1615 
thread__trace(struct thread * thread,struct trace * trace)1616 static struct thread_trace *thread__trace(struct thread *thread, struct trace *trace)
1617 {
1618 	struct thread_trace *ttrace;
1619 
1620 	if (thread == NULL)
1621 		goto fail;
1622 
1623 	if (thread__priv(thread) == NULL)
1624 		thread__set_priv(thread, thread_trace__new(trace));
1625 
1626 	if (thread__priv(thread) == NULL)
1627 		goto fail;
1628 
1629 	ttrace = thread__priv(thread);
1630 	++ttrace->nr_events;
1631 
1632 	return ttrace;
1633 fail:
1634 	color_fprintf(trace->output, PERF_COLOR_RED,
1635 		      "WARNING: not enough memory, dropping samples!\n");
1636 	return NULL;
1637 }
1638 
1639 
syscall_arg__set_ret_scnprintf(struct syscall_arg * arg,size_t (* ret_scnprintf)(char * bf,size_t size,struct syscall_arg * arg))1640 void syscall_arg__set_ret_scnprintf(struct syscall_arg *arg,
1641 				    size_t (*ret_scnprintf)(char *bf, size_t size, struct syscall_arg *arg))
1642 {
1643 	struct thread_trace *ttrace = thread__priv(arg->thread);
1644 
1645 	ttrace->ret_scnprintf = ret_scnprintf;
1646 }
1647 
1648 #define TRACE_PFMAJ		(1 << 0)
1649 #define TRACE_PFMIN		(1 << 1)
1650 
1651 static const size_t trace__entry_str_size = 2048;
1652 
thread_trace__free_files(struct thread_trace * ttrace)1653 static void thread_trace__free_files(struct thread_trace *ttrace)
1654 {
1655 	for (int i = 0; i <= ttrace->files.max; ++i) {
1656 		struct file *file = ttrace->files.table + i;
1657 		zfree(&file->pathname);
1658 	}
1659 
1660 	zfree(&ttrace->files.table);
1661 	ttrace->files.max  = -1;
1662 }
1663 
thread_trace__files_entry(struct thread_trace * ttrace,int fd)1664 static struct file *thread_trace__files_entry(struct thread_trace *ttrace, int fd)
1665 {
1666 	if (fd < 0)
1667 		return NULL;
1668 
1669 	if (fd > ttrace->files.max) {
1670 		struct file *nfiles = realloc(ttrace->files.table, (fd + 1) * sizeof(struct file));
1671 
1672 		if (nfiles == NULL)
1673 			return NULL;
1674 
1675 		if (ttrace->files.max != -1) {
1676 			memset(nfiles + ttrace->files.max + 1, 0,
1677 			       (fd - ttrace->files.max) * sizeof(struct file));
1678 		} else {
1679 			memset(nfiles, 0, (fd + 1) * sizeof(struct file));
1680 		}
1681 
1682 		ttrace->files.table = nfiles;
1683 		ttrace->files.max   = fd;
1684 	}
1685 
1686 	return ttrace->files.table + fd;
1687 }
1688 
thread__files_entry(struct thread * thread,int fd)1689 struct file *thread__files_entry(struct thread *thread, int fd)
1690 {
1691 	return thread_trace__files_entry(thread__priv(thread), fd);
1692 }
1693 
trace__set_fd_pathname(struct thread * thread,int fd,const char * pathname)1694 static int trace__set_fd_pathname(struct thread *thread, int fd, const char *pathname)
1695 {
1696 	struct thread_trace *ttrace = thread__priv(thread);
1697 	struct file *file = thread_trace__files_entry(ttrace, fd);
1698 
1699 	if (file != NULL) {
1700 		struct stat st;
1701 
1702 		if (stat(pathname, &st) == 0)
1703 			file->dev_maj = major(st.st_rdev);
1704 		file->pathname = strdup(pathname);
1705 		if (file->pathname)
1706 			return 0;
1707 	}
1708 
1709 	return -1;
1710 }
1711 
thread__read_fd_path(struct thread * thread,int fd)1712 static int thread__read_fd_path(struct thread *thread, int fd)
1713 {
1714 	char linkname[PATH_MAX], pathname[PATH_MAX];
1715 	struct stat st;
1716 	int ret;
1717 
1718 	if (thread__pid(thread) == thread__tid(thread)) {
1719 		scnprintf(linkname, sizeof(linkname),
1720 			  "/proc/%d/fd/%d", thread__pid(thread), fd);
1721 	} else {
1722 		scnprintf(linkname, sizeof(linkname),
1723 			  "/proc/%d/task/%d/fd/%d",
1724 			  thread__pid(thread), thread__tid(thread), fd);
1725 	}
1726 
1727 	if (lstat(linkname, &st) < 0 || st.st_size + 1 > (off_t)sizeof(pathname))
1728 		return -1;
1729 
1730 	ret = readlink(linkname, pathname, sizeof(pathname));
1731 
1732 	if (ret < 0 || ret > st.st_size)
1733 		return -1;
1734 
1735 	pathname[ret] = '\0';
1736 	return trace__set_fd_pathname(thread, fd, pathname);
1737 }
1738 
thread__fd_path(struct thread * thread,int fd,struct trace * trace)1739 static const char *thread__fd_path(struct thread *thread, int fd,
1740 				   struct trace *trace)
1741 {
1742 	struct thread_trace *ttrace = thread__priv(thread);
1743 
1744 	if (ttrace == NULL || trace->fd_path_disabled)
1745 		return NULL;
1746 
1747 	if (fd < 0)
1748 		return NULL;
1749 
1750 	if ((fd > ttrace->files.max || ttrace->files.table[fd].pathname == NULL)) {
1751 		if (!trace->live)
1752 			return NULL;
1753 		++trace->stats.proc_getname;
1754 		if (thread__read_fd_path(thread, fd))
1755 			return NULL;
1756 	}
1757 
1758 	return ttrace->files.table[fd].pathname;
1759 }
1760 
syscall_arg__scnprintf_fd(char * bf,size_t size,struct syscall_arg * arg)1761 size_t syscall_arg__scnprintf_fd(char *bf, size_t size, struct syscall_arg *arg)
1762 {
1763 	int fd = arg->val;
1764 	size_t printed = scnprintf(bf, size, "%d", fd);
1765 	const char *path = thread__fd_path(arg->thread, fd, arg->trace);
1766 
1767 	if (path)
1768 		printed += scnprintf(bf + printed, size - printed, "<%s>", path);
1769 
1770 	return printed;
1771 }
1772 
pid__scnprintf_fd(struct trace * trace,pid_t pid,int fd,char * bf,size_t size)1773 size_t pid__scnprintf_fd(struct trace *trace, pid_t pid, int fd, char *bf, size_t size)
1774 {
1775         size_t printed = scnprintf(bf, size, "%d", fd);
1776 	struct thread *thread = machine__find_thread(trace->host, pid, pid);
1777 
1778 	if (thread) {
1779 		const char *path = thread__fd_path(thread, fd, trace);
1780 
1781 		if (path)
1782 			printed += scnprintf(bf + printed, size - printed, "<%s>", path);
1783 
1784 		thread__put(thread);
1785 	}
1786 
1787         return printed;
1788 }
1789 
syscall_arg__scnprintf_close_fd(char * bf,size_t size,struct syscall_arg * arg)1790 static size_t syscall_arg__scnprintf_close_fd(char *bf, size_t size,
1791 					      struct syscall_arg *arg)
1792 {
1793 	int fd = arg->val;
1794 	size_t printed = syscall_arg__scnprintf_fd(bf, size, arg);
1795 	struct thread_trace *ttrace = thread__priv(arg->thread);
1796 
1797 	if (ttrace && fd >= 0 && fd <= ttrace->files.max)
1798 		zfree(&ttrace->files.table[fd].pathname);
1799 
1800 	return printed;
1801 }
1802 
thread__set_filename_pos(struct thread * thread,const char * bf,unsigned long ptr)1803 static void thread__set_filename_pos(struct thread *thread, const char *bf,
1804 				     unsigned long ptr)
1805 {
1806 	struct thread_trace *ttrace = thread__priv(thread);
1807 
1808 	ttrace->filename.ptr = ptr;
1809 	ttrace->filename.entry_str_pos = bf - ttrace->entry_str;
1810 }
1811 
syscall_arg__scnprintf_augmented_string(struct syscall_arg * arg,char * bf,size_t size)1812 static size_t syscall_arg__scnprintf_augmented_string(struct syscall_arg *arg, char *bf, size_t size)
1813 {
1814 	struct augmented_arg *augmented_arg = arg->augmented.args;
1815 	size_t printed = scnprintf(bf, size, "\"%.*s\"", augmented_arg->size, augmented_arg->value);
1816 	/*
1817 	 * So that the next arg with a payload can consume its augmented arg, i.e. for rename* syscalls
1818 	 * we would have two strings, each prefixed by its size.
1819 	 */
1820 	int consumed = sizeof(*augmented_arg) + augmented_arg->size;
1821 
1822 	arg->augmented.args = ((void *)arg->augmented.args) + consumed;
1823 	arg->augmented.size -= consumed;
1824 
1825 	return printed;
1826 }
1827 
syscall_arg__scnprintf_filename(char * bf,size_t size,struct syscall_arg * arg)1828 static size_t syscall_arg__scnprintf_filename(char *bf, size_t size,
1829 					      struct syscall_arg *arg)
1830 {
1831 	unsigned long ptr = arg->val;
1832 
1833 	if (arg->augmented.args)
1834 		return syscall_arg__scnprintf_augmented_string(arg, bf, size);
1835 
1836 	if (!arg->trace->vfs_getname)
1837 		return scnprintf(bf, size, "%#x", ptr);
1838 
1839 	thread__set_filename_pos(arg->thread, bf, ptr);
1840 	return 0;
1841 }
1842 
1843 #define MAX_CONTROL_CHAR 31
1844 #define MAX_ASCII 127
1845 
syscall_arg__scnprintf_buf(char * bf,size_t size,struct syscall_arg * arg)1846 static size_t syscall_arg__scnprintf_buf(char *bf, size_t size, struct syscall_arg *arg)
1847 {
1848 	struct augmented_arg *augmented_arg = arg->augmented.args;
1849 	unsigned char *orig = (unsigned char *)augmented_arg->value;
1850 	size_t printed = 0;
1851 	int consumed;
1852 
1853 	if (augmented_arg == NULL)
1854 		return 0;
1855 
1856 	for (int j = 0; j < augmented_arg->size; ++j) {
1857 		bool control_char = orig[j] <= MAX_CONTROL_CHAR || orig[j] >= MAX_ASCII;
1858 		/* print control characters (0~31 and 127), and non-ascii characters in \(digits) */
1859 		printed += scnprintf(bf + printed, size - printed, control_char ? "\\%d" : "%c", (int)orig[j]);
1860 	}
1861 
1862 	consumed = sizeof(*augmented_arg) + augmented_arg->size;
1863 	arg->augmented.args = ((void *)arg->augmented.args) + consumed;
1864 	arg->augmented.size -= consumed;
1865 
1866 	return printed;
1867 }
1868 
trace__filter_duration(struct trace * trace,double t)1869 static bool trace__filter_duration(struct trace *trace, double t)
1870 {
1871 	return t < (trace->duration_filter * NSEC_PER_MSEC);
1872 }
1873 
__trace__fprintf_tstamp(struct trace * trace,u64 tstamp,FILE * fp)1874 static size_t __trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp)
1875 {
1876 	double ts = (double)(tstamp - trace->base_time) / NSEC_PER_MSEC;
1877 
1878 	return fprintf(fp, "%10.3f ", ts);
1879 }
1880 
1881 /*
1882  * We're handling tstamp=0 as an undefined tstamp, i.e. like when we are
1883  * using ttrace->entry_time for a thread that receives a sys_exit without
1884  * first having received a sys_enter ("poll" issued before tracing session
1885  * starts, lost sys_enter exit due to ring buffer overflow).
1886  */
trace__fprintf_tstamp(struct trace * trace,u64 tstamp,FILE * fp)1887 static size_t trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp)
1888 {
1889 	if (tstamp > 0)
1890 		return __trace__fprintf_tstamp(trace, tstamp, fp);
1891 
1892 	return fprintf(fp, "         ? ");
1893 }
1894 
1895 static pid_t workload_pid = -1;
1896 static volatile sig_atomic_t done = false;
1897 static volatile sig_atomic_t interrupted = false;
1898 
sighandler_interrupt(int sig __maybe_unused)1899 static void sighandler_interrupt(int sig __maybe_unused)
1900 {
1901 	done = interrupted = true;
1902 }
1903 
sighandler_chld(int sig __maybe_unused,siginfo_t * info,void * context __maybe_unused)1904 static void sighandler_chld(int sig __maybe_unused, siginfo_t *info,
1905 			    void *context __maybe_unused)
1906 {
1907 	if (info->si_pid == workload_pid)
1908 		done = true;
1909 }
1910 
trace__fprintf_comm_tid(struct trace * trace,struct thread * thread,FILE * fp)1911 static size_t trace__fprintf_comm_tid(struct trace *trace, struct thread *thread, FILE *fp)
1912 {
1913 	size_t printed = 0;
1914 
1915 	if (trace->multiple_threads) {
1916 		if (trace->show_comm)
1917 			printed += fprintf(fp, "%.14s/", thread__comm_str(thread));
1918 		printed += fprintf(fp, "%d ", thread__tid(thread));
1919 	}
1920 
1921 	return printed;
1922 }
1923 
trace__fprintf_entry_head(struct trace * trace,struct thread * thread,u64 duration,bool duration_calculated,u64 tstamp,FILE * fp)1924 static size_t trace__fprintf_entry_head(struct trace *trace, struct thread *thread,
1925 					u64 duration, bool duration_calculated, u64 tstamp, FILE *fp)
1926 {
1927 	size_t printed = 0;
1928 
1929 	if (trace->show_tstamp)
1930 		printed = trace__fprintf_tstamp(trace, tstamp, fp);
1931 	if (trace->show_duration)
1932 		printed += fprintf_duration(duration, duration_calculated, fp);
1933 	return printed + trace__fprintf_comm_tid(trace, thread, fp);
1934 }
1935 
trace__process_event(struct trace * trace,struct machine * machine,union perf_event * event,struct perf_sample * sample)1936 static int trace__process_event(struct trace *trace, struct machine *machine,
1937 				union perf_event *event, struct perf_sample *sample)
1938 {
1939 	int ret = 0;
1940 
1941 	switch (event->header.type) {
1942 	case PERF_RECORD_LOST:
1943 		color_fprintf(trace->output, PERF_COLOR_RED,
1944 			      "LOST %" PRIu64 " events!\n", (u64)event->lost.lost);
1945 		ret = machine__process_lost_event(machine, event, sample);
1946 		break;
1947 	default:
1948 		ret = machine__process_event(machine, event, sample);
1949 		break;
1950 	}
1951 
1952 	return ret;
1953 }
1954 
trace__tool_process(const struct perf_tool * tool,union perf_event * event,struct perf_sample * sample,struct machine * machine)1955 static int trace__tool_process(const struct perf_tool *tool,
1956 			       union perf_event *event,
1957 			       struct perf_sample *sample,
1958 			       struct machine *machine)
1959 {
1960 	struct trace *trace = container_of(tool, struct trace, tool);
1961 	return trace__process_event(trace, machine, event, sample);
1962 }
1963 
trace__machine__resolve_kernel_addr(void * vmachine,unsigned long long * addrp,char ** modp)1964 static char *trace__machine__resolve_kernel_addr(void *vmachine, unsigned long long *addrp, char **modp)
1965 {
1966 	struct machine *machine = vmachine;
1967 
1968 	if (machine->kptr_restrict_warned)
1969 		return NULL;
1970 
1971 	if (symbol_conf.kptr_restrict) {
1972 		pr_warning("Kernel address maps (/proc/{kallsyms,modules}) are restricted.\n\n"
1973 			   "Check /proc/sys/kernel/kptr_restrict and /proc/sys/kernel/perf_event_paranoid.\n\n"
1974 			   "Kernel samples will not be resolved.\n");
1975 		machine->kptr_restrict_warned = true;
1976 		return NULL;
1977 	}
1978 
1979 	return machine__resolve_kernel_addr(vmachine, addrp, modp);
1980 }
1981 
trace__symbols_init(struct trace * trace,int argc,const char ** argv,struct evlist * evlist)1982 static int trace__symbols_init(struct trace *trace, int argc, const char **argv,
1983 			       struct evlist *evlist)
1984 {
1985 	int err = symbol__init(NULL);
1986 
1987 	if (err)
1988 		return err;
1989 
1990 	perf_env__init(&trace->host_env);
1991 	err = perf_env__set_cmdline(&trace->host_env, argc, argv);
1992 	if (err)
1993 		goto out;
1994 
1995 	trace->host = machine__new_host(&trace->host_env);
1996 	if (trace->host == NULL) {
1997 		err = -ENOMEM;
1998 		goto out;
1999 	}
2000 	thread__set_priv_destructor(thread_trace__delete);
2001 
2002 	err = trace_event__register_resolver(trace->host, trace__machine__resolve_kernel_addr);
2003 	if (err < 0)
2004 		goto out;
2005 
2006 	err = __machine__synthesize_threads(trace->host, &trace->tool, &trace->opts.target,
2007 					    evlist->core.threads, trace__tool_process,
2008 					    true, false, 1);
2009 out:
2010 	if (err) {
2011 		perf_env__exit(&trace->host_env);
2012 		symbol__exit();
2013 	}
2014 	return err;
2015 }
2016 
trace__symbols__exit(struct trace * trace)2017 static void trace__symbols__exit(struct trace *trace)
2018 {
2019 	machine__exit(trace->host);
2020 	trace->host = NULL;
2021 
2022 	perf_env__exit(&trace->host_env);
2023 	symbol__exit();
2024 }
2025 
syscall__alloc_arg_fmts(struct syscall * sc,int nr_args)2026 static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
2027 {
2028 	int idx;
2029 
2030 	if (nr_args == RAW_SYSCALL_ARGS_NUM && sc->fmt && sc->fmt->nr_args != 0)
2031 		nr_args = sc->fmt->nr_args;
2032 
2033 	sc->arg_fmt = calloc(nr_args, sizeof(*sc->arg_fmt));
2034 	if (sc->arg_fmt == NULL)
2035 		return -1;
2036 
2037 	for (idx = 0; idx < nr_args; ++idx) {
2038 		if (sc->fmt)
2039 			sc->arg_fmt[idx] = sc->fmt->arg[idx];
2040 	}
2041 
2042 	sc->nr_args = nr_args;
2043 	return 0;
2044 }
2045 
2046 static const struct syscall_arg_fmt syscall_arg_fmts__by_name[] = {
2047 	{ .name = "msr",	.scnprintf = SCA_X86_MSR,	  .strtoul = STUL_X86_MSR,	   },
2048 	{ .name = "vector",	.scnprintf = SCA_X86_IRQ_VECTORS, .strtoul = STUL_X86_IRQ_VECTORS, },
2049 };
2050 
syscall_arg_fmt__cmp(const void * name,const void * fmtp)2051 static int syscall_arg_fmt__cmp(const void *name, const void *fmtp)
2052 {
2053        const struct syscall_arg_fmt *fmt = fmtp;
2054        return strcmp(name, fmt->name);
2055 }
2056 
2057 static const struct syscall_arg_fmt *
__syscall_arg_fmt__find_by_name(const struct syscall_arg_fmt * fmts,const int nmemb,const char * name)2058 __syscall_arg_fmt__find_by_name(const struct syscall_arg_fmt *fmts, const int nmemb,
2059 				const char *name)
2060 {
2061        return bsearch(name, fmts, nmemb, sizeof(struct syscall_arg_fmt), syscall_arg_fmt__cmp);
2062 }
2063 
syscall_arg_fmt__find_by_name(const char * name)2064 static const struct syscall_arg_fmt *syscall_arg_fmt__find_by_name(const char *name)
2065 {
2066        const int nmemb = ARRAY_SIZE(syscall_arg_fmts__by_name);
2067        return __syscall_arg_fmt__find_by_name(syscall_arg_fmts__by_name, nmemb, name);
2068 }
2069 
2070 static struct tep_format_field *
syscall_arg_fmt__init_array(struct syscall_arg_fmt * arg,struct tep_format_field * field,bool * use_btf)2071 syscall_arg_fmt__init_array(struct syscall_arg_fmt *arg, struct tep_format_field *field,
2072 			    bool *use_btf)
2073 {
2074 	struct tep_format_field *last_field = NULL;
2075 	int len;
2076 
2077 	for (; field; field = field->next, ++arg) {
2078 		last_field = field;
2079 
2080 		if (arg->scnprintf)
2081 			continue;
2082 
2083 		len = strlen(field->name);
2084 
2085 		// As far as heuristics (or intention) goes this seems to hold true, and makes sense!
2086 		if ((field->flags & TEP_FIELD_IS_POINTER) && strstarts(field->type, "const "))
2087 			arg->from_user = true;
2088 
2089 		if (strcmp(field->type, "const char *") == 0 &&
2090 		    ((len >= 4 && strcmp(field->name + len - 4, "name") == 0) ||
2091 		     strstr(field->name, "path") != NULL)) {
2092 			arg->scnprintf = SCA_FILENAME;
2093 		} else if ((field->flags & TEP_FIELD_IS_POINTER) || strstr(field->name, "addr"))
2094 			arg->scnprintf = SCA_PTR;
2095 		else if (strcmp(field->type, "pid_t") == 0)
2096 			arg->scnprintf = SCA_PID;
2097 		else if (strcmp(field->type, "umode_t") == 0)
2098 			arg->scnprintf = SCA_MODE_T;
2099 		else if ((field->flags & TEP_FIELD_IS_ARRAY) && strstr(field->type, "char")) {
2100 			arg->scnprintf = SCA_CHAR_ARRAY;
2101 			arg->nr_entries = field->arraylen;
2102 		} else if ((strcmp(field->type, "int") == 0 ||
2103 			  strcmp(field->type, "unsigned int") == 0 ||
2104 			  strcmp(field->type, "long") == 0) &&
2105 			 len >= 2 && strcmp(field->name + len - 2, "fd") == 0) {
2106 			/*
2107 			 * /sys/kernel/tracing/events/syscalls/sys_enter*
2108 			 * grep -E 'field:.*fd;' .../format|sed -r 's/.*field:([a-z ]+) [a-z_]*fd.+/\1/g'|sort|uniq -c
2109 			 * 65 int
2110 			 * 23 unsigned int
2111 			 * 7 unsigned long
2112 			 */
2113 			arg->scnprintf = SCA_FD;
2114 		} else if (strstr(field->type, "enum") && use_btf != NULL) {
2115 			*use_btf = true;
2116 			arg->strtoul = STUL_BTF_TYPE;
2117 		} else {
2118 			const struct syscall_arg_fmt *fmt =
2119 				syscall_arg_fmt__find_by_name(field->name);
2120 
2121 			if (fmt) {
2122 				arg->scnprintf = fmt->scnprintf;
2123 				arg->strtoul   = fmt->strtoul;
2124 			}
2125 		}
2126 	}
2127 
2128 	return last_field;
2129 }
2130 
syscall__set_arg_fmts(struct syscall * sc)2131 static int syscall__set_arg_fmts(struct syscall *sc)
2132 {
2133 	struct tep_format_field *last_field = syscall_arg_fmt__init_array(sc->arg_fmt, sc->args,
2134 									  &sc->use_btf);
2135 
2136 	if (last_field)
2137 		sc->args_size = last_field->offset + last_field->size;
2138 
2139 	return 0;
2140 }
2141 
syscall__read_info(struct syscall * sc,struct trace * trace)2142 static int syscall__read_info(struct syscall *sc, struct trace *trace)
2143 {
2144 	char tp_name[128];
2145 	const char *name;
2146 	int err;
2147 
2148 	if (sc->nonexistent)
2149 		return -EEXIST;
2150 
2151 	if (sc->name) {
2152 		/* Info already read. */
2153 		return 0;
2154 	}
2155 
2156 	name = syscalltbl__name(sc->e_machine, sc->id);
2157 	if (name == NULL) {
2158 		sc->nonexistent = true;
2159 		return -EEXIST;
2160 	}
2161 
2162 	sc->name = name;
2163 	sc->fmt  = syscall_fmt__find(sc->name);
2164 
2165 	snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->name);
2166 	sc->tp_format = trace_event__tp_format("syscalls", tp_name);
2167 
2168 	if (IS_ERR(sc->tp_format) && sc->fmt && sc->fmt->alias) {
2169 		snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->fmt->alias);
2170 		sc->tp_format = trace_event__tp_format("syscalls", tp_name);
2171 	}
2172 
2173 	/*
2174 	 * Fails to read trace point format via sysfs node, so the trace point
2175 	 * doesn't exist.  Set the 'nonexistent' flag as true.
2176 	 */
2177 	if (IS_ERR(sc->tp_format)) {
2178 		sc->nonexistent = true;
2179 		err = PTR_ERR(sc->tp_format);
2180 		sc->tp_format = NULL;
2181 		return err;
2182 	}
2183 
2184 	/*
2185 	 * The tracepoint format contains __syscall_nr field, so it's one more
2186 	 * than the actual number of syscall arguments.
2187 	 */
2188 	if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1))
2189 		return -ENOMEM;
2190 
2191 	sc->args = sc->tp_format->format.fields;
2192 	/*
2193 	 * We need to check and discard the first variable '__syscall_nr'
2194 	 * or 'nr' that mean the syscall number. It is needless here.
2195 	 * So drop '__syscall_nr' or 'nr' field but does not exist on older kernels.
2196 	 */
2197 	if (sc->args && (!strcmp(sc->args->name, "__syscall_nr") || !strcmp(sc->args->name, "nr"))) {
2198 		sc->args = sc->args->next;
2199 		--sc->nr_args;
2200 	}
2201 
2202 	sc->is_exit = !strcmp(name, "exit_group") || !strcmp(name, "exit");
2203 	sc->is_open = !strcmp(name, "open") || !strcmp(name, "openat");
2204 
2205 	err = syscall__set_arg_fmts(sc);
2206 
2207 	/* after calling syscall__set_arg_fmts() we'll know whether use_btf is true */
2208 	if (sc->use_btf)
2209 		trace__load_vmlinux_btf(trace);
2210 
2211 	return err;
2212 }
2213 
evsel__init_tp_arg_scnprintf(struct evsel * evsel,bool * use_btf)2214 static int evsel__init_tp_arg_scnprintf(struct evsel *evsel, bool *use_btf)
2215 {
2216 	struct syscall_arg_fmt *fmt = evsel__syscall_arg_fmt(evsel);
2217 
2218 	if (fmt != NULL) {
2219 		const struct tep_event *tp_format = evsel__tp_format(evsel);
2220 
2221 		if (tp_format) {
2222 			syscall_arg_fmt__init_array(fmt, tp_format->format.fields, use_btf);
2223 			return 0;
2224 		}
2225 	}
2226 
2227 	return -ENOMEM;
2228 }
2229 
intcmp(const void * a,const void * b)2230 static int intcmp(const void *a, const void *b)
2231 {
2232 	const int *one = a, *another = b;
2233 
2234 	return *one - *another;
2235 }
2236 
trace__validate_ev_qualifier(struct trace * trace)2237 static int trace__validate_ev_qualifier(struct trace *trace)
2238 {
2239 	int err = 0;
2240 	bool printed_invalid_prefix = false;
2241 	struct str_node *pos;
2242 	size_t nr_used = 0, nr_allocated = strlist__nr_entries(trace->ev_qualifier);
2243 
2244 	trace->ev_qualifier_ids.entries = malloc(nr_allocated *
2245 						 sizeof(trace->ev_qualifier_ids.entries[0]));
2246 
2247 	if (trace->ev_qualifier_ids.entries == NULL) {
2248 		fputs("Error:\tNot enough memory for allocating events qualifier ids\n",
2249 		       trace->output);
2250 		err = -EINVAL;
2251 		goto out;
2252 	}
2253 
2254 	strlist__for_each_entry(pos, trace->ev_qualifier) {
2255 		const char *sc = pos->s;
2256 		/*
2257 		 * TODO: Assume more than the validation/warnings are all for
2258 		 * the same binary type as perf.
2259 		 */
2260 		int id = syscalltbl__id(EM_HOST, sc), match_next = -1;
2261 
2262 		if (id < 0) {
2263 			id = syscalltbl__strglobmatch_first(EM_HOST, sc, &match_next);
2264 			if (id >= 0)
2265 				goto matches;
2266 
2267 			if (!printed_invalid_prefix) {
2268 				pr_debug("Skipping unknown syscalls: ");
2269 				printed_invalid_prefix = true;
2270 			} else {
2271 				pr_debug(", ");
2272 			}
2273 
2274 			pr_debug("%s", sc);
2275 			continue;
2276 		}
2277 matches:
2278 		trace->ev_qualifier_ids.entries[nr_used++] = id;
2279 		if (match_next == -1)
2280 			continue;
2281 
2282 		while (1) {
2283 			id = syscalltbl__strglobmatch_next(EM_HOST, sc, &match_next);
2284 			if (id < 0)
2285 				break;
2286 			if (nr_allocated == nr_used) {
2287 				void *entries;
2288 
2289 				nr_allocated += 8;
2290 				entries = realloc(trace->ev_qualifier_ids.entries,
2291 						  nr_allocated * sizeof(trace->ev_qualifier_ids.entries[0]));
2292 				if (entries == NULL) {
2293 					err = -ENOMEM;
2294 					fputs("\nError:\t Not enough memory for parsing\n", trace->output);
2295 					goto out_free;
2296 				}
2297 				trace->ev_qualifier_ids.entries = entries;
2298 			}
2299 			trace->ev_qualifier_ids.entries[nr_used++] = id;
2300 		}
2301 	}
2302 
2303 	trace->ev_qualifier_ids.nr = nr_used;
2304 	qsort(trace->ev_qualifier_ids.entries, nr_used, sizeof(int), intcmp);
2305 out:
2306 	if (printed_invalid_prefix)
2307 		pr_debug("\n");
2308 	return err;
2309 out_free:
2310 	zfree(&trace->ev_qualifier_ids.entries);
2311 	trace->ev_qualifier_ids.nr = 0;
2312 	goto out;
2313 }
2314 
trace__syscall_enabled(struct trace * trace,int id)2315 static __maybe_unused bool trace__syscall_enabled(struct trace *trace, int id)
2316 {
2317 	bool in_ev_qualifier;
2318 
2319 	if (trace->ev_qualifier_ids.nr == 0)
2320 		return true;
2321 
2322 	in_ev_qualifier = bsearch(&id, trace->ev_qualifier_ids.entries,
2323 				  trace->ev_qualifier_ids.nr, sizeof(int), intcmp) != NULL;
2324 
2325 	if (in_ev_qualifier)
2326 	       return !trace->not_ev_qualifier;
2327 
2328 	return trace->not_ev_qualifier;
2329 }
2330 
2331 /*
2332  * args is to be interpreted as a series of longs but we need to handle
2333  * 8-byte unaligned accesses. args points to raw_data within the event
2334  * and raw_data is guaranteed to be 8-byte unaligned because it is
2335  * preceded by raw_size which is a u32. So we need to copy args to a temp
2336  * variable to read it. Most notably this avoids extended load instructions
2337  * on unaligned addresses
2338  */
syscall_arg__val(struct syscall_arg * arg,u8 idx)2339 unsigned long syscall_arg__val(struct syscall_arg *arg, u8 idx)
2340 {
2341 	unsigned long val;
2342 	unsigned char *p = arg->args + sizeof(unsigned long) * idx;
2343 
2344 	memcpy(&val, p, sizeof(val));
2345 	return val;
2346 }
2347 
syscall__scnprintf_name(struct syscall * sc,char * bf,size_t size,struct syscall_arg * arg)2348 static size_t syscall__scnprintf_name(struct syscall *sc, char *bf, size_t size,
2349 				      struct syscall_arg *arg)
2350 {
2351 	if (sc->arg_fmt && sc->arg_fmt[arg->idx].name)
2352 		return scnprintf(bf, size, "%s: ", sc->arg_fmt[arg->idx].name);
2353 
2354 	return scnprintf(bf, size, "arg%d: ", arg->idx);
2355 }
2356 
2357 /*
2358  * Check if the value is in fact zero, i.e. mask whatever needs masking, such
2359  * as mount 'flags' argument that needs ignoring some magic flag, see comment
2360  * in tools/perf/trace/beauty/mount_flags.c
2361  */
syscall_arg_fmt__mask_val(struct syscall_arg_fmt * fmt,struct syscall_arg * arg,unsigned long val)2362 static unsigned long syscall_arg_fmt__mask_val(struct syscall_arg_fmt *fmt, struct syscall_arg *arg, unsigned long val)
2363 {
2364 	if (fmt && fmt->mask_val)
2365 		return fmt->mask_val(arg, val);
2366 
2367 	return val;
2368 }
2369 
syscall_arg_fmt__scnprintf_val(struct syscall_arg_fmt * fmt,char * bf,size_t size,struct syscall_arg * arg,unsigned long val)2370 static size_t syscall_arg_fmt__scnprintf_val(struct syscall_arg_fmt *fmt, char *bf, size_t size,
2371 					     struct syscall_arg *arg, unsigned long val)
2372 {
2373 	if (fmt && fmt->scnprintf) {
2374 		arg->val = val;
2375 		if (fmt->parm)
2376 			arg->parm = fmt->parm;
2377 		return fmt->scnprintf(bf, size, arg);
2378 	}
2379 	return scnprintf(bf, size, "%ld", val);
2380 }
2381 
syscall__scnprintf_args(struct syscall * sc,char * bf,size_t size,unsigned char * args,void * augmented_args,int augmented_args_size,struct trace * trace,struct thread * thread)2382 static size_t syscall__scnprintf_args(struct syscall *sc, char *bf, size_t size,
2383 				      unsigned char *args, void *augmented_args, int augmented_args_size,
2384 				      struct trace *trace, struct thread *thread)
2385 {
2386 	size_t printed = 0, btf_printed;
2387 	unsigned long val;
2388 	u8 bit = 1;
2389 	struct syscall_arg arg = {
2390 		.args	= args,
2391 		.augmented = {
2392 			.size = augmented_args_size,
2393 			.args = augmented_args,
2394 		},
2395 		.idx	= 0,
2396 		.mask	= 0,
2397 		.trace  = trace,
2398 		.thread = thread,
2399 		.show_string_prefix = trace->show_string_prefix,
2400 	};
2401 	struct thread_trace *ttrace = thread__priv(thread);
2402 	void *default_scnprintf;
2403 
2404 	/*
2405 	 * Things like fcntl will set this in its 'cmd' formatter to pick the
2406 	 * right formatter for the return value (an fd? file flags?), which is
2407 	 * not needed for syscalls that always return a given type, say an fd.
2408 	 */
2409 	ttrace->ret_scnprintf = NULL;
2410 
2411 	if (sc->args != NULL) {
2412 		struct tep_format_field *field;
2413 
2414 		for (field = sc->args; field;
2415 		     field = field->next, ++arg.idx, bit <<= 1) {
2416 			if (arg.mask & bit)
2417 				continue;
2418 
2419 			arg.fmt = &sc->arg_fmt[arg.idx];
2420 			val = syscall_arg__val(&arg, arg.idx);
2421 			/*
2422 			 * Some syscall args need some mask, most don't and
2423 			 * return val untouched.
2424 			 */
2425 			val = syscall_arg_fmt__mask_val(&sc->arg_fmt[arg.idx], &arg, val);
2426 
2427 			/*
2428 			 * Suppress this argument if its value is zero and show_zero
2429 			 * property isn't set.
2430 			 *
2431 			 * If it has a BTF type, then override the zero suppression knob
2432 			 * as the common case is for zero in an enum to have an associated entry.
2433 			 */
2434 			if (val == 0 && !trace->show_zeros &&
2435 			    !(sc->arg_fmt && sc->arg_fmt[arg.idx].show_zero) &&
2436 			    !(sc->arg_fmt && sc->arg_fmt[arg.idx].strtoul == STUL_BTF_TYPE))
2437 				continue;
2438 
2439 			printed += scnprintf(bf + printed, size - printed, "%s", printed ? ", " : "");
2440 
2441 			if (trace->show_arg_names)
2442 				printed += scnprintf(bf + printed, size - printed, "%s: ", field->name);
2443 
2444 			default_scnprintf = sc->arg_fmt[arg.idx].scnprintf;
2445 
2446 			if (trace->force_btf || default_scnprintf == NULL || default_scnprintf == SCA_PTR) {
2447 				btf_printed = trace__btf_scnprintf(trace, &arg, bf + printed,
2448 								   size - printed, val, field->type);
2449 				if (btf_printed) {
2450 					printed += btf_printed;
2451 					continue;
2452 				}
2453 			}
2454 
2455 			printed += syscall_arg_fmt__scnprintf_val(&sc->arg_fmt[arg.idx],
2456 								  bf + printed, size - printed, &arg, val);
2457 		}
2458 	} else if (IS_ERR(sc->tp_format)) {
2459 		/*
2460 		 * If we managed to read the tracepoint /format file, then we
2461 		 * may end up not having any args, like with gettid(), so only
2462 		 * print the raw args when we didn't manage to read it.
2463 		 */
2464 		while (arg.idx < sc->nr_args) {
2465 			if (arg.mask & bit)
2466 				goto next_arg;
2467 			val = syscall_arg__val(&arg, arg.idx);
2468 			if (printed)
2469 				printed += scnprintf(bf + printed, size - printed, ", ");
2470 			printed += syscall__scnprintf_name(sc, bf + printed, size - printed, &arg);
2471 			printed += syscall_arg_fmt__scnprintf_val(&sc->arg_fmt[arg.idx], bf + printed, size - printed, &arg, val);
2472 next_arg:
2473 			++arg.idx;
2474 			bit <<= 1;
2475 		}
2476 	}
2477 
2478 	return printed;
2479 }
2480 
syscall__new(int e_machine,int id)2481 static struct syscall *syscall__new(int e_machine, int id)
2482 {
2483 	struct syscall *sc = zalloc(sizeof(*sc));
2484 
2485 	if (!sc)
2486 		return NULL;
2487 
2488 	sc->e_machine = e_machine;
2489 	sc->id = id;
2490 	return sc;
2491 }
2492 
syscall__delete(struct syscall * sc)2493 static void syscall__delete(struct syscall *sc)
2494 {
2495 	if (!sc)
2496 		return;
2497 
2498 	free(sc->arg_fmt);
2499 	free(sc);
2500 }
2501 
syscall__bsearch_cmp(const void * key,const void * entry)2502 static int syscall__bsearch_cmp(const void *key, const void *entry)
2503 {
2504 	const struct syscall *a = key, *b = *((const struct syscall **)entry);
2505 
2506 	if (a->e_machine != b->e_machine)
2507 		return a->e_machine - b->e_machine;
2508 
2509 	return a->id - b->id;
2510 }
2511 
syscall__cmp(const void * va,const void * vb)2512 static int syscall__cmp(const void *va, const void *vb)
2513 {
2514 	const struct syscall *a = *((const struct syscall **)va);
2515 	const struct syscall *b = *((const struct syscall **)vb);
2516 
2517 	if (a->e_machine != b->e_machine)
2518 		return a->e_machine - b->e_machine;
2519 
2520 	return a->id - b->id;
2521 }
2522 
trace__find_syscall(struct trace * trace,int e_machine,int id)2523 static struct syscall *trace__find_syscall(struct trace *trace, int e_machine, int id)
2524 {
2525 	struct syscall key = {
2526 		.e_machine = e_machine,
2527 		.id = id,
2528 	};
2529 	struct syscall *sc, **tmp;
2530 
2531 	if (trace->syscalls.table) {
2532 		struct syscall **sc_entry = bsearch(&key, trace->syscalls.table,
2533 						    trace->syscalls.table_size,
2534 						    sizeof(trace->syscalls.table[0]),
2535 						    syscall__bsearch_cmp);
2536 
2537 		if (sc_entry)
2538 			return *sc_entry;
2539 	}
2540 
2541 	sc = syscall__new(e_machine, id);
2542 	if (!sc)
2543 		return NULL;
2544 
2545 	tmp = reallocarray(trace->syscalls.table, trace->syscalls.table_size + 1,
2546 			   sizeof(trace->syscalls.table[0]));
2547 	if (!tmp) {
2548 		syscall__delete(sc);
2549 		return NULL;
2550 	}
2551 
2552 	trace->syscalls.table = tmp;
2553 	trace->syscalls.table[trace->syscalls.table_size++] = sc;
2554 	qsort(trace->syscalls.table, trace->syscalls.table_size, sizeof(trace->syscalls.table[0]),
2555 	      syscall__cmp);
2556 	return sc;
2557 }
2558 
2559 typedef int (*tracepoint_handler)(struct trace *trace, struct evsel *evsel,
2560 				  union perf_event *event,
2561 				  struct perf_sample *sample);
2562 
trace__syscall_info(struct trace * trace,struct evsel * evsel,int e_machine,int id)2563 static struct syscall *trace__syscall_info(struct trace *trace, struct evsel *evsel,
2564 					   int e_machine, int id)
2565 {
2566 	struct syscall *sc;
2567 	int err = 0;
2568 
2569 	if (id < 0) {
2570 
2571 		/*
2572 		 * XXX: Noticed on x86_64, reproduced as far back as 3.0.36, haven't tried
2573 		 * before that, leaving at a higher verbosity level till that is
2574 		 * explained. Reproduced with plain ftrace with:
2575 		 *
2576 		 * echo 1 > /t/events/raw_syscalls/sys_exit/enable
2577 		 * grep "NR -1 " /t/trace_pipe
2578 		 *
2579 		 * After generating some load on the machine.
2580  		 */
2581 		if (verbose > 1) {
2582 			static u64 n;
2583 			fprintf(trace->output, "Invalid syscall %d id, skipping (%s, %" PRIu64 ") ...\n",
2584 				id, evsel__name(evsel), ++n);
2585 		}
2586 		return NULL;
2587 	}
2588 
2589 	err = -EINVAL;
2590 
2591 	sc = trace__find_syscall(trace, e_machine, id);
2592 	if (sc)
2593 		err = syscall__read_info(sc, trace);
2594 
2595 	if (err && verbose > 0) {
2596 		char sbuf[STRERR_BUFSIZE];
2597 
2598 		fprintf(trace->output, "Problems reading syscall %d: %d (%s)", id, -err,
2599 			str_error_r(-err, sbuf, sizeof(sbuf)));
2600 		if (sc && sc->name)
2601 			fprintf(trace->output, "(%s)", sc->name);
2602 		fputs(" information\n", trace->output);
2603 	}
2604 	return err ? NULL : sc;
2605 }
2606 
2607 struct syscall_stats {
2608 	struct stats stats;
2609 	u64	     nr_failures;
2610 	int	     max_errno;
2611 	u32	     *errnos;
2612 };
2613 
thread__update_stats(struct thread * thread,struct thread_trace * ttrace,int id,struct perf_sample * sample,long err,struct trace * trace)2614 static void thread__update_stats(struct thread *thread, struct thread_trace *ttrace,
2615 				 int id, struct perf_sample *sample, long err,
2616 				 struct trace *trace)
2617 {
2618 	struct hashmap *syscall_stats = ttrace->syscall_stats;
2619 	struct syscall_stats *stats = NULL;
2620 	u64 duration = 0;
2621 
2622 	if (trace->summary_bpf)
2623 		return;
2624 
2625 	if (trace->summary_mode == SUMMARY__BY_TOTAL)
2626 		syscall_stats = trace->syscall_stats;
2627 
2628 	if (!hashmap__find(syscall_stats, id, &stats)) {
2629 		stats = zalloc(sizeof(*stats));
2630 		if (stats == NULL)
2631 			return;
2632 
2633 		init_stats(&stats->stats);
2634 		if (hashmap__add(syscall_stats, id, stats) < 0) {
2635 			free(stats);
2636 			return;
2637 		}
2638 	}
2639 
2640 	if (ttrace->entry_time && sample->time > ttrace->entry_time)
2641 		duration = sample->time - ttrace->entry_time;
2642 
2643 	update_stats(&stats->stats, duration);
2644 
2645 	if (err < 0) {
2646 		++stats->nr_failures;
2647 
2648 		if (!trace->errno_summary)
2649 			return;
2650 
2651 		err = -err;
2652 		if (err > stats->max_errno) {
2653 			u32 *new_errnos = realloc(stats->errnos, err * sizeof(u32));
2654 
2655 			if (new_errnos) {
2656 				memset(new_errnos + stats->max_errno, 0, (err - stats->max_errno) * sizeof(u32));
2657 			} else {
2658 				pr_debug("Not enough memory for errno stats for thread \"%s\"(%d/%d), results will be incomplete\n",
2659 					 thread__comm_str(thread), thread__pid(thread),
2660 					 thread__tid(thread));
2661 				return;
2662 			}
2663 
2664 			stats->errnos = new_errnos;
2665 			stats->max_errno = err;
2666 		}
2667 
2668 		++stats->errnos[err - 1];
2669 	}
2670 }
2671 
trace__printf_interrupted_entry(struct trace * trace)2672 static int trace__printf_interrupted_entry(struct trace *trace)
2673 {
2674 	struct thread_trace *ttrace;
2675 	size_t printed;
2676 	int len;
2677 
2678 	if (trace->failure_only || trace->current == NULL)
2679 		return 0;
2680 
2681 	ttrace = thread__priv(trace->current);
2682 
2683 	if (!ttrace->entry_pending)
2684 		return 0;
2685 
2686 	printed  = trace__fprintf_entry_head(trace, trace->current, 0, false, ttrace->entry_time, trace->output);
2687 	printed += len = fprintf(trace->output, "%s)", ttrace->entry_str);
2688 
2689 	if (len < trace->args_alignment - 4)
2690 		printed += fprintf(trace->output, "%-*s", trace->args_alignment - 4 - len, " ");
2691 
2692 	printed += fprintf(trace->output, " ...\n");
2693 
2694 	ttrace->entry_pending = false;
2695 	++trace->nr_events_printed;
2696 
2697 	return printed;
2698 }
2699 
trace__fprintf_sample(struct trace * trace,struct evsel * evsel,struct perf_sample * sample,struct thread * thread)2700 static int trace__fprintf_sample(struct trace *trace, struct evsel *evsel,
2701 				 struct perf_sample *sample, struct thread *thread)
2702 {
2703 	int printed = 0;
2704 
2705 	if (trace->print_sample) {
2706 		double ts = (double)sample->time / NSEC_PER_MSEC;
2707 
2708 		printed += fprintf(trace->output, "%22s %10.3f %s %d/%d [%d]\n",
2709 				   evsel__name(evsel), ts,
2710 				   thread__comm_str(thread),
2711 				   sample->pid, sample->tid, sample->cpu);
2712 	}
2713 
2714 	return printed;
2715 }
2716 
syscall__augmented_args(struct syscall * sc,struct perf_sample * sample,int * augmented_args_size,int raw_augmented_args_size)2717 static void *syscall__augmented_args(struct syscall *sc, struct perf_sample *sample, int *augmented_args_size, int raw_augmented_args_size)
2718 {
2719 	/*
2720 	 * For now with BPF raw_augmented we hook into raw_syscalls:sys_enter
2721 	 * and there we get all 6 syscall args plus the tracepoint common fields
2722 	 * that gets calculated at the start and the syscall_nr (another long).
2723 	 * So we check if that is the case and if so don't look after the
2724 	 * sc->args_size but always after the full raw_syscalls:sys_enter payload,
2725 	 * which is fixed.
2726 	 *
2727 	 * We'll revisit this later to pass s->args_size to the BPF augmenter
2728 	 * (now tools/perf/examples/bpf/augmented_raw_syscalls.c, so that it
2729 	 * copies only what we need for each syscall, like what happens when we
2730 	 * use syscalls:sys_enter_NAME, so that we reduce the kernel/userspace
2731 	 * traffic to just what is needed for each syscall.
2732 	 */
2733 	int args_size = raw_augmented_args_size ?: sc->args_size;
2734 
2735 	*augmented_args_size = sample->raw_size - args_size;
2736 	if (*augmented_args_size > 0) {
2737 		static uintptr_t argbuf[1024]; /* assuming single-threaded */
2738 
2739 		if ((size_t)(*augmented_args_size) > sizeof(argbuf))
2740 			return NULL;
2741 
2742 		/*
2743 		 * The perf ring-buffer is 8-byte aligned but sample->raw_data
2744 		 * is not because it's preceded by u32 size.  Later, beautifier
2745 		 * will use the augmented args with stricter alignments like in
2746 		 * some struct.  To make sure it's aligned, let's copy the args
2747 		 * into a static buffer as it's single-threaded for now.
2748 		 */
2749 		memcpy(argbuf, sample->raw_data + args_size, *augmented_args_size);
2750 
2751 		return argbuf;
2752 	}
2753 	return NULL;
2754 }
2755 
trace__sys_enter(struct trace * trace,struct evsel * evsel,union perf_event * event __maybe_unused,struct perf_sample * sample)2756 static int trace__sys_enter(struct trace *trace, struct evsel *evsel,
2757 			    union perf_event *event __maybe_unused,
2758 			    struct perf_sample *sample)
2759 {
2760 	char *msg;
2761 	void *args;
2762 	int printed = 0;
2763 	struct thread *thread;
2764 	int id = perf_evsel__sc_tp_uint(evsel, id, sample), err = -1;
2765 	int augmented_args_size = 0, e_machine;
2766 	void *augmented_args = NULL;
2767 	struct syscall *sc;
2768 	struct thread_trace *ttrace;
2769 
2770 	thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);
2771 	e_machine = thread__e_machine(thread, trace->host);
2772 	sc = trace__syscall_info(trace, evsel, e_machine, id);
2773 	if (sc == NULL)
2774 		goto out_put;
2775 	ttrace = thread__trace(thread, trace);
2776 	if (ttrace == NULL)
2777 		goto out_put;
2778 
2779 	trace__fprintf_sample(trace, evsel, sample, thread);
2780 
2781 	args = perf_evsel__sc_tp_ptr(evsel, args, sample);
2782 
2783 	if (ttrace->entry_str == NULL) {
2784 		ttrace->entry_str = malloc(trace__entry_str_size);
2785 		if (!ttrace->entry_str)
2786 			goto out_put;
2787 	}
2788 
2789 	if (!(trace->duration_filter || trace->summary_only || trace->min_stack))
2790 		trace__printf_interrupted_entry(trace);
2791 	/*
2792 	 * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
2793 	 * arguments, even if the syscall being handled, say "openat", uses only 4 arguments
2794 	 * this breaks syscall__augmented_args() check for augmented args, as we calculate
2795 	 * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,
2796 	 * so when handling, say the openat syscall, we end up getting 6 args for the
2797 	 * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
2798 	 * thinking that the extra 2 u64 args are the augmented filename, so just check
2799 	 * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
2800 	 */
2801 	if (evsel != trace->syscalls.events.sys_enter)
2802 		augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
2803 	ttrace->entry_time = sample->time;
2804 	msg = ttrace->entry_str;
2805 	printed += scnprintf(msg + printed, trace__entry_str_size - printed, "%s(", sc->name);
2806 
2807 	printed += syscall__scnprintf_args(sc, msg + printed, trace__entry_str_size - printed,
2808 					   args, augmented_args, augmented_args_size, trace, thread);
2809 
2810 	if (sc->is_exit) {
2811 		if (!(trace->duration_filter || trace->summary_only || trace->failure_only || trace->min_stack)) {
2812 			int alignment = 0;
2813 
2814 			trace__fprintf_entry_head(trace, thread, 0, false, ttrace->entry_time, trace->output);
2815 			printed = fprintf(trace->output, "%s)", ttrace->entry_str);
2816 			if (trace->args_alignment > printed)
2817 				alignment = trace->args_alignment - printed;
2818 			fprintf(trace->output, "%*s= ?\n", alignment, " ");
2819 		}
2820 	} else {
2821 		ttrace->entry_pending = true;
2822 		/* See trace__vfs_getname & trace__sys_exit */
2823 		ttrace->filename.pending_open = false;
2824 	}
2825 
2826 	if (trace->current != thread) {
2827 		thread__put(trace->current);
2828 		trace->current = thread__get(thread);
2829 	}
2830 	err = 0;
2831 out_put:
2832 	thread__put(thread);
2833 	return err;
2834 }
2835 
trace__fprintf_sys_enter(struct trace * trace,struct evsel * evsel,struct perf_sample * sample)2836 static int trace__fprintf_sys_enter(struct trace *trace, struct evsel *evsel,
2837 				    struct perf_sample *sample)
2838 {
2839 	struct thread_trace *ttrace;
2840 	struct thread *thread;
2841 	int id = perf_evsel__sc_tp_uint(evsel, id, sample), err = -1;
2842 	struct syscall *sc;
2843 	char msg[1024];
2844 	void *args, *augmented_args = NULL;
2845 	int augmented_args_size, e_machine;
2846 	size_t printed = 0;
2847 
2848 
2849 	thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);
2850 	e_machine = thread__e_machine(thread, trace->host);
2851 	sc = trace__syscall_info(trace, evsel, e_machine, id);
2852 	if (sc == NULL)
2853 		goto out_put;
2854 	ttrace = thread__trace(thread, trace);
2855 	/*
2856 	 * We need to get ttrace just to make sure it is there when syscall__scnprintf_args()
2857 	 * and the rest of the beautifiers accessing it via struct syscall_arg touches it.
2858 	 */
2859 	if (ttrace == NULL)
2860 		goto out_put;
2861 
2862 	args = perf_evsel__sc_tp_ptr(evsel, args, sample);
2863 	augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
2864 	printed += syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread);
2865 	fprintf(trace->output, "%.*s", (int)printed, msg);
2866 	err = 0;
2867 out_put:
2868 	thread__put(thread);
2869 	return err;
2870 }
2871 
trace__resolve_callchain(struct trace * trace,struct evsel * evsel,struct perf_sample * sample,struct callchain_cursor * cursor)2872 static int trace__resolve_callchain(struct trace *trace, struct evsel *evsel,
2873 				    struct perf_sample *sample,
2874 				    struct callchain_cursor *cursor)
2875 {
2876 	struct addr_location al;
2877 	int max_stack = evsel->core.attr.sample_max_stack ?
2878 			evsel->core.attr.sample_max_stack :
2879 			trace->max_stack;
2880 	int err = -1;
2881 
2882 	addr_location__init(&al);
2883 	if (machine__resolve(trace->host, &al, sample) < 0)
2884 		goto out;
2885 
2886 	err = thread__resolve_callchain(al.thread, cursor, evsel, sample, NULL, NULL, max_stack);
2887 out:
2888 	addr_location__exit(&al);
2889 	return err;
2890 }
2891 
trace__fprintf_callchain(struct trace * trace,struct perf_sample * sample)2892 static int trace__fprintf_callchain(struct trace *trace, struct perf_sample *sample)
2893 {
2894 	/* TODO: user-configurable print_opts */
2895 	const unsigned int print_opts = EVSEL__PRINT_SYM |
2896 				        EVSEL__PRINT_DSO |
2897 				        EVSEL__PRINT_UNKNOWN_AS_ADDR;
2898 
2899 	return sample__fprintf_callchain(sample, 38, print_opts, get_tls_callchain_cursor(), symbol_conf.bt_stop_list, trace->output);
2900 }
2901 
trace__sys_exit(struct trace * trace,struct evsel * evsel,union perf_event * event __maybe_unused,struct perf_sample * sample)2902 static int trace__sys_exit(struct trace *trace, struct evsel *evsel,
2903 			   union perf_event *event __maybe_unused,
2904 			   struct perf_sample *sample)
2905 {
2906 	long ret;
2907 	u64 duration = 0;
2908 	bool duration_calculated = false;
2909 	struct thread *thread;
2910 	int id = perf_evsel__sc_tp_uint(evsel, id, sample), err = -1, callchain_ret = 0, printed = 0;
2911 	int alignment = trace->args_alignment, e_machine;
2912 	struct syscall *sc;
2913 	struct thread_trace *ttrace;
2914 
2915 	thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);
2916 	e_machine = thread__e_machine(thread, trace->host);
2917 	sc = trace__syscall_info(trace, evsel, e_machine, id);
2918 	if (sc == NULL)
2919 		goto out_put;
2920 	ttrace = thread__trace(thread, trace);
2921 	if (ttrace == NULL)
2922 		goto out_put;
2923 
2924 	trace__fprintf_sample(trace, evsel, sample, thread);
2925 
2926 	ret = perf_evsel__sc_tp_uint(evsel, ret, sample);
2927 
2928 	if (trace->summary)
2929 		thread__update_stats(thread, ttrace, id, sample, ret, trace);
2930 
2931 	if (!trace->fd_path_disabled && sc->is_open && ret >= 0 && ttrace->filename.pending_open) {
2932 		trace__set_fd_pathname(thread, ret, ttrace->filename.name);
2933 		ttrace->filename.pending_open = false;
2934 		++trace->stats.vfs_getname;
2935 	}
2936 
2937 	if (ttrace->entry_time) {
2938 		duration = sample->time - ttrace->entry_time;
2939 		if (trace__filter_duration(trace, duration))
2940 			goto out;
2941 		duration_calculated = true;
2942 	} else if (trace->duration_filter)
2943 		goto out;
2944 
2945 	if (sample->callchain) {
2946 		struct callchain_cursor *cursor = get_tls_callchain_cursor();
2947 
2948 		callchain_ret = trace__resolve_callchain(trace, evsel, sample, cursor);
2949 		if (callchain_ret == 0) {
2950 			if (cursor->nr < trace->min_stack)
2951 				goto out;
2952 			callchain_ret = 1;
2953 		}
2954 	}
2955 
2956 	if (trace->summary_only || (ret >= 0 && trace->failure_only))
2957 		goto out;
2958 
2959 	trace__fprintf_entry_head(trace, thread, duration, duration_calculated, ttrace->entry_time, trace->output);
2960 
2961 	if (ttrace->entry_pending) {
2962 		printed = fprintf(trace->output, "%s", ttrace->entry_str);
2963 	} else {
2964 		printed += fprintf(trace->output, " ... [");
2965 		color_fprintf(trace->output, PERF_COLOR_YELLOW, "continued");
2966 		printed += 9;
2967 		printed += fprintf(trace->output, "]: %s()", sc->name);
2968 	}
2969 
2970 	printed++; /* the closing ')' */
2971 
2972 	if (alignment > printed)
2973 		alignment -= printed;
2974 	else
2975 		alignment = 0;
2976 
2977 	fprintf(trace->output, ")%*s= ", alignment, " ");
2978 
2979 	if (sc->fmt == NULL) {
2980 		if (ret < 0)
2981 			goto errno_print;
2982 signed_print:
2983 		fprintf(trace->output, "%ld", ret);
2984 	} else if (ret < 0) {
2985 errno_print: {
2986 		char bf[STRERR_BUFSIZE];
2987 		struct perf_env *env = evsel__env(evsel) ?: &trace->host_env;
2988 		const char *emsg = str_error_r(-ret, bf, sizeof(bf));
2989 		const char *e = perf_env__arch_strerrno(env, err);
2990 
2991 		fprintf(trace->output, "-1 %s (%s)", e, emsg);
2992 	}
2993 	} else if (ret == 0 && sc->fmt->timeout)
2994 		fprintf(trace->output, "0 (Timeout)");
2995 	else if (ttrace->ret_scnprintf) {
2996 		char bf[1024];
2997 		struct syscall_arg arg = {
2998 			.val	= ret,
2999 			.thread	= thread,
3000 			.trace	= trace,
3001 		};
3002 		ttrace->ret_scnprintf(bf, sizeof(bf), &arg);
3003 		ttrace->ret_scnprintf = NULL;
3004 		fprintf(trace->output, "%s", bf);
3005 	} else if (sc->fmt->hexret)
3006 		fprintf(trace->output, "%#lx", ret);
3007 	else if (sc->fmt->errpid) {
3008 		struct thread *child = machine__find_thread(trace->host, ret, ret);
3009 
3010 		fprintf(trace->output, "%ld", ret);
3011 		if (child != NULL) {
3012 			if (thread__comm_set(child))
3013 				fprintf(trace->output, " (%s)", thread__comm_str(child));
3014 			thread__put(child);
3015 		}
3016 	} else
3017 		goto signed_print;
3018 
3019 	fputc('\n', trace->output);
3020 
3021 	/*
3022 	 * We only consider an 'event' for the sake of --max-events a non-filtered
3023 	 * sys_enter + sys_exit and other tracepoint events.
3024 	 */
3025 	if (++trace->nr_events_printed == trace->max_events && trace->max_events != ULONG_MAX)
3026 		interrupted = true;
3027 
3028 	if (callchain_ret > 0)
3029 		trace__fprintf_callchain(trace, sample);
3030 	else if (callchain_ret < 0)
3031 		pr_err("Problem processing %s callchain, skipping...\n", evsel__name(evsel));
3032 out:
3033 	ttrace->entry_pending = false;
3034 	err = 0;
3035 out_put:
3036 	thread__put(thread);
3037 	return err;
3038 }
3039 
trace__vfs_getname(struct trace * trace,struct evsel * evsel,union perf_event * event __maybe_unused,struct perf_sample * sample)3040 static int trace__vfs_getname(struct trace *trace, struct evsel *evsel,
3041 			      union perf_event *event __maybe_unused,
3042 			      struct perf_sample *sample)
3043 {
3044 	struct thread *thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);
3045 	struct thread_trace *ttrace;
3046 	size_t filename_len, entry_str_len, to_move;
3047 	ssize_t remaining_space;
3048 	char *pos;
3049 	const char *filename = evsel__rawptr(evsel, sample, "pathname");
3050 
3051 	if (!thread)
3052 		goto out;
3053 
3054 	ttrace = thread__priv(thread);
3055 	if (!ttrace)
3056 		goto out_put;
3057 
3058 	filename_len = strlen(filename);
3059 	if (filename_len == 0)
3060 		goto out_put;
3061 
3062 	if (ttrace->filename.namelen < filename_len) {
3063 		char *f = realloc(ttrace->filename.name, filename_len + 1);
3064 
3065 		if (f == NULL)
3066 			goto out_put;
3067 
3068 		ttrace->filename.namelen = filename_len;
3069 		ttrace->filename.name = f;
3070 	}
3071 
3072 	strcpy(ttrace->filename.name, filename);
3073 	ttrace->filename.pending_open = true;
3074 
3075 	if (!ttrace->filename.ptr)
3076 		goto out_put;
3077 
3078 	entry_str_len = strlen(ttrace->entry_str);
3079 	remaining_space = trace__entry_str_size - entry_str_len - 1; /* \0 */
3080 	if (remaining_space <= 0)
3081 		goto out_put;
3082 
3083 	if (filename_len > (size_t)remaining_space) {
3084 		filename += filename_len - remaining_space;
3085 		filename_len = remaining_space;
3086 	}
3087 
3088 	to_move = entry_str_len - ttrace->filename.entry_str_pos + 1; /* \0 */
3089 	pos = ttrace->entry_str + ttrace->filename.entry_str_pos;
3090 	memmove(pos + filename_len, pos, to_move);
3091 	memcpy(pos, filename, filename_len);
3092 
3093 	ttrace->filename.ptr = 0;
3094 	ttrace->filename.entry_str_pos = 0;
3095 out_put:
3096 	thread__put(thread);
3097 out:
3098 	return 0;
3099 }
3100 
trace__sched_stat_runtime(struct trace * trace,struct evsel * evsel,union perf_event * event __maybe_unused,struct perf_sample * sample)3101 static int trace__sched_stat_runtime(struct trace *trace, struct evsel *evsel,
3102 				     union perf_event *event __maybe_unused,
3103 				     struct perf_sample *sample)
3104 {
3105         u64 runtime = evsel__intval(evsel, sample, "runtime");
3106 	double runtime_ms = (double)runtime / NSEC_PER_MSEC;
3107 	struct thread *thread = machine__findnew_thread(trace->host,
3108 							sample->pid,
3109 							sample->tid);
3110 	struct thread_trace *ttrace = thread__trace(thread, trace);
3111 
3112 	if (ttrace == NULL)
3113 		goto out_dump;
3114 
3115 	ttrace->runtime_ms += runtime_ms;
3116 	trace->runtime_ms += runtime_ms;
3117 out_put:
3118 	thread__put(thread);
3119 	return 0;
3120 
3121 out_dump:
3122 	fprintf(trace->output, "%s: comm=%s,pid=%u,runtime=%" PRIu64 ",vruntime=%" PRIu64 ")\n",
3123 	       evsel->name,
3124 	       evsel__strval(evsel, sample, "comm"),
3125 	       (pid_t)evsel__intval(evsel, sample, "pid"),
3126 	       runtime,
3127 	       evsel__intval(evsel, sample, "vruntime"));
3128 	goto out_put;
3129 }
3130 
bpf_output__printer(enum binary_printer_ops op,unsigned int val,void * extra __maybe_unused,FILE * fp)3131 static int bpf_output__printer(enum binary_printer_ops op,
3132 			       unsigned int val, void *extra __maybe_unused, FILE *fp)
3133 {
3134 	unsigned char ch = (unsigned char)val;
3135 
3136 	switch (op) {
3137 	case BINARY_PRINT_CHAR_DATA:
3138 		return fprintf(fp, "%c", isprint(ch) ? ch : '.');
3139 	case BINARY_PRINT_DATA_BEGIN:
3140 	case BINARY_PRINT_LINE_BEGIN:
3141 	case BINARY_PRINT_ADDR:
3142 	case BINARY_PRINT_NUM_DATA:
3143 	case BINARY_PRINT_NUM_PAD:
3144 	case BINARY_PRINT_SEP:
3145 	case BINARY_PRINT_CHAR_PAD:
3146 	case BINARY_PRINT_LINE_END:
3147 	case BINARY_PRINT_DATA_END:
3148 	default:
3149 		break;
3150 	}
3151 
3152 	return 0;
3153 }
3154 
bpf_output__fprintf(struct trace * trace,struct perf_sample * sample)3155 static void bpf_output__fprintf(struct trace *trace,
3156 				struct perf_sample *sample)
3157 {
3158 	binary__fprintf(sample->raw_data, sample->raw_size, 8,
3159 			bpf_output__printer, NULL, trace->output);
3160 	++trace->nr_events_printed;
3161 }
3162 
trace__fprintf_tp_fields(struct trace * trace,struct evsel * evsel,struct perf_sample * sample,struct thread * thread,void * augmented_args,int augmented_args_size)3163 static size_t trace__fprintf_tp_fields(struct trace *trace, struct evsel *evsel, struct perf_sample *sample,
3164 				       struct thread *thread, void *augmented_args, int augmented_args_size)
3165 {
3166 	char bf[2048];
3167 	size_t size = sizeof(bf);
3168 	const struct tep_event *tp_format = evsel__tp_format(evsel);
3169 	struct tep_format_field *field = tp_format ? tp_format->format.fields : NULL;
3170 	struct syscall_arg_fmt *arg = __evsel__syscall_arg_fmt(evsel);
3171 	size_t printed = 0, btf_printed;
3172 	unsigned long val;
3173 	u8 bit = 1;
3174 	struct syscall_arg syscall_arg = {
3175 		.augmented = {
3176 			.size = augmented_args_size,
3177 			.args = augmented_args,
3178 		},
3179 		.idx	= 0,
3180 		.mask	= 0,
3181 		.trace  = trace,
3182 		.thread = thread,
3183 		.show_string_prefix = trace->show_string_prefix,
3184 	};
3185 
3186 	for (; field && arg; field = field->next, ++syscall_arg.idx, bit <<= 1, ++arg) {
3187 		if (syscall_arg.mask & bit)
3188 			continue;
3189 
3190 		syscall_arg.len = 0;
3191 		syscall_arg.fmt = arg;
3192 		if (field->flags & TEP_FIELD_IS_ARRAY) {
3193 			int offset = field->offset;
3194 
3195 			if (field->flags & TEP_FIELD_IS_DYNAMIC) {
3196 				offset = format_field__intval(field, sample, evsel->needs_swap);
3197 				syscall_arg.len = offset >> 16;
3198 				offset &= 0xffff;
3199 				if (tep_field_is_relative(field->flags))
3200 					offset += field->offset + field->size;
3201 			}
3202 
3203 			val = (uintptr_t)(sample->raw_data + offset);
3204 		} else
3205 			val = format_field__intval(field, sample, evsel->needs_swap);
3206 		/*
3207 		 * Some syscall args need some mask, most don't and
3208 		 * return val untouched.
3209 		 */
3210 		val = syscall_arg_fmt__mask_val(arg, &syscall_arg, val);
3211 
3212 		/* Suppress this argument if its value is zero and show_zero property isn't set. */
3213 		if (val == 0 && !trace->show_zeros && !arg->show_zero && arg->strtoul != STUL_BTF_TYPE)
3214 			continue;
3215 
3216 		printed += scnprintf(bf + printed, size - printed, "%s", printed ? ", " : "");
3217 
3218 		if (trace->show_arg_names)
3219 			printed += scnprintf(bf + printed, size - printed, "%s: ", field->name);
3220 
3221 		btf_printed = trace__btf_scnprintf(trace, &syscall_arg, bf + printed, size - printed, val, field->type);
3222 		if (btf_printed) {
3223 			printed += btf_printed;
3224 			continue;
3225 		}
3226 
3227 		printed += syscall_arg_fmt__scnprintf_val(arg, bf + printed, size - printed, &syscall_arg, val);
3228 	}
3229 
3230 	return fprintf(trace->output, "%.*s", (int)printed, bf);
3231 }
3232 
trace__event_handler(struct trace * trace,struct evsel * evsel,union perf_event * event __maybe_unused,struct perf_sample * sample)3233 static int trace__event_handler(struct trace *trace, struct evsel *evsel,
3234 				union perf_event *event __maybe_unused,
3235 				struct perf_sample *sample)
3236 {
3237 	struct thread *thread;
3238 	int callchain_ret = 0;
3239 
3240 	if (evsel->nr_events_printed >= evsel->max_events)
3241 		return 0;
3242 
3243 	thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);
3244 
3245 	if (sample->callchain) {
3246 		struct callchain_cursor *cursor = get_tls_callchain_cursor();
3247 
3248 		callchain_ret = trace__resolve_callchain(trace, evsel, sample, cursor);
3249 		if (callchain_ret == 0) {
3250 			if (cursor->nr < trace->min_stack)
3251 				goto out;
3252 			callchain_ret = 1;
3253 		}
3254 	}
3255 
3256 	trace__printf_interrupted_entry(trace);
3257 	trace__fprintf_tstamp(trace, sample->time, trace->output);
3258 
3259 	if (trace->trace_syscalls && trace->show_duration)
3260 		fprintf(trace->output, "(         ): ");
3261 
3262 	if (thread)
3263 		trace__fprintf_comm_tid(trace, thread, trace->output);
3264 
3265 	if (evsel == trace->syscalls.events.bpf_output) {
3266 		int id = perf_evsel__sc_tp_uint(evsel, id, sample);
3267 		int e_machine = thread ? thread__e_machine(thread, trace->host) : EM_HOST;
3268 		struct syscall *sc = trace__syscall_info(trace, evsel, e_machine, id);
3269 
3270 		if (sc) {
3271 			fprintf(trace->output, "%s(", sc->name);
3272 			trace__fprintf_sys_enter(trace, evsel, sample);
3273 			fputc(')', trace->output);
3274 			goto newline;
3275 		}
3276 
3277 		/*
3278 		 * XXX: Not having the associated syscall info or not finding/adding
3279 		 * 	the thread should never happen, but if it does...
3280 		 * 	fall thru and print it as a bpf_output event.
3281 		 */
3282 	}
3283 
3284 	fprintf(trace->output, "%s(", evsel->name);
3285 
3286 	if (evsel__is_bpf_output(evsel)) {
3287 		bpf_output__fprintf(trace, sample);
3288 	} else {
3289 		const struct tep_event *tp_format = evsel__tp_format(evsel);
3290 
3291 		if (tp_format && (strncmp(tp_format->name, "sys_enter_", 10) ||
3292 				  trace__fprintf_sys_enter(trace, evsel, sample))) {
3293 			if (trace->libtraceevent_print) {
3294 				event_format__fprintf(tp_format, sample->cpu,
3295 						      sample->raw_data, sample->raw_size,
3296 						      trace->output);
3297 			} else {
3298 				trace__fprintf_tp_fields(trace, evsel, sample, thread, NULL, 0);
3299 			}
3300 		}
3301 	}
3302 
3303 newline:
3304 	fprintf(trace->output, ")\n");
3305 
3306 	if (callchain_ret > 0)
3307 		trace__fprintf_callchain(trace, sample);
3308 	else if (callchain_ret < 0)
3309 		pr_err("Problem processing %s callchain, skipping...\n", evsel__name(evsel));
3310 
3311 	++trace->nr_events_printed;
3312 
3313 	if (evsel->max_events != ULONG_MAX && ++evsel->nr_events_printed == evsel->max_events) {
3314 		evsel__disable(evsel);
3315 		evsel__close(evsel);
3316 	}
3317 out:
3318 	thread__put(thread);
3319 	return 0;
3320 }
3321 
print_location(FILE * f,struct perf_sample * sample,struct addr_location * al,bool print_dso,bool print_sym)3322 static void print_location(FILE *f, struct perf_sample *sample,
3323 			   struct addr_location *al,
3324 			   bool print_dso, bool print_sym)
3325 {
3326 
3327 	if ((verbose > 0 || print_dso) && al->map)
3328 		fprintf(f, "%s@", dso__long_name(map__dso(al->map)));
3329 
3330 	if ((verbose > 0 || print_sym) && al->sym)
3331 		fprintf(f, "%s+0x%" PRIx64, al->sym->name,
3332 			al->addr - al->sym->start);
3333 	else if (al->map)
3334 		fprintf(f, "0x%" PRIx64, al->addr);
3335 	else
3336 		fprintf(f, "0x%" PRIx64, sample->addr);
3337 }
3338 
trace__pgfault(struct trace * trace,struct evsel * evsel,union perf_event * event __maybe_unused,struct perf_sample * sample)3339 static int trace__pgfault(struct trace *trace,
3340 			  struct evsel *evsel,
3341 			  union perf_event *event __maybe_unused,
3342 			  struct perf_sample *sample)
3343 {
3344 	struct thread *thread;
3345 	struct addr_location al;
3346 	char map_type = 'd';
3347 	struct thread_trace *ttrace;
3348 	int err = -1;
3349 	int callchain_ret = 0;
3350 
3351 	addr_location__init(&al);
3352 	thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);
3353 
3354 	if (sample->callchain) {
3355 		struct callchain_cursor *cursor = get_tls_callchain_cursor();
3356 
3357 		callchain_ret = trace__resolve_callchain(trace, evsel, sample, cursor);
3358 		if (callchain_ret == 0) {
3359 			if (cursor->nr < trace->min_stack)
3360 				goto out_put;
3361 			callchain_ret = 1;
3362 		}
3363 	}
3364 
3365 	ttrace = thread__trace(thread, trace);
3366 	if (ttrace == NULL)
3367 		goto out_put;
3368 
3369 	if (evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ) {
3370 		ttrace->pfmaj++;
3371 		trace->pfmaj++;
3372 	} else {
3373 		ttrace->pfmin++;
3374 		trace->pfmin++;
3375 	}
3376 
3377 	if (trace->summary_only)
3378 		goto out;
3379 
3380 	thread__find_symbol(thread, sample->cpumode, sample->ip, &al);
3381 
3382 	trace__fprintf_entry_head(trace, thread, 0, true, sample->time, trace->output);
3383 
3384 	fprintf(trace->output, "%sfault [",
3385 		evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ?
3386 		"maj" : "min");
3387 
3388 	print_location(trace->output, sample, &al, false, true);
3389 
3390 	fprintf(trace->output, "] => ");
3391 
3392 	thread__find_symbol(thread, sample->cpumode, sample->addr, &al);
3393 
3394 	if (!al.map) {
3395 		thread__find_symbol(thread, sample->cpumode, sample->addr, &al);
3396 
3397 		if (al.map)
3398 			map_type = 'x';
3399 		else
3400 			map_type = '?';
3401 	}
3402 
3403 	print_location(trace->output, sample, &al, true, false);
3404 
3405 	fprintf(trace->output, " (%c%c)\n", map_type, al.level);
3406 
3407 	if (callchain_ret > 0)
3408 		trace__fprintf_callchain(trace, sample);
3409 	else if (callchain_ret < 0)
3410 		pr_err("Problem processing %s callchain, skipping...\n", evsel__name(evsel));
3411 
3412 	++trace->nr_events_printed;
3413 out:
3414 	err = 0;
3415 out_put:
3416 	thread__put(thread);
3417 	addr_location__exit(&al);
3418 	return err;
3419 }
3420 
trace__set_base_time(struct trace * trace,struct evsel * evsel,struct perf_sample * sample)3421 static void trace__set_base_time(struct trace *trace,
3422 				 struct evsel *evsel,
3423 				 struct perf_sample *sample)
3424 {
3425 	/*
3426 	 * BPF events were not setting PERF_SAMPLE_TIME, so be more robust
3427 	 * and don't use sample->time unconditionally, we may end up having
3428 	 * some other event in the future without PERF_SAMPLE_TIME for good
3429 	 * reason, i.e. we may not be interested in its timestamps, just in
3430 	 * it taking place, picking some piece of information when it
3431 	 * appears in our event stream (vfs_getname comes to mind).
3432 	 */
3433 	if (trace->base_time == 0 && !trace->full_time &&
3434 	    (evsel->core.attr.sample_type & PERF_SAMPLE_TIME))
3435 		trace->base_time = sample->time;
3436 }
3437 
trace__process_sample(const struct perf_tool * tool,union perf_event * event,struct perf_sample * sample,struct evsel * evsel,struct machine * machine __maybe_unused)3438 static int trace__process_sample(const struct perf_tool *tool,
3439 				 union perf_event *event,
3440 				 struct perf_sample *sample,
3441 				 struct evsel *evsel,
3442 				 struct machine *machine __maybe_unused)
3443 {
3444 	struct trace *trace = container_of(tool, struct trace, tool);
3445 	struct thread *thread;
3446 	int err = 0;
3447 
3448 	tracepoint_handler handler = evsel->handler;
3449 
3450 	thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);
3451 	if (thread && thread__is_filtered(thread))
3452 		goto out;
3453 
3454 	trace__set_base_time(trace, evsel, sample);
3455 
3456 	if (handler) {
3457 		++trace->nr_events;
3458 		handler(trace, evsel, event, sample);
3459 	}
3460 out:
3461 	thread__put(thread);
3462 	return err;
3463 }
3464 
trace__record(struct trace * trace,int argc,const char ** argv)3465 static int trace__record(struct trace *trace, int argc, const char **argv)
3466 {
3467 	unsigned int rec_argc, i, j;
3468 	const char **rec_argv;
3469 	const char * const record_args[] = {
3470 		"record",
3471 		"-R",
3472 		"-m", "1024",
3473 		"-c", "1",
3474 	};
3475 	pid_t pid = getpid();
3476 	char *filter = asprintf__tp_filter_pids(1, &pid);
3477 	const char * const sc_args[] = { "-e", };
3478 	unsigned int sc_args_nr = ARRAY_SIZE(sc_args);
3479 	const char * const majpf_args[] = { "-e", "major-faults" };
3480 	unsigned int majpf_args_nr = ARRAY_SIZE(majpf_args);
3481 	const char * const minpf_args[] = { "-e", "minor-faults" };
3482 	unsigned int minpf_args_nr = ARRAY_SIZE(minpf_args);
3483 	int err = -1;
3484 
3485 	/* +3 is for the event string below and the pid filter */
3486 	rec_argc = ARRAY_SIZE(record_args) + sc_args_nr + 3 +
3487 		majpf_args_nr + minpf_args_nr + argc;
3488 	rec_argv = calloc(rec_argc + 1, sizeof(char *));
3489 
3490 	if (rec_argv == NULL || filter == NULL)
3491 		goto out_free;
3492 
3493 	j = 0;
3494 	for (i = 0; i < ARRAY_SIZE(record_args); i++)
3495 		rec_argv[j++] = record_args[i];
3496 
3497 	if (trace->trace_syscalls) {
3498 		for (i = 0; i < sc_args_nr; i++)
3499 			rec_argv[j++] = sc_args[i];
3500 
3501 		/* event string may be different for older kernels - e.g., RHEL6 */
3502 		if (is_valid_tracepoint("raw_syscalls:sys_enter"))
3503 			rec_argv[j++] = "raw_syscalls:sys_enter,raw_syscalls:sys_exit";
3504 		else if (is_valid_tracepoint("syscalls:sys_enter"))
3505 			rec_argv[j++] = "syscalls:sys_enter,syscalls:sys_exit";
3506 		else {
3507 			pr_err("Neither raw_syscalls nor syscalls events exist.\n");
3508 			goto out_free;
3509 		}
3510 	}
3511 
3512 	rec_argv[j++] = "--filter";
3513 	rec_argv[j++] = filter;
3514 
3515 	if (trace->trace_pgfaults & TRACE_PFMAJ)
3516 		for (i = 0; i < majpf_args_nr; i++)
3517 			rec_argv[j++] = majpf_args[i];
3518 
3519 	if (trace->trace_pgfaults & TRACE_PFMIN)
3520 		for (i = 0; i < minpf_args_nr; i++)
3521 			rec_argv[j++] = minpf_args[i];
3522 
3523 	for (i = 0; i < (unsigned int)argc; i++)
3524 		rec_argv[j++] = argv[i];
3525 
3526 	err = cmd_record(j, rec_argv);
3527 out_free:
3528 	free(filter);
3529 	free(rec_argv);
3530 	return err;
3531 }
3532 
3533 static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp);
3534 static size_t trace__fprintf_total_summary(struct trace *trace, FILE *fp);
3535 
evlist__add_vfs_getname(struct evlist * evlist)3536 static bool evlist__add_vfs_getname(struct evlist *evlist)
3537 {
3538 	bool found = false;
3539 	struct evsel *evsel, *tmp;
3540 	struct parse_events_error err;
3541 	int ret;
3542 
3543 	parse_events_error__init(&err);
3544 	ret = parse_events(evlist, "probe:vfs_getname*", &err);
3545 	parse_events_error__exit(&err);
3546 	if (ret)
3547 		return false;
3548 
3549 	evlist__for_each_entry_safe(evlist, evsel, tmp) {
3550 		if (!strstarts(evsel__name(evsel), "probe:vfs_getname"))
3551 			continue;
3552 
3553 		if (evsel__field(evsel, "pathname")) {
3554 			evsel->handler = trace__vfs_getname;
3555 			found = true;
3556 			continue;
3557 		}
3558 
3559 		list_del_init(&evsel->core.node);
3560 		evsel->evlist = NULL;
3561 		evsel__delete(evsel);
3562 	}
3563 
3564 	return found;
3565 }
3566 
evsel__new_pgfault(u64 config)3567 static struct evsel *evsel__new_pgfault(u64 config)
3568 {
3569 	struct evsel *evsel;
3570 	struct perf_event_attr attr = {
3571 		.type = PERF_TYPE_SOFTWARE,
3572 		.mmap_data = 1,
3573 	};
3574 
3575 	attr.config = config;
3576 	attr.sample_period = 1;
3577 
3578 	event_attr_init(&attr);
3579 
3580 	evsel = evsel__new(&attr);
3581 	if (evsel)
3582 		evsel->handler = trace__pgfault;
3583 
3584 	return evsel;
3585 }
3586 
evlist__free_syscall_tp_fields(struct evlist * evlist)3587 static void evlist__free_syscall_tp_fields(struct evlist *evlist)
3588 {
3589 	struct evsel *evsel;
3590 
3591 	evlist__for_each_entry(evlist, evsel) {
3592 		evsel_trace__delete(evsel->priv);
3593 		evsel->priv = NULL;
3594 	}
3595 }
3596 
trace__handle_event(struct trace * trace,union perf_event * event,struct perf_sample * sample)3597 static void trace__handle_event(struct trace *trace, union perf_event *event, struct perf_sample *sample)
3598 {
3599 	const u32 type = event->header.type;
3600 	struct evsel *evsel;
3601 
3602 	if (type != PERF_RECORD_SAMPLE) {
3603 		trace__process_event(trace, trace->host, event, sample);
3604 		return;
3605 	}
3606 
3607 	evsel = evlist__id2evsel(trace->evlist, sample->id);
3608 	if (evsel == NULL) {
3609 		fprintf(trace->output, "Unknown tp ID %" PRIu64 ", skipping...\n", sample->id);
3610 		return;
3611 	}
3612 
3613 	if (evswitch__discard(&trace->evswitch, evsel))
3614 		return;
3615 
3616 	trace__set_base_time(trace, evsel, sample);
3617 
3618 	if (evsel->core.attr.type == PERF_TYPE_TRACEPOINT &&
3619 	    sample->raw_data == NULL) {
3620 		fprintf(trace->output, "%s sample with no payload for tid: %d, cpu %d, raw_size=%d, skipping...\n",
3621 		       evsel__name(evsel), sample->tid,
3622 		       sample->cpu, sample->raw_size);
3623 	} else {
3624 		tracepoint_handler handler = evsel->handler;
3625 		handler(trace, evsel, event, sample);
3626 	}
3627 
3628 	if (trace->nr_events_printed >= trace->max_events && trace->max_events != ULONG_MAX)
3629 		interrupted = true;
3630 }
3631 
trace__add_syscall_newtp(struct trace * trace)3632 static int trace__add_syscall_newtp(struct trace *trace)
3633 {
3634 	int ret = -1;
3635 	struct evlist *evlist = trace->evlist;
3636 	struct evsel *sys_enter, *sys_exit;
3637 
3638 	sys_enter = perf_evsel__raw_syscall_newtp("sys_enter", trace__sys_enter);
3639 	if (sys_enter == NULL)
3640 		goto out;
3641 
3642 	if (perf_evsel__init_sc_tp_ptr_field(sys_enter, args))
3643 		goto out_delete_sys_enter;
3644 
3645 	sys_exit = perf_evsel__raw_syscall_newtp("sys_exit", trace__sys_exit);
3646 	if (sys_exit == NULL)
3647 		goto out_delete_sys_enter;
3648 
3649 	if (perf_evsel__init_sc_tp_uint_field(sys_exit, ret))
3650 		goto out_delete_sys_exit;
3651 
3652 	evsel__config_callchain(sys_enter, &trace->opts, &callchain_param);
3653 	evsel__config_callchain(sys_exit, &trace->opts, &callchain_param);
3654 
3655 	evlist__add(evlist, sys_enter);
3656 	evlist__add(evlist, sys_exit);
3657 
3658 	if (callchain_param.enabled && !trace->kernel_syscallchains) {
3659 		/*
3660 		 * We're interested only in the user space callchain
3661 		 * leading to the syscall, allow overriding that for
3662 		 * debugging reasons using --kernel_syscall_callchains
3663 		 */
3664 		sys_exit->core.attr.exclude_callchain_kernel = 1;
3665 	}
3666 
3667 	trace->syscalls.events.sys_enter = sys_enter;
3668 	trace->syscalls.events.sys_exit  = sys_exit;
3669 
3670 	ret = 0;
3671 out:
3672 	return ret;
3673 
3674 out_delete_sys_exit:
3675 	evsel__delete_priv(sys_exit);
3676 out_delete_sys_enter:
3677 	evsel__delete_priv(sys_enter);
3678 	goto out;
3679 }
3680 
trace__set_ev_qualifier_tp_filter(struct trace * trace)3681 static int trace__set_ev_qualifier_tp_filter(struct trace *trace)
3682 {
3683 	int err = -1;
3684 	struct evsel *sys_exit;
3685 	char *filter = asprintf_expr_inout_ints("id", !trace->not_ev_qualifier,
3686 						trace->ev_qualifier_ids.nr,
3687 						trace->ev_qualifier_ids.entries);
3688 
3689 	if (filter == NULL)
3690 		goto out_enomem;
3691 
3692 	if (!evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter)) {
3693 		sys_exit = trace->syscalls.events.sys_exit;
3694 		err = evsel__append_tp_filter(sys_exit, filter);
3695 	}
3696 
3697 	free(filter);
3698 out:
3699 	return err;
3700 out_enomem:
3701 	errno = ENOMEM;
3702 	goto out;
3703 }
3704 
3705 #ifdef HAVE_LIBBPF_SUPPORT
3706 
3707 static struct bpf_program *unaugmented_prog;
3708 
syscall_arg_fmt__cache_btf_struct(struct syscall_arg_fmt * arg_fmt,struct btf * btf,char * type)3709 static int syscall_arg_fmt__cache_btf_struct(struct syscall_arg_fmt *arg_fmt, struct btf *btf, char *type)
3710 {
3711        int id;
3712 
3713 	if (arg_fmt->type != NULL)
3714 		return -1;
3715 
3716        id = btf__find_by_name(btf, type);
3717        if (id < 0)
3718 		return -1;
3719 
3720        arg_fmt->type    = btf__type_by_id(btf, id);
3721        arg_fmt->type_id = id;
3722 
3723        return 0;
3724 }
3725 
trace__find_syscall_bpf_prog(struct trace * trace __maybe_unused,struct syscall * sc,const char * prog_name,const char * type)3726 static struct bpf_program *trace__find_syscall_bpf_prog(struct trace *trace __maybe_unused,
3727 							struct syscall *sc,
3728 							const char *prog_name, const char *type)
3729 {
3730 	struct bpf_program *prog;
3731 
3732 	if (prog_name == NULL) {
3733 		char default_prog_name[256];
3734 		scnprintf(default_prog_name, sizeof(default_prog_name), "tp/syscalls/sys_%s_%s", type, sc->name);
3735 		prog = augmented_syscalls__find_by_title(default_prog_name);
3736 		if (prog != NULL)
3737 			goto out_found;
3738 		if (sc->fmt && sc->fmt->alias) {
3739 			scnprintf(default_prog_name, sizeof(default_prog_name), "tp/syscalls/sys_%s_%s", type, sc->fmt->alias);
3740 			prog = augmented_syscalls__find_by_title(default_prog_name);
3741 			if (prog != NULL)
3742 				goto out_found;
3743 		}
3744 		goto out_unaugmented;
3745 	}
3746 
3747 	prog = augmented_syscalls__find_by_title(prog_name);
3748 
3749 	if (prog != NULL) {
3750 out_found:
3751 		return prog;
3752 	}
3753 
3754 	pr_debug("Couldn't find BPF prog \"%s\" to associate with syscalls:sys_%s_%s, not augmenting it\n",
3755 		 prog_name, type, sc->name);
3756 out_unaugmented:
3757 	return unaugmented_prog;
3758 }
3759 
trace__init_syscall_bpf_progs(struct trace * trace,int e_machine,int id)3760 static void trace__init_syscall_bpf_progs(struct trace *trace, int e_machine, int id)
3761 {
3762 	struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, id);
3763 
3764 	if (sc == NULL)
3765 		return;
3766 
3767 	sc->bpf_prog.sys_enter = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_enter : NULL, "enter");
3768 	sc->bpf_prog.sys_exit  = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_exit  : NULL,  "exit");
3769 }
3770 
trace__bpf_prog_sys_enter_fd(struct trace * trace,int e_machine,int id)3771 static int trace__bpf_prog_sys_enter_fd(struct trace *trace, int e_machine, int id)
3772 {
3773 	struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, id);
3774 	return sc ? bpf_program__fd(sc->bpf_prog.sys_enter) : bpf_program__fd(unaugmented_prog);
3775 }
3776 
trace__bpf_prog_sys_exit_fd(struct trace * trace,int e_machine,int id)3777 static int trace__bpf_prog_sys_exit_fd(struct trace *trace, int e_machine, int id)
3778 {
3779 	struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, id);
3780 	return sc ? bpf_program__fd(sc->bpf_prog.sys_exit) : bpf_program__fd(unaugmented_prog);
3781 }
3782 
trace__bpf_sys_enter_beauty_map(struct trace * trace,int e_machine,int key,unsigned int * beauty_array)3783 static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, int key, unsigned int *beauty_array)
3784 {
3785 	struct tep_format_field *field;
3786 	struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, key);
3787 	const struct btf_type *bt;
3788 	char *struct_offset, *tmp, name[32];
3789 	bool can_augment = false;
3790 	int i, cnt;
3791 
3792 	if (sc == NULL)
3793 		return -1;
3794 
3795 	trace__load_vmlinux_btf(trace);
3796 	if (trace->btf == NULL)
3797 		return -1;
3798 
3799 	for (i = 0, field = sc->args; field; ++i, field = field->next) {
3800 		// XXX We're only collecting pointer payloads _from_ user space
3801 		if (!sc->arg_fmt[i].from_user)
3802 			continue;
3803 
3804 		struct_offset = strstr(field->type, "struct ");
3805 		if (struct_offset == NULL)
3806 			struct_offset = strstr(field->type, "union ");
3807 		else
3808 			struct_offset++; // "union" is shorter
3809 
3810 		if (field->flags & TEP_FIELD_IS_POINTER && struct_offset) { /* struct or union (think BPF's attr arg) */
3811 			struct_offset += 6;
3812 
3813 			/* for 'struct foo *', we only want 'foo' */
3814 			for (tmp = struct_offset, cnt = 0; *tmp != ' ' && *tmp != '\0'; ++tmp, ++cnt) {
3815 			}
3816 
3817 			strncpy(name, struct_offset, cnt);
3818 			name[cnt] = '\0';
3819 
3820 			/* cache struct's btf_type and type_id */
3821 			if (syscall_arg_fmt__cache_btf_struct(&sc->arg_fmt[i], trace->btf, name))
3822 				continue;
3823 
3824 			bt = sc->arg_fmt[i].type;
3825 			beauty_array[i] = bt->size;
3826 			can_augment = true;
3827 		} else if (field->flags & TEP_FIELD_IS_POINTER && /* string */
3828 			   strcmp(field->type, "const char *") == 0 &&
3829 			   (strstr(field->name, "name") ||
3830 			    strstr(field->name, "path") ||
3831 			    strstr(field->name, "file") ||
3832 			    strstr(field->name, "root") ||
3833 			    strstr(field->name, "key") ||
3834 			    strstr(field->name, "special") ||
3835 			    strstr(field->name, "type") ||
3836 			    strstr(field->name, "description"))) {
3837 			beauty_array[i] = 1;
3838 			can_augment = true;
3839 		} else if (field->flags & TEP_FIELD_IS_POINTER && /* buffer */
3840 			   strstr(field->type, "char *") &&
3841 			   (strstr(field->name, "buf") ||
3842 			    strstr(field->name, "val") ||
3843 			    strstr(field->name, "msg"))) {
3844 			int j;
3845 			struct tep_format_field *field_tmp;
3846 
3847 			/* find the size of the buffer that appears in pairs with buf */
3848 			for (j = 0, field_tmp = sc->args; field_tmp; ++j, field_tmp = field_tmp->next) {
3849 				if (!(field_tmp->flags & TEP_FIELD_IS_POINTER) && /* only integers */
3850 				    (strstr(field_tmp->name, "count") ||
3851 				     strstr(field_tmp->name, "siz") ||  /* size, bufsiz */
3852 				     (strstr(field_tmp->name, "len") && strcmp(field_tmp->name, "filename")))) {
3853 					 /* filename's got 'len' in it, we don't want that */
3854 					beauty_array[i] = -(j + 1);
3855 					can_augment = true;
3856 					break;
3857 				}
3858 			}
3859 		}
3860 	}
3861 
3862 	if (can_augment)
3863 		return 0;
3864 
3865 	return -1;
3866 }
3867 
trace__find_usable_bpf_prog_entry(struct trace * trace,struct syscall * sc)3868 static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace,
3869 							     struct syscall *sc)
3870 {
3871 	struct tep_format_field *field, *candidate_field;
3872 	/*
3873 	 * We're only interested in syscalls that have a pointer:
3874 	 */
3875 	for (field = sc->args; field; field = field->next) {
3876 		if (field->flags & TEP_FIELD_IS_POINTER)
3877 			goto try_to_find_pair;
3878 	}
3879 
3880 	return NULL;
3881 
3882 try_to_find_pair:
3883 	for (int i = 0, num_idx = syscalltbl__num_idx(sc->e_machine); i < num_idx; ++i) {
3884 		int id = syscalltbl__id_at_idx(sc->e_machine, i);
3885 		struct syscall *pair = trace__syscall_info(trace, NULL, sc->e_machine, id);
3886 		struct bpf_program *pair_prog;
3887 		bool is_candidate = false;
3888 
3889 		if (pair == NULL || pair->id == sc->id ||
3890 		    pair->bpf_prog.sys_enter == unaugmented_prog)
3891 			continue;
3892 
3893 		for (field = sc->args, candidate_field = pair->args;
3894 		     field && candidate_field; field = field->next, candidate_field = candidate_field->next) {
3895 			bool is_pointer = field->flags & TEP_FIELD_IS_POINTER,
3896 			     candidate_is_pointer = candidate_field->flags & TEP_FIELD_IS_POINTER;
3897 
3898 			if (is_pointer) {
3899 			       if (!candidate_is_pointer) {
3900 					// The candidate just doesn't copies our pointer arg, might copy other pointers we want.
3901 					continue;
3902 			       }
3903 			} else {
3904 				if (candidate_is_pointer) {
3905 					// The candidate might copy a pointer we don't have, skip it.
3906 					goto next_candidate;
3907 				}
3908 				continue;
3909 			}
3910 
3911 			if (strcmp(field->type, candidate_field->type))
3912 				goto next_candidate;
3913 
3914 			/*
3915 			 * This is limited in the BPF program but sys_write
3916 			 * uses "const char *" for its "buf" arg so we need to
3917 			 * use some heuristic that is kinda future proof...
3918 			 */
3919 			if (strcmp(field->type, "const char *") == 0 &&
3920 			    !(strstr(field->name, "name") ||
3921 			      strstr(field->name, "path") ||
3922 			      strstr(field->name, "file") ||
3923 			      strstr(field->name, "root") ||
3924 			      strstr(field->name, "description")))
3925 				goto next_candidate;
3926 
3927 			is_candidate = true;
3928 		}
3929 
3930 		if (!is_candidate)
3931 			goto next_candidate;
3932 
3933 		/*
3934 		 * Check if the tentative pair syscall augmenter has more pointers, if it has,
3935 		 * then it may be collecting that and we then can't use it, as it would collect
3936 		 * more than what is common to the two syscalls.
3937 		 */
3938 		if (candidate_field) {
3939 			for (candidate_field = candidate_field->next; candidate_field; candidate_field = candidate_field->next)
3940 				if (candidate_field->flags & TEP_FIELD_IS_POINTER)
3941 					goto next_candidate;
3942 		}
3943 
3944 		pair_prog = pair->bpf_prog.sys_enter;
3945 		/*
3946 		 * If the pair isn't enabled, then its bpf_prog.sys_enter will not
3947 		 * have been searched for, so search it here and if it returns the
3948 		 * unaugmented one, then ignore it, otherwise we'll reuse that BPF
3949 		 * program for a filtered syscall on a non-filtered one.
3950 		 *
3951 		 * For instance, we have "!syscalls:sys_enter_renameat" and that is
3952 		 * useful for "renameat2".
3953 		 */
3954 		if (pair_prog == NULL) {
3955 			pair_prog = trace__find_syscall_bpf_prog(trace, pair, pair->fmt ? pair->fmt->bpf_prog_name.sys_enter : NULL, "enter");
3956 			if (pair_prog == unaugmented_prog)
3957 				goto next_candidate;
3958 		}
3959 
3960 		pr_debug("Reusing \"%s\" BPF sys_enter augmenter for \"%s\"\n", pair->name,
3961 			 sc->name);
3962 		return pair_prog;
3963 	next_candidate:
3964 		continue;
3965 	}
3966 
3967 	return NULL;
3968 }
3969 
trace__init_syscalls_bpf_prog_array_maps(struct trace * trace,int e_machine)3970 static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace, int e_machine)
3971 {
3972 	int map_enter_fd;
3973 	int map_exit_fd;
3974 	int beauty_map_fd;
3975 	int err = 0;
3976 	unsigned int beauty_array[6];
3977 
3978 	if (augmented_syscalls__get_map_fds(&map_enter_fd, &map_exit_fd, &beauty_map_fd) < 0)
3979 		return -1;
3980 
3981 	unaugmented_prog = augmented_syscalls__unaugmented();
3982 
3983 	for (int i = 0, num_idx = syscalltbl__num_idx(e_machine); i < num_idx; ++i) {
3984 		int prog_fd, key = syscalltbl__id_at_idx(e_machine, i);
3985 
3986 		if (!trace__syscall_enabled(trace, key))
3987 			continue;
3988 
3989 		trace__init_syscall_bpf_progs(trace, e_machine, key);
3990 
3991 		// It'll get at least the "!raw_syscalls:unaugmented"
3992 		prog_fd = trace__bpf_prog_sys_enter_fd(trace, e_machine, key);
3993 		err = bpf_map_update_elem(map_enter_fd, &key, &prog_fd, BPF_ANY);
3994 		if (err)
3995 			break;
3996 		prog_fd = trace__bpf_prog_sys_exit_fd(trace, e_machine, key);
3997 		err = bpf_map_update_elem(map_exit_fd, &key, &prog_fd, BPF_ANY);
3998 		if (err)
3999 			break;
4000 
4001 		/* use beauty_map to tell BPF how many bytes to collect, set beauty_map's value here */
4002 		memset(beauty_array, 0, sizeof(beauty_array));
4003 		err = trace__bpf_sys_enter_beauty_map(trace, e_machine, key, (unsigned int *)beauty_array);
4004 		if (err)
4005 			continue;
4006 		err = bpf_map_update_elem(beauty_map_fd, &key, beauty_array, BPF_ANY);
4007 		if (err)
4008 			break;
4009 	}
4010 
4011 	/*
4012 	 * Now lets do a second pass looking for enabled syscalls without
4013 	 * an augmenter that have a signature that is a superset of another
4014 	 * syscall with an augmenter so that we can auto-reuse it.
4015 	 *
4016 	 * I.e. if we have an augmenter for the "open" syscall that has
4017 	 * this signature:
4018 	 *
4019 	 *   int open(const char *pathname, int flags, mode_t mode);
4020 	 *
4021 	 * I.e. that will collect just the first string argument, then we
4022 	 * can reuse it for the 'creat' syscall, that has this signature:
4023 	 *
4024 	 *   int creat(const char *pathname, mode_t mode);
4025 	 *
4026 	 * and for:
4027 	 *
4028 	 *   int stat(const char *pathname, struct stat *statbuf);
4029 	 *   int lstat(const char *pathname, struct stat *statbuf);
4030 	 *
4031 	 * Because the 'open' augmenter will collect the first arg as a string,
4032 	 * and leave alone all the other args, which already helps with
4033 	 * beautifying 'stat' and 'lstat''s pathname arg.
4034 	 *
4035 	 * Then, in time, when 'stat' gets an augmenter that collects both
4036 	 * first and second arg (this one on the raw_syscalls:sys_exit prog
4037 	 * array tail call, then that one will be used.
4038 	 */
4039 	for (int i = 0, num_idx = syscalltbl__num_idx(e_machine); i < num_idx; ++i) {
4040 		int key = syscalltbl__id_at_idx(e_machine, i);
4041 		struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, key);
4042 		struct bpf_program *pair_prog;
4043 		int prog_fd;
4044 
4045 		if (sc == NULL || sc->bpf_prog.sys_enter == NULL)
4046 			continue;
4047 
4048 		/*
4049 		 * For now we're just reusing the sys_enter prog, and if it
4050 		 * already has an augmenter, we don't need to find one.
4051 		 */
4052 		if (sc->bpf_prog.sys_enter != unaugmented_prog)
4053 			continue;
4054 
4055 		/*
4056 		 * Look at all the other syscalls for one that has a signature
4057 		 * that is close enough that we can share:
4058 		 */
4059 		pair_prog = trace__find_usable_bpf_prog_entry(trace, sc);
4060 		if (pair_prog == NULL)
4061 			continue;
4062 
4063 		sc->bpf_prog.sys_enter = pair_prog;
4064 
4065 		/*
4066 		 * Update the BPF_MAP_TYPE_PROG_SHARED for raw_syscalls:sys_enter
4067 		 * with the fd for the program we're reusing:
4068 		 */
4069 		prog_fd = bpf_program__fd(sc->bpf_prog.sys_enter);
4070 		err = bpf_map_update_elem(map_enter_fd, &key, &prog_fd, BPF_ANY);
4071 		if (err)
4072 			break;
4073 	}
4074 
4075 	return err;
4076 }
4077 #else // !HAVE_LIBBPF_SUPPORT
trace__init_syscalls_bpf_prog_array_maps(struct trace * trace __maybe_unused,int e_machine __maybe_unused)4078 static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace __maybe_unused,
4079 						    int e_machine __maybe_unused)
4080 {
4081 	return -1;
4082 }
4083 #endif // HAVE_LIBBPF_SUPPORT
4084 
trace__set_ev_qualifier_filter(struct trace * trace)4085 static int trace__set_ev_qualifier_filter(struct trace *trace)
4086 {
4087 	if (trace->syscalls.events.sys_enter)
4088 		return trace__set_ev_qualifier_tp_filter(trace);
4089 	return 0;
4090 }
4091 
trace__set_filter_loop_pids(struct trace * trace)4092 static int trace__set_filter_loop_pids(struct trace *trace)
4093 {
4094 	unsigned int nr = 1, err;
4095 	pid_t pids[32] = {
4096 		getpid(),
4097 	};
4098 	struct thread *thread = machine__find_thread(trace->host, pids[0], pids[0]);
4099 
4100 	while (thread && nr < ARRAY_SIZE(pids)) {
4101 		struct thread *parent = machine__find_thread(trace->host,
4102 							     thread__ppid(thread),
4103 							     thread__ppid(thread));
4104 
4105 		if (parent == NULL)
4106 			break;
4107 
4108 		if (!strcmp(thread__comm_str(parent), "sshd") ||
4109 		    strstarts(thread__comm_str(parent), "gnome-terminal")) {
4110 			pids[nr++] = thread__tid(parent);
4111 			thread__put(parent);
4112 			break;
4113 		}
4114 		thread__put(thread);
4115 		thread = parent;
4116 	}
4117 	thread__put(thread);
4118 
4119 	err = evlist__append_tp_filter_pids(trace->evlist, nr, pids);
4120 	if (!err)
4121 		err = augmented_syscalls__set_filter_pids(nr, pids);
4122 
4123 	return err;
4124 }
4125 
trace__set_filter_pids(struct trace * trace)4126 static int trace__set_filter_pids(struct trace *trace)
4127 {
4128 	int err = 0;
4129 	/*
4130 	 * Better not use !target__has_task() here because we need to cover the
4131 	 * case where no threads were specified in the command line, but a
4132 	 * workload was, and in that case we will fill in the thread_map when
4133 	 * we fork the workload in evlist__prepare_workload.
4134 	 */
4135 	if (trace->filter_pids.nr > 0) {
4136 		err = evlist__append_tp_filter_pids(trace->evlist, trace->filter_pids.nr,
4137 						    trace->filter_pids.entries);
4138 		if (!err) {
4139 			err = augmented_syscalls__set_filter_pids(trace->filter_pids.nr,
4140 						       trace->filter_pids.entries);
4141 		}
4142 	} else if (perf_thread_map__pid(trace->evlist->core.threads, 0) == -1) {
4143 		err = trace__set_filter_loop_pids(trace);
4144 	}
4145 
4146 	return err;
4147 }
4148 
__trace__deliver_event(struct trace * trace,union perf_event * event)4149 static int __trace__deliver_event(struct trace *trace, union perf_event *event)
4150 {
4151 	struct evlist *evlist = trace->evlist;
4152 	struct perf_sample sample;
4153 	int err;
4154 
4155 	perf_sample__init(&sample, /*all=*/false);
4156 	err = evlist__parse_sample(evlist, event, &sample);
4157 	if (err)
4158 		fprintf(trace->output, "Can't parse sample, err = %d, skipping...\n", err);
4159 	else
4160 		trace__handle_event(trace, event, &sample);
4161 
4162 	perf_sample__exit(&sample);
4163 	return 0;
4164 }
4165 
__trace__flush_events(struct trace * trace)4166 static int __trace__flush_events(struct trace *trace)
4167 {
4168 	u64 first = ordered_events__first_time(&trace->oe.data);
4169 	u64 flush = trace->oe.last - NSEC_PER_SEC;
4170 
4171 	/* Is there some thing to flush.. */
4172 	if (first && first < flush)
4173 		return ordered_events__flush_time(&trace->oe.data, flush);
4174 
4175 	return 0;
4176 }
4177 
trace__flush_events(struct trace * trace)4178 static int trace__flush_events(struct trace *trace)
4179 {
4180 	return !trace->sort_events ? 0 : __trace__flush_events(trace);
4181 }
4182 
trace__deliver_event(struct trace * trace,union perf_event * event)4183 static int trace__deliver_event(struct trace *trace, union perf_event *event)
4184 {
4185 	int err;
4186 
4187 	if (!trace->sort_events)
4188 		return __trace__deliver_event(trace, event);
4189 
4190 	err = evlist__parse_sample_timestamp(trace->evlist, event, &trace->oe.last);
4191 	if (err && err != -1)
4192 		return err;
4193 
4194 	err = ordered_events__queue(&trace->oe.data, event, trace->oe.last, 0, NULL);
4195 	if (err)
4196 		return err;
4197 
4198 	return trace__flush_events(trace);
4199 }
4200 
ordered_events__deliver_event(struct ordered_events * oe,struct ordered_event * event)4201 static int ordered_events__deliver_event(struct ordered_events *oe,
4202 					 struct ordered_event *event)
4203 {
4204 	struct trace *trace = container_of(oe, struct trace, oe.data);
4205 
4206 	return __trace__deliver_event(trace, event->event);
4207 }
4208 
evsel__find_syscall_arg_fmt_by_name(struct evsel * evsel,char * arg,char ** type)4209 static struct syscall_arg_fmt *evsel__find_syscall_arg_fmt_by_name(struct evsel *evsel, char *arg,
4210 								   char **type)
4211 {
4212 	struct syscall_arg_fmt *fmt = __evsel__syscall_arg_fmt(evsel);
4213 	const struct tep_event *tp_format;
4214 
4215 	if (!fmt)
4216 		return NULL;
4217 
4218 	tp_format = evsel__tp_format(evsel);
4219 	if (!tp_format)
4220 		return NULL;
4221 
4222 	for (const struct tep_format_field *field = tp_format->format.fields; field;
4223 	     field = field->next, ++fmt) {
4224 		if (strcmp(field->name, arg) == 0) {
4225 			*type = field->type;
4226 			return fmt;
4227 		}
4228 	}
4229 
4230 	return NULL;
4231 }
4232 
trace__expand_filter(struct trace * trace,struct evsel * evsel)4233 static int trace__expand_filter(struct trace *trace, struct evsel *evsel)
4234 {
4235 	char *tok, *left = evsel->filter, *new_filter = evsel->filter;
4236 
4237 	while ((tok = strpbrk(left, "=<>!")) != NULL) {
4238 		char *right = tok + 1, *right_end;
4239 
4240 		if (*right == '=')
4241 			++right;
4242 
4243 		while (isspace(*right))
4244 			++right;
4245 
4246 		if (*right == '\0')
4247 			break;
4248 
4249 		while (!isalpha(*left))
4250 			if (++left == tok) {
4251 				/*
4252 				 * Bail out, can't find the name of the argument that is being
4253 				 * used in the filter, let it try to set this filter, will fail later.
4254 				 */
4255 				return 0;
4256 			}
4257 
4258 		right_end = right + 1;
4259 		while (isalnum(*right_end) || *right_end == '_' || *right_end == '|')
4260 			++right_end;
4261 
4262 		if (isalpha(*right)) {
4263 			struct syscall_arg_fmt *fmt;
4264 			int left_size = tok - left,
4265 			    right_size = right_end - right;
4266 			char arg[128], *type;
4267 
4268 			while (isspace(left[left_size - 1]))
4269 				--left_size;
4270 
4271 			scnprintf(arg, sizeof(arg), "%.*s", left_size, left);
4272 
4273 			fmt = evsel__find_syscall_arg_fmt_by_name(evsel, arg, &type);
4274 			if (fmt == NULL) {
4275 				pr_err("\"%s\" not found in \"%s\", can't set filter \"%s\"\n",
4276 				       arg, evsel->name, evsel->filter);
4277 				return -1;
4278 			}
4279 
4280 			pr_debug2("trying to expand \"%s\" \"%.*s\" \"%.*s\" -> ",
4281 				 arg, (int)(right - tok), tok, right_size, right);
4282 
4283 			if (fmt->strtoul) {
4284 				u64 val;
4285 				struct syscall_arg syscall_arg = {
4286 					.trace = trace,
4287 					.fmt   = fmt,
4288 					.type_name = type,
4289 					.parm = fmt->parm,
4290 				};
4291 
4292 				if (fmt->strtoul(right, right_size, &syscall_arg, &val)) {
4293 					char *n, expansion[19];
4294 					int expansion_lenght = scnprintf(expansion, sizeof(expansion), "%#" PRIx64, val);
4295 					int expansion_offset = right - new_filter;
4296 
4297 					pr_debug("%s", expansion);
4298 
4299 					if (asprintf(&n, "%.*s%s%s", expansion_offset, new_filter, expansion, right_end) < 0) {
4300 						pr_debug(" out of memory!\n");
4301 						free(new_filter);
4302 						return -1;
4303 					}
4304 					if (new_filter != evsel->filter)
4305 						free(new_filter);
4306 					left = n + expansion_offset + expansion_lenght;
4307 					new_filter = n;
4308 				} else {
4309 					pr_err("\"%.*s\" not found for \"%s\" in \"%s\", can't set filter \"%s\"\n",
4310 					       right_size, right, arg, evsel->name, evsel->filter);
4311 					return -1;
4312 				}
4313 			} else {
4314 				pr_err("No resolver (strtoul) for \"%s\" in \"%s\", can't set filter \"%s\"\n",
4315 				       arg, evsel->name, evsel->filter);
4316 				return -1;
4317 			}
4318 
4319 			pr_debug("\n");
4320 		} else {
4321 			left = right_end;
4322 		}
4323 	}
4324 
4325 	if (new_filter != evsel->filter) {
4326 		pr_debug("New filter for %s: %s\n", evsel->name, new_filter);
4327 		evsel__set_filter(evsel, new_filter);
4328 		free(new_filter);
4329 	}
4330 
4331 	return 0;
4332 }
4333 
trace__expand_filters(struct trace * trace,struct evsel ** err_evsel)4334 static int trace__expand_filters(struct trace *trace, struct evsel **err_evsel)
4335 {
4336 	struct evlist *evlist = trace->evlist;
4337 	struct evsel *evsel;
4338 
4339 	evlist__for_each_entry(evlist, evsel) {
4340 		if (evsel->filter == NULL)
4341 			continue;
4342 
4343 		if (trace__expand_filter(trace, evsel)) {
4344 			*err_evsel = evsel;
4345 			return -1;
4346 		}
4347 	}
4348 
4349 	return 0;
4350 }
4351 
trace__run(struct trace * trace,int argc,const char ** argv)4352 static int trace__run(struct trace *trace, int argc, const char **argv)
4353 {
4354 	struct evlist *evlist = trace->evlist;
4355 	struct evsel *evsel, *pgfault_maj = NULL, *pgfault_min = NULL;
4356 	int err = -1, i;
4357 	unsigned long before;
4358 	const bool forks = argc > 0;
4359 	bool draining = false;
4360 
4361 	trace->live = true;
4362 
4363 	if (trace->summary_bpf) {
4364 		if (trace_prepare_bpf_summary(trace->summary_mode) < 0)
4365 			goto out_delete_evlist;
4366 
4367 		if (trace->summary_only)
4368 			goto create_maps;
4369 	}
4370 
4371 	if (!trace->raw_augmented_syscalls) {
4372 		if (trace->trace_syscalls && trace__add_syscall_newtp(trace))
4373 			goto out_error_raw_syscalls;
4374 
4375 		if (trace->trace_syscalls)
4376 			trace->vfs_getname = evlist__add_vfs_getname(evlist);
4377 	}
4378 
4379 	if ((trace->trace_pgfaults & TRACE_PFMAJ)) {
4380 		pgfault_maj = evsel__new_pgfault(PERF_COUNT_SW_PAGE_FAULTS_MAJ);
4381 		if (pgfault_maj == NULL)
4382 			goto out_error_mem;
4383 		evsel__config_callchain(pgfault_maj, &trace->opts, &callchain_param);
4384 		evlist__add(evlist, pgfault_maj);
4385 	}
4386 
4387 	if ((trace->trace_pgfaults & TRACE_PFMIN)) {
4388 		pgfault_min = evsel__new_pgfault(PERF_COUNT_SW_PAGE_FAULTS_MIN);
4389 		if (pgfault_min == NULL)
4390 			goto out_error_mem;
4391 		evsel__config_callchain(pgfault_min, &trace->opts, &callchain_param);
4392 		evlist__add(evlist, pgfault_min);
4393 	}
4394 
4395 	/* Enable ignoring missing threads when -p option is defined. */
4396 	trace->opts.ignore_missing_thread = trace->opts.target.pid;
4397 
4398 	if (trace->sched &&
4399 	    evlist__add_newtp(evlist, "sched", "sched_stat_runtime", trace__sched_stat_runtime))
4400 		goto out_error_sched_stat_runtime;
4401 	/*
4402 	 * If a global cgroup was set, apply it to all the events without an
4403 	 * explicit cgroup. I.e.:
4404 	 *
4405 	 * 	trace -G A -e sched:*switch
4406 	 *
4407 	 * Will set all raw_syscalls:sys_{enter,exit}, pgfault, vfs_getname, etc
4408 	 * _and_ sched:sched_switch to the 'A' cgroup, while:
4409 	 *
4410 	 * trace -e sched:*switch -G A
4411 	 *
4412 	 * will only set the sched:sched_switch event to the 'A' cgroup, all the
4413 	 * other events (raw_syscalls:sys_{enter,exit}, etc are left "without"
4414 	 * a cgroup (on the root cgroup, sys wide, etc).
4415 	 *
4416 	 * Multiple cgroups:
4417 	 *
4418 	 * trace -G A -e sched:*switch -G B
4419 	 *
4420 	 * the syscall ones go to the 'A' cgroup, the sched:sched_switch goes
4421 	 * to the 'B' cgroup.
4422 	 *
4423 	 * evlist__set_default_cgroup() grabs a reference of the passed cgroup
4424 	 * only for the evsels still without a cgroup, i.e. evsel->cgroup == NULL.
4425 	 */
4426 	if (trace->cgroup)
4427 		evlist__set_default_cgroup(trace->evlist, trace->cgroup);
4428 
4429 create_maps:
4430 	err = evlist__create_maps(evlist, &trace->opts.target);
4431 	if (err < 0) {
4432 		fprintf(trace->output, "Problems parsing the target to trace, check your options!\n");
4433 		goto out_delete_evlist;
4434 	}
4435 
4436 	err = trace__symbols_init(trace, argc, argv, evlist);
4437 	if (err < 0) {
4438 		fprintf(trace->output, "Problems initializing symbol libraries!\n");
4439 		goto out_delete_evlist;
4440 	}
4441 
4442 	if (trace->summary_mode == SUMMARY__BY_TOTAL && !trace->summary_bpf) {
4443 		trace->syscall_stats = alloc_syscall_stats();
4444 		if (IS_ERR(trace->syscall_stats))
4445 			goto out_delete_evlist;
4446 	}
4447 
4448 	evlist__config(evlist, &trace->opts, &callchain_param);
4449 
4450 	if (forks) {
4451 		err = evlist__prepare_workload(evlist, &trace->opts.target, argv, false, NULL);
4452 		if (err < 0) {
4453 			fprintf(trace->output, "Couldn't run the workload!\n");
4454 			goto out_delete_evlist;
4455 		}
4456 		workload_pid = evlist->workload.pid;
4457 	}
4458 
4459 	err = evlist__open(evlist);
4460 	if (err < 0)
4461 		goto out_error_open;
4462 
4463 	augmented_syscalls__setup_bpf_output();
4464 
4465 	err = trace__set_filter_pids(trace);
4466 	if (err < 0)
4467 		goto out_error_mem;
4468 
4469 	/*
4470 	 * TODO: Initialize for all host binary machine types, not just
4471 	 * those matching the perf binary.
4472 	 */
4473 	trace__init_syscalls_bpf_prog_array_maps(trace, EM_HOST);
4474 
4475 	if (trace->ev_qualifier_ids.nr > 0) {
4476 		err = trace__set_ev_qualifier_filter(trace);
4477 		if (err < 0)
4478 			goto out_errno;
4479 
4480 		if (trace->syscalls.events.sys_exit) {
4481 			pr_debug("event qualifier tracepoint filter: %s\n",
4482 				 trace->syscalls.events.sys_exit->filter);
4483 		}
4484 	}
4485 
4486 	/*
4487 	 * If the "close" syscall is not traced, then we will not have the
4488 	 * opportunity to, in syscall_arg__scnprintf_close_fd() invalidate the
4489 	 * fd->pathname table and were ending up showing the last value set by
4490 	 * syscalls opening a pathname and associating it with a descriptor or
4491 	 * reading it from /proc/pid/fd/ in cases where that doesn't make
4492 	 * sense.
4493 	 *
4494 	 *  So just disable this beautifier (SCA_FD, SCA_FDAT) when 'close' is
4495 	 *  not in use.
4496 	 */
4497 	/* TODO: support for more than just perf binary machine type close. */
4498 	trace->fd_path_disabled = !trace__syscall_enabled(trace, syscalltbl__id(EM_HOST, "close"));
4499 
4500 	err = trace__expand_filters(trace, &evsel);
4501 	if (err)
4502 		goto out_delete_evlist;
4503 	err = evlist__apply_filters(evlist, &evsel, &trace->opts.target);
4504 	if (err < 0)
4505 		goto out_error_apply_filters;
4506 
4507 	if (!trace->summary_only || !trace->summary_bpf) {
4508 		err = evlist__mmap(evlist, trace->opts.mmap_pages);
4509 		if (err < 0)
4510 			goto out_error_mmap;
4511 	}
4512 
4513 	if (!target__none(&trace->opts.target) && !trace->opts.target.initial_delay)
4514 		evlist__enable(evlist);
4515 
4516 	if (forks)
4517 		evlist__start_workload(evlist);
4518 
4519 	if (trace->opts.target.initial_delay) {
4520 		usleep(trace->opts.target.initial_delay * 1000);
4521 		evlist__enable(evlist);
4522 	}
4523 
4524 	if (trace->summary_bpf)
4525 		trace_start_bpf_summary();
4526 
4527 	trace->multiple_threads = perf_thread_map__pid(evlist->core.threads, 0) == -1 ||
4528 		perf_thread_map__nr(evlist->core.threads) > 1 ||
4529 		evlist__first(evlist)->core.attr.inherit;
4530 
4531 	/*
4532 	 * Now that we already used evsel->core.attr to ask the kernel to setup the
4533 	 * events, lets reuse evsel->core.attr.sample_max_stack as the limit in
4534 	 * trace__resolve_callchain(), allowing per-event max-stack settings
4535 	 * to override an explicitly set --max-stack global setting.
4536 	 */
4537 	evlist__for_each_entry(evlist, evsel) {
4538 		if (evsel__has_callchain(evsel) &&
4539 		    evsel->core.attr.sample_max_stack == 0)
4540 			evsel->core.attr.sample_max_stack = trace->max_stack;
4541 	}
4542 again:
4543 	before = trace->nr_events;
4544 
4545 	for (i = 0; i < evlist->core.nr_mmaps; i++) {
4546 		union perf_event *event;
4547 		struct mmap *md;
4548 
4549 		md = &evlist->mmap[i];
4550 		if (perf_mmap__read_init(&md->core) < 0)
4551 			continue;
4552 
4553 		while ((event = perf_mmap__read_event(&md->core)) != NULL) {
4554 			++trace->nr_events;
4555 
4556 			err = trace__deliver_event(trace, event);
4557 			if (err)
4558 				goto out_disable;
4559 
4560 			perf_mmap__consume(&md->core);
4561 
4562 			if (interrupted)
4563 				goto out_disable;
4564 
4565 			if (done && !draining) {
4566 				evlist__disable(evlist);
4567 				draining = true;
4568 			}
4569 		}
4570 		perf_mmap__read_done(&md->core);
4571 	}
4572 
4573 	if (trace->nr_events == before) {
4574 		int timeout = done ? 100 : -1;
4575 
4576 		if (!draining && evlist__poll(evlist, timeout) > 0) {
4577 			if (evlist__filter_pollfd(evlist, POLLERR | POLLHUP | POLLNVAL) == 0)
4578 				draining = true;
4579 
4580 			goto again;
4581 		} else {
4582 			if (trace__flush_events(trace))
4583 				goto out_disable;
4584 		}
4585 	} else {
4586 		goto again;
4587 	}
4588 
4589 out_disable:
4590 	thread__zput(trace->current);
4591 
4592 	evlist__disable(evlist);
4593 
4594 	if (trace->summary_bpf)
4595 		trace_end_bpf_summary();
4596 
4597 	if (trace->sort_events)
4598 		ordered_events__flush(&trace->oe.data, OE_FLUSH__FINAL);
4599 
4600 	if (!err) {
4601 		if (trace->summary) {
4602 			if (trace->summary_bpf)
4603 				trace_print_bpf_summary(trace->output, trace->max_summary);
4604 			else if (trace->summary_mode == SUMMARY__BY_TOTAL)
4605 				trace__fprintf_total_summary(trace, trace->output);
4606 			else
4607 				trace__fprintf_thread_summary(trace, trace->output);
4608 		}
4609 
4610 		if (trace->show_tool_stats) {
4611 			fprintf(trace->output, "Stats:\n "
4612 					       " vfs_getname : %" PRIu64 "\n"
4613 					       " proc_getname: %" PRIu64 "\n",
4614 				trace->stats.vfs_getname,
4615 				trace->stats.proc_getname);
4616 		}
4617 	}
4618 
4619 out_delete_evlist:
4620 	trace_cleanup_bpf_summary();
4621 	delete_syscall_stats(trace->syscall_stats);
4622 	trace__symbols__exit(trace);
4623 	evlist__free_syscall_tp_fields(evlist);
4624 	evlist__delete(evlist);
4625 	cgroup__put(trace->cgroup);
4626 	trace->evlist = NULL;
4627 	trace->live = false;
4628 	return err;
4629 {
4630 	char errbuf[BUFSIZ];
4631 
4632 out_error_sched_stat_runtime:
4633 	tracing_path__strerror_open_tp(errno, errbuf, sizeof(errbuf), "sched", "sched_stat_runtime");
4634 	goto out_error;
4635 
4636 out_error_raw_syscalls:
4637 	tracing_path__strerror_open_tp(errno, errbuf, sizeof(errbuf), "raw_syscalls", "sys_(enter|exit)");
4638 	goto out_error;
4639 
4640 out_error_mmap:
4641 	evlist__strerror_mmap(evlist, errno, errbuf, sizeof(errbuf));
4642 	goto out_error;
4643 
4644 out_error_open:
4645 	evlist__strerror_open(evlist, errno, errbuf, sizeof(errbuf));
4646 
4647 out_error:
4648 	fprintf(trace->output, "%s\n", errbuf);
4649 	goto out_delete_evlist;
4650 
4651 out_error_apply_filters:
4652 	fprintf(trace->output,
4653 		"Failed to set filter \"%s\" on event %s with %d (%s)\n",
4654 		evsel->filter, evsel__name(evsel), errno,
4655 		str_error_r(errno, errbuf, sizeof(errbuf)));
4656 	goto out_delete_evlist;
4657 }
4658 out_error_mem:
4659 	fprintf(trace->output, "Not enough memory to run!\n");
4660 	goto out_delete_evlist;
4661 
4662 out_errno:
4663 	fprintf(trace->output, "errno=%d,%s\n", errno, strerror(errno));
4664 	goto out_delete_evlist;
4665 }
4666 
trace__replay(struct trace * trace)4667 static int trace__replay(struct trace *trace)
4668 {
4669 	const struct evsel_str_handler handlers[] = {
4670 		{ "probe:vfs_getname",	     trace__vfs_getname, },
4671 	};
4672 	struct perf_data data = {
4673 		.path  = input_name,
4674 		.mode  = PERF_DATA_MODE_READ,
4675 		.force = trace->force,
4676 	};
4677 	struct perf_session *session;
4678 	struct evsel *evsel;
4679 	int err = -1;
4680 
4681 	perf_tool__init(&trace->tool, /*ordered_events=*/true);
4682 	trace->tool.sample	  = trace__process_sample;
4683 	trace->tool.mmap	  = perf_event__process_mmap;
4684 	trace->tool.mmap2	  = perf_event__process_mmap2;
4685 	trace->tool.comm	  = perf_event__process_comm;
4686 	trace->tool.exit	  = perf_event__process_exit;
4687 	trace->tool.fork	  = perf_event__process_fork;
4688 	trace->tool.attr	  = perf_event__process_attr;
4689 	trace->tool.tracing_data  = perf_event__process_tracing_data;
4690 	trace->tool.build_id	  = perf_event__process_build_id;
4691 	trace->tool.namespaces	  = perf_event__process_namespaces;
4692 
4693 	trace->tool.ordered_events = true;
4694 	trace->tool.ordering_requires_timestamps = true;
4695 
4696 	/* add tid to output */
4697 	trace->multiple_threads = true;
4698 
4699 	session = perf_session__new(&data, &trace->tool);
4700 	if (IS_ERR(session))
4701 		return PTR_ERR(session);
4702 
4703 	if (trace->opts.target.pid)
4704 		symbol_conf.pid_list_str = strdup(trace->opts.target.pid);
4705 
4706 	if (trace->opts.target.tid)
4707 		symbol_conf.tid_list_str = strdup(trace->opts.target.tid);
4708 
4709 	if (symbol__init(perf_session__env(session)) < 0)
4710 		goto out;
4711 
4712 	trace->host = &session->machines.host;
4713 
4714 	err = perf_session__set_tracepoints_handlers(session, handlers);
4715 	if (err)
4716 		goto out;
4717 
4718 	evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_enter");
4719 	trace->syscalls.events.sys_enter = evsel;
4720 	/* older kernels have syscalls tp versus raw_syscalls */
4721 	if (evsel == NULL)
4722 		evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_enter");
4723 
4724 	if (evsel &&
4725 	    (evsel__init_raw_syscall_tp(evsel, trace__sys_enter) < 0 ||
4726 	    perf_evsel__init_sc_tp_ptr_field(evsel, args))) {
4727 		pr_err("Error during initialize raw_syscalls:sys_enter event\n");
4728 		goto out;
4729 	}
4730 
4731 	evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_exit");
4732 	trace->syscalls.events.sys_exit = evsel;
4733 	if (evsel == NULL)
4734 		evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_exit");
4735 	if (evsel &&
4736 	    (evsel__init_raw_syscall_tp(evsel, trace__sys_exit) < 0 ||
4737 	    perf_evsel__init_sc_tp_uint_field(evsel, ret))) {
4738 		pr_err("Error during initialize raw_syscalls:sys_exit event\n");
4739 		goto out;
4740 	}
4741 
4742 	evlist__for_each_entry(session->evlist, evsel) {
4743 		if (evsel->core.attr.type == PERF_TYPE_SOFTWARE &&
4744 		    (evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ||
4745 		     evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MIN ||
4746 		     evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS))
4747 			evsel->handler = trace__pgfault;
4748 	}
4749 
4750 	if (trace->summary_mode == SUMMARY__BY_TOTAL) {
4751 		trace->syscall_stats = alloc_syscall_stats();
4752 		if (IS_ERR(trace->syscall_stats))
4753 			goto out;
4754 	}
4755 
4756 	setup_pager();
4757 
4758 	err = perf_session__process_events(session);
4759 	if (err)
4760 		pr_err("Failed to process events, error %d", err);
4761 
4762 	else if (trace->summary)
4763 		trace__fprintf_thread_summary(trace, trace->output);
4764 
4765 out:
4766 	delete_syscall_stats(trace->syscall_stats);
4767 	perf_session__delete(session);
4768 
4769 	return err;
4770 }
4771 
trace__fprintf_summary_header(FILE * fp)4772 static size_t trace__fprintf_summary_header(FILE *fp)
4773 {
4774 	size_t printed;
4775 
4776 	printed  = fprintf(fp, "\n Summary of events:\n\n");
4777 
4778 	return printed;
4779 }
4780 
4781 struct syscall_entry {
4782 	struct syscall_stats *stats;
4783 	double		     msecs;
4784 	int		     syscall;
4785 };
4786 
entry_cmp(const void * e1,const void * e2)4787 static int entry_cmp(const void *e1, const void *e2)
4788 {
4789 	const struct syscall_entry *entry1 = e1;
4790 	const struct syscall_entry *entry2 = e2;
4791 
4792 	return entry1->msecs > entry2->msecs ? -1 : 1;
4793 }
4794 
syscall__sort_stats(struct hashmap * syscall_stats)4795 static struct syscall_entry *syscall__sort_stats(struct hashmap *syscall_stats)
4796 {
4797 	struct syscall_entry *entry;
4798 	struct hashmap_entry *pos;
4799 	unsigned bkt, i, nr;
4800 
4801 	nr = syscall_stats->sz;
4802 	entry = malloc(nr * sizeof(*entry));
4803 	if (entry == NULL)
4804 		return NULL;
4805 
4806 	i = 0;
4807 	hashmap__for_each_entry(syscall_stats, pos, bkt) {
4808 		struct syscall_stats *ss = pos->pvalue;
4809 		struct stats *st = &ss->stats;
4810 
4811 		entry[i].stats = ss;
4812 		entry[i].msecs = (u64)st->n * (avg_stats(st) / NSEC_PER_MSEC);
4813 		entry[i].syscall = pos->key;
4814 		i++;
4815 	}
4816 	assert(i == nr);
4817 
4818 	qsort(entry, nr, sizeof(*entry), entry_cmp);
4819 	return entry;
4820 }
4821 
syscall__dump_stats(struct trace * trace,int e_machine,FILE * fp,struct hashmap * syscall_stats)4822 static size_t syscall__dump_stats(struct trace *trace, int e_machine, FILE *fp,
4823 				  struct hashmap *syscall_stats)
4824 {
4825 	size_t printed = 0;
4826 	int lines = 0;
4827 	struct syscall *sc;
4828 	struct syscall_entry *entries;
4829 
4830 	entries = syscall__sort_stats(syscall_stats);
4831 	if (entries == NULL)
4832 		return 0;
4833 
4834 	printed += fprintf(fp, "\n");
4835 
4836 	printed += fprintf(fp, "   syscall            calls  errors  total       min       avg       max       stddev\n");
4837 	printed += fprintf(fp, "                                     (msec)    (msec)    (msec)    (msec)        (%%)\n");
4838 	printed += fprintf(fp, "   --------------- --------  ------ -------- --------- --------- ---------     ------\n");
4839 
4840 	for (size_t i = 0; i < syscall_stats->sz; i++) {
4841 		struct syscall_entry *entry = &entries[i];
4842 		struct syscall_stats *stats = entry->stats;
4843 
4844 		if (stats) {
4845 			double min = (double)(stats->stats.min) / NSEC_PER_MSEC;
4846 			double max = (double)(stats->stats.max) / NSEC_PER_MSEC;
4847 			double avg = avg_stats(&stats->stats);
4848 			double pct;
4849 			u64 n = (u64)stats->stats.n;
4850 
4851 			pct = avg ? 100.0 * stddev_stats(&stats->stats) / avg : 0.0;
4852 			avg /= NSEC_PER_MSEC;
4853 
4854 			sc = trace__syscall_info(trace, /*evsel=*/NULL, e_machine, entry->syscall);
4855 			if (!sc)
4856 				continue;
4857 
4858 			printed += fprintf(fp, "   %-15s", sc->name);
4859 			printed += fprintf(fp, " %8" PRIu64 " %6" PRIu64 " %9.3f %9.3f %9.3f",
4860 					   n, stats->nr_failures, entry->msecs, min, avg);
4861 			printed += fprintf(fp, " %9.3f %9.2f%%\n", max, pct);
4862 
4863 			if (trace->errno_summary && stats->nr_failures) {
4864 				int e;
4865 
4866 				for (e = 0; e < stats->max_errno; ++e) {
4867 					if (stats->errnos[e] != 0)
4868 						fprintf(fp, "\t\t\t\t%s: %d\n", perf_env__arch_strerrno(trace->host->env, e + 1), stats->errnos[e]);
4869 				}
4870 			}
4871 			lines++;
4872 		}
4873 
4874 		if (trace->max_summary && trace->max_summary <= lines)
4875 			break;
4876 	}
4877 
4878 	free(entries);
4879 	printed += fprintf(fp, "\n\n");
4880 
4881 	return printed;
4882 }
4883 
thread__dump_stats(struct thread_trace * ttrace,struct trace * trace,int e_machine,FILE * fp)4884 static size_t thread__dump_stats(struct thread_trace *ttrace,
4885 				 struct trace *trace, int e_machine, FILE *fp)
4886 {
4887 	return syscall__dump_stats(trace, e_machine, fp, ttrace->syscall_stats);
4888 }
4889 
system__dump_stats(struct trace * trace,int e_machine,FILE * fp)4890 static size_t system__dump_stats(struct trace *trace, int e_machine, FILE *fp)
4891 {
4892 	return syscall__dump_stats(trace, e_machine, fp, trace->syscall_stats);
4893 }
4894 
trace__fprintf_thread(FILE * fp,struct thread * thread,struct trace * trace)4895 static size_t trace__fprintf_thread(FILE *fp, struct thread *thread, struct trace *trace)
4896 {
4897 	size_t printed = 0;
4898 	struct thread_trace *ttrace = thread__priv(thread);
4899 	int e_machine = thread__e_machine(thread, trace->host);
4900 	double ratio;
4901 
4902 	if (ttrace == NULL)
4903 		return 0;
4904 
4905 	ratio = (double)ttrace->nr_events / trace->nr_events * 100.0;
4906 
4907 	printed += fprintf(fp, " %s (%d), ", thread__comm_str(thread), thread__tid(thread));
4908 	printed += fprintf(fp, "%lu events, ", ttrace->nr_events);
4909 	printed += fprintf(fp, "%.1f%%", ratio);
4910 	if (ttrace->pfmaj)
4911 		printed += fprintf(fp, ", %lu majfaults", ttrace->pfmaj);
4912 	if (ttrace->pfmin)
4913 		printed += fprintf(fp, ", %lu minfaults", ttrace->pfmin);
4914 	if (trace->sched)
4915 		printed += fprintf(fp, ", %.3f msec\n", ttrace->runtime_ms);
4916 	else if (fputc('\n', fp) != EOF)
4917 		++printed;
4918 
4919 	printed += thread__dump_stats(ttrace, trace, e_machine, fp);
4920 
4921 	return printed;
4922 }
4923 
thread__nr_events(struct thread_trace * ttrace)4924 static unsigned long thread__nr_events(struct thread_trace *ttrace)
4925 {
4926 	return ttrace ? ttrace->nr_events : 0;
4927 }
4928 
trace_nr_events_cmp(void * priv __maybe_unused,const struct list_head * la,const struct list_head * lb)4929 static int trace_nr_events_cmp(void *priv __maybe_unused,
4930 			       const struct list_head *la,
4931 			       const struct list_head *lb)
4932 {
4933 	struct thread_list *a = list_entry(la, struct thread_list, list);
4934 	struct thread_list *b = list_entry(lb, struct thread_list, list);
4935 	unsigned long a_nr_events = thread__nr_events(thread__priv(a->thread));
4936 	unsigned long b_nr_events = thread__nr_events(thread__priv(b->thread));
4937 
4938 	if (a_nr_events != b_nr_events)
4939 		return a_nr_events < b_nr_events ? -1 : 1;
4940 
4941 	/* Identical number of threads, place smaller tids first. */
4942 	return thread__tid(a->thread) < thread__tid(b->thread)
4943 		? -1
4944 		: (thread__tid(a->thread) > thread__tid(b->thread) ? 1 : 0);
4945 }
4946 
trace__fprintf_thread_summary(struct trace * trace,FILE * fp)4947 static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp)
4948 {
4949 	size_t printed = trace__fprintf_summary_header(fp);
4950 	LIST_HEAD(threads);
4951 
4952 	if (machine__thread_list(trace->host, &threads) == 0) {
4953 		struct thread_list *pos;
4954 
4955 		list_sort(NULL, &threads, trace_nr_events_cmp);
4956 
4957 		list_for_each_entry(pos, &threads, list)
4958 			printed += trace__fprintf_thread(fp, pos->thread, trace);
4959 	}
4960 	thread_list__delete(&threads);
4961 	return printed;
4962 }
4963 
trace__fprintf_total_summary(struct trace * trace,FILE * fp)4964 static size_t trace__fprintf_total_summary(struct trace *trace, FILE *fp)
4965 {
4966 	size_t printed = trace__fprintf_summary_header(fp);
4967 
4968 	printed += fprintf(fp, " total, ");
4969 	printed += fprintf(fp, "%lu events", trace->nr_events);
4970 
4971 	if (trace->pfmaj)
4972 		printed += fprintf(fp, ", %lu majfaults", trace->pfmaj);
4973 	if (trace->pfmin)
4974 		printed += fprintf(fp, ", %lu minfaults", trace->pfmin);
4975 	if (trace->sched)
4976 		printed += fprintf(fp, ", %.3f msec\n", trace->runtime_ms);
4977 	else if (fputc('\n', fp) != EOF)
4978 		++printed;
4979 
4980 	/* TODO: get all system e_machines. */
4981 	printed += system__dump_stats(trace, EM_HOST, fp);
4982 
4983 	return printed;
4984 }
4985 
trace__set_duration(const struct option * opt,const char * str,int unset __maybe_unused)4986 static int trace__set_duration(const struct option *opt, const char *str,
4987 			       int unset __maybe_unused)
4988 {
4989 	struct trace *trace = opt->value;
4990 
4991 	trace->duration_filter = atof(str);
4992 	return 0;
4993 }
4994 
trace__set_filter_pids_from_option(const struct option * opt,const char * str,int unset __maybe_unused)4995 static int trace__set_filter_pids_from_option(const struct option *opt, const char *str,
4996 					      int unset __maybe_unused)
4997 {
4998 	int ret = -1;
4999 	size_t i;
5000 	struct trace *trace = opt->value;
5001 	/*
5002 	 * FIXME: introduce a intarray class, plain parse csv and create a
5003 	 * { int nr, int entries[] } struct...
5004 	 */
5005 	struct intlist *list = intlist__new(str);
5006 
5007 	if (list == NULL)
5008 		return -1;
5009 
5010 	i = trace->filter_pids.nr = intlist__nr_entries(list) + 1;
5011 	trace->filter_pids.entries = calloc(i, sizeof(pid_t));
5012 
5013 	if (trace->filter_pids.entries == NULL)
5014 		goto out;
5015 
5016 	trace->filter_pids.entries[0] = getpid();
5017 
5018 	for (i = 1; i < trace->filter_pids.nr; ++i)
5019 		trace->filter_pids.entries[i] = intlist__entry(list, i - 1)->i;
5020 
5021 	intlist__delete(list);
5022 	ret = 0;
5023 out:
5024 	return ret;
5025 }
5026 
trace__open_output(struct trace * trace,const char * filename)5027 static int trace__open_output(struct trace *trace, const char *filename)
5028 {
5029 	struct stat st;
5030 
5031 	if (!stat(filename, &st) && st.st_size) {
5032 		char oldname[PATH_MAX];
5033 
5034 		scnprintf(oldname, sizeof(oldname), "%s.old", filename);
5035 		unlink(oldname);
5036 		rename(filename, oldname);
5037 	}
5038 
5039 	trace->output = fopen(filename, "w");
5040 
5041 	return trace->output == NULL ? -errno : 0;
5042 }
5043 
parse_pagefaults(const struct option * opt,const char * str,int unset __maybe_unused)5044 static int parse_pagefaults(const struct option *opt, const char *str,
5045 			    int unset __maybe_unused)
5046 {
5047 	int *trace_pgfaults = opt->value;
5048 
5049 	if (strcmp(str, "all") == 0)
5050 		*trace_pgfaults |= TRACE_PFMAJ | TRACE_PFMIN;
5051 	else if (strcmp(str, "maj") == 0)
5052 		*trace_pgfaults |= TRACE_PFMAJ;
5053 	else if (strcmp(str, "min") == 0)
5054 		*trace_pgfaults |= TRACE_PFMIN;
5055 	else
5056 		return -1;
5057 
5058 	return 0;
5059 }
5060 
evlist__set_default_evsel_handler(struct evlist * evlist,void * handler)5061 static void evlist__set_default_evsel_handler(struct evlist *evlist, void *handler)
5062 {
5063 	struct evsel *evsel;
5064 
5065 	evlist__for_each_entry(evlist, evsel) {
5066 		if (evsel->handler == NULL)
5067 			evsel->handler = handler;
5068 	}
5069 }
5070 
evsel__set_syscall_arg_fmt(struct evsel * evsel,const char * name)5071 static void evsel__set_syscall_arg_fmt(struct evsel *evsel, const char *name)
5072 {
5073 	struct syscall_arg_fmt *fmt = evsel__syscall_arg_fmt(evsel);
5074 
5075 	if (fmt) {
5076 		const struct syscall_fmt *scfmt = syscall_fmt__find(name);
5077 
5078 		if (scfmt) {
5079 			const struct tep_event *tp_format = evsel__tp_format(evsel);
5080 
5081 			if (tp_format) {
5082 				int skip = 0;
5083 
5084 				if (strcmp(tp_format->format.fields->name, "__syscall_nr") == 0 ||
5085 				    strcmp(tp_format->format.fields->name, "nr") == 0)
5086 					++skip;
5087 
5088 				memcpy(fmt + skip, scfmt->arg,
5089 				       (tp_format->format.nr_fields - skip) * sizeof(*fmt));
5090 			}
5091 		}
5092 	}
5093 }
5094 
evlist__set_syscall_tp_fields(struct evlist * evlist,bool * use_btf)5095 static int evlist__set_syscall_tp_fields(struct evlist *evlist, bool *use_btf)
5096 {
5097 	struct evsel *evsel;
5098 
5099 	evlist__for_each_entry(evlist, evsel) {
5100 		const struct tep_event *tp_format;
5101 
5102 		if (evsel->priv)
5103 			continue;
5104 
5105 		tp_format = evsel__tp_format(evsel);
5106 		if (!tp_format)
5107 			continue;
5108 
5109 		if (strcmp(tp_format->system, "syscalls")) {
5110 			evsel__init_tp_arg_scnprintf(evsel, use_btf);
5111 			continue;
5112 		}
5113 
5114 		if (evsel__init_syscall_tp(evsel))
5115 			return -1;
5116 
5117 		if (!strncmp(tp_format->name, "sys_enter_", 10)) {
5118 			struct syscall_tp *sc = __evsel__syscall_tp(evsel);
5119 
5120 			if (__tp_field__init_ptr(&sc->args, sc->id.offset + sizeof(u64)))
5121 				return -1;
5122 
5123 			evsel__set_syscall_arg_fmt(evsel,
5124 						   tp_format->name + sizeof("sys_enter_") - 1);
5125 		} else if (!strncmp(tp_format->name, "sys_exit_", 9)) {
5126 			struct syscall_tp *sc = __evsel__syscall_tp(evsel);
5127 
5128 			if (__tp_field__init_uint(&sc->ret, sizeof(u64),
5129 						  sc->id.offset + sizeof(u64),
5130 						  evsel->needs_swap))
5131 				return -1;
5132 
5133 			evsel__set_syscall_arg_fmt(evsel,
5134 						   tp_format->name + sizeof("sys_exit_") - 1);
5135 		}
5136 	}
5137 
5138 	return 0;
5139 }
5140 
5141 /*
5142  * XXX: Hackish, just splitting the combined -e+--event (syscalls
5143  * (raw_syscalls:{sys_{enter,exit}} + events (tracepoints, HW, SW, etc) to use
5144  * existing facilities unchanged (trace->ev_qualifier + parse_options()).
5145  *
5146  * It'd be better to introduce a parse_options() variant that would return a
5147  * list with the terms it didn't match to an event...
5148  */
trace__parse_events_option(const struct option * opt,const char * str,int unset __maybe_unused)5149 static int trace__parse_events_option(const struct option *opt, const char *str,
5150 				      int unset __maybe_unused)
5151 {
5152 	struct trace *trace = (struct trace *)opt->value;
5153 	const char *s = str;
5154 	char *sep = NULL, *lists[2] = { NULL, NULL, };
5155 	int len = strlen(str) + 1, err = -1, list, idx;
5156 	char *strace_groups_dir = system_path(STRACE_GROUPS_DIR);
5157 	char group_name[PATH_MAX];
5158 	const struct syscall_fmt *fmt;
5159 
5160 	if (strace_groups_dir == NULL)
5161 		return -1;
5162 
5163 	if (*s == '!') {
5164 		++s;
5165 		trace->not_ev_qualifier = true;
5166 	}
5167 
5168 	while (1) {
5169 		if ((sep = strchr(s, ',')) != NULL)
5170 			*sep = '\0';
5171 
5172 		list = 0;
5173 		/* TODO: support for more than just perf binary machine type syscalls. */
5174 		if (syscalltbl__id(EM_HOST, s) >= 0 ||
5175 		    syscalltbl__strglobmatch_first(EM_HOST, s, &idx) >= 0) {
5176 			list = 1;
5177 			goto do_concat;
5178 		}
5179 
5180 		fmt = syscall_fmt__find_by_alias(s);
5181 		if (fmt != NULL) {
5182 			list = 1;
5183 			s = fmt->name;
5184 		} else {
5185 			path__join(group_name, sizeof(group_name), strace_groups_dir, s);
5186 			if (access(group_name, R_OK) == 0)
5187 				list = 1;
5188 		}
5189 do_concat:
5190 		if (lists[list]) {
5191 			sprintf(lists[list] + strlen(lists[list]), ",%s", s);
5192 		} else {
5193 			lists[list] = malloc(len);
5194 			if (lists[list] == NULL)
5195 				goto out;
5196 			strcpy(lists[list], s);
5197 		}
5198 
5199 		if (!sep)
5200 			break;
5201 
5202 		*sep = ',';
5203 		s = sep + 1;
5204 	}
5205 
5206 	if (lists[1] != NULL) {
5207 		struct strlist_config slist_config = {
5208 			.dirname = strace_groups_dir,
5209 		};
5210 
5211 		trace->ev_qualifier = strlist__new(lists[1], &slist_config);
5212 		if (trace->ev_qualifier == NULL) {
5213 			fputs("Not enough memory to parse event qualifier", trace->output);
5214 			goto out;
5215 		}
5216 
5217 		if (trace__validate_ev_qualifier(trace))
5218 			goto out;
5219 		trace->trace_syscalls = true;
5220 	}
5221 
5222 	err = 0;
5223 
5224 	if (lists[0]) {
5225 		struct parse_events_option_args parse_events_option_args = {
5226 			.evlistp = &trace->evlist,
5227 		};
5228 		struct option o = {
5229 			.value = &parse_events_option_args,
5230 		};
5231 		err = parse_events_option(&o, lists[0], 0);
5232 	}
5233 out:
5234 	free(strace_groups_dir);
5235 	free(lists[0]);
5236 	free(lists[1]);
5237 	if (sep)
5238 		*sep = ',';
5239 
5240 	return err;
5241 }
5242 
trace__parse_cgroups(const struct option * opt,const char * str,int unset)5243 static int trace__parse_cgroups(const struct option *opt, const char *str, int unset)
5244 {
5245 	struct trace *trace = opt->value;
5246 
5247 	if (!list_empty(&trace->evlist->core.entries)) {
5248 		struct option o = {
5249 			.value = &trace->evlist,
5250 		};
5251 		return parse_cgroups(&o, str, unset);
5252 	}
5253 	trace->cgroup = evlist__findnew_cgroup(trace->evlist, str);
5254 
5255 	return 0;
5256 }
5257 
trace__parse_summary_mode(const struct option * opt,const char * str,int unset __maybe_unused)5258 static int trace__parse_summary_mode(const struct option *opt, const char *str,
5259 				     int unset __maybe_unused)
5260 {
5261 	struct trace *trace = opt->value;
5262 
5263 	if (!strcmp(str, "thread")) {
5264 		trace->summary_mode = SUMMARY__BY_THREAD;
5265 	} else if (!strcmp(str, "total")) {
5266 		trace->summary_mode = SUMMARY__BY_TOTAL;
5267 	} else if (!strcmp(str, "cgroup")) {
5268 		trace->summary_mode = SUMMARY__BY_CGROUP;
5269 	} else {
5270 		pr_err("Unknown summary mode: %s\n", str);
5271 		return -1;
5272 	}
5273 
5274 	return 0;
5275 }
5276 
trace__config(const char * var,const char * value,void * arg)5277 static int trace__config(const char *var, const char *value, void *arg)
5278 {
5279 	struct trace *trace = arg;
5280 	int err = 0;
5281 
5282 	if (!strcmp(var, "trace.add_events")) {
5283 		trace->perfconfig_events = strdup(value);
5284 		if (trace->perfconfig_events == NULL) {
5285 			pr_err("Not enough memory for %s\n", "trace.add_events");
5286 			return -1;
5287 		}
5288 	} else if (!strcmp(var, "trace.show_timestamp")) {
5289 		trace->show_tstamp = perf_config_bool(var, value);
5290 	} else if (!strcmp(var, "trace.show_duration")) {
5291 		trace->show_duration = perf_config_bool(var, value);
5292 	} else if (!strcmp(var, "trace.show_arg_names")) {
5293 		trace->show_arg_names = perf_config_bool(var, value);
5294 		if (!trace->show_arg_names)
5295 			trace->show_zeros = true;
5296 	} else if (!strcmp(var, "trace.show_zeros")) {
5297 		bool new_show_zeros = perf_config_bool(var, value);
5298 		if (!trace->show_arg_names && !new_show_zeros) {
5299 			pr_warning("trace.show_zeros has to be set when trace.show_arg_names=no\n");
5300 			goto out;
5301 		}
5302 		trace->show_zeros = new_show_zeros;
5303 	} else if (!strcmp(var, "trace.show_prefix")) {
5304 		trace->show_string_prefix = perf_config_bool(var, value);
5305 	} else if (!strcmp(var, "trace.no_inherit")) {
5306 		trace->opts.no_inherit = perf_config_bool(var, value);
5307 	} else if (!strcmp(var, "trace.args_alignment")) {
5308 		int args_alignment = 0;
5309 		if (perf_config_int(&args_alignment, var, value) == 0)
5310 			trace->args_alignment = args_alignment;
5311 	} else if (!strcmp(var, "trace.tracepoint_beautifiers")) {
5312 		if (strcasecmp(value, "libtraceevent") == 0)
5313 			trace->libtraceevent_print = true;
5314 		else if (strcasecmp(value, "libbeauty") == 0)
5315 			trace->libtraceevent_print = false;
5316 	}
5317 out:
5318 	return err;
5319 }
5320 
trace__exit(struct trace * trace)5321 static void trace__exit(struct trace *trace)
5322 {
5323 	thread__zput(trace->current);
5324 	strlist__delete(trace->ev_qualifier);
5325 	zfree(&trace->ev_qualifier_ids.entries);
5326 	if (trace->syscalls.table) {
5327 		for (size_t i = 0; i < trace->syscalls.table_size; i++)
5328 			syscall__delete(trace->syscalls.table[i]);
5329 		zfree(&trace->syscalls.table);
5330 	}
5331 	zfree(&trace->perfconfig_events);
5332 	evlist__delete(trace->evlist);
5333 	trace->evlist = NULL;
5334 	ordered_events__free(&trace->oe.data);
5335 #ifdef HAVE_LIBBPF_SUPPORT
5336 	btf__free(trace->btf);
5337 	trace->btf = NULL;
5338 #endif
5339 }
5340 
cmd_trace(int argc,const char ** argv)5341 int cmd_trace(int argc, const char **argv)
5342 {
5343 	const char *trace_usage[] = {
5344 		"perf trace [<options>] [<command>]",
5345 		"perf trace [<options>] -- <command> [<options>]",
5346 		"perf trace record [<options>] [<command>]",
5347 		"perf trace record [<options>] -- <command> [<options>]",
5348 		NULL
5349 	};
5350 	struct trace trace = {
5351 		.opts = {
5352 			.target = {
5353 				.uses_mmap = true,
5354 			},
5355 			.user_freq     = UINT_MAX,
5356 			.user_interval = ULLONG_MAX,
5357 			.no_buffering  = true,
5358 			.mmap_pages    = UINT_MAX,
5359 		},
5360 		.output = stderr,
5361 		.show_comm = true,
5362 		.show_tstamp = true,
5363 		.show_duration = true,
5364 		.show_arg_names = true,
5365 		.args_alignment = 70,
5366 		.trace_syscalls = false,
5367 		.kernel_syscallchains = false,
5368 		.max_stack = UINT_MAX,
5369 		.max_events = ULONG_MAX,
5370 	};
5371 	const char *output_name = NULL;
5372 	const struct option trace_options[] = {
5373 	OPT_CALLBACK('e', "event", &trace, "event",
5374 		     "event/syscall selector. use 'perf list' to list available events",
5375 		     trace__parse_events_option),
5376 	OPT_CALLBACK(0, "filter", &trace.evlist, "filter",
5377 		     "event filter", parse_filter),
5378 	OPT_BOOLEAN(0, "comm", &trace.show_comm,
5379 		    "show the thread COMM next to its id"),
5380 	OPT_BOOLEAN(0, "tool_stats", &trace.show_tool_stats, "show tool stats"),
5381 	OPT_CALLBACK(0, "expr", &trace, "expr", "list of syscalls/events to trace",
5382 		     trace__parse_events_option),
5383 	OPT_STRING('o', "output", &output_name, "file", "output file name"),
5384 	OPT_STRING('i', "input", &input_name, "file", "Analyze events in file"),
5385 	OPT_STRING('p', "pid", &trace.opts.target.pid, "pid",
5386 		    "trace events on existing process id"),
5387 	OPT_STRING('t', "tid", &trace.opts.target.tid, "tid",
5388 		    "trace events on existing thread id"),
5389 	OPT_CALLBACK(0, "filter-pids", &trace, "CSV list of pids",
5390 		     "pids to filter (by the kernel)", trace__set_filter_pids_from_option),
5391 	OPT_BOOLEAN('a', "all-cpus", &trace.opts.target.system_wide,
5392 		    "system-wide collection from all CPUs"),
5393 	OPT_STRING('C', "cpu", &trace.opts.target.cpu_list, "cpu",
5394 		    "list of cpus to monitor"),
5395 	OPT_BOOLEAN(0, "no-inherit", &trace.opts.no_inherit,
5396 		    "child tasks do not inherit counters"),
5397 	OPT_CALLBACK('m', "mmap-pages", &trace.opts.mmap_pages, "pages",
5398 		     "number of mmap data pages", evlist__parse_mmap_pages),
5399 	OPT_STRING('u', "uid", &trace.uid_str, "user", "user to profile"),
5400 	OPT_CALLBACK(0, "duration", &trace, "float",
5401 		     "show only events with duration > N.M ms",
5402 		     trace__set_duration),
5403 	OPT_BOOLEAN(0, "sched", &trace.sched, "show blocking scheduler events"),
5404 	OPT_INCR('v', "verbose", &verbose, "be more verbose"),
5405 	OPT_BOOLEAN('T', "time", &trace.full_time,
5406 		    "Show full timestamp, not time relative to first start"),
5407 	OPT_BOOLEAN(0, "failure", &trace.failure_only,
5408 		    "Show only syscalls that failed"),
5409 	OPT_BOOLEAN('s', "summary", &trace.summary_only,
5410 		    "Show only syscall summary with statistics"),
5411 	OPT_BOOLEAN('S', "with-summary", &trace.summary,
5412 		    "Show all syscalls and summary with statistics"),
5413 	OPT_BOOLEAN(0, "errno-summary", &trace.errno_summary,
5414 		    "Show errno stats per syscall, use with -s or -S"),
5415 	OPT_CALLBACK(0, "summary-mode", &trace, "mode",
5416 		     "How to show summary: select thread (default), total or cgroup",
5417 		     trace__parse_summary_mode),
5418 	OPT_CALLBACK_DEFAULT('F', "pf", &trace.trace_pgfaults, "all|maj|min",
5419 		     "Trace pagefaults", parse_pagefaults, "maj"),
5420 	OPT_BOOLEAN(0, "syscalls", &trace.trace_syscalls, "Trace syscalls"),
5421 	OPT_BOOLEAN('f', "force", &trace.force, "don't complain, do it"),
5422 	OPT_CALLBACK(0, "call-graph", &trace.opts,
5423 		     "record_mode[,record_size]", record_callchain_help,
5424 		     &record_parse_callchain_opt),
5425 	OPT_BOOLEAN(0, "libtraceevent_print", &trace.libtraceevent_print,
5426 		    "Use libtraceevent to print the tracepoint arguments."),
5427 	OPT_BOOLEAN(0, "kernel-syscall-graph", &trace.kernel_syscallchains,
5428 		    "Show the kernel callchains on the syscall exit path"),
5429 	OPT_ULONG(0, "max-events", &trace.max_events,
5430 		"Set the maximum number of events to print, exit after that is reached. "),
5431 	OPT_UINTEGER(0, "min-stack", &trace.min_stack,
5432 		     "Set the minimum stack depth when parsing the callchain, "
5433 		     "anything below the specified depth will be ignored."),
5434 	OPT_UINTEGER(0, "max-stack", &trace.max_stack,
5435 		     "Set the maximum stack depth when parsing the callchain, "
5436 		     "anything beyond the specified depth will be ignored. "
5437 		     "Default: kernel.perf_event_max_stack or " __stringify(PERF_MAX_STACK_DEPTH)),
5438 	OPT_BOOLEAN(0, "sort-events", &trace.sort_events,
5439 			"Sort batch of events before processing, use if getting out of order events"),
5440 	OPT_BOOLEAN(0, "print-sample", &trace.print_sample,
5441 			"print the PERF_RECORD_SAMPLE PERF_SAMPLE_ info, for debugging"),
5442 	OPT_UINTEGER(0, "proc-map-timeout", &proc_map_timeout,
5443 			"per thread proc mmap processing timeout in ms"),
5444 	OPT_CALLBACK('G', "cgroup", &trace, "name", "monitor event in cgroup name only",
5445 		     trace__parse_cgroups),
5446 	OPT_INTEGER('D', "delay", &trace.opts.target.initial_delay,
5447 		     "ms to wait before starting measurement after program "
5448 		     "start"),
5449 	OPT_BOOLEAN(0, "force-btf", &trace.force_btf, "Prefer btf_dump general pretty printer"
5450 		       "to customized ones"),
5451 	OPT_BOOLEAN(0, "bpf-summary", &trace.summary_bpf, "Summary syscall stats in BPF"),
5452 	OPT_INTEGER(0, "max-summary", &trace.max_summary,
5453 		     "Max number of entries in the summary."),
5454 	OPTS_EVSWITCH(&trace.evswitch),
5455 	OPT_END()
5456 	};
5457 	bool __maybe_unused max_stack_user_set = true;
5458 	bool mmap_pages_user_set = true;
5459 	struct evsel *evsel;
5460 	const char * const trace_subcommands[] = { "record", NULL };
5461 	int err = -1;
5462 	char bf[BUFSIZ];
5463 	struct sigaction sigchld_act;
5464 
5465 	signal(SIGSEGV, sighandler_dump_stack);
5466 	signal(SIGFPE, sighandler_dump_stack);
5467 	signal(SIGINT, sighandler_interrupt);
5468 
5469 	memset(&sigchld_act, 0, sizeof(sigchld_act));
5470 	sigchld_act.sa_flags = SA_SIGINFO;
5471 	sigchld_act.sa_sigaction = sighandler_chld;
5472 	sigaction(SIGCHLD, &sigchld_act, NULL);
5473 
5474 	ordered_events__init(&trace.oe.data, ordered_events__deliver_event, &trace);
5475 	ordered_events__set_copy_on_queue(&trace.oe.data, true);
5476 
5477 	trace.evlist = evlist__new();
5478 
5479 	if (trace.evlist == NULL) {
5480 		pr_err("Not enough memory to run!\n");
5481 		err = -ENOMEM;
5482 		goto out;
5483 	}
5484 
5485 	/*
5486 	 * Parsing .perfconfig may entail creating a BPF event, that may need
5487 	 * to create BPF maps, so bump RLIM_MEMLOCK as the default 64K setting
5488 	 * is too small. This affects just this process, not touching the
5489 	 * global setting. If it fails we'll get something in 'perf trace -v'
5490 	 * to help diagnose the problem.
5491 	 */
5492 	rlimit__bump_memlock();
5493 
5494 	err = perf_config(trace__config, &trace);
5495 	if (err)
5496 		goto out;
5497 
5498 	argc = parse_options_subcommand(argc, argv, trace_options, trace_subcommands,
5499 				 trace_usage, PARSE_OPT_STOP_AT_NON_OPTION);
5500 
5501 	/*
5502 	 * Here we already passed thru trace__parse_events_option() and it has
5503 	 * already figured out if -e syscall_name, if not but if --event
5504 	 * foo:bar was used, the user is interested _just_ in those, say,
5505 	 * tracepoint events, not in the strace-like syscall-name-based mode.
5506 	 *
5507 	 * This is important because we need to check if strace-like mode is
5508 	 * needed to decided if we should filter out the eBPF
5509 	 * __augmented_syscalls__ code, if it is in the mix, say, via
5510 	 * .perfconfig trace.add_events, and filter those out.
5511 	 */
5512 	if (!trace.trace_syscalls && !trace.trace_pgfaults &&
5513 	    trace.evlist->core.nr_entries == 0 /* Was --events used? */) {
5514 		trace.trace_syscalls = true;
5515 	}
5516 	/*
5517 	 * Now that we have --verbose figured out, lets see if we need to parse
5518 	 * events from .perfconfig, so that if those events fail parsing, say some
5519 	 * BPF program fails, then we'll be able to use --verbose to see what went
5520 	 * wrong in more detail.
5521 	 */
5522 	if (trace.perfconfig_events != NULL) {
5523 		struct parse_events_error parse_err;
5524 
5525 		parse_events_error__init(&parse_err);
5526 		err = parse_events(trace.evlist, trace.perfconfig_events, &parse_err);
5527 		if (err)
5528 			parse_events_error__print(&parse_err, trace.perfconfig_events);
5529 		parse_events_error__exit(&parse_err);
5530 		if (err)
5531 			goto out;
5532 	}
5533 
5534 	if ((nr_cgroups || trace.cgroup) && !trace.opts.target.system_wide) {
5535 		usage_with_options_msg(trace_usage, trace_options,
5536 				       "cgroup monitoring only available in system-wide mode");
5537 	}
5538 
5539 	if (!trace.trace_syscalls)
5540 		goto skip_augmentation;
5541 
5542 	if ((argc >= 1) && (strcmp(argv[0], "record") == 0)) {
5543 		pr_debug("Syscall augmentation fails with record, disabling augmentation");
5544 		goto skip_augmentation;
5545 	}
5546 
5547 	if (trace.summary_bpf) {
5548 		if (!trace.opts.target.system_wide) {
5549 			/* TODO: Add filters in the BPF to support other targets. */
5550 			pr_err("Error: --bpf-summary only works for system-wide mode.\n");
5551 			goto out;
5552 		}
5553 		if (trace.summary_only)
5554 			goto skip_augmentation;
5555 	}
5556 
5557 	err = augmented_syscalls__prepare();
5558 	if (err < 0)
5559 		goto skip_augmentation;
5560 
5561 	trace__add_syscall_newtp(&trace);
5562 
5563 	err = augmented_syscalls__create_bpf_output(trace.evlist);
5564 	if (err == 0)
5565 		trace.syscalls.events.bpf_output = evlist__last(trace.evlist);
5566 
5567 skip_augmentation:
5568 	err = -1;
5569 
5570 	if (trace.trace_pgfaults) {
5571 		trace.opts.sample_address = true;
5572 		trace.opts.sample_time = true;
5573 	}
5574 
5575 	if (trace.opts.mmap_pages == UINT_MAX)
5576 		mmap_pages_user_set = false;
5577 
5578 	if (trace.max_stack == UINT_MAX) {
5579 		trace.max_stack = input_name ? PERF_MAX_STACK_DEPTH : sysctl__max_stack();
5580 		max_stack_user_set = false;
5581 	}
5582 
5583 #ifdef HAVE_DWARF_UNWIND_SUPPORT
5584 	if ((trace.min_stack || max_stack_user_set) && !callchain_param.enabled) {
5585 		record_opts__parse_callchain(&trace.opts, &callchain_param, "dwarf", false);
5586 	}
5587 #endif
5588 
5589 	if (callchain_param.enabled) {
5590 		if (!mmap_pages_user_set && geteuid() == 0)
5591 			trace.opts.mmap_pages = perf_event_mlock_kb_in_pages() * 4;
5592 
5593 		symbol_conf.use_callchain = true;
5594 	}
5595 
5596 	if (trace.evlist->core.nr_entries > 0) {
5597 		bool use_btf = false;
5598 
5599 		evlist__set_default_evsel_handler(trace.evlist, trace__event_handler);
5600 		if (evlist__set_syscall_tp_fields(trace.evlist, &use_btf)) {
5601 			perror("failed to set syscalls:* tracepoint fields");
5602 			goto out;
5603 		}
5604 
5605 		if (use_btf)
5606 			trace__load_vmlinux_btf(&trace);
5607 	}
5608 
5609 	/*
5610 	 * If we are augmenting syscalls, then combine what we put in the
5611 	 * __augmented_syscalls__ BPF map with what is in the
5612 	 * syscalls:sys_exit_FOO tracepoints, i.e. just like we do without BPF,
5613 	 * combining raw_syscalls:sys_enter with raw_syscalls:sys_exit.
5614 	 *
5615 	 * We'll switch to look at two BPF maps, one for sys_enter and the
5616 	 * other for sys_exit when we start augmenting the sys_exit paths with
5617 	 * buffers that are being copied from kernel to userspace, think 'read'
5618 	 * syscall.
5619 	 */
5620 	if (trace.syscalls.events.bpf_output) {
5621 		evlist__for_each_entry(trace.evlist, evsel) {
5622 			bool raw_syscalls_sys_exit = evsel__name_is(evsel, "raw_syscalls:sys_exit");
5623 
5624 			if (raw_syscalls_sys_exit) {
5625 				trace.raw_augmented_syscalls = true;
5626 				goto init_augmented_syscall_tp;
5627 			}
5628 
5629 			if (trace.syscalls.events.bpf_output->priv == NULL &&
5630 			    strstr(evsel__name(evsel), "syscalls:sys_enter")) {
5631 				struct evsel *augmented = trace.syscalls.events.bpf_output;
5632 				if (evsel__init_augmented_syscall_tp(augmented, evsel) ||
5633 				    evsel__init_augmented_syscall_tp_args(augmented))
5634 					goto out;
5635 				/*
5636 				 * Augmented is __augmented_syscalls__ BPF_OUTPUT event
5637 				 * Above we made sure we can get from the payload the tp fields
5638 				 * that we get from syscalls:sys_enter tracefs format file.
5639 				 */
5640 				augmented->handler = trace__sys_enter;
5641 				/*
5642 				 * Now we do the same for the *syscalls:sys_enter event so that
5643 				 * if we handle it directly, i.e. if the BPF prog returns 0 so
5644 				 * as not to filter it, then we'll handle it just like we would
5645 				 * for the BPF_OUTPUT one:
5646 				 */
5647 				if (evsel__init_augmented_syscall_tp(evsel, evsel) ||
5648 				    evsel__init_augmented_syscall_tp_args(evsel))
5649 					goto out;
5650 				evsel->handler = trace__sys_enter;
5651 			}
5652 
5653 			if (strstarts(evsel__name(evsel), "syscalls:sys_exit_")) {
5654 				struct syscall_tp *sc;
5655 init_augmented_syscall_tp:
5656 				if (evsel__init_augmented_syscall_tp(evsel, evsel))
5657 					goto out;
5658 				sc = __evsel__syscall_tp(evsel);
5659 				/*
5660 				 * For now with BPF raw_augmented we hook into
5661 				 * raw_syscalls:sys_enter and there we get all
5662 				 * 6 syscall args plus the tracepoint common
5663 				 * fields and the syscall_nr (another long).
5664 				 * So we check if that is the case and if so
5665 				 * don't look after the sc->args_size but
5666 				 * always after the full raw_syscalls:sys_enter
5667 				 * payload, which is fixed.
5668 				 *
5669 				 * We'll revisit this later to pass
5670 				 * s->args_size to the BPF augmenter (now
5671 				 * tools/perf/examples/bpf/augmented_raw_syscalls.c,
5672 				 * so that it copies only what we need for each
5673 				 * syscall, like what happens when we use
5674 				 * syscalls:sys_enter_NAME, so that we reduce
5675 				 * the kernel/userspace traffic to just what is
5676 				 * needed for each syscall.
5677 				 */
5678 				if (trace.raw_augmented_syscalls)
5679 					trace.raw_augmented_syscalls_args_size = (6 + 1) * sizeof(long) + sc->id.offset;
5680 				evsel__init_augmented_syscall_tp_ret(evsel);
5681 				evsel->handler = trace__sys_exit;
5682 			}
5683 		}
5684 	}
5685 
5686 	if ((argc >= 1) && (strcmp(argv[0], "record") == 0)) {
5687 		err = trace__record(&trace, argc-1, &argv[1]);
5688 		goto out;
5689 	}
5690 
5691 	/* Using just --errno-summary will trigger --summary */
5692 	if (trace.errno_summary && !trace.summary && !trace.summary_only)
5693 		trace.summary_only = true;
5694 
5695 	/* summary_only implies summary option, but don't overwrite summary if set */
5696 	if (trace.summary_only)
5697 		trace.summary = trace.summary_only;
5698 
5699 	/* Keep exited threads, otherwise information might be lost for summary */
5700 	if (trace.summary) {
5701 		symbol_conf.keep_exited_threads = true;
5702 		if (trace.summary_mode == SUMMARY__NONE)
5703 			trace.summary_mode = SUMMARY__BY_THREAD;
5704 
5705 		if (!trace.summary_bpf && trace.summary_mode == SUMMARY__BY_CGROUP) {
5706 			pr_err("Error: --summary-mode=cgroup only works with --bpf-summary\n");
5707 			err = -EINVAL;
5708 			goto out;
5709 		}
5710 	}
5711 
5712 	if (output_name != NULL) {
5713 		err = trace__open_output(&trace, output_name);
5714 		if (err < 0) {
5715 			perror("failed to create output file");
5716 			goto out;
5717 		}
5718 	}
5719 
5720 	err = evswitch__init(&trace.evswitch, trace.evlist, stderr);
5721 	if (err)
5722 		goto out_close;
5723 
5724 	err = target__validate(&trace.opts.target);
5725 	if (err) {
5726 		target__strerror(&trace.opts.target, err, bf, sizeof(bf));
5727 		fprintf(trace.output, "%s", bf);
5728 		goto out_close;
5729 	}
5730 
5731 	if (trace.uid_str) {
5732 		uid_t uid = parse_uid(trace.uid_str);
5733 
5734 		if (uid == UINT_MAX) {
5735 			ui__error("Invalid User: %s", trace.uid_str);
5736 			err = -EINVAL;
5737 			goto out_close;
5738 		}
5739 		err = parse_uid_filter(trace.evlist, uid);
5740 		if (err)
5741 			goto out_close;
5742 
5743 		trace.opts.target.system_wide = true;
5744 	}
5745 
5746 	if (!argc && target__none(&trace.opts.target))
5747 		trace.opts.target.system_wide = true;
5748 
5749 	if (input_name)
5750 		err = trace__replay(&trace);
5751 	else
5752 		err = trace__run(&trace, argc, argv);
5753 
5754 out_close:
5755 	if (output_name != NULL)
5756 		fclose(trace.output);
5757 out:
5758 	trace__exit(&trace);
5759 	augmented_syscalls__cleanup();
5760 	return err;
5761 }
5762