1 /* 2 * builtin-trace.c 3 * 4 * Builtin 'trace' command: 5 * 6 * Display a continuously updated trace of any workload, CPU, specific PID, 7 * system wide, etc. Default format is loosely strace like, but any other 8 * event may be specified using --event. 9 * 10 * Copyright (C) 2012, 2013, 2014, 2015 Red Hat Inc, Arnaldo Carvalho de Melo <acme@redhat.com> 11 * 12 * Initially based on the 'trace' prototype by Thomas Gleixner: 13 * 14 * http://lwn.net/Articles/415728/ ("Announcing a new utility: 'trace'") 15 */ 16 17 #include "util/record.h" 18 #include <api/fs/tracing_path.h> 19 #ifdef HAVE_LIBBPF_SUPPORT 20 #include <bpf/bpf.h> 21 #include <bpf/libbpf.h> 22 #include <bpf/btf.h> 23 #endif 24 #include "util/rlimit.h" 25 #include "builtin.h" 26 #include "util/cgroup.h" 27 #include "util/color.h" 28 #include "util/config.h" 29 #include "util/debug.h" 30 #include "util/dso.h" 31 #include "util/env.h" 32 #include "util/event.h" 33 #include "util/evsel.h" 34 #include "util/evsel_fprintf.h" 35 #include "util/synthetic-events.h" 36 #include "util/evlist.h" 37 #include "util/evswitch.h" 38 #include "util/hashmap.h" 39 #include "util/mmap.h" 40 #include <subcmd/pager.h> 41 #include <subcmd/exec-cmd.h> 42 #include "util/machine.h" 43 #include "util/map.h" 44 #include "util/symbol.h" 45 #include "util/path.h" 46 #include "util/session.h" 47 #include "util/thread.h" 48 #include <subcmd/parse-options.h> 49 #include "util/strlist.h" 50 #include "util/intlist.h" 51 #include "util/thread_map.h" 52 #include "util/stat.h" 53 #include "util/tool.h" 54 #include "util/trace.h" 55 #include "util/util.h" 56 #include "trace/beauty/beauty.h" 57 #include "trace-event.h" 58 #include "util/parse-events.h" 59 #include "util/tracepoint.h" 60 #include "callchain.h" 61 #include "print_binary.h" 62 #include "string2.h" 63 #include "trace/beauty/syscalltbl.h" 64 #include "../perf.h" 65 #include "trace_augment.h" 66 #include "dwarf-regs.h" 67 68 #include <errno.h> 69 #include <sys/stat.h> 70 #include <inttypes.h> 71 #include <poll.h> 72 #include <signal.h> 73 #include <stdlib.h> 74 #include <string.h> 75 #include <linux/err.h> 76 #include <linux/filter.h> 77 #include <linux/kernel.h> 78 #include <linux/list_sort.h> 79 #include <linux/random.h> 80 #include <linux/stringify.h> 81 #include <linux/time64.h> 82 #include <linux/zalloc.h> 83 #include <fcntl.h> 84 #include <sys/sysmacros.h> 85 86 #include <linux/ctype.h> 87 #include <perf/mmap.h> 88 #include <tools/libc_compat.h> 89 90 #ifdef HAVE_LIBTRACEEVENT 91 #include <event-parse.h> 92 #endif 93 94 #ifndef O_CLOEXEC 95 # define O_CLOEXEC 02000000 96 #endif 97 98 #ifndef F_LINUX_SPECIFIC_BASE 99 # define F_LINUX_SPECIFIC_BASE 1024 100 #endif 101 102 #define RAW_SYSCALL_ARGS_NUM 6 103 104 /* 105 * strtoul: Go from a string to a value, i.e. for msr: MSR_FS_BASE to 0xc0000100 106 * 107 * We have to explicitely mark the direction of the flow of data, if from the 108 * kernel to user space or the other way around, since the BPF collector we 109 * have so far copies only from user to kernel space, mark the arguments that 110 * go that direction, so that we don´t end up collecting the previous contents 111 * for syscall args that goes from kernel to user space. 112 */ 113 struct syscall_arg_fmt { 114 size_t (*scnprintf)(char *bf, size_t size, struct syscall_arg *arg); 115 bool (*strtoul)(char *bf, size_t size, struct syscall_arg *arg, u64 *val); 116 unsigned long (*mask_val)(struct syscall_arg *arg, unsigned long val); 117 void *parm; 118 const char *name; 119 u16 nr_entries; // for arrays 120 bool from_user; 121 bool show_zero; 122 #ifdef HAVE_LIBBPF_SUPPORT 123 const struct btf_type *type; 124 int type_id; /* used in btf_dump */ 125 #endif 126 }; 127 128 struct syscall_fmt { 129 const char *name; 130 const char *alias; 131 struct { 132 const char *sys_enter, 133 *sys_exit; 134 } bpf_prog_name; 135 struct syscall_arg_fmt arg[RAW_SYSCALL_ARGS_NUM]; 136 u8 nr_args; 137 bool errpid; 138 bool timeout; 139 bool hexret; 140 }; 141 142 struct trace { 143 struct perf_env host_env; 144 struct perf_tool tool; 145 struct { 146 /** Sorted sycall numbers used by the trace. */ 147 struct syscall **table; 148 /** Size of table. */ 149 size_t table_size; 150 struct { 151 struct evsel *sys_enter, 152 *sys_exit, 153 *bpf_output; 154 } events; 155 } syscalls; 156 #ifdef HAVE_LIBBPF_SUPPORT 157 struct btf *btf; 158 #endif 159 struct record_opts opts; 160 struct evlist *evlist; 161 struct machine *host; 162 struct thread *current; 163 struct cgroup *cgroup; 164 u64 base_time; 165 FILE *output; 166 unsigned long nr_events; 167 unsigned long nr_events_printed; 168 unsigned long max_events; 169 struct evswitch evswitch; 170 struct strlist *ev_qualifier; 171 struct { 172 size_t nr; 173 int *entries; 174 } ev_qualifier_ids; 175 struct { 176 size_t nr; 177 pid_t *entries; 178 struct bpf_map *map; 179 } filter_pids; 180 /* 181 * TODO: The map is from an ID (aka system call number) to struct 182 * syscall_stats. If there is >1 e_machine, such as i386 and x86-64 183 * processes, then the stats here will gather wrong the statistics for 184 * the non EM_HOST system calls. A fix would be to add the e_machine 185 * into the key, but this would make the code inconsistent with the 186 * per-thread version. 187 */ 188 struct hashmap *syscall_stats; 189 double duration_filter; 190 double runtime_ms; 191 unsigned long pfmaj, pfmin; 192 struct { 193 u64 vfs_getname, 194 proc_getname; 195 } stats; 196 unsigned int max_stack; 197 unsigned int min_stack; 198 enum trace_summary_mode summary_mode; 199 int max_summary; 200 int raw_augmented_syscalls_args_size; 201 bool raw_augmented_syscalls; 202 bool fd_path_disabled; 203 bool sort_events; 204 bool not_ev_qualifier; 205 bool live; 206 bool full_time; 207 bool sched; 208 bool multiple_threads; 209 bool summary; 210 bool summary_only; 211 bool errno_summary; 212 bool failure_only; 213 bool show_comm; 214 bool print_sample; 215 bool show_tool_stats; 216 bool trace_syscalls; 217 bool libtraceevent_print; 218 bool kernel_syscallchains; 219 s16 args_alignment; 220 bool show_tstamp; 221 bool show_cpu; 222 bool show_duration; 223 bool show_zeros; 224 bool show_arg_names; 225 bool show_string_prefix; 226 bool force; 227 bool vfs_getname; 228 bool force_btf; 229 bool summary_bpf; 230 int trace_pgfaults; 231 char *perfconfig_events; 232 struct { 233 struct ordered_events data; 234 u64 last; 235 } oe; 236 const char *uid_str; 237 }; 238 239 bool trace__show_zeros(const struct trace *trace) 240 { 241 return trace->show_zeros; 242 } 243 244 struct machine *trace__host(const struct trace *trace) 245 { 246 return trace->host; 247 } 248 249 static void trace__load_vmlinux_btf(struct trace *trace __maybe_unused) 250 { 251 #ifdef HAVE_LIBBPF_SUPPORT 252 if (trace->btf != NULL) 253 return; 254 255 trace->btf = btf__load_vmlinux_btf(); 256 if (verbose > 0) { 257 fprintf(trace->output, trace->btf ? "vmlinux BTF loaded\n" : 258 "Failed to load vmlinux BTF\n"); 259 } 260 #endif 261 } 262 263 struct tp_field { 264 int offset; 265 union { 266 u64 (*integer)(struct tp_field *field, struct perf_sample *sample); 267 void *(*pointer)(struct tp_field *field, struct perf_sample *sample); 268 }; 269 }; 270 271 #define TP_UINT_FIELD(bits) \ 272 static u64 tp_field__u##bits(struct tp_field *field, struct perf_sample *sample) \ 273 { \ 274 u##bits value; \ 275 memcpy(&value, sample->raw_data + field->offset, sizeof(value)); \ 276 return value; \ 277 } 278 279 TP_UINT_FIELD(8); 280 TP_UINT_FIELD(16); 281 TP_UINT_FIELD(32); 282 TP_UINT_FIELD(64); 283 284 #define TP_UINT_FIELD__SWAPPED(bits) \ 285 static u64 tp_field__swapped_u##bits(struct tp_field *field, struct perf_sample *sample) \ 286 { \ 287 u##bits value; \ 288 memcpy(&value, sample->raw_data + field->offset, sizeof(value)); \ 289 return bswap_##bits(value);\ 290 } 291 292 TP_UINT_FIELD__SWAPPED(16); 293 TP_UINT_FIELD__SWAPPED(32); 294 TP_UINT_FIELD__SWAPPED(64); 295 296 static int __tp_field__init_uint(struct tp_field *field, int size, int offset, bool needs_swap) 297 { 298 field->offset = offset; 299 300 switch (size) { 301 case 1: 302 field->integer = tp_field__u8; 303 break; 304 case 2: 305 field->integer = needs_swap ? tp_field__swapped_u16 : tp_field__u16; 306 break; 307 case 4: 308 field->integer = needs_swap ? tp_field__swapped_u32 : tp_field__u32; 309 break; 310 case 8: 311 field->integer = needs_swap ? tp_field__swapped_u64 : tp_field__u64; 312 break; 313 default: 314 return -1; 315 } 316 317 return 0; 318 } 319 320 static int tp_field__init_uint(struct tp_field *field, struct tep_format_field *format_field, bool needs_swap) 321 { 322 return __tp_field__init_uint(field, format_field->size, format_field->offset, needs_swap); 323 } 324 325 static void *tp_field__ptr(struct tp_field *field, struct perf_sample *sample) 326 { 327 return sample->raw_data + field->offset; 328 } 329 330 static int __tp_field__init_ptr(struct tp_field *field, int offset) 331 { 332 field->offset = offset; 333 field->pointer = tp_field__ptr; 334 return 0; 335 } 336 337 static int tp_field__init_ptr(struct tp_field *field, struct tep_format_field *format_field) 338 { 339 return __tp_field__init_ptr(field, format_field->offset); 340 } 341 342 struct syscall_tp { 343 struct tp_field id; 344 union { 345 struct tp_field args, ret; 346 }; 347 }; 348 349 /* 350 * The evsel->priv as used by 'perf trace' 351 * sc: for raw_syscalls:sys_{enter,exit} and syscalls:sys_{enter,exit}_SYSCALLNAME 352 * fmt: for all the other tracepoints 353 */ 354 struct evsel_trace { 355 struct syscall_tp sc; 356 struct syscall_arg_fmt *fmt; 357 }; 358 359 static struct evsel_trace *evsel_trace__new(void) 360 { 361 return zalloc(sizeof(struct evsel_trace)); 362 } 363 364 static void evsel_trace__delete(struct evsel_trace *et) 365 { 366 if (et == NULL) 367 return; 368 369 zfree(&et->fmt); 370 free(et); 371 } 372 373 /* 374 * Used with raw_syscalls:sys_{enter,exit} and with the 375 * syscalls:sys_{enter,exit}_SYSCALL tracepoints 376 */ 377 static inline struct syscall_tp *__evsel__syscall_tp(struct evsel *evsel) 378 { 379 struct evsel_trace *et = evsel->priv; 380 381 return &et->sc; 382 } 383 384 static struct syscall_tp *evsel__syscall_tp(struct evsel *evsel) 385 { 386 if (evsel->priv == NULL) { 387 evsel->priv = evsel_trace__new(); 388 if (evsel->priv == NULL) 389 return NULL; 390 } 391 392 return __evsel__syscall_tp(evsel); 393 } 394 395 /* 396 * Used with all the other tracepoints. 397 */ 398 static inline struct syscall_arg_fmt *__evsel__syscall_arg_fmt(struct evsel *evsel) 399 { 400 struct evsel_trace *et = evsel->priv; 401 402 return et->fmt; 403 } 404 405 static struct syscall_arg_fmt *evsel__syscall_arg_fmt(struct evsel *evsel) 406 { 407 struct evsel_trace *et = evsel->priv; 408 409 if (evsel->priv == NULL) { 410 et = evsel->priv = evsel_trace__new(); 411 412 if (et == NULL) 413 return NULL; 414 } 415 416 if (et->fmt == NULL) { 417 const struct tep_event *tp_format = evsel__tp_format(evsel); 418 419 if (tp_format == NULL) 420 goto out_delete; 421 422 et->fmt = calloc(tp_format->format.nr_fields, sizeof(struct syscall_arg_fmt)); 423 if (et->fmt == NULL) 424 goto out_delete; 425 } 426 427 return __evsel__syscall_arg_fmt(evsel); 428 429 out_delete: 430 evsel_trace__delete(evsel->priv); 431 evsel->priv = NULL; 432 return NULL; 433 } 434 435 static int evsel__init_tp_uint_field(struct evsel *evsel, struct tp_field *field, const char *name) 436 { 437 struct tep_format_field *format_field = evsel__field(evsel, name); 438 439 if (format_field == NULL) 440 return -1; 441 442 return tp_field__init_uint(field, format_field, evsel->needs_swap); 443 } 444 445 #define perf_evsel__init_sc_tp_uint_field(evsel, name) \ 446 ({ struct syscall_tp *sc = __evsel__syscall_tp(evsel);\ 447 evsel__init_tp_uint_field(evsel, &sc->name, #name); }) 448 449 static int evsel__init_tp_ptr_field(struct evsel *evsel, struct tp_field *field, const char *name) 450 { 451 struct tep_format_field *format_field = evsel__field(evsel, name); 452 453 if (format_field == NULL) 454 return -1; 455 456 return tp_field__init_ptr(field, format_field); 457 } 458 459 #define perf_evsel__init_sc_tp_ptr_field(evsel, name) \ 460 ({ struct syscall_tp *sc = __evsel__syscall_tp(evsel);\ 461 evsel__init_tp_ptr_field(evsel, &sc->name, #name); }) 462 463 static void evsel__delete_priv(struct evsel *evsel) 464 { 465 zfree(&evsel->priv); 466 evsel__delete(evsel); 467 } 468 469 static int evsel__init_syscall_tp(struct evsel *evsel) 470 { 471 struct syscall_tp *sc = evsel__syscall_tp(evsel); 472 473 if (sc != NULL) { 474 if (evsel__init_tp_uint_field(evsel, &sc->id, "__syscall_nr") && 475 evsel__init_tp_uint_field(evsel, &sc->id, "nr")) 476 return -ENOENT; 477 478 return 0; 479 } 480 481 return -ENOMEM; 482 } 483 484 static int evsel__init_augmented_syscall_tp(struct evsel *evsel, struct evsel *tp) 485 { 486 struct syscall_tp *sc = evsel__syscall_tp(evsel); 487 488 if (sc != NULL) { 489 struct tep_format_field *syscall_id = evsel__field(tp, "id"); 490 if (syscall_id == NULL) 491 syscall_id = evsel__field(tp, "__syscall_nr"); 492 if (syscall_id == NULL || 493 __tp_field__init_uint(&sc->id, syscall_id->size, syscall_id->offset, evsel->needs_swap)) 494 return -EINVAL; 495 496 return 0; 497 } 498 499 return -ENOMEM; 500 } 501 502 static int evsel__init_augmented_syscall_tp_args(struct evsel *evsel) 503 { 504 struct syscall_tp *sc = __evsel__syscall_tp(evsel); 505 506 return __tp_field__init_ptr(&sc->args, sc->id.offset + sizeof(u64)); 507 } 508 509 static int evsel__init_augmented_syscall_tp_ret(struct evsel *evsel) 510 { 511 struct syscall_tp *sc = __evsel__syscall_tp(evsel); 512 513 return __tp_field__init_uint(&sc->ret, sizeof(u64), sc->id.offset + sizeof(u64), evsel->needs_swap); 514 } 515 516 static int evsel__init_raw_syscall_tp(struct evsel *evsel, void *handler) 517 { 518 if (evsel__syscall_tp(evsel) != NULL) { 519 if (perf_evsel__init_sc_tp_uint_field(evsel, id)) 520 return -ENOENT; 521 522 evsel->handler = handler; 523 return 0; 524 } 525 526 return -ENOMEM; 527 } 528 529 static struct evsel *perf_evsel__raw_syscall_newtp(const char *direction, void *handler) 530 { 531 struct evsel *evsel = evsel__newtp("raw_syscalls", direction); 532 533 /* older kernel (e.g., RHEL6) use syscalls:{enter,exit} */ 534 if (IS_ERR(evsel)) 535 evsel = evsel__newtp("syscalls", direction); 536 537 if (IS_ERR(evsel)) 538 return NULL; 539 540 if (evsel__init_raw_syscall_tp(evsel, handler)) 541 goto out_delete; 542 543 return evsel; 544 545 out_delete: 546 evsel__delete_priv(evsel); 547 return NULL; 548 } 549 550 #define perf_evsel__sc_tp_uint(name, sample) \ 551 ({ struct syscall_tp *fields = __evsel__syscall_tp(sample->evsel); \ 552 fields->name.integer(&fields->name, sample); }) 553 554 #define perf_evsel__sc_tp_ptr(name, sample) \ 555 ({ struct syscall_tp *fields = __evsel__syscall_tp(sample->evsel); \ 556 fields->name.pointer(&fields->name, sample); }) 557 558 size_t strarray__scnprintf_suffix(struct strarray *sa, char *bf, size_t size, const char *intfmt, bool show_suffix, int val) 559 { 560 int idx = val - sa->offset; 561 562 if (idx < 0 || idx >= sa->nr_entries || sa->entries[idx] == NULL) { 563 size_t printed = scnprintf(bf, size, intfmt, val); 564 if (show_suffix) 565 printed += scnprintf(bf + printed, size - printed, " /* %s??? */", sa->prefix); 566 return printed; 567 } 568 569 return scnprintf(bf, size, "%s%s", sa->entries[idx], show_suffix ? sa->prefix : ""); 570 } 571 572 size_t strarray__scnprintf(struct strarray *sa, char *bf, size_t size, const char *intfmt, bool show_prefix, int val) 573 { 574 int idx = val - sa->offset; 575 576 if (idx < 0 || idx >= sa->nr_entries || sa->entries[idx] == NULL) { 577 size_t printed = scnprintf(bf, size, intfmt, val); 578 if (show_prefix) 579 printed += scnprintf(bf + printed, size - printed, " /* %s??? */", sa->prefix); 580 return printed; 581 } 582 583 return scnprintf(bf, size, "%s%s", show_prefix ? sa->prefix : "", sa->entries[idx]); 584 } 585 586 static size_t __syscall_arg__scnprintf_strarray(char *bf, size_t size, 587 const char *intfmt, 588 struct syscall_arg *arg) 589 { 590 return strarray__scnprintf(arg->parm, bf, size, intfmt, arg->show_string_prefix, arg->val); 591 } 592 593 static size_t syscall_arg__scnprintf_strarray(char *bf, size_t size, 594 struct syscall_arg *arg) 595 { 596 return __syscall_arg__scnprintf_strarray(bf, size, "%d", arg); 597 } 598 599 #define SCA_STRARRAY syscall_arg__scnprintf_strarray 600 601 bool syscall_arg__strtoul_strarray(char *bf, size_t size, struct syscall_arg *arg, u64 *ret) 602 { 603 return strarray__strtoul(arg->parm, bf, size, ret); 604 } 605 606 bool syscall_arg__strtoul_strarray_flags(char *bf, size_t size, struct syscall_arg *arg, u64 *ret) 607 { 608 return strarray__strtoul_flags(arg->parm, bf, size, ret); 609 } 610 611 bool syscall_arg__strtoul_strarrays(char *bf, size_t size, struct syscall_arg *arg, u64 *ret) 612 { 613 return strarrays__strtoul(arg->parm, bf, size, ret); 614 } 615 616 size_t syscall_arg__scnprintf_strarray_flags(char *bf, size_t size, struct syscall_arg *arg) 617 { 618 return strarray__scnprintf_flags(arg->parm, bf, size, arg->show_string_prefix, arg->val); 619 } 620 621 size_t strarrays__scnprintf(struct strarrays *sas, char *bf, size_t size, const char *intfmt, bool show_prefix, int val) 622 { 623 size_t printed; 624 int i; 625 626 for (i = 0; i < sas->nr_entries; ++i) { 627 struct strarray *sa = sas->entries[i]; 628 int idx = val - sa->offset; 629 630 if (idx >= 0 && idx < sa->nr_entries) { 631 if (sa->entries[idx] == NULL) 632 break; 633 return scnprintf(bf, size, "%s%s", show_prefix ? sa->prefix : "", sa->entries[idx]); 634 } 635 } 636 637 printed = scnprintf(bf, size, intfmt, val); 638 if (show_prefix) 639 printed += scnprintf(bf + printed, size - printed, " /* %s??? */", sas->entries[0]->prefix); 640 return printed; 641 } 642 643 bool strarray__strtoul(struct strarray *sa, char *bf, size_t size, u64 *ret) 644 { 645 int i; 646 647 for (i = 0; i < sa->nr_entries; ++i) { 648 if (sa->entries[i] && strncmp(sa->entries[i], bf, size) == 0 && sa->entries[i][size] == '\0') { 649 *ret = sa->offset + i; 650 return true; 651 } 652 } 653 654 return false; 655 } 656 657 bool strarray__strtoul_flags(struct strarray *sa, char *bf, size_t size, u64 *ret) 658 { 659 u64 val = 0; 660 char *tok = bf, *sep, *end; 661 662 *ret = 0; 663 664 while (size != 0) { 665 int toklen = size; 666 667 sep = memchr(tok, '|', size); 668 if (sep != NULL) { 669 size -= sep - tok + 1; 670 671 end = sep - 1; 672 while (end > tok && isspace(*end)) 673 --end; 674 675 toklen = end - tok + 1; 676 } 677 678 while (isspace(*tok)) 679 ++tok; 680 681 if (isalpha(*tok) || *tok == '_') { 682 if (!strarray__strtoul(sa, tok, toklen, &val)) 683 return false; 684 } else 685 val = strtoul(tok, NULL, 0); 686 687 *ret |= (1 << (val - 1)); 688 689 if (sep == NULL) 690 break; 691 tok = sep + 1; 692 } 693 694 return true; 695 } 696 697 bool strarrays__strtoul(struct strarrays *sas, char *bf, size_t size, u64 *ret) 698 { 699 int i; 700 701 for (i = 0; i < sas->nr_entries; ++i) { 702 struct strarray *sa = sas->entries[i]; 703 704 if (strarray__strtoul(sa, bf, size, ret)) 705 return true; 706 } 707 708 return false; 709 } 710 711 size_t syscall_arg__scnprintf_strarrays(char *bf, size_t size, 712 struct syscall_arg *arg) 713 { 714 return strarrays__scnprintf(arg->parm, bf, size, "%d", arg->show_string_prefix, arg->val); 715 } 716 717 #ifndef AT_FDCWD 718 #define AT_FDCWD -100 719 #endif 720 721 static size_t syscall_arg__scnprintf_fd_at(char *bf, size_t size, 722 struct syscall_arg *arg) 723 { 724 int fd = arg->val; 725 const char *prefix = "AT_FD"; 726 727 if (fd == AT_FDCWD) 728 return scnprintf(bf, size, "%s%s", arg->show_string_prefix ? prefix : "", "CWD"); 729 730 return syscall_arg__scnprintf_fd(bf, size, arg); 731 } 732 733 #define SCA_FDAT syscall_arg__scnprintf_fd_at 734 735 static size_t syscall_arg__scnprintf_close_fd(char *bf, size_t size, 736 struct syscall_arg *arg); 737 738 #define SCA_CLOSE_FD syscall_arg__scnprintf_close_fd 739 740 size_t syscall_arg__scnprintf_hex(char *bf, size_t size, struct syscall_arg *arg) 741 { 742 return scnprintf(bf, size, "%#lx", arg->val); 743 } 744 745 size_t syscall_arg__scnprintf_ptr(char *bf, size_t size, struct syscall_arg *arg) 746 { 747 if (arg->val == 0) 748 return scnprintf(bf, size, "NULL"); 749 return syscall_arg__scnprintf_hex(bf, size, arg); 750 } 751 752 size_t syscall_arg__scnprintf_int(char *bf, size_t size, struct syscall_arg *arg) 753 { 754 return scnprintf(bf, size, "%d", arg->val); 755 } 756 757 size_t syscall_arg__scnprintf_long(char *bf, size_t size, struct syscall_arg *arg) 758 { 759 return scnprintf(bf, size, "%ld", arg->val); 760 } 761 762 static size_t syscall_arg__scnprintf_char_array(char *bf, size_t size, struct syscall_arg *arg) 763 { 764 // XXX Hey, maybe for sched:sched_switch prev/next comm fields we can 765 // fill missing comms using thread__set_comm()... 766 // here or in a special syscall_arg__scnprintf_pid_sched_tp... 767 return scnprintf(bf, size, "\"%-.*s\"", arg->fmt->nr_entries ?: arg->len, arg->val); 768 } 769 770 #define SCA_CHAR_ARRAY syscall_arg__scnprintf_char_array 771 772 static const char *bpf_cmd[] = { 773 "MAP_CREATE", "MAP_LOOKUP_ELEM", "MAP_UPDATE_ELEM", "MAP_DELETE_ELEM", 774 "MAP_GET_NEXT_KEY", "PROG_LOAD", "OBJ_PIN", "OBJ_GET", "PROG_ATTACH", 775 "PROG_DETACH", "PROG_TEST_RUN", "PROG_GET_NEXT_ID", "MAP_GET_NEXT_ID", 776 "PROG_GET_FD_BY_ID", "MAP_GET_FD_BY_ID", "OBJ_GET_INFO_BY_FD", 777 "PROG_QUERY", "RAW_TRACEPOINT_OPEN", "BTF_LOAD", "BTF_GET_FD_BY_ID", 778 "TASK_FD_QUERY", "MAP_LOOKUP_AND_DELETE_ELEM", "MAP_FREEZE", 779 "BTF_GET_NEXT_ID", "MAP_LOOKUP_BATCH", "MAP_LOOKUP_AND_DELETE_BATCH", 780 "MAP_UPDATE_BATCH", "MAP_DELETE_BATCH", "LINK_CREATE", "LINK_UPDATE", 781 "LINK_GET_FD_BY_ID", "LINK_GET_NEXT_ID", "ENABLE_STATS", "ITER_CREATE", 782 "LINK_DETACH", "PROG_BIND_MAP", 783 }; 784 static DEFINE_STRARRAY(bpf_cmd, "BPF_"); 785 786 static const char *epoll_ctl_ops[] = { "ADD", "DEL", "MOD", }; 787 static DEFINE_STRARRAY_OFFSET(epoll_ctl_ops, "EPOLL_CTL_", 1); 788 789 static const char *itimers[] = { "REAL", "VIRTUAL", "PROF", }; 790 static DEFINE_STRARRAY(itimers, "ITIMER_"); 791 792 static const char *keyctl_options[] = { 793 "GET_KEYRING_ID", "JOIN_SESSION_KEYRING", "UPDATE", "REVOKE", "CHOWN", 794 "SETPERM", "DESCRIBE", "CLEAR", "LINK", "UNLINK", "SEARCH", "READ", 795 "INSTANTIATE", "NEGATE", "SET_REQKEY_KEYRING", "SET_TIMEOUT", 796 "ASSUME_AUTHORITY", "GET_SECURITY", "SESSION_TO_PARENT", "REJECT", 797 "INSTANTIATE_IOV", "INVALIDATE", "GET_PERSISTENT", 798 }; 799 static DEFINE_STRARRAY(keyctl_options, "KEYCTL_"); 800 801 static const char *whences[] = { "SET", "CUR", "END", 802 #ifdef SEEK_DATA 803 "DATA", 804 #endif 805 #ifdef SEEK_HOLE 806 "HOLE", 807 #endif 808 }; 809 static DEFINE_STRARRAY(whences, "SEEK_"); 810 811 static const char *fcntl_cmds[] = { 812 "DUPFD", "GETFD", "SETFD", "GETFL", "SETFL", "GETLK", "SETLK", 813 "SETLKW", "SETOWN", "GETOWN", "SETSIG", "GETSIG", "GETLK64", 814 "SETLK64", "SETLKW64", "SETOWN_EX", "GETOWN_EX", 815 "GETOWNER_UIDS", 816 }; 817 static DEFINE_STRARRAY(fcntl_cmds, "F_"); 818 819 static const char *fcntl_linux_specific_cmds[] = { 820 "SETLEASE", "GETLEASE", "NOTIFY", "DUPFD_QUERY", [5] = "CANCELLK", "DUPFD_CLOEXEC", 821 "SETPIPE_SZ", "GETPIPE_SZ", "ADD_SEALS", "GET_SEALS", 822 "GET_RW_HINT", "SET_RW_HINT", "GET_FILE_RW_HINT", "SET_FILE_RW_HINT", 823 }; 824 825 static DEFINE_STRARRAY_OFFSET(fcntl_linux_specific_cmds, "F_", F_LINUX_SPECIFIC_BASE); 826 827 static struct strarray *fcntl_cmds_arrays[] = { 828 &strarray__fcntl_cmds, 829 &strarray__fcntl_linux_specific_cmds, 830 }; 831 832 static DEFINE_STRARRAYS(fcntl_cmds_arrays); 833 834 static const char *rlimit_resources[] = { 835 "CPU", "FSIZE", "DATA", "STACK", "CORE", "RSS", "NPROC", "NOFILE", 836 "MEMLOCK", "AS", "LOCKS", "SIGPENDING", "MSGQUEUE", "NICE", "RTPRIO", 837 "RTTIME", 838 }; 839 static DEFINE_STRARRAY(rlimit_resources, "RLIMIT_"); 840 841 static const char *sighow[] = { "BLOCK", "UNBLOCK", "SETMASK", }; 842 static DEFINE_STRARRAY(sighow, "SIG_"); 843 844 static const char *clockid[] = { 845 "REALTIME", "MONOTONIC", "PROCESS_CPUTIME_ID", "THREAD_CPUTIME_ID", 846 "MONOTONIC_RAW", "REALTIME_COARSE", "MONOTONIC_COARSE", "BOOTTIME", 847 "REALTIME_ALARM", "BOOTTIME_ALARM", "SGI_CYCLE", "TAI" 848 }; 849 static DEFINE_STRARRAY(clockid, "CLOCK_"); 850 851 static size_t syscall_arg__scnprintf_access_mode(char *bf, size_t size, 852 struct syscall_arg *arg) 853 { 854 bool show_prefix = arg->show_string_prefix; 855 const char *suffix = "_OK"; 856 size_t printed = 0; 857 int mode = arg->val; 858 859 if (mode == F_OK) /* 0 */ 860 return scnprintf(bf, size, "F%s", show_prefix ? suffix : ""); 861 #define P_MODE(n) \ 862 if (mode & n##_OK) { \ 863 printed += scnprintf(bf + printed, size - printed, "%s%s", #n, show_prefix ? suffix : ""); \ 864 mode &= ~n##_OK; \ 865 } 866 867 P_MODE(R); 868 P_MODE(W); 869 P_MODE(X); 870 #undef P_MODE 871 872 if (mode) 873 printed += scnprintf(bf + printed, size - printed, "|%#x", mode); 874 875 return printed; 876 } 877 878 #define SCA_ACCMODE syscall_arg__scnprintf_access_mode 879 880 static size_t syscall_arg__scnprintf_filename(char *bf, size_t size, 881 struct syscall_arg *arg); 882 883 #define SCA_FILENAME syscall_arg__scnprintf_filename 884 885 // 'argname' is just documentational at this point, to remove the previous comment with that info 886 #define SCA_FILENAME_FROM_USER(argname) \ 887 { .scnprintf = SCA_FILENAME, \ 888 .from_user = true, } 889 890 static size_t syscall_arg__scnprintf_buf(char *bf, size_t size, struct syscall_arg *arg); 891 892 #define SCA_BUF syscall_arg__scnprintf_buf 893 894 static size_t syscall_arg__scnprintf_pipe_flags(char *bf, size_t size, 895 struct syscall_arg *arg) 896 { 897 bool show_prefix = arg->show_string_prefix; 898 const char *prefix = "O_"; 899 int printed = 0, flags = arg->val; 900 901 #define P_FLAG(n) \ 902 if (flags & O_##n) { \ 903 printed += scnprintf(bf + printed, size - printed, "%s%s%s", printed ? "|" : "", show_prefix ? prefix : "", #n); \ 904 flags &= ~O_##n; \ 905 } 906 907 P_FLAG(CLOEXEC); 908 P_FLAG(NONBLOCK); 909 #undef P_FLAG 910 911 if (flags) 912 printed += scnprintf(bf + printed, size - printed, "%s%#x", printed ? "|" : "", flags); 913 914 return printed; 915 } 916 917 #define SCA_PIPE_FLAGS syscall_arg__scnprintf_pipe_flags 918 919 #ifndef GRND_NONBLOCK 920 #define GRND_NONBLOCK 0x0001 921 #endif 922 #ifndef GRND_RANDOM 923 #define GRND_RANDOM 0x0002 924 #endif 925 926 static size_t syscall_arg__scnprintf_getrandom_flags(char *bf, size_t size, 927 struct syscall_arg *arg) 928 { 929 bool show_prefix = arg->show_string_prefix; 930 const char *prefix = "GRND_"; 931 int printed = 0, flags = arg->val; 932 933 #define P_FLAG(n) \ 934 if (flags & GRND_##n) { \ 935 printed += scnprintf(bf + printed, size - printed, "%s%s%s", printed ? "|" : "", show_prefix ? prefix : "", #n); \ 936 flags &= ~GRND_##n; \ 937 } 938 939 P_FLAG(RANDOM); 940 P_FLAG(NONBLOCK); 941 #undef P_FLAG 942 943 if (flags) 944 printed += scnprintf(bf + printed, size - printed, "%s%#x", printed ? "|" : "", flags); 945 946 return printed; 947 } 948 949 #define SCA_GETRANDOM_FLAGS syscall_arg__scnprintf_getrandom_flags 950 951 #ifdef HAVE_LIBBPF_SUPPORT 952 static void syscall_arg_fmt__cache_btf_enum(struct syscall_arg_fmt *arg_fmt, struct btf *btf, char *type) 953 { 954 int id; 955 956 type = strstr(type, "enum "); 957 if (type == NULL) 958 return; 959 960 type += 5; // skip "enum " to get the enumeration name 961 962 id = btf__find_by_name(btf, type); 963 if (id < 0) 964 return; 965 966 arg_fmt->type = btf__type_by_id(btf, id); 967 } 968 969 static bool syscall_arg__strtoul_btf_enum(char *bf, size_t size, struct syscall_arg *arg, u64 *val) 970 { 971 const struct btf_type *bt = arg->fmt->type; 972 struct btf *btf = arg->trace->btf; 973 struct btf_enum *be = btf_enum(bt); 974 975 for (u32 i = 0; i < btf_vlen(bt); ++i, ++be) { 976 const char *name = btf__name_by_offset(btf, be->name_off); 977 int max_len = max(size, strlen(name)); 978 979 if (strncmp(name, bf, max_len) == 0) { 980 *val = be->val; 981 return true; 982 } 983 } 984 985 return false; 986 } 987 988 static bool syscall_arg__strtoul_btf_type(char *bf, size_t size, struct syscall_arg *arg, u64 *val) 989 { 990 const struct btf_type *bt; 991 char *type = arg->type_name; 992 struct btf *btf; 993 994 trace__load_vmlinux_btf(arg->trace); 995 996 btf = arg->trace->btf; 997 if (btf == NULL) 998 return false; 999 1000 if (arg->fmt->type == NULL) { 1001 // See if this is an enum 1002 syscall_arg_fmt__cache_btf_enum(arg->fmt, btf, type); 1003 } 1004 1005 // Now let's see if we have a BTF type resolved 1006 bt = arg->fmt->type; 1007 if (bt == NULL) 1008 return false; 1009 1010 // If it is an enum: 1011 if (btf_is_enum(arg->fmt->type)) 1012 return syscall_arg__strtoul_btf_enum(bf, size, arg, val); 1013 1014 return false; 1015 } 1016 1017 static size_t btf_enum_scnprintf(const struct btf_type *type, struct btf *btf, char *bf, size_t size, int val) 1018 { 1019 struct btf_enum *be = btf_enum(type); 1020 const unsigned int nr_entries = btf_vlen(type); 1021 1022 for (unsigned int i = 0; i < nr_entries; ++i, ++be) { 1023 if (be->val == val) { 1024 return scnprintf(bf, size, "%s", 1025 btf__name_by_offset(btf, be->name_off)); 1026 } 1027 } 1028 1029 return 0; 1030 } 1031 1032 struct trace_btf_dump_snprintf_ctx { 1033 char *bf; 1034 size_t printed, size; 1035 }; 1036 1037 static void trace__btf_dump_snprintf(void *vctx, const char *fmt, va_list args) 1038 { 1039 struct trace_btf_dump_snprintf_ctx *ctx = vctx; 1040 1041 ctx->printed += vscnprintf(ctx->bf + ctx->printed, ctx->size - ctx->printed, fmt, args); 1042 } 1043 1044 static size_t btf_struct_scnprintf(const struct btf_type *type, struct btf *btf, char *bf, size_t size, struct syscall_arg *arg) 1045 { 1046 struct trace_btf_dump_snprintf_ctx ctx = { 1047 .bf = bf, 1048 .size = size, 1049 }; 1050 struct augmented_arg *augmented_arg = arg->augmented.args; 1051 int type_id = arg->fmt->type_id, consumed; 1052 struct btf_dump *btf_dump; 1053 1054 LIBBPF_OPTS(btf_dump_opts, dump_opts); 1055 LIBBPF_OPTS(btf_dump_type_data_opts, dump_data_opts); 1056 1057 if (arg == NULL || arg->augmented.args == NULL) 1058 return 0; 1059 1060 dump_data_opts.compact = true; 1061 dump_data_opts.skip_names = !arg->trace->show_arg_names; 1062 1063 btf_dump = btf_dump__new(btf, trace__btf_dump_snprintf, &ctx, &dump_opts); 1064 if (btf_dump == NULL) 1065 return 0; 1066 1067 /* pretty print the struct data here */ 1068 if (btf_dump__dump_type_data(btf_dump, type_id, arg->augmented.args->value, type->size, &dump_data_opts) == 0) 1069 return 0; 1070 1071 consumed = sizeof(*augmented_arg) + augmented_arg->size; 1072 arg->augmented.args = ((void *)arg->augmented.args) + consumed; 1073 arg->augmented.size -= consumed; 1074 1075 btf_dump__free(btf_dump); 1076 1077 return ctx.printed; 1078 } 1079 1080 static size_t trace__btf_scnprintf(struct trace *trace, struct syscall_arg *arg, char *bf, 1081 size_t size, int val, char *type) 1082 { 1083 struct syscall_arg_fmt *arg_fmt = arg->fmt; 1084 1085 if (trace->btf == NULL) 1086 return 0; 1087 1088 if (arg_fmt->type == NULL) { 1089 // Check if this is an enum and if we have the BTF type for it. 1090 syscall_arg_fmt__cache_btf_enum(arg_fmt, trace->btf, type); 1091 } 1092 1093 // Did we manage to find a BTF type for the syscall/tracepoint argument? 1094 if (arg_fmt->type == NULL) 1095 return 0; 1096 1097 if (btf_is_enum(arg_fmt->type)) 1098 return btf_enum_scnprintf(arg_fmt->type, trace->btf, bf, size, val); 1099 else if (btf_is_struct(arg_fmt->type) || btf_is_union(arg_fmt->type)) 1100 return btf_struct_scnprintf(arg_fmt->type, trace->btf, bf, size, arg); 1101 1102 return 0; 1103 } 1104 1105 #else // HAVE_LIBBPF_SUPPORT 1106 static size_t trace__btf_scnprintf(struct trace *trace __maybe_unused, struct syscall_arg *arg __maybe_unused, 1107 char *bf __maybe_unused, size_t size __maybe_unused, int val __maybe_unused, 1108 char *type __maybe_unused) 1109 { 1110 return 0; 1111 } 1112 1113 static bool syscall_arg__strtoul_btf_type(char *bf __maybe_unused, size_t size __maybe_unused, 1114 struct syscall_arg *arg __maybe_unused, u64 *val __maybe_unused) 1115 { 1116 return false; 1117 } 1118 #endif // HAVE_LIBBPF_SUPPORT 1119 1120 #define STUL_BTF_TYPE syscall_arg__strtoul_btf_type 1121 1122 #define STRARRAY(name, array) \ 1123 { .scnprintf = SCA_STRARRAY, \ 1124 .strtoul = STUL_STRARRAY, \ 1125 .parm = &strarray__##array, \ 1126 .show_zero = true, } 1127 1128 #define STRARRAY_FLAGS(name, array) \ 1129 { .scnprintf = SCA_STRARRAY_FLAGS, \ 1130 .strtoul = STUL_STRARRAY_FLAGS, \ 1131 .parm = &strarray__##array, \ 1132 .show_zero = true, } 1133 1134 static const struct syscall_fmt syscall_fmts[] = { 1135 { .name = "access", 1136 .arg = { [1] = { .scnprintf = SCA_ACCMODE, /* mode */ }, }, }, 1137 { .name = "arch_prctl", 1138 .arg = { [0] = { .scnprintf = SCA_X86_ARCH_PRCTL_CODE, /* code */ }, 1139 [1] = { .scnprintf = SCA_PTR, /* arg2 */ }, }, }, 1140 { .name = "bind", 1141 .arg = { [0] = { .scnprintf = SCA_INT, /* fd */ }, 1142 [1] = SCA_SOCKADDR_FROM_USER(umyaddr), 1143 [2] = { .scnprintf = SCA_INT, /* addrlen */ }, }, }, 1144 { .name = "bpf", 1145 .arg = { [0] = STRARRAY(cmd, bpf_cmd), 1146 [1] = { .from_user = true /* attr */, }, } }, 1147 { .name = "brk", .hexret = true, 1148 .arg = { [0] = { .scnprintf = SCA_PTR, /* brk */ }, }, }, 1149 { .name = "clock_gettime", 1150 .arg = { [0] = STRARRAY(clk_id, clockid), }, }, 1151 { .name = "clock_nanosleep", 1152 .arg = { [2] = SCA_TIMESPEC_FROM_USER(req), }, }, 1153 { .name = "clone", .errpid = true, .nr_args = 5, 1154 .arg = { [0] = { .name = "flags", .scnprintf = SCA_CLONE_FLAGS, }, 1155 [1] = { .name = "child_stack", .scnprintf = SCA_HEX, }, 1156 [2] = { .name = "parent_tidptr", .scnprintf = SCA_HEX, }, 1157 [3] = { .name = "child_tidptr", .scnprintf = SCA_HEX, }, 1158 [4] = { .name = "tls", .scnprintf = SCA_HEX, }, }, }, 1159 { .name = "close", 1160 .arg = { [0] = { .scnprintf = SCA_CLOSE_FD, /* fd */ }, }, }, 1161 { .name = "connect", 1162 .arg = { [0] = { .scnprintf = SCA_INT, /* fd */ }, 1163 [1] = SCA_SOCKADDR_FROM_USER(servaddr), 1164 [2] = { .scnprintf = SCA_INT, /* addrlen */ }, }, }, 1165 { .name = "epoll_ctl", 1166 .arg = { [1] = STRARRAY(op, epoll_ctl_ops), }, }, 1167 { .name = "eventfd2", 1168 .arg = { [1] = { .scnprintf = SCA_EFD_FLAGS, /* flags */ }, }, }, 1169 { .name = "faccessat", 1170 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dirfd */ }, 1171 [1] = SCA_FILENAME_FROM_USER(pathname), 1172 [2] = { .scnprintf = SCA_ACCMODE, /* mode */ }, }, }, 1173 { .name = "faccessat2", 1174 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dirfd */ }, 1175 [1] = SCA_FILENAME_FROM_USER(pathname), 1176 [2] = { .scnprintf = SCA_ACCMODE, /* mode */ }, 1177 [3] = { .scnprintf = SCA_FACCESSAT2_FLAGS, /* flags */ }, }, }, 1178 { .name = "fchmodat", 1179 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, }, 1180 { .name = "fchownat", 1181 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, }, 1182 { .name = "fcntl", 1183 .arg = { [1] = { .scnprintf = SCA_FCNTL_CMD, /* cmd */ 1184 .strtoul = STUL_STRARRAYS, 1185 .parm = &strarrays__fcntl_cmds_arrays, 1186 .show_zero = true, }, 1187 [2] = { .scnprintf = SCA_FCNTL_ARG, /* arg */ }, }, }, 1188 { .name = "flock", 1189 .arg = { [1] = { .scnprintf = SCA_FLOCK, /* cmd */ }, }, }, 1190 { .name = "fsconfig", 1191 .arg = { [1] = STRARRAY(cmd, fsconfig_cmds), }, }, 1192 { .name = "fsmount", 1193 .arg = { [1] = { .scnprintf = SCA_FSMOUNT_FLAGS, /* fsmount_flags */ 1194 .strtoul = STUL_STRARRAYS, 1195 .show_zero = true, }, 1196 [2] = { .scnprintf = SCA_FSMOUNT_ATTR_FLAGS, /* attr_flags */ }, }, }, 1197 { .name = "fspick", 1198 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, 1199 [1] = SCA_FILENAME_FROM_USER(path), 1200 [2] = { .scnprintf = SCA_FSPICK_FLAGS, /* flags */ }, }, }, 1201 { .name = "fstat", .alias = "newfstat", }, 1202 { .name = "futex", 1203 .arg = { [1] = { .scnprintf = SCA_FUTEX_OP, /* op */ }, 1204 [5] = { .scnprintf = SCA_FUTEX_VAL3, /* val3 */ }, }, }, 1205 { .name = "futimesat", 1206 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, }, 1207 { .name = "getitimer", 1208 .arg = { [0] = STRARRAY(which, itimers), }, }, 1209 { .name = "getpid", .errpid = true, }, 1210 { .name = "getpgid", .errpid = true, }, 1211 { .name = "getppid", .errpid = true, }, 1212 { .name = "getrandom", 1213 .arg = { [2] = { .scnprintf = SCA_GETRANDOM_FLAGS, /* flags */ }, }, }, 1214 { .name = "getrlimit", 1215 .arg = { [0] = STRARRAY(resource, rlimit_resources), }, }, 1216 { .name = "getsockopt", 1217 .arg = { [1] = STRARRAY(level, socket_level), }, }, 1218 { .name = "gettid", .errpid = true, }, 1219 { .name = "ioctl", 1220 .arg = { 1221 #if defined(__i386__) || defined(__x86_64__) 1222 /* 1223 * FIXME: Make this available to all arches. 1224 */ 1225 [1] = { .scnprintf = SCA_IOCTL_CMD, /* cmd */ }, 1226 [2] = { .scnprintf = SCA_HEX, /* arg */ }, }, }, 1227 #else 1228 [2] = { .scnprintf = SCA_HEX, /* arg */ }, }, }, 1229 #endif 1230 { .name = "kcmp", .nr_args = 5, 1231 .arg = { [0] = { .name = "pid1", .scnprintf = SCA_PID, }, 1232 [1] = { .name = "pid2", .scnprintf = SCA_PID, }, 1233 [2] = { .name = "type", .scnprintf = SCA_KCMP_TYPE, }, 1234 [3] = { .name = "idx1", .scnprintf = SCA_KCMP_IDX, }, 1235 [4] = { .name = "idx2", .scnprintf = SCA_KCMP_IDX, }, }, }, 1236 { .name = "keyctl", 1237 .arg = { [0] = STRARRAY(option, keyctl_options), }, }, 1238 { .name = "kill", 1239 .arg = { [1] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, }, 1240 { .name = "linkat", 1241 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, }, 1242 { .name = "lseek", 1243 .arg = { [2] = STRARRAY(whence, whences), }, }, 1244 { .name = "lstat", .alias = "newlstat", }, 1245 { .name = "madvise", 1246 .arg = { [0] = { .scnprintf = SCA_HEX, /* start */ }, 1247 [2] = { .scnprintf = SCA_MADV_BHV, /* behavior */ }, }, }, 1248 { .name = "mkdirat", 1249 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, }, 1250 { .name = "mknodat", 1251 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, }, 1252 { .name = "mmap", .hexret = true, 1253 /* The standard mmap maps to old_mmap on s390x */ 1254 #if defined(__s390x__) 1255 .alias = "old_mmap", 1256 #endif 1257 .arg = { [2] = { .scnprintf = SCA_MMAP_PROT, .show_zero = true, /* prot */ }, 1258 [3] = { .scnprintf = SCA_MMAP_FLAGS, /* flags */ 1259 .strtoul = STUL_STRARRAY_FLAGS, 1260 .parm = &strarray__mmap_flags, }, 1261 [5] = { .scnprintf = SCA_HEX, /* offset */ }, }, }, 1262 { .name = "mount", 1263 .arg = { [0] = SCA_FILENAME_FROM_USER(devname), 1264 [3] = { .scnprintf = SCA_MOUNT_FLAGS, /* flags */ 1265 .mask_val = SCAMV_MOUNT_FLAGS, /* flags */ }, }, }, 1266 { .name = "move_mount", 1267 .arg = { [0] = { .scnprintf = SCA_FDAT, /* from_dfd */ }, 1268 [1] = SCA_FILENAME_FROM_USER(pathname), 1269 [2] = { .scnprintf = SCA_FDAT, /* to_dfd */ }, 1270 [3] = SCA_FILENAME_FROM_USER(pathname), 1271 [4] = { .scnprintf = SCA_MOVE_MOUNT_FLAGS, /* flags */ }, }, }, 1272 { .name = "mprotect", 1273 .arg = { [0] = { .scnprintf = SCA_HEX, /* start */ }, 1274 [2] = { .scnprintf = SCA_MMAP_PROT, .show_zero = true, /* prot */ }, }, }, 1275 { .name = "mq_unlink", 1276 .arg = { [0] = SCA_FILENAME_FROM_USER(u_name), }, }, 1277 { .name = "mremap", .hexret = true, 1278 .arg = { [3] = { .scnprintf = SCA_MREMAP_FLAGS, /* flags */ }, }, }, 1279 { .name = "name_to_handle_at", 1280 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, }, 1281 { .name = "nanosleep", 1282 .arg = { [0] = SCA_TIMESPEC_FROM_USER(req), }, }, 1283 { .name = "newfstatat", .alias = "fstatat", 1284 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dirfd */ }, 1285 [1] = SCA_FILENAME_FROM_USER(pathname), 1286 [3] = { .scnprintf = SCA_FS_AT_FLAGS, /* flags */ }, }, }, 1287 { .name = "open", 1288 .arg = { [1] = { .scnprintf = SCA_OPEN_FLAGS, /* flags */ }, }, }, 1289 { .name = "open_by_handle_at", 1290 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, 1291 [2] = { .scnprintf = SCA_OPEN_FLAGS, /* flags */ }, }, }, 1292 { .name = "openat", 1293 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, 1294 [2] = { .scnprintf = SCA_OPEN_FLAGS, /* flags */ }, }, }, 1295 { .name = "perf_event_open", 1296 .arg = { [0] = SCA_PERF_ATTR_FROM_USER(attr), 1297 [2] = { .scnprintf = SCA_INT, /* cpu */ }, 1298 [3] = { .scnprintf = SCA_FD, /* group_fd */ }, 1299 [4] = { .scnprintf = SCA_PERF_FLAGS, /* flags */ }, }, }, 1300 { .name = "pipe2", 1301 .arg = { [1] = { .scnprintf = SCA_PIPE_FLAGS, /* flags */ }, }, }, 1302 { .name = "pkey_alloc", 1303 .arg = { [1] = { .scnprintf = SCA_PKEY_ALLOC_ACCESS_RIGHTS, /* access_rights */ }, }, }, 1304 { .name = "pkey_free", 1305 .arg = { [0] = { .scnprintf = SCA_INT, /* key */ }, }, }, 1306 { .name = "pkey_mprotect", 1307 .arg = { [0] = { .scnprintf = SCA_HEX, /* start */ }, 1308 [2] = { .scnprintf = SCA_MMAP_PROT, .show_zero = true, /* prot */ }, 1309 [3] = { .scnprintf = SCA_INT, /* pkey */ }, }, }, 1310 { .name = "poll", .timeout = true, }, 1311 { .name = "ppoll", .timeout = true, }, 1312 { .name = "prctl", 1313 .arg = { [0] = { .scnprintf = SCA_PRCTL_OPTION, /* option */ 1314 .strtoul = STUL_STRARRAY, 1315 .parm = &strarray__prctl_options, }, 1316 [1] = { .scnprintf = SCA_PRCTL_ARG2, /* arg2 */ }, 1317 [2] = { .scnprintf = SCA_PRCTL_ARG3, /* arg3 */ }, }, }, 1318 { .name = "pread", .alias = "pread64", }, 1319 { .name = "preadv", .alias = "pread", }, 1320 { .name = "prlimit64", 1321 .arg = { [1] = STRARRAY(resource, rlimit_resources), 1322 [2] = { .from_user = true /* new_rlim */, }, }, }, 1323 { .name = "pwrite", .alias = "pwrite64", }, 1324 { .name = "readlinkat", 1325 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, }, 1326 { .name = "recvfrom", 1327 .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, }, 1328 { .name = "recvmmsg", 1329 .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, }, 1330 { .name = "recvmsg", 1331 .arg = { [2] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, }, 1332 { .name = "renameat", 1333 .arg = { [0] = { .scnprintf = SCA_FDAT, /* olddirfd */ }, 1334 [2] = { .scnprintf = SCA_FDAT, /* newdirfd */ }, }, }, 1335 { .name = "renameat2", 1336 .arg = { [0] = { .scnprintf = SCA_FDAT, /* olddirfd */ }, 1337 [2] = { .scnprintf = SCA_FDAT, /* newdirfd */ }, 1338 [4] = { .scnprintf = SCA_RENAMEAT2_FLAGS, /* flags */ }, }, }, 1339 { .name = "rseq", 1340 .arg = { [0] = { .from_user = true /* rseq */, }, }, }, 1341 { .name = "rt_sigaction", 1342 .arg = { [0] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, }, 1343 { .name = "rt_sigprocmask", 1344 .arg = { [0] = STRARRAY(how, sighow), }, }, 1345 { .name = "rt_sigqueueinfo", 1346 .arg = { [1] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, }, 1347 { .name = "rt_tgsigqueueinfo", 1348 .arg = { [2] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, }, 1349 { .name = "sched_setscheduler", 1350 .arg = { [1] = { .scnprintf = SCA_SCHED_POLICY, /* policy */ }, }, }, 1351 { .name = "seccomp", 1352 .arg = { [0] = { .scnprintf = SCA_SECCOMP_OP, /* op */ }, 1353 [1] = { .scnprintf = SCA_SECCOMP_FLAGS, /* flags */ }, }, }, 1354 { .name = "select", .timeout = true, }, 1355 { .name = "sendfile", .alias = "sendfile64", }, 1356 { .name = "sendmmsg", 1357 .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, }, 1358 { .name = "sendmsg", 1359 .arg = { [2] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, }, 1360 { .name = "sendto", 1361 .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, 1362 [4] = SCA_SOCKADDR_FROM_USER(addr), }, }, 1363 { .name = "set_robust_list", 1364 .arg = { [0] = { .from_user = true /* head */, }, }, }, 1365 { .name = "set_tid_address", .errpid = true, }, 1366 { .name = "setitimer", 1367 .arg = { [0] = STRARRAY(which, itimers), }, }, 1368 { .name = "setrlimit", 1369 .arg = { [0] = STRARRAY(resource, rlimit_resources), 1370 [1] = { .from_user = true /* rlim */, }, }, }, 1371 { .name = "setsockopt", 1372 .arg = { [1] = STRARRAY(level, socket_level), }, }, 1373 { .name = "socket", 1374 .arg = { [0] = STRARRAY(family, socket_families), 1375 [1] = { .scnprintf = SCA_SK_TYPE, /* type */ }, 1376 [2] = { .scnprintf = SCA_SK_PROTO, /* protocol */ }, }, }, 1377 { .name = "socketpair", 1378 .arg = { [0] = STRARRAY(family, socket_families), 1379 [1] = { .scnprintf = SCA_SK_TYPE, /* type */ }, 1380 [2] = { .scnprintf = SCA_SK_PROTO, /* protocol */ }, }, }, 1381 { .name = "stat", .alias = "newstat", }, 1382 { .name = "statx", 1383 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fdat */ }, 1384 [2] = { .scnprintf = SCA_FS_AT_FLAGS, /* flags */ } , 1385 [3] = { .scnprintf = SCA_STATX_MASK, /* mask */ }, }, }, 1386 { .name = "swapoff", 1387 .arg = { [0] = SCA_FILENAME_FROM_USER(specialfile), }, }, 1388 { .name = "swapon", 1389 .arg = { [0] = SCA_FILENAME_FROM_USER(specialfile), }, }, 1390 { .name = "symlinkat", 1391 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, }, 1392 { .name = "sync_file_range", 1393 .arg = { [3] = { .scnprintf = SCA_SYNC_FILE_RANGE_FLAGS, /* flags */ }, }, }, 1394 { .name = "tgkill", 1395 .arg = { [2] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, }, 1396 { .name = "tkill", 1397 .arg = { [1] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, }, 1398 { .name = "umount2", .alias = "umount", 1399 .arg = { [0] = SCA_FILENAME_FROM_USER(name), }, }, 1400 { .name = "uname", .alias = "newuname", }, 1401 { .name = "unlinkat", 1402 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, 1403 [1] = SCA_FILENAME_FROM_USER(pathname), 1404 [2] = { .scnprintf = SCA_FS_AT_FLAGS, /* flags */ }, }, }, 1405 { .name = "utimensat", 1406 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dirfd */ }, }, }, 1407 { .name = "wait4", .errpid = true, 1408 .arg = { [2] = { .scnprintf = SCA_WAITID_OPTIONS, /* options */ }, }, }, 1409 { .name = "waitid", .errpid = true, 1410 .arg = { [3] = { .scnprintf = SCA_WAITID_OPTIONS, /* options */ }, }, }, 1411 { .name = "write", 1412 .arg = { [1] = { .scnprintf = SCA_BUF /* buf */, .from_user = true, }, }, }, 1413 }; 1414 1415 static int syscall_fmt__cmp(const void *name, const void *fmtp) 1416 { 1417 const struct syscall_fmt *fmt = fmtp; 1418 return strcmp(name, fmt->name); 1419 } 1420 1421 static const struct syscall_fmt *__syscall_fmt__find(const struct syscall_fmt *fmts, 1422 const int nmemb, 1423 const char *name) 1424 { 1425 return bsearch(name, fmts, nmemb, sizeof(struct syscall_fmt), syscall_fmt__cmp); 1426 } 1427 1428 static const struct syscall_fmt *syscall_fmt__find(const char *name) 1429 { 1430 const int nmemb = ARRAY_SIZE(syscall_fmts); 1431 return __syscall_fmt__find(syscall_fmts, nmemb, name); 1432 } 1433 1434 static const struct syscall_fmt *__syscall_fmt__find_by_alias(const struct syscall_fmt *fmts, 1435 const int nmemb, const char *alias) 1436 { 1437 int i; 1438 1439 for (i = 0; i < nmemb; ++i) { 1440 if (fmts[i].alias && strcmp(fmts[i].alias, alias) == 0) 1441 return &fmts[i]; 1442 } 1443 1444 return NULL; 1445 } 1446 1447 static const struct syscall_fmt *syscall_fmt__find_by_alias(const char *alias) 1448 { 1449 const int nmemb = ARRAY_SIZE(syscall_fmts); 1450 return __syscall_fmt__find_by_alias(syscall_fmts, nmemb, alias); 1451 } 1452 1453 /** 1454 * struct syscall 1455 */ 1456 struct syscall { 1457 /** @e_machine: The ELF machine associated with the entry. */ 1458 int e_machine; 1459 /** @id: id value from the tracepoint, the system call number. */ 1460 int id; 1461 struct tep_event *tp_format; 1462 int nr_args; 1463 /** 1464 * @args_size: sum of the sizes of the syscall arguments, anything 1465 * after that is augmented stuff: pathname for openat, etc. 1466 */ 1467 1468 int args_size; 1469 struct { 1470 struct bpf_program *sys_enter, 1471 *sys_exit; 1472 } bpf_prog; 1473 /** @is_exit: is this "exit" or "exit_group"? */ 1474 bool is_exit; 1475 /** 1476 * @is_open: is this "open" or "openat"? To associate the fd returned in 1477 * sys_exit with the pathname in sys_enter. 1478 */ 1479 bool is_open; 1480 /** 1481 * @nonexistent: Name lookup failed. Just a hole in the syscall table, 1482 * syscall id not allocated. 1483 */ 1484 bool nonexistent; 1485 bool use_btf; 1486 struct tep_format_field *args; 1487 const char *name; 1488 const struct syscall_fmt *fmt; 1489 struct syscall_arg_fmt *arg_fmt; 1490 }; 1491 1492 /* 1493 * We need to have this 'calculated' boolean because in some cases we really 1494 * don't know what is the duration of a syscall, for instance, when we start 1495 * a session and some threads are waiting for a syscall to finish, say 'poll', 1496 * in which case all we can do is to print "( ? ) for duration and for the 1497 * start timestamp. 1498 */ 1499 static size_t fprintf_duration(unsigned long t, bool calculated, FILE *fp) 1500 { 1501 double duration = (double)t / NSEC_PER_MSEC; 1502 size_t printed = fprintf(fp, "("); 1503 1504 if (!calculated) 1505 printed += fprintf(fp, " "); 1506 else if (duration >= 1.0) 1507 printed += color_fprintf(fp, PERF_COLOR_RED, "%6.3f ms", duration); 1508 else if (duration >= 0.01) 1509 printed += color_fprintf(fp, PERF_COLOR_YELLOW, "%6.3f ms", duration); 1510 else 1511 printed += color_fprintf(fp, PERF_COLOR_NORMAL, "%6.3f ms", duration); 1512 return printed + fprintf(fp, "): "); 1513 } 1514 1515 /** 1516 * filename.ptr: The filename char pointer that will be vfs_getname'd 1517 * filename.entry_str_pos: Where to insert the string translated from 1518 * filename.ptr by the vfs_getname tracepoint/kprobe. 1519 * ret_scnprintf: syscall args may set this to a different syscall return 1520 * formatter, for instance, fcntl may return fds, file flags, etc. 1521 */ 1522 struct thread_trace { 1523 u64 entry_time; 1524 u32 entry_cpu; 1525 bool entry_pending; 1526 unsigned long nr_events; 1527 unsigned long pfmaj, pfmin; 1528 char *entry_str; 1529 double runtime_ms; 1530 size_t (*ret_scnprintf)(char *bf, size_t size, struct syscall_arg *arg); 1531 struct { 1532 unsigned long ptr; 1533 short int entry_str_pos; 1534 bool pending_open; 1535 unsigned int namelen; 1536 char *name; 1537 } filename; 1538 struct { 1539 int max; 1540 struct file *table; 1541 } files; 1542 1543 struct hashmap *syscall_stats; 1544 }; 1545 1546 static size_t syscall_id_hash(long key, void *ctx __maybe_unused) 1547 { 1548 return key; 1549 } 1550 1551 static bool syscall_id_equal(long key1, long key2, void *ctx __maybe_unused) 1552 { 1553 return key1 == key2; 1554 } 1555 1556 static struct hashmap *alloc_syscall_stats(void) 1557 { 1558 struct hashmap *result = hashmap__new(syscall_id_hash, syscall_id_equal, NULL); 1559 1560 return IS_ERR(result) ? NULL : result; 1561 } 1562 1563 static void delete_syscall_stats(struct hashmap *syscall_stats) 1564 { 1565 struct hashmap_entry *pos; 1566 size_t bkt; 1567 1568 if (!syscall_stats) 1569 return; 1570 1571 hashmap__for_each_entry(syscall_stats, pos, bkt) 1572 zfree(&pos->pvalue); 1573 hashmap__free(syscall_stats); 1574 } 1575 1576 static struct thread_trace *thread_trace__new(struct trace *trace) 1577 { 1578 struct thread_trace *ttrace = zalloc(sizeof(struct thread_trace)); 1579 1580 if (ttrace) { 1581 ttrace->files.max = -1; 1582 if (trace->summary) { 1583 ttrace->syscall_stats = alloc_syscall_stats(); 1584 if (!ttrace->syscall_stats) 1585 zfree(&ttrace); 1586 } 1587 } 1588 1589 return ttrace; 1590 } 1591 1592 static void thread_trace__free_files(struct thread_trace *ttrace); 1593 1594 static void thread_trace__delete(void *pttrace) 1595 { 1596 struct thread_trace *ttrace = pttrace; 1597 1598 if (!ttrace) 1599 return; 1600 1601 delete_syscall_stats(ttrace->syscall_stats); 1602 ttrace->syscall_stats = NULL; 1603 thread_trace__free_files(ttrace); 1604 zfree(&ttrace->entry_str); 1605 free(ttrace); 1606 } 1607 1608 static struct thread_trace *thread__trace(struct thread *thread, struct trace *trace) 1609 { 1610 struct thread_trace *ttrace; 1611 1612 if (thread == NULL) 1613 goto fail; 1614 1615 if (thread__priv(thread) == NULL) 1616 thread__set_priv(thread, thread_trace__new(trace)); 1617 1618 if (thread__priv(thread) == NULL) 1619 goto fail; 1620 1621 ttrace = thread__priv(thread); 1622 ++ttrace->nr_events; 1623 1624 return ttrace; 1625 fail: 1626 color_fprintf(trace->output, PERF_COLOR_RED, 1627 "WARNING: not enough memory, dropping samples!\n"); 1628 return NULL; 1629 } 1630 1631 1632 void syscall_arg__set_ret_scnprintf(struct syscall_arg *arg, 1633 size_t (*ret_scnprintf)(char *bf, size_t size, struct syscall_arg *arg)) 1634 { 1635 struct thread_trace *ttrace = thread__priv(arg->thread); 1636 1637 ttrace->ret_scnprintf = ret_scnprintf; 1638 } 1639 1640 #define TRACE_PFMAJ (1 << 0) 1641 #define TRACE_PFMIN (1 << 1) 1642 1643 static const size_t trace__entry_str_size = 2048; 1644 1645 static void thread_trace__free_files(struct thread_trace *ttrace) 1646 { 1647 for (int i = 0; i <= ttrace->files.max; ++i) { 1648 struct file *file = ttrace->files.table + i; 1649 zfree(&file->pathname); 1650 } 1651 1652 zfree(&ttrace->files.table); 1653 ttrace->files.max = -1; 1654 } 1655 1656 static struct file *thread_trace__files_entry(struct thread_trace *ttrace, int fd) 1657 { 1658 if (fd < 0) 1659 return NULL; 1660 1661 if (fd > ttrace->files.max) { 1662 struct file *nfiles = realloc(ttrace->files.table, (fd + 1) * sizeof(struct file)); 1663 1664 if (nfiles == NULL) 1665 return NULL; 1666 1667 if (ttrace->files.max != -1) { 1668 memset(nfiles + ttrace->files.max + 1, 0, 1669 (fd - ttrace->files.max) * sizeof(struct file)); 1670 } else { 1671 memset(nfiles, 0, (fd + 1) * sizeof(struct file)); 1672 } 1673 1674 ttrace->files.table = nfiles; 1675 ttrace->files.max = fd; 1676 } 1677 1678 return ttrace->files.table + fd; 1679 } 1680 1681 struct file *thread__files_entry(struct thread *thread, int fd) 1682 { 1683 return thread_trace__files_entry(thread__priv(thread), fd); 1684 } 1685 1686 static int trace__set_fd_pathname(struct thread *thread, int fd, const char *pathname) 1687 { 1688 struct thread_trace *ttrace = thread__priv(thread); 1689 struct file *file = thread_trace__files_entry(ttrace, fd); 1690 1691 if (file != NULL) { 1692 struct stat st; 1693 1694 if (stat(pathname, &st) == 0) 1695 file->dev_maj = major(st.st_rdev); 1696 file->pathname = strdup(pathname); 1697 if (file->pathname) 1698 return 0; 1699 } 1700 1701 return -1; 1702 } 1703 1704 static int thread__read_fd_path(struct thread *thread, int fd) 1705 { 1706 char linkname[PATH_MAX], pathname[PATH_MAX]; 1707 struct stat st; 1708 int ret; 1709 1710 if (thread__pid(thread) == thread__tid(thread)) { 1711 scnprintf(linkname, sizeof(linkname), 1712 "/proc/%d/fd/%d", thread__pid(thread), fd); 1713 } else { 1714 scnprintf(linkname, sizeof(linkname), 1715 "/proc/%d/task/%d/fd/%d", 1716 thread__pid(thread), thread__tid(thread), fd); 1717 } 1718 1719 if (lstat(linkname, &st) < 0 || st.st_size + 1 > (off_t)sizeof(pathname)) 1720 return -1; 1721 1722 ret = readlink(linkname, pathname, sizeof(pathname)); 1723 1724 if (ret < 0 || ret > st.st_size) 1725 return -1; 1726 1727 pathname[ret] = '\0'; 1728 return trace__set_fd_pathname(thread, fd, pathname); 1729 } 1730 1731 static const char *thread__fd_path(struct thread *thread, int fd, 1732 struct trace *trace) 1733 { 1734 struct thread_trace *ttrace = thread__priv(thread); 1735 1736 if (ttrace == NULL || trace->fd_path_disabled) 1737 return NULL; 1738 1739 if (fd < 0) 1740 return NULL; 1741 1742 if ((fd > ttrace->files.max || ttrace->files.table[fd].pathname == NULL)) { 1743 if (!trace->live) 1744 return NULL; 1745 ++trace->stats.proc_getname; 1746 if (thread__read_fd_path(thread, fd)) 1747 return NULL; 1748 } 1749 1750 return ttrace->files.table[fd].pathname; 1751 } 1752 1753 size_t syscall_arg__scnprintf_fd(char *bf, size_t size, struct syscall_arg *arg) 1754 { 1755 int fd = arg->val; 1756 size_t printed = scnprintf(bf, size, "%d", fd); 1757 const char *path = thread__fd_path(arg->thread, fd, arg->trace); 1758 1759 if (path) 1760 printed += scnprintf(bf + printed, size - printed, "<%s>", path); 1761 1762 return printed; 1763 } 1764 1765 size_t pid__scnprintf_fd(struct trace *trace, pid_t pid, int fd, char *bf, size_t size) 1766 { 1767 size_t printed = scnprintf(bf, size, "%d", fd); 1768 struct thread *thread = machine__find_thread(trace->host, pid, pid); 1769 1770 if (thread) { 1771 const char *path = thread__fd_path(thread, fd, trace); 1772 1773 if (path) 1774 printed += scnprintf(bf + printed, size - printed, "<%s>", path); 1775 1776 thread__put(thread); 1777 } 1778 1779 return printed; 1780 } 1781 1782 static size_t syscall_arg__scnprintf_close_fd(char *bf, size_t size, 1783 struct syscall_arg *arg) 1784 { 1785 int fd = arg->val; 1786 size_t printed = syscall_arg__scnprintf_fd(bf, size, arg); 1787 struct thread_trace *ttrace = thread__priv(arg->thread); 1788 1789 if (ttrace && fd >= 0 && fd <= ttrace->files.max) 1790 zfree(&ttrace->files.table[fd].pathname); 1791 1792 return printed; 1793 } 1794 1795 static void thread__set_filename_pos(struct thread *thread, const char *bf, 1796 unsigned long ptr) 1797 { 1798 struct thread_trace *ttrace = thread__priv(thread); 1799 1800 ttrace->filename.ptr = ptr; 1801 ttrace->filename.entry_str_pos = bf - ttrace->entry_str; 1802 } 1803 1804 static size_t syscall_arg__scnprintf_augmented_string(struct syscall_arg *arg, char *bf, size_t size) 1805 { 1806 struct augmented_arg *augmented_arg = arg->augmented.args; 1807 size_t printed = scnprintf(bf, size, "\"%.*s\"", augmented_arg->size, augmented_arg->value); 1808 /* 1809 * So that the next arg with a payload can consume its augmented arg, i.e. for rename* syscalls 1810 * we would have two strings, each prefixed by its size. 1811 */ 1812 int consumed = sizeof(*augmented_arg) + augmented_arg->size; 1813 1814 arg->augmented.args = ((void *)arg->augmented.args) + consumed; 1815 arg->augmented.size -= consumed; 1816 1817 return printed; 1818 } 1819 1820 static size_t syscall_arg__scnprintf_filename(char *bf, size_t size, 1821 struct syscall_arg *arg) 1822 { 1823 unsigned long ptr = arg->val; 1824 1825 if (arg->augmented.args) 1826 return syscall_arg__scnprintf_augmented_string(arg, bf, size); 1827 1828 if (!arg->trace->vfs_getname) 1829 return scnprintf(bf, size, "%#x", ptr); 1830 1831 thread__set_filename_pos(arg->thread, bf, ptr); 1832 return 0; 1833 } 1834 1835 #define MAX_CONTROL_CHAR 31 1836 #define MAX_ASCII 127 1837 1838 static size_t syscall_arg__scnprintf_buf(char *bf, size_t size, struct syscall_arg *arg) 1839 { 1840 struct augmented_arg *augmented_arg = arg->augmented.args; 1841 unsigned char *orig = (unsigned char *)augmented_arg->value; 1842 size_t printed = 0; 1843 int consumed; 1844 1845 if (augmented_arg == NULL) 1846 return 0; 1847 1848 for (int j = 0; j < augmented_arg->size; ++j) { 1849 bool control_char = orig[j] <= MAX_CONTROL_CHAR || orig[j] >= MAX_ASCII; 1850 /* print control characters (0~31 and 127), and non-ascii characters in \(digits) */ 1851 printed += scnprintf(bf + printed, size - printed, control_char ? "\\%d" : "%c", (int)orig[j]); 1852 } 1853 1854 consumed = sizeof(*augmented_arg) + augmented_arg->size; 1855 arg->augmented.args = ((void *)arg->augmented.args) + consumed; 1856 arg->augmented.size -= consumed; 1857 1858 return printed; 1859 } 1860 1861 static bool trace__filter_duration(struct trace *trace, double t) 1862 { 1863 return t < (trace->duration_filter * NSEC_PER_MSEC); 1864 } 1865 1866 static size_t __trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp) 1867 { 1868 double ts = (double)(tstamp - trace->base_time) / NSEC_PER_MSEC; 1869 1870 return fprintf(fp, "%10.3f ", ts); 1871 } 1872 1873 /* 1874 * We're handling tstamp=0 as an undefined tstamp, i.e. like when we are 1875 * using ttrace->entry_time for a thread that receives a sys_exit without 1876 * first having received a sys_enter ("poll" issued before tracing session 1877 * starts, lost sys_enter exit due to ring buffer overflow). 1878 */ 1879 static size_t trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp) 1880 { 1881 if (tstamp > 0) 1882 return __trace__fprintf_tstamp(trace, tstamp, fp); 1883 1884 return fprintf(fp, " ? "); 1885 } 1886 1887 /** 1888 * trace__fprintf_cpu - Print the CPU ID to a given file stream 1889 * @cpu: The CPU ID to print 1890 * @fp: The file stream to write to 1891 * 1892 * Formats and prints the specified CPU ID enclosed in brackets 1893 * (e.g., "[003] ") to the provided file pointer. It is used to 1894 * align and display the CPU ID consistently within the trace output. 1895 * 1896 * Return: The number of characters printed. 1897 */ 1898 static size_t trace__fprintf_cpu(u32 cpu, FILE *fp) 1899 { 1900 size_t printed = 0; 1901 1902 if (cpu != (u32)-1) 1903 printed += fprintf(fp, "[%03u] ", cpu); 1904 1905 return printed; 1906 } 1907 1908 static pid_t workload_pid = -1; 1909 static volatile sig_atomic_t done = false; 1910 static volatile sig_atomic_t interrupted = false; 1911 1912 static void sighandler_interrupt(int sig __maybe_unused) 1913 { 1914 done = interrupted = true; 1915 } 1916 1917 static void sighandler_chld(int sig __maybe_unused, siginfo_t *info, 1918 void *context __maybe_unused) 1919 { 1920 if (info->si_pid == workload_pid) 1921 done = true; 1922 } 1923 1924 static size_t trace__fprintf_comm_tid(struct trace *trace, struct thread *thread, FILE *fp) 1925 { 1926 size_t printed = 0; 1927 1928 if (trace->multiple_threads) { 1929 if (trace->show_comm) 1930 printed += fprintf(fp, "%.14s/", thread__comm_str(thread)); 1931 printed += fprintf(fp, "%d ", thread__tid(thread)); 1932 } 1933 1934 return printed; 1935 } 1936 1937 static size_t trace__fprintf_entry_head(struct trace *trace, struct thread *thread, 1938 u64 duration, bool duration_calculated, 1939 u64 tstamp, u32 cpu, FILE *fp) 1940 { 1941 size_t printed = 0; 1942 1943 if (trace->show_tstamp) 1944 printed = trace__fprintf_tstamp(trace, tstamp, fp); 1945 if (trace->show_cpu && cpu != (u32)-1) 1946 printed += trace__fprintf_cpu(cpu, fp); 1947 if (trace->show_duration) 1948 printed += fprintf_duration(duration, duration_calculated, fp); 1949 return printed + trace__fprintf_comm_tid(trace, thread, fp); 1950 } 1951 1952 static int trace__process_event(struct trace *trace, struct machine *machine, 1953 union perf_event *event, struct perf_sample *sample) 1954 { 1955 int ret = 0; 1956 1957 switch (event->header.type) { 1958 case PERF_RECORD_LOST: 1959 color_fprintf(trace->output, PERF_COLOR_RED, 1960 "LOST %" PRIu64 " events!\n", (u64)event->lost.lost); 1961 ret = machine__process_lost_event(machine, event, sample); 1962 break; 1963 default: 1964 ret = machine__process_event(machine, event, sample); 1965 break; 1966 } 1967 1968 return ret; 1969 } 1970 1971 static int trace__tool_process(const struct perf_tool *tool, 1972 union perf_event *event, 1973 struct perf_sample *sample, 1974 struct machine *machine) 1975 { 1976 struct trace *trace = container_of(tool, struct trace, tool); 1977 return trace__process_event(trace, machine, event, sample); 1978 } 1979 1980 static char *trace__machine__resolve_kernel_addr(void *vmachine, unsigned long long *addrp, char **modp) 1981 { 1982 struct machine *machine = vmachine; 1983 1984 if (machine->kptr_restrict_warned) 1985 return NULL; 1986 1987 if (symbol_conf.kptr_restrict) { 1988 pr_warning("Kernel address maps (/proc/{kallsyms,modules}) are restricted.\n\n" 1989 "Check /proc/sys/kernel/kptr_restrict and /proc/sys/kernel/perf_event_paranoid.\n\n" 1990 "Kernel samples will not be resolved.\n"); 1991 machine->kptr_restrict_warned = true; 1992 return NULL; 1993 } 1994 1995 return machine__resolve_kernel_addr(vmachine, addrp, modp); 1996 } 1997 1998 static int trace__symbols_init(struct trace *trace, int argc, const char **argv, 1999 struct evlist *evlist) 2000 { 2001 int err = symbol__init(NULL); 2002 2003 if (err) 2004 return err; 2005 2006 perf_env__init(&trace->host_env); 2007 err = perf_env__set_cmdline(&trace->host_env, argc, argv); 2008 if (err) 2009 goto out; 2010 2011 trace->host = machine__new_host(&trace->host_env); 2012 if (trace->host == NULL) { 2013 err = -ENOMEM; 2014 goto out; 2015 } 2016 thread__set_priv_destructor(thread_trace__delete); 2017 2018 err = trace_event__register_resolver(trace->host, trace__machine__resolve_kernel_addr); 2019 if (err < 0) 2020 goto out; 2021 2022 if (trace->summary_only && trace->summary_mode != SUMMARY__BY_THREAD) 2023 goto out; 2024 2025 err = __machine__synthesize_threads(trace->host, &trace->tool, &trace->opts.target, 2026 evlist->core.threads, trace__tool_process, 2027 /*needs_mmap=*/callchain_param.enabled && 2028 !trace->summary_only, 2029 /*mmap_data=*/false, 2030 /*nr_threads_synthesize=*/1); 2031 out: 2032 if (err) { 2033 perf_env__exit(&trace->host_env); 2034 symbol__exit(); 2035 } 2036 return err; 2037 } 2038 2039 static void trace__symbols__exit(struct trace *trace) 2040 { 2041 machine__exit(trace->host); 2042 trace->host = NULL; 2043 2044 perf_env__exit(&trace->host_env); 2045 symbol__exit(); 2046 } 2047 2048 static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args) 2049 { 2050 int idx; 2051 2052 if (nr_args == RAW_SYSCALL_ARGS_NUM && sc->fmt && sc->fmt->nr_args != 0) 2053 nr_args = sc->fmt->nr_args; 2054 2055 sc->arg_fmt = calloc(nr_args, sizeof(*sc->arg_fmt)); 2056 if (sc->arg_fmt == NULL) 2057 return -1; 2058 2059 for (idx = 0; idx < nr_args; ++idx) { 2060 if (sc->fmt) 2061 sc->arg_fmt[idx] = sc->fmt->arg[idx]; 2062 } 2063 2064 sc->nr_args = nr_args; 2065 return 0; 2066 } 2067 2068 static const struct syscall_arg_fmt syscall_arg_fmts__by_name[] = { 2069 { .name = "msr", .scnprintf = SCA_X86_MSR, .strtoul = STUL_X86_MSR, }, 2070 { .name = "vector", .scnprintf = SCA_X86_IRQ_VECTORS, .strtoul = STUL_X86_IRQ_VECTORS, }, 2071 }; 2072 2073 static int syscall_arg_fmt__cmp(const void *name, const void *fmtp) 2074 { 2075 const struct syscall_arg_fmt *fmt = fmtp; 2076 return strcmp(name, fmt->name); 2077 } 2078 2079 static const struct syscall_arg_fmt * 2080 __syscall_arg_fmt__find_by_name(const struct syscall_arg_fmt *fmts, const int nmemb, 2081 const char *name) 2082 { 2083 return bsearch(name, fmts, nmemb, sizeof(struct syscall_arg_fmt), syscall_arg_fmt__cmp); 2084 } 2085 2086 static const struct syscall_arg_fmt *syscall_arg_fmt__find_by_name(const char *name) 2087 { 2088 const int nmemb = ARRAY_SIZE(syscall_arg_fmts__by_name); 2089 return __syscall_arg_fmt__find_by_name(syscall_arg_fmts__by_name, nmemb, name); 2090 } 2091 2092 /* 2093 * v6.19 kernel added new fields to read userspace memory for event tracing. 2094 * But it's not used by perf and confuses the syscall parameters. 2095 */ 2096 static bool is_internal_field(struct tep_format_field *field) 2097 { 2098 return !strcmp(field->type, "__data_loc char[]"); 2099 } 2100 2101 static struct tep_format_field * 2102 syscall_arg_fmt__init_array(struct syscall_arg_fmt *arg, struct tep_format_field *field, 2103 bool *use_btf) 2104 { 2105 struct tep_format_field *last_field = NULL; 2106 int len; 2107 2108 for (; field; field = field->next, ++arg) { 2109 /* assume it's the last argument */ 2110 if (is_internal_field(field)) 2111 continue; 2112 2113 last_field = field; 2114 2115 if (arg->scnprintf) 2116 continue; 2117 2118 len = strlen(field->name); 2119 2120 // As far as heuristics (or intention) goes this seems to hold true, and makes sense! 2121 if ((field->flags & TEP_FIELD_IS_POINTER) && strstarts(field->type, "const ")) 2122 arg->from_user = true; 2123 2124 if (strcmp(field->type, "const char *") == 0 && 2125 ((len >= 4 && strcmp(field->name + len - 4, "name") == 0) || 2126 strstr(field->name, "path") != NULL)) { 2127 arg->scnprintf = SCA_FILENAME; 2128 } else if ((field->flags & TEP_FIELD_IS_POINTER) || strstr(field->name, "addr")) 2129 arg->scnprintf = SCA_PTR; 2130 else if (strcmp(field->type, "pid_t") == 0) 2131 arg->scnprintf = SCA_PID; 2132 else if (strcmp(field->type, "umode_t") == 0) 2133 arg->scnprintf = SCA_MODE_T; 2134 else if ((field->flags & TEP_FIELD_IS_ARRAY) && strstr(field->type, "char")) { 2135 arg->scnprintf = SCA_CHAR_ARRAY; 2136 arg->nr_entries = field->arraylen; 2137 } else if ((strcmp(field->type, "int") == 0 || 2138 strcmp(field->type, "unsigned int") == 0 || 2139 strcmp(field->type, "long") == 0) && 2140 len >= 2 && strcmp(field->name + len - 2, "fd") == 0) { 2141 /* 2142 * /sys/kernel/tracing/events/syscalls/sys_enter* 2143 * grep -E 'field:.*fd;' .../format|sed -r 's/.*field:([a-z ]+) [a-z_]*fd.+/\1/g'|sort|uniq -c 2144 * 65 int 2145 * 23 unsigned int 2146 * 7 unsigned long 2147 */ 2148 arg->scnprintf = SCA_FD; 2149 } else if (strstr(field->type, "enum") && use_btf != NULL) { 2150 *use_btf = true; 2151 arg->strtoul = STUL_BTF_TYPE; 2152 } else { 2153 const struct syscall_arg_fmt *fmt = 2154 syscall_arg_fmt__find_by_name(field->name); 2155 2156 if (fmt) { 2157 arg->scnprintf = fmt->scnprintf; 2158 arg->strtoul = fmt->strtoul; 2159 } 2160 } 2161 } 2162 2163 return last_field; 2164 } 2165 2166 static int syscall__set_arg_fmts(struct syscall *sc) 2167 { 2168 struct tep_format_field *last_field = syscall_arg_fmt__init_array(sc->arg_fmt, sc->args, 2169 &sc->use_btf); 2170 2171 if (last_field) 2172 sc->args_size = last_field->offset + last_field->size; 2173 2174 return 0; 2175 } 2176 2177 static int syscall__read_info(struct syscall *sc, struct trace *trace) 2178 { 2179 char tp_name[128]; 2180 const char *name; 2181 struct tep_format_field *field; 2182 int err; 2183 2184 if (sc->nonexistent) 2185 return -EEXIST; 2186 2187 if (sc->name) { 2188 /* Info already read. */ 2189 return 0; 2190 } 2191 2192 name = syscalltbl__name(sc->e_machine, sc->id); 2193 if (name == NULL) { 2194 sc->nonexistent = true; 2195 return -EEXIST; 2196 } 2197 2198 sc->name = name; 2199 sc->fmt = syscall_fmt__find(sc->name); 2200 2201 snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->name); 2202 sc->tp_format = trace_event__tp_format("syscalls", tp_name); 2203 2204 if (IS_ERR(sc->tp_format) && sc->fmt && sc->fmt->alias) { 2205 snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->fmt->alias); 2206 sc->tp_format = trace_event__tp_format("syscalls", tp_name); 2207 } 2208 2209 /* 2210 * Fails to read trace point format via sysfs node, so the trace point 2211 * doesn't exist. Set the 'nonexistent' flag as true. 2212 */ 2213 if (IS_ERR(sc->tp_format)) { 2214 sc->nonexistent = true; 2215 err = PTR_ERR(sc->tp_format); 2216 sc->tp_format = NULL; 2217 return err; 2218 } 2219 2220 /* 2221 * The tracepoint format contains __syscall_nr field, so it's one more 2222 * than the actual number of syscall arguments. 2223 */ 2224 if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1)) 2225 return -ENOMEM; 2226 2227 sc->args = sc->tp_format->format.fields; 2228 /* 2229 * We need to check and discard the first variable '__syscall_nr' 2230 * or 'nr' that mean the syscall number. It is needless here. 2231 * So drop '__syscall_nr' or 'nr' field but does not exist on older kernels. 2232 */ 2233 if (sc->args && (!strcmp(sc->args->name, "__syscall_nr") || !strcmp(sc->args->name, "nr"))) { 2234 sc->args = sc->args->next; 2235 --sc->nr_args; 2236 } 2237 2238 field = sc->args; 2239 while (field) { 2240 if (is_internal_field(field)) 2241 --sc->nr_args; 2242 field = field->next; 2243 } 2244 2245 sc->is_exit = !strcmp(name, "exit_group") || !strcmp(name, "exit"); 2246 sc->is_open = !strcmp(name, "open") || !strcmp(name, "openat"); 2247 2248 err = syscall__set_arg_fmts(sc); 2249 2250 /* after calling syscall__set_arg_fmts() we'll know whether use_btf is true */ 2251 if (sc->use_btf) 2252 trace__load_vmlinux_btf(trace); 2253 2254 return err; 2255 } 2256 2257 static int evsel__init_tp_arg_scnprintf(struct evsel *evsel, bool *use_btf) 2258 { 2259 struct syscall_arg_fmt *fmt = evsel__syscall_arg_fmt(evsel); 2260 2261 if (fmt != NULL) { 2262 const struct tep_event *tp_format = evsel__tp_format(evsel); 2263 2264 if (tp_format) { 2265 syscall_arg_fmt__init_array(fmt, tp_format->format.fields, use_btf); 2266 return 0; 2267 } 2268 } 2269 2270 return -ENOMEM; 2271 } 2272 2273 static int intcmp(const void *a, const void *b) 2274 { 2275 const int *one = a, *another = b; 2276 2277 return *one - *another; 2278 } 2279 2280 static int trace__validate_ev_qualifier(struct trace *trace) 2281 { 2282 int err = 0; 2283 bool printed_invalid_prefix = false; 2284 struct str_node *pos; 2285 size_t nr_used = 0, nr_allocated = strlist__nr_entries(trace->ev_qualifier); 2286 2287 trace->ev_qualifier_ids.entries = calloc(nr_allocated, sizeof(trace->ev_qualifier_ids.entries[0])); 2288 if (trace->ev_qualifier_ids.entries == NULL) { 2289 fputs("Error:\tNot enough memory for allocating events qualifier ids\n", 2290 trace->output); 2291 err = -EINVAL; 2292 goto out; 2293 } 2294 2295 strlist__for_each_entry(pos, trace->ev_qualifier) { 2296 const char *sc = pos->s; 2297 /* 2298 * TODO: Assume more than the validation/warnings are all for 2299 * the same binary type as perf. 2300 */ 2301 int id = syscalltbl__id(EM_HOST, sc), match_next = -1; 2302 2303 if (id < 0) { 2304 id = syscalltbl__strglobmatch_first(EM_HOST, sc, &match_next); 2305 if (id >= 0) 2306 goto matches; 2307 2308 if (!printed_invalid_prefix) { 2309 pr_debug("Skipping unknown syscalls: "); 2310 printed_invalid_prefix = true; 2311 } else { 2312 pr_debug(", "); 2313 } 2314 2315 pr_debug("%s", sc); 2316 continue; 2317 } 2318 matches: 2319 trace->ev_qualifier_ids.entries[nr_used++] = id; 2320 if (match_next == -1) 2321 continue; 2322 2323 while (1) { 2324 id = syscalltbl__strglobmatch_next(EM_HOST, sc, &match_next); 2325 if (id < 0) 2326 break; 2327 if (nr_allocated == nr_used) { 2328 void *entries; 2329 2330 nr_allocated += 8; 2331 entries = realloc(trace->ev_qualifier_ids.entries, 2332 nr_allocated * sizeof(trace->ev_qualifier_ids.entries[0])); 2333 if (entries == NULL) { 2334 err = -ENOMEM; 2335 fputs("\nError:\t Not enough memory for parsing\n", trace->output); 2336 goto out_free; 2337 } 2338 trace->ev_qualifier_ids.entries = entries; 2339 } 2340 trace->ev_qualifier_ids.entries[nr_used++] = id; 2341 } 2342 } 2343 2344 trace->ev_qualifier_ids.nr = nr_used; 2345 qsort(trace->ev_qualifier_ids.entries, nr_used, sizeof(int), intcmp); 2346 out: 2347 if (printed_invalid_prefix) 2348 pr_debug("\n"); 2349 return err; 2350 out_free: 2351 zfree(&trace->ev_qualifier_ids.entries); 2352 trace->ev_qualifier_ids.nr = 0; 2353 goto out; 2354 } 2355 2356 static __maybe_unused bool trace__syscall_enabled(struct trace *trace, int id) 2357 { 2358 bool in_ev_qualifier; 2359 2360 if (trace->ev_qualifier_ids.nr == 0) 2361 return true; 2362 2363 in_ev_qualifier = bsearch(&id, trace->ev_qualifier_ids.entries, 2364 trace->ev_qualifier_ids.nr, sizeof(int), intcmp) != NULL; 2365 2366 if (in_ev_qualifier) 2367 return !trace->not_ev_qualifier; 2368 2369 return trace->not_ev_qualifier; 2370 } 2371 2372 /* 2373 * args is to be interpreted as a series of longs but we need to handle 2374 * 8-byte unaligned accesses. args points to raw_data within the event 2375 * and raw_data is guaranteed to be 8-byte unaligned because it is 2376 * preceded by raw_size which is a u32. So we need to copy args to a temp 2377 * variable to read it. Most notably this avoids extended load instructions 2378 * on unaligned addresses 2379 */ 2380 unsigned long syscall_arg__val(struct syscall_arg *arg, u8 idx) 2381 { 2382 unsigned long val; 2383 unsigned char *p = arg->args + sizeof(unsigned long) * idx; 2384 2385 memcpy(&val, p, sizeof(val)); 2386 return val; 2387 } 2388 2389 static size_t syscall__scnprintf_name(struct syscall *sc, char *bf, size_t size, 2390 struct syscall_arg *arg) 2391 { 2392 if (sc->arg_fmt && sc->arg_fmt[arg->idx].name) 2393 return scnprintf(bf, size, "%s: ", sc->arg_fmt[arg->idx].name); 2394 2395 return scnprintf(bf, size, "arg%d: ", arg->idx); 2396 } 2397 2398 /* 2399 * Check if the value is in fact zero, i.e. mask whatever needs masking, such 2400 * as mount 'flags' argument that needs ignoring some magic flag, see comment 2401 * in tools/perf/trace/beauty/mount_flags.c 2402 */ 2403 static unsigned long syscall_arg_fmt__mask_val(struct syscall_arg_fmt *fmt, struct syscall_arg *arg, unsigned long val) 2404 { 2405 if (fmt && fmt->mask_val) 2406 return fmt->mask_val(arg, val); 2407 2408 return val; 2409 } 2410 2411 static size_t syscall_arg_fmt__scnprintf_val(struct syscall_arg_fmt *fmt, char *bf, size_t size, 2412 struct syscall_arg *arg, unsigned long val) 2413 { 2414 if (fmt && fmt->scnprintf) { 2415 arg->val = val; 2416 if (fmt->parm) 2417 arg->parm = fmt->parm; 2418 return fmt->scnprintf(bf, size, arg); 2419 } 2420 return scnprintf(bf, size, "%ld", val); 2421 } 2422 2423 static size_t syscall__scnprintf_args(struct syscall *sc, char *bf, size_t size, 2424 unsigned char *args, void *augmented_args, int augmented_args_size, 2425 struct trace *trace, struct thread *thread) 2426 { 2427 size_t printed = 0, btf_printed; 2428 unsigned long val; 2429 u8 bit = 1; 2430 struct syscall_arg arg = { 2431 .args = args, 2432 .augmented = { 2433 .size = augmented_args_size, 2434 .args = augmented_args, 2435 }, 2436 .idx = 0, 2437 .mask = 0, 2438 .trace = trace, 2439 .thread = thread, 2440 .show_string_prefix = trace->show_string_prefix, 2441 }; 2442 struct thread_trace *ttrace = thread__priv(thread); 2443 void *default_scnprintf; 2444 2445 /* 2446 * Things like fcntl will set this in its 'cmd' formatter to pick the 2447 * right formatter for the return value (an fd? file flags?), which is 2448 * not needed for syscalls that always return a given type, say an fd. 2449 */ 2450 ttrace->ret_scnprintf = NULL; 2451 2452 if (sc->args != NULL) { 2453 struct tep_format_field *field; 2454 2455 for (field = sc->args; field; 2456 field = field->next, ++arg.idx, bit <<= 1) { 2457 if (arg.mask & bit) 2458 continue; 2459 2460 arg.fmt = &sc->arg_fmt[arg.idx]; 2461 val = syscall_arg__val(&arg, arg.idx); 2462 /* 2463 * Some syscall args need some mask, most don't and 2464 * return val untouched. 2465 */ 2466 val = syscall_arg_fmt__mask_val(&sc->arg_fmt[arg.idx], &arg, val); 2467 2468 /* 2469 * Suppress this argument if its value is zero and show_zero 2470 * property isn't set. 2471 * 2472 * If it has a BTF type, then override the zero suppression knob 2473 * as the common case is for zero in an enum to have an associated entry. 2474 */ 2475 if (val == 0 && !trace->show_zeros && 2476 !(sc->arg_fmt && sc->arg_fmt[arg.idx].show_zero) && 2477 !(sc->arg_fmt && sc->arg_fmt[arg.idx].strtoul == STUL_BTF_TYPE)) 2478 continue; 2479 2480 printed += scnprintf(bf + printed, size - printed, "%s", printed ? ", " : ""); 2481 2482 if (trace->show_arg_names) 2483 printed += scnprintf(bf + printed, size - printed, "%s: ", field->name); 2484 2485 default_scnprintf = sc->arg_fmt[arg.idx].scnprintf; 2486 2487 if (trace->force_btf || default_scnprintf == NULL || default_scnprintf == SCA_PTR) { 2488 btf_printed = trace__btf_scnprintf(trace, &arg, bf + printed, 2489 size - printed, val, field->type); 2490 if (btf_printed) { 2491 printed += btf_printed; 2492 continue; 2493 } 2494 } 2495 2496 printed += syscall_arg_fmt__scnprintf_val(&sc->arg_fmt[arg.idx], 2497 bf + printed, size - printed, &arg, val); 2498 } 2499 } else if (IS_ERR(sc->tp_format)) { 2500 /* 2501 * If we managed to read the tracepoint /format file, then we 2502 * may end up not having any args, like with gettid(), so only 2503 * print the raw args when we didn't manage to read it. 2504 */ 2505 while (arg.idx < sc->nr_args) { 2506 if (arg.mask & bit) 2507 goto next_arg; 2508 val = syscall_arg__val(&arg, arg.idx); 2509 if (printed) 2510 printed += scnprintf(bf + printed, size - printed, ", "); 2511 printed += syscall__scnprintf_name(sc, bf + printed, size - printed, &arg); 2512 printed += syscall_arg_fmt__scnprintf_val(&sc->arg_fmt[arg.idx], bf + printed, size - printed, &arg, val); 2513 next_arg: 2514 ++arg.idx; 2515 bit <<= 1; 2516 } 2517 } 2518 2519 return printed; 2520 } 2521 2522 static struct syscall *syscall__new(int e_machine, int id) 2523 { 2524 struct syscall *sc = zalloc(sizeof(*sc)); 2525 2526 if (!sc) 2527 return NULL; 2528 2529 sc->e_machine = e_machine; 2530 sc->id = id; 2531 return sc; 2532 } 2533 2534 static void syscall__delete(struct syscall *sc) 2535 { 2536 if (!sc) 2537 return; 2538 2539 free(sc->arg_fmt); 2540 free(sc); 2541 } 2542 2543 static int syscall__bsearch_cmp(const void *key, const void *entry) 2544 { 2545 const struct syscall *a = key, *b = *((const struct syscall **)entry); 2546 2547 if (a->e_machine != b->e_machine) 2548 return a->e_machine - b->e_machine; 2549 2550 return a->id - b->id; 2551 } 2552 2553 static int syscall__cmp(const void *va, const void *vb) 2554 { 2555 const struct syscall *a = *((const struct syscall **)va); 2556 const struct syscall *b = *((const struct syscall **)vb); 2557 2558 if (a->e_machine != b->e_machine) 2559 return a->e_machine - b->e_machine; 2560 2561 return a->id - b->id; 2562 } 2563 2564 static struct syscall *trace__find_syscall(struct trace *trace, int e_machine, int id) 2565 { 2566 struct syscall key = { 2567 .e_machine = e_machine, 2568 .id = id, 2569 }; 2570 struct syscall *sc, **tmp; 2571 2572 if (trace->syscalls.table) { 2573 struct syscall **sc_entry = bsearch(&key, trace->syscalls.table, 2574 trace->syscalls.table_size, 2575 sizeof(trace->syscalls.table[0]), 2576 syscall__bsearch_cmp); 2577 2578 if (sc_entry) 2579 return *sc_entry; 2580 } 2581 2582 sc = syscall__new(e_machine, id); 2583 if (!sc) 2584 return NULL; 2585 2586 tmp = reallocarray(trace->syscalls.table, trace->syscalls.table_size + 1, 2587 sizeof(trace->syscalls.table[0])); 2588 if (!tmp) { 2589 syscall__delete(sc); 2590 return NULL; 2591 } 2592 2593 trace->syscalls.table = tmp; 2594 trace->syscalls.table[trace->syscalls.table_size++] = sc; 2595 qsort(trace->syscalls.table, trace->syscalls.table_size, sizeof(trace->syscalls.table[0]), 2596 syscall__cmp); 2597 return sc; 2598 } 2599 2600 typedef int (*tracepoint_handler)(struct trace *trace, 2601 union perf_event *event, 2602 struct perf_sample *sample); 2603 2604 static struct syscall *trace__syscall_info(struct trace *trace, struct evsel *evsel, 2605 int e_machine, int id) 2606 { 2607 struct syscall *sc; 2608 int err = 0; 2609 2610 if (id < 0) { 2611 2612 /* 2613 * XXX: Noticed on x86_64, reproduced as far back as 3.0.36, haven't tried 2614 * before that, leaving at a higher verbosity level till that is 2615 * explained. Reproduced with plain ftrace with: 2616 * 2617 * echo 1 > /t/events/raw_syscalls/sys_exit/enable 2618 * grep "NR -1 " /t/trace_pipe 2619 * 2620 * After generating some load on the machine. 2621 */ 2622 if (verbose > 1) { 2623 static u64 n; 2624 fprintf(trace->output, "Invalid syscall %d id, skipping (%s, %" PRIu64 ") ...\n", 2625 id, evsel__name(evsel), ++n); 2626 } 2627 return NULL; 2628 } 2629 2630 err = -EINVAL; 2631 2632 sc = trace__find_syscall(trace, e_machine, id); 2633 if (sc) 2634 err = syscall__read_info(sc, trace); 2635 2636 if (err && verbose > 0) { 2637 errno = -err; 2638 fprintf(trace->output, "Problems reading syscall %d: %m", id); 2639 if (sc && sc->name) 2640 fprintf(trace->output, " (%s)", sc->name); 2641 fputs(" information\n", trace->output); 2642 } 2643 return err ? NULL : sc; 2644 } 2645 2646 struct syscall_stats { 2647 struct stats stats; 2648 u64 nr_failures; 2649 int max_errno; 2650 u32 *errnos; 2651 }; 2652 2653 static void thread__update_stats(struct thread *thread, struct thread_trace *ttrace, 2654 int id, struct perf_sample *sample, long err, 2655 struct trace *trace) 2656 { 2657 struct hashmap *syscall_stats = ttrace->syscall_stats; 2658 struct syscall_stats *stats = NULL; 2659 u64 duration = 0; 2660 2661 if (trace->summary_bpf) 2662 return; 2663 2664 if (trace->summary_mode == SUMMARY__BY_TOTAL) 2665 syscall_stats = trace->syscall_stats; 2666 2667 if (!hashmap__find(syscall_stats, id, &stats)) { 2668 stats = zalloc(sizeof(*stats)); 2669 if (stats == NULL) 2670 return; 2671 2672 init_stats(&stats->stats); 2673 if (hashmap__add(syscall_stats, id, stats) < 0) { 2674 free(stats); 2675 return; 2676 } 2677 } 2678 2679 if (ttrace->entry_time && sample->time > ttrace->entry_time) 2680 duration = sample->time - ttrace->entry_time; 2681 2682 update_stats(&stats->stats, duration); 2683 2684 if (err < 0) { 2685 ++stats->nr_failures; 2686 2687 if (!trace->errno_summary) 2688 return; 2689 2690 err = -err; 2691 if (err > stats->max_errno) { 2692 u32 *new_errnos = realloc(stats->errnos, err * sizeof(u32)); 2693 2694 if (new_errnos) { 2695 memset(new_errnos + stats->max_errno, 0, (err - stats->max_errno) * sizeof(u32)); 2696 } else { 2697 pr_debug("Not enough memory for errno stats for thread \"%s\"(%d/%d), results will be incomplete\n", 2698 thread__comm_str(thread), thread__pid(thread), 2699 thread__tid(thread)); 2700 return; 2701 } 2702 2703 stats->errnos = new_errnos; 2704 stats->max_errno = err; 2705 } 2706 2707 ++stats->errnos[err - 1]; 2708 } 2709 } 2710 2711 static int trace__printf_interrupted_entry(struct trace *trace) 2712 { 2713 struct thread_trace *ttrace; 2714 size_t printed; 2715 int len; 2716 2717 if (trace->failure_only || trace->current == NULL) 2718 return 0; 2719 2720 ttrace = thread__priv(trace->current); 2721 2722 if (!ttrace->entry_pending) 2723 return 0; 2724 2725 printed = trace__fprintf_entry_head(trace, trace->current, 0, false, 2726 ttrace->entry_time, ttrace->entry_cpu, 2727 trace->output); 2728 printed += len = fprintf(trace->output, "%s)", ttrace->entry_str); 2729 2730 if (len < trace->args_alignment - 4) 2731 printed += fprintf(trace->output, "%-*s", trace->args_alignment - 4 - len, " "); 2732 2733 printed += fprintf(trace->output, " ...\n"); 2734 2735 ttrace->entry_pending = false; 2736 ++trace->nr_events_printed; 2737 2738 return printed; 2739 } 2740 2741 static int trace__fprintf_sample(struct trace *trace, struct perf_sample *sample, 2742 struct thread *thread) 2743 { 2744 int printed = 0; 2745 2746 if (trace->print_sample) { 2747 double ts = (double)sample->time / NSEC_PER_MSEC; 2748 2749 printed += fprintf(trace->output, "%22s %10.3f %s %d/%d [%d]\n", 2750 evsel__name(sample->evsel), ts, 2751 thread__comm_str(thread), 2752 sample->pid, sample->tid, sample->cpu); 2753 } 2754 2755 return printed; 2756 } 2757 2758 static void *syscall__augmented_args(struct syscall *sc, struct perf_sample *sample, int *augmented_args_size, int raw_augmented_args_size) 2759 { 2760 /* 2761 * For now with BPF raw_augmented we hook into raw_syscalls:sys_enter 2762 * and there we get all 6 syscall args plus the tracepoint common fields 2763 * that gets calculated at the start and the syscall_nr (another long). 2764 * So we check if that is the case and if so don't look after the 2765 * sc->args_size but always after the full raw_syscalls:sys_enter payload, 2766 * which is fixed. 2767 * 2768 * We'll revisit this later to pass s->args_size to the BPF augmenter 2769 * (now tools/perf/examples/bpf/augmented_raw_syscalls.c, so that it 2770 * copies only what we need for each syscall, like what happens when we 2771 * use syscalls:sys_enter_NAME, so that we reduce the kernel/userspace 2772 * traffic to just what is needed for each syscall. 2773 */ 2774 int args_size = raw_augmented_args_size ?: sc->args_size; 2775 2776 *augmented_args_size = sample->raw_size - args_size; 2777 if (*augmented_args_size > 0) { 2778 static uintptr_t argbuf[1024]; /* assuming single-threaded */ 2779 2780 if ((size_t)(*augmented_args_size) > sizeof(argbuf)) 2781 return NULL; 2782 2783 /* 2784 * The perf ring-buffer is 8-byte aligned but sample->raw_data 2785 * is not because it's preceded by u32 size. Later, beautifier 2786 * will use the augmented args with stricter alignments like in 2787 * some struct. To make sure it's aligned, let's copy the args 2788 * into a static buffer as it's single-threaded for now. 2789 */ 2790 memcpy(argbuf, sample->raw_data + args_size, *augmented_args_size); 2791 2792 return argbuf; 2793 } 2794 return NULL; 2795 } 2796 2797 static int trace__sys_enter(struct trace *trace, 2798 union perf_event *event __maybe_unused, 2799 struct perf_sample *sample) 2800 { 2801 struct evsel *evsel = sample->evsel; 2802 char *msg; 2803 void *args; 2804 int printed = 0; 2805 struct thread *thread; 2806 int id = perf_evsel__sc_tp_uint(id, sample), err = -1; 2807 int augmented_args_size = 0, e_machine; 2808 void *augmented_args = NULL; 2809 struct syscall *sc; 2810 struct thread_trace *ttrace; 2811 2812 thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 2813 e_machine = thread__e_machine(thread, trace->host, /*e_flags=*/NULL); 2814 sc = trace__syscall_info(trace, evsel, e_machine, id); 2815 if (sc == NULL) 2816 goto out_put; 2817 ttrace = thread__trace(thread, trace); 2818 if (ttrace == NULL) 2819 goto out_put; 2820 2821 trace__fprintf_sample(trace, sample, thread); 2822 2823 args = perf_evsel__sc_tp_ptr(args, sample); 2824 2825 if (ttrace->entry_str == NULL) { 2826 ttrace->entry_str = malloc(trace__entry_str_size); 2827 if (!ttrace->entry_str) 2828 goto out_put; 2829 } 2830 2831 if (!(trace->duration_filter || trace->summary_only || trace->min_stack)) 2832 trace__printf_interrupted_entry(trace); 2833 /* 2834 * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible 2835 * arguments, even if the syscall being handled, say "openat", uses only 4 arguments 2836 * this breaks syscall__augmented_args() check for augmented args, as we calculate 2837 * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file, 2838 * so when handling, say the openat syscall, we end up getting 6 args for the 2839 * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly 2840 * thinking that the extra 2 u64 args are the augmented filename, so just check 2841 * here and avoid using augmented syscalls when the evsel is the raw_syscalls one. 2842 */ 2843 if (evsel != trace->syscalls.events.sys_enter) 2844 augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size); 2845 ttrace->entry_time = sample->time; 2846 ttrace->entry_cpu = sample->cpu; 2847 msg = ttrace->entry_str; 2848 printed += scnprintf(msg + printed, trace__entry_str_size - printed, "%s(", sc->name); 2849 2850 printed += syscall__scnprintf_args(sc, msg + printed, trace__entry_str_size - printed, 2851 args, augmented_args, augmented_args_size, trace, thread); 2852 2853 if (sc->is_exit) { 2854 if (!(trace->duration_filter || trace->summary_only || trace->failure_only || trace->min_stack)) { 2855 int alignment = 0; 2856 2857 trace__fprintf_entry_head(trace, thread, 0, false, 2858 ttrace->entry_time, 2859 sample->cpu, trace->output); 2860 printed = fprintf(trace->output, "%s)", ttrace->entry_str); 2861 if (trace->args_alignment > printed) 2862 alignment = trace->args_alignment - printed; 2863 fprintf(trace->output, "%*s= ?\n", alignment, " "); 2864 } 2865 } else { 2866 ttrace->entry_pending = true; 2867 /* See trace__vfs_getname & trace__sys_exit */ 2868 ttrace->filename.pending_open = false; 2869 } 2870 2871 if (trace->current != thread) { 2872 thread__put(trace->current); 2873 trace->current = thread__get(thread); 2874 } 2875 err = 0; 2876 out_put: 2877 thread__put(thread); 2878 return err; 2879 } 2880 2881 static int trace__fprintf_sys_enter(struct trace *trace, struct perf_sample *sample) 2882 { 2883 struct thread_trace *ttrace; 2884 struct thread *thread; 2885 int id = perf_evsel__sc_tp_uint(id, sample), err = -1; 2886 struct syscall *sc; 2887 char msg[1024]; 2888 void *args, *augmented_args = NULL; 2889 int augmented_args_size, e_machine; 2890 size_t printed = 0; 2891 2892 2893 thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 2894 e_machine = thread__e_machine(thread, trace->host, /*e_flags=*/NULL); 2895 sc = trace__syscall_info(trace, sample->evsel, e_machine, id); 2896 if (sc == NULL) 2897 goto out_put; 2898 ttrace = thread__trace(thread, trace); 2899 /* 2900 * We need to get ttrace just to make sure it is there when syscall__scnprintf_args() 2901 * and the rest of the beautifiers accessing it via struct syscall_arg touches it. 2902 */ 2903 if (ttrace == NULL) 2904 goto out_put; 2905 2906 args = perf_evsel__sc_tp_ptr(args, sample); 2907 augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size); 2908 printed += syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread); 2909 fprintf(trace->output, "%.*s", (int)printed, msg); 2910 err = 0; 2911 out_put: 2912 thread__put(thread); 2913 return err; 2914 } 2915 2916 static int trace__resolve_callchain(struct trace *trace, 2917 struct perf_sample *sample, 2918 struct callchain_cursor *cursor) 2919 { 2920 struct evsel *evsel = sample->evsel; 2921 struct addr_location al; 2922 int max_stack = evsel->core.attr.sample_max_stack ? 2923 evsel->core.attr.sample_max_stack : 2924 trace->max_stack; 2925 int err = -1; 2926 2927 addr_location__init(&al); 2928 if (machine__resolve(trace->host, &al, sample) < 0) 2929 goto out; 2930 2931 err = thread__resolve_callchain(al.thread, cursor, sample, NULL, NULL, max_stack); 2932 out: 2933 addr_location__exit(&al); 2934 return err; 2935 } 2936 2937 static int trace__fprintf_callchain(struct trace *trace, struct perf_sample *sample) 2938 { 2939 /* TODO: user-configurable print_opts */ 2940 const unsigned int print_opts = EVSEL__PRINT_SYM | 2941 EVSEL__PRINT_DSO | 2942 EVSEL__PRINT_UNKNOWN_AS_ADDR; 2943 2944 return sample__fprintf_callchain(sample, 38, print_opts, get_tls_callchain_cursor(), symbol_conf.bt_stop_list, trace->output); 2945 } 2946 2947 static int trace__sys_exit(struct trace *trace, 2948 union perf_event *event __maybe_unused, 2949 struct perf_sample *sample) 2950 { 2951 struct evsel *evsel = sample->evsel; 2952 long ret; 2953 u64 duration = 0; 2954 bool duration_calculated = false; 2955 struct thread *thread; 2956 int id = perf_evsel__sc_tp_uint(id, sample), err = -1, callchain_ret = 0, printed = 0; 2957 int alignment = trace->args_alignment, e_machine; 2958 struct syscall *sc; 2959 struct thread_trace *ttrace; 2960 2961 thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 2962 e_machine = thread__e_machine(thread, trace->host, /*e_flags=*/NULL); 2963 sc = trace__syscall_info(trace, evsel, e_machine, id); 2964 if (sc == NULL) 2965 goto out_put; 2966 ttrace = thread__trace(thread, trace); 2967 if (ttrace == NULL) 2968 goto out_put; 2969 2970 trace__fprintf_sample(trace, sample, thread); 2971 2972 ret = perf_evsel__sc_tp_uint(ret, sample); 2973 2974 if (trace->summary) 2975 thread__update_stats(thread, ttrace, id, sample, ret, trace); 2976 2977 if (!trace->fd_path_disabled && sc->is_open && ret >= 0 && ttrace->filename.pending_open) { 2978 trace__set_fd_pathname(thread, ret, ttrace->filename.name); 2979 ttrace->filename.pending_open = false; 2980 ++trace->stats.vfs_getname; 2981 } 2982 2983 if (ttrace->entry_time && sample->time >= ttrace->entry_time) { 2984 duration = sample->time - ttrace->entry_time; 2985 if (trace__filter_duration(trace, duration)) 2986 goto out; 2987 duration_calculated = true; 2988 } else if (trace->duration_filter) 2989 goto out; 2990 2991 if (sample->callchain) { 2992 struct callchain_cursor *cursor = get_tls_callchain_cursor(); 2993 2994 callchain_ret = trace__resolve_callchain(trace, sample, cursor); 2995 if (callchain_ret == 0) { 2996 if (cursor->nr < trace->min_stack) 2997 goto out; 2998 callchain_ret = 1; 2999 } 3000 } 3001 3002 if (trace->summary_only || (ret >= 0 && trace->failure_only)) 3003 goto out; 3004 3005 trace__fprintf_entry_head(trace, thread, duration, 3006 duration_calculated, ttrace->entry_time, 3007 sample->cpu, trace->output); 3008 3009 if (ttrace->entry_pending) { 3010 printed = fprintf(trace->output, "%s", ttrace->entry_str); 3011 } else { 3012 printed += fprintf(trace->output, " ... ["); 3013 color_fprintf(trace->output, PERF_COLOR_YELLOW, "continued"); 3014 printed += 9; 3015 printed += fprintf(trace->output, "]: %s()", sc->name); 3016 } 3017 3018 printed++; /* the closing ')' */ 3019 3020 if (alignment > printed) 3021 alignment -= printed; 3022 else 3023 alignment = 0; 3024 3025 fprintf(trace->output, ")%*s= ", alignment, " "); 3026 3027 if (sc->fmt == NULL) { 3028 if (ret < 0) 3029 goto errno_print; 3030 signed_print: 3031 fprintf(trace->output, "%ld", ret); 3032 } else if (ret < 0) { 3033 errno_print: { 3034 char bf[STRERR_BUFSIZE]; 3035 const char *emsg = str_error_r(-ret, bf, sizeof(bf)); 3036 const char *e = perf_env__arch_strerrno(e_machine, err); 3037 3038 fprintf(trace->output, "-1 %s (%s)", e, emsg); 3039 } 3040 } else if (ret == 0 && sc->fmt->timeout) 3041 fprintf(trace->output, "0 (Timeout)"); 3042 else if (ttrace->ret_scnprintf) { 3043 char bf[1024]; 3044 struct syscall_arg arg = { 3045 .val = ret, 3046 .thread = thread, 3047 .trace = trace, 3048 }; 3049 ttrace->ret_scnprintf(bf, sizeof(bf), &arg); 3050 ttrace->ret_scnprintf = NULL; 3051 fprintf(trace->output, "%s", bf); 3052 } else if (sc->fmt->hexret) 3053 fprintf(trace->output, "%#lx", ret); 3054 else if (sc->fmt->errpid) { 3055 struct thread *child = machine__find_thread(trace->host, ret, ret); 3056 3057 fprintf(trace->output, "%ld", ret); 3058 if (child != NULL) { 3059 if (thread__comm_set(child)) 3060 fprintf(trace->output, " (%s)", thread__comm_str(child)); 3061 thread__put(child); 3062 } 3063 } else 3064 goto signed_print; 3065 3066 fputc('\n', trace->output); 3067 3068 /* 3069 * We only consider an 'event' for the sake of --max-events a non-filtered 3070 * sys_enter + sys_exit and other tracepoint events. 3071 */ 3072 if (++trace->nr_events_printed == trace->max_events && trace->max_events != ULONG_MAX) 3073 interrupted = true; 3074 3075 if (callchain_ret > 0) 3076 trace__fprintf_callchain(trace, sample); 3077 else if (callchain_ret < 0) 3078 pr_err("Problem processing %s callchain, skipping...\n", evsel__name(evsel)); 3079 out: 3080 ttrace->entry_pending = false; 3081 err = 0; 3082 out_put: 3083 thread__put(thread); 3084 return err; 3085 } 3086 3087 static int trace__vfs_getname(struct trace *trace, 3088 union perf_event *event __maybe_unused, 3089 struct perf_sample *sample) 3090 { 3091 struct thread *thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 3092 struct thread_trace *ttrace; 3093 size_t filename_len, entry_str_len, to_move; 3094 ssize_t remaining_space; 3095 char *pos; 3096 const char *filename = perf_sample__strval(sample, "pathname"); 3097 3098 if (!thread) 3099 goto out; 3100 3101 ttrace = thread__priv(thread); 3102 if (!ttrace) 3103 goto out_put; 3104 3105 filename_len = strlen(filename); 3106 if (filename_len == 0) 3107 goto out_put; 3108 3109 if (ttrace->filename.namelen < filename_len) { 3110 char *f = realloc(ttrace->filename.name, filename_len + 1); 3111 3112 if (f == NULL) 3113 goto out_put; 3114 3115 ttrace->filename.namelen = filename_len; 3116 ttrace->filename.name = f; 3117 } 3118 3119 strcpy(ttrace->filename.name, filename); 3120 ttrace->filename.pending_open = true; 3121 3122 if (!ttrace->filename.ptr) 3123 goto out_put; 3124 3125 entry_str_len = strlen(ttrace->entry_str); 3126 remaining_space = trace__entry_str_size - entry_str_len - 1; /* \0 */ 3127 if (remaining_space <= 0) 3128 goto out_put; 3129 3130 if (filename_len > (size_t)remaining_space) { 3131 filename += filename_len - remaining_space; 3132 filename_len = remaining_space; 3133 } 3134 3135 to_move = entry_str_len - ttrace->filename.entry_str_pos + 1; /* \0 */ 3136 pos = ttrace->entry_str + ttrace->filename.entry_str_pos; 3137 memmove(pos + filename_len, pos, to_move); 3138 memcpy(pos, filename, filename_len); 3139 3140 ttrace->filename.ptr = 0; 3141 ttrace->filename.entry_str_pos = 0; 3142 out_put: 3143 thread__put(thread); 3144 out: 3145 return 0; 3146 } 3147 3148 static int trace__sched_stat_runtime(struct trace *trace, 3149 union perf_event *event __maybe_unused, 3150 struct perf_sample *sample) 3151 { 3152 u64 runtime = perf_sample__intval(sample, "runtime"); 3153 double runtime_ms = (double)runtime / NSEC_PER_MSEC; 3154 struct thread *thread = machine__findnew_thread(trace->host, 3155 sample->pid, 3156 sample->tid); 3157 struct thread_trace *ttrace = thread__trace(thread, trace); 3158 3159 if (ttrace == NULL) 3160 goto out_dump; 3161 3162 ttrace->runtime_ms += runtime_ms; 3163 trace->runtime_ms += runtime_ms; 3164 out_put: 3165 thread__put(thread); 3166 return 0; 3167 3168 out_dump: 3169 fprintf(trace->output, "%s: comm=%s,pid=%u,runtime=%" PRIu64 ",vruntime=%" PRIu64 ")\n", 3170 sample->evsel->name, 3171 perf_sample__strval(sample, "comm"), 3172 (pid_t)perf_sample__intval(sample, "pid"), 3173 runtime, 3174 perf_sample__intval(sample, "vruntime")); 3175 goto out_put; 3176 } 3177 3178 static int bpf_output__printer(enum binary_printer_ops op, 3179 unsigned int val, void *extra __maybe_unused, FILE *fp) 3180 { 3181 unsigned char ch = (unsigned char)val; 3182 3183 switch (op) { 3184 case BINARY_PRINT_CHAR_DATA: 3185 return fprintf(fp, "%c", isprint(ch) ? ch : '.'); 3186 case BINARY_PRINT_DATA_BEGIN: 3187 case BINARY_PRINT_LINE_BEGIN: 3188 case BINARY_PRINT_ADDR: 3189 case BINARY_PRINT_NUM_DATA: 3190 case BINARY_PRINT_NUM_PAD: 3191 case BINARY_PRINT_SEP: 3192 case BINARY_PRINT_CHAR_PAD: 3193 case BINARY_PRINT_LINE_END: 3194 case BINARY_PRINT_DATA_END: 3195 default: 3196 break; 3197 } 3198 3199 return 0; 3200 } 3201 3202 static void bpf_output__fprintf(struct trace *trace, 3203 struct perf_sample *sample) 3204 { 3205 binary__fprintf(sample->raw_data, sample->raw_size, 8, 3206 bpf_output__printer, NULL, trace->output); 3207 ++trace->nr_events_printed; 3208 } 3209 3210 static size_t trace__fprintf_tp_fields(struct trace *trace, struct perf_sample *sample, 3211 struct thread *thread, void *augmented_args, int augmented_args_size) 3212 { 3213 struct evsel *evsel = sample->evsel; 3214 char bf[2048]; 3215 size_t size = sizeof(bf); 3216 const struct tep_event *tp_format = evsel__tp_format(evsel); 3217 struct tep_format_field *field = tp_format ? tp_format->format.fields : NULL; 3218 struct syscall_arg_fmt *arg = __evsel__syscall_arg_fmt(evsel); 3219 size_t printed = 0, btf_printed; 3220 unsigned long val; 3221 u8 bit = 1; 3222 struct syscall_arg syscall_arg = { 3223 .augmented = { 3224 .size = augmented_args_size, 3225 .args = augmented_args, 3226 }, 3227 .idx = 0, 3228 .mask = 0, 3229 .trace = trace, 3230 .thread = thread, 3231 .show_string_prefix = trace->show_string_prefix, 3232 }; 3233 3234 for (; field && arg; field = field->next, ++syscall_arg.idx, bit <<= 1, ++arg) { 3235 if (syscall_arg.mask & bit) 3236 continue; 3237 3238 syscall_arg.len = 0; 3239 syscall_arg.fmt = arg; 3240 if (field->flags & TEP_FIELD_IS_ARRAY) { 3241 int offset = field->offset; 3242 3243 if (field->flags & TEP_FIELD_IS_DYNAMIC) { 3244 offset = format_field__intval(field, sample, evsel->needs_swap); 3245 syscall_arg.len = offset >> 16; 3246 offset &= 0xffff; 3247 if (tep_field_is_relative(field->flags)) 3248 offset += field->offset + field->size; 3249 } 3250 3251 val = (uintptr_t)(sample->raw_data + offset); 3252 } else 3253 val = format_field__intval(field, sample, evsel->needs_swap); 3254 /* 3255 * Some syscall args need some mask, most don't and 3256 * return val untouched. 3257 */ 3258 val = syscall_arg_fmt__mask_val(arg, &syscall_arg, val); 3259 3260 /* Suppress this argument if its value is zero and show_zero property isn't set. */ 3261 if (val == 0 && !trace->show_zeros && !arg->show_zero && arg->strtoul != STUL_BTF_TYPE) 3262 continue; 3263 3264 /* 3265 * __probe_ip is implicitly added to bare dynamic probes. 3266 * Suppress it by default to avoid cluttering the output. 3267 * If verbose mode is enabled, ensure it is formatted as a 3268 * hexadecimal memory address rather than a signed integer. 3269 */ 3270 if (evsel__is_probe(evsel) && !strcmp(field->name, "__probe_ip")) { 3271 if (!verbose) 3272 continue; 3273 3274 printed += scnprintf(bf + printed, size - printed, 3275 "%s", printed ? ", " : ""); 3276 if (trace->show_arg_names) 3277 printed += scnprintf(bf + printed, size - printed, 3278 "%s: ", field->name); 3279 3280 printed += scnprintf(bf + printed, size - printed, "%#016llx", 3281 (unsigned long long)val); 3282 continue; 3283 } 3284 3285 printed += scnprintf(bf + printed, size - printed, "%s", printed ? ", " : ""); 3286 3287 if (trace->show_arg_names) 3288 printed += scnprintf(bf + printed, size - printed, "%s: ", field->name); 3289 3290 btf_printed = trace__btf_scnprintf(trace, &syscall_arg, bf + printed, size - printed, val, field->type); 3291 if (btf_printed) { 3292 printed += btf_printed; 3293 continue; 3294 } 3295 3296 printed += syscall_arg_fmt__scnprintf_val(arg, bf + printed, size - printed, &syscall_arg, val); 3297 } 3298 3299 return fprintf(trace->output, "%.*s", (int)printed, bf); 3300 } 3301 3302 static int trace__event_handler(struct trace *trace, 3303 union perf_event *event __maybe_unused, 3304 struct perf_sample *sample) 3305 { 3306 struct evsel *evsel = sample->evsel; 3307 struct thread *thread; 3308 int callchain_ret = 0; 3309 3310 if (evsel->nr_events_printed >= evsel->max_events) 3311 return 0; 3312 3313 thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 3314 3315 if (sample->callchain) { 3316 struct callchain_cursor *cursor = get_tls_callchain_cursor(); 3317 3318 callchain_ret = trace__resolve_callchain(trace, sample, cursor); 3319 if (callchain_ret == 0) { 3320 if (cursor->nr < trace->min_stack) 3321 goto out; 3322 callchain_ret = 1; 3323 } 3324 } 3325 3326 trace__printf_interrupted_entry(trace); 3327 trace__fprintf_tstamp(trace, sample->time, trace->output); 3328 3329 if (trace->show_cpu) 3330 trace__fprintf_cpu(sample->cpu, trace->output); 3331 3332 if (trace->trace_syscalls && trace->show_duration) 3333 fprintf(trace->output, "( ): "); 3334 3335 if (thread) 3336 trace__fprintf_comm_tid(trace, thread, trace->output); 3337 3338 if (evsel == trace->syscalls.events.bpf_output) { 3339 int id = perf_evsel__sc_tp_uint(id, sample); 3340 int e_machine = thread 3341 ? thread__e_machine(thread, trace->host, /*e_flags=*/NULL) 3342 : EM_HOST; 3343 struct syscall *sc = trace__syscall_info(trace, evsel, e_machine, id); 3344 3345 if (sc) { 3346 fprintf(trace->output, "%s(", sc->name); 3347 trace__fprintf_sys_enter(trace, sample); 3348 fputc(')', trace->output); 3349 goto newline; 3350 } 3351 3352 /* 3353 * XXX: Not having the associated syscall info or not finding/adding 3354 * the thread should never happen, but if it does... 3355 * fall thru and print it as a bpf_output event. 3356 */ 3357 } 3358 3359 fprintf(trace->output, "%s(", evsel->name); 3360 3361 if (evsel__is_bpf_output(evsel)) { 3362 bpf_output__fprintf(trace, sample); 3363 } else { 3364 const struct tep_event *tp_format = evsel__tp_format(evsel); 3365 3366 if (tp_format && (strncmp(tp_format->name, "sys_enter_", 10) || 3367 trace__fprintf_sys_enter(trace, sample))) { 3368 if (trace->libtraceevent_print) { 3369 event_format__fprintf(tp_format, sample->cpu, 3370 sample->raw_data, sample->raw_size, 3371 trace->output); 3372 } else { 3373 trace__fprintf_tp_fields(trace, sample, thread, NULL, 0); 3374 } 3375 } 3376 } 3377 3378 newline: 3379 fprintf(trace->output, ")\n"); 3380 3381 if (callchain_ret > 0) 3382 trace__fprintf_callchain(trace, sample); 3383 else if (callchain_ret < 0) 3384 pr_err("Problem processing %s callchain, skipping...\n", evsel__name(evsel)); 3385 3386 ++trace->nr_events_printed; 3387 3388 if (evsel->max_events != ULONG_MAX && ++evsel->nr_events_printed == evsel->max_events) { 3389 evsel__disable(evsel); 3390 evsel__close(evsel); 3391 } 3392 out: 3393 thread__put(thread); 3394 return 0; 3395 } 3396 3397 static void print_location(FILE *f, struct perf_sample *sample, 3398 struct addr_location *al, 3399 bool print_dso, bool print_sym) 3400 { 3401 3402 if ((verbose > 0 || print_dso) && al->map) 3403 fprintf(f, "%s@", dso__long_name(map__dso(al->map))); 3404 3405 if ((verbose > 0 || print_sym) && al->sym) 3406 fprintf(f, "%s+0x%" PRIx64, al->sym->name, 3407 al->addr - al->sym->start); 3408 else if (al->map) 3409 fprintf(f, "0x%" PRIx64, al->addr); 3410 else 3411 fprintf(f, "0x%" PRIx64, sample->addr); 3412 } 3413 3414 static int trace__pgfault(struct trace *trace, 3415 union perf_event *event __maybe_unused, 3416 struct perf_sample *sample) 3417 { 3418 struct thread *thread; 3419 struct addr_location al; 3420 char map_type = 'd'; 3421 struct thread_trace *ttrace; 3422 int err = -1; 3423 int callchain_ret = 0; 3424 3425 addr_location__init(&al); 3426 thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 3427 3428 if (sample->callchain) { 3429 struct callchain_cursor *cursor = get_tls_callchain_cursor(); 3430 3431 callchain_ret = trace__resolve_callchain(trace, sample, cursor); 3432 if (callchain_ret == 0) { 3433 if (cursor->nr < trace->min_stack) 3434 goto out_put; 3435 callchain_ret = 1; 3436 } 3437 } 3438 3439 ttrace = thread__trace(thread, trace); 3440 if (ttrace == NULL) 3441 goto out_put; 3442 3443 if (sample->evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ) { 3444 ttrace->pfmaj++; 3445 trace->pfmaj++; 3446 } else { 3447 ttrace->pfmin++; 3448 trace->pfmin++; 3449 } 3450 3451 if (trace->summary_only) 3452 goto out; 3453 3454 thread__find_symbol(thread, sample->cpumode, sample->ip, &al); 3455 3456 trace__fprintf_entry_head(trace, thread, 0, true, sample->time, 3457 sample->cpu, trace->output); 3458 3459 fprintf(trace->output, "%sfault [", 3460 sample->evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ? 3461 "maj" : "min"); 3462 3463 print_location(trace->output, sample, &al, false, true); 3464 3465 fprintf(trace->output, "] => "); 3466 3467 thread__find_symbol(thread, sample->cpumode, sample->addr, &al); 3468 3469 if (!al.map) { 3470 thread__find_symbol(thread, sample->cpumode, sample->addr, &al); 3471 3472 if (al.map) 3473 map_type = 'x'; 3474 else 3475 map_type = '?'; 3476 } 3477 3478 print_location(trace->output, sample, &al, true, false); 3479 3480 fprintf(trace->output, " (%c%c)\n", map_type, al.level); 3481 3482 if (callchain_ret > 0) 3483 trace__fprintf_callchain(trace, sample); 3484 else if (callchain_ret < 0) 3485 pr_err("Problem processing %s callchain, skipping...\n", 3486 evsel__name(sample->evsel)); 3487 3488 ++trace->nr_events_printed; 3489 out: 3490 err = 0; 3491 out_put: 3492 thread__put(thread); 3493 addr_location__exit(&al); 3494 return err; 3495 } 3496 3497 static void trace__set_base_time(struct trace *trace, 3498 struct perf_sample *sample) 3499 { 3500 /* 3501 * BPF events were not setting PERF_SAMPLE_TIME, so be more robust 3502 * and don't use sample->time unconditionally, we may end up having 3503 * some other event in the future without PERF_SAMPLE_TIME for good 3504 * reason, i.e. we may not be interested in its timestamps, just in 3505 * it taking place, picking some piece of information when it 3506 * appears in our event stream (vfs_getname comes to mind). 3507 */ 3508 if (trace->base_time == 0 && !trace->full_time && 3509 (sample->evsel->core.attr.sample_type & PERF_SAMPLE_TIME)) 3510 trace->base_time = sample->time; 3511 } 3512 3513 static int trace__process_sample(const struct perf_tool *tool, 3514 union perf_event *event, 3515 struct perf_sample *sample, 3516 struct machine *machine __maybe_unused) 3517 { 3518 struct trace *trace = container_of(tool, struct trace, tool); 3519 struct evsel *evsel = sample->evsel; 3520 struct thread *thread; 3521 int err = 0; 3522 3523 tracepoint_handler handler = evsel->handler; 3524 3525 thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 3526 if (thread && thread__is_filtered(thread)) 3527 goto out; 3528 3529 trace__set_base_time(trace, sample); 3530 3531 if (handler) { 3532 ++trace->nr_events; 3533 handler(trace, event, sample); 3534 } 3535 out: 3536 thread__put(thread); 3537 return err; 3538 } 3539 3540 static int trace__record(struct trace *trace, int argc, const char **argv) 3541 { 3542 unsigned int rec_argc, i, j; 3543 const char **rec_argv; 3544 const char * const record_args[] = { 3545 "record", 3546 "-R", 3547 "-m", "1024", 3548 "-c", "1", 3549 }; 3550 pid_t pid = getpid(); 3551 char *filter = asprintf__tp_filter_pids(1, &pid); 3552 const char * const sc_args[] = { "-e", }; 3553 unsigned int sc_args_nr = ARRAY_SIZE(sc_args); 3554 const char * const majpf_args[] = { "-e", "major-faults" }; 3555 unsigned int majpf_args_nr = ARRAY_SIZE(majpf_args); 3556 const char * const minpf_args[] = { "-e", "minor-faults" }; 3557 unsigned int minpf_args_nr = ARRAY_SIZE(minpf_args); 3558 int err = -1; 3559 3560 /* +3 is for the event string below and the pid filter */ 3561 rec_argc = ARRAY_SIZE(record_args) + sc_args_nr + 3 + 3562 majpf_args_nr + minpf_args_nr + argc; 3563 rec_argv = calloc(rec_argc + 1, sizeof(char *)); 3564 3565 if (rec_argv == NULL || filter == NULL) 3566 goto out_free; 3567 3568 j = 0; 3569 for (i = 0; i < ARRAY_SIZE(record_args); i++) 3570 rec_argv[j++] = record_args[i]; 3571 3572 if (trace->trace_syscalls) { 3573 for (i = 0; i < sc_args_nr; i++) 3574 rec_argv[j++] = sc_args[i]; 3575 3576 /* event string may be different for older kernels - e.g., RHEL6 */ 3577 if (is_valid_tracepoint("raw_syscalls:sys_enter")) 3578 rec_argv[j++] = "raw_syscalls:sys_enter,raw_syscalls:sys_exit"; 3579 else if (is_valid_tracepoint("syscalls:sys_enter")) 3580 rec_argv[j++] = "syscalls:sys_enter,syscalls:sys_exit"; 3581 else { 3582 pr_err("Neither raw_syscalls nor syscalls events exist.\n"); 3583 goto out_free; 3584 } 3585 } 3586 3587 rec_argv[j++] = "--filter"; 3588 rec_argv[j++] = filter; 3589 3590 if (trace->trace_pgfaults & TRACE_PFMAJ) 3591 for (i = 0; i < majpf_args_nr; i++) 3592 rec_argv[j++] = majpf_args[i]; 3593 3594 if (trace->trace_pgfaults & TRACE_PFMIN) 3595 for (i = 0; i < minpf_args_nr; i++) 3596 rec_argv[j++] = minpf_args[i]; 3597 3598 for (i = 0; i < (unsigned int)argc; i++) 3599 rec_argv[j++] = argv[i]; 3600 3601 err = cmd_record(j, rec_argv); 3602 out_free: 3603 free(filter); 3604 free(rec_argv); 3605 return err; 3606 } 3607 3608 static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp); 3609 static size_t trace__fprintf_total_summary(struct trace *trace, FILE *fp); 3610 3611 static bool evlist__add_vfs_getname(struct evlist *evlist) 3612 { 3613 bool found = false; 3614 struct evsel *evsel, *tmp; 3615 struct parse_events_error err; 3616 int ret; 3617 3618 parse_events_error__init(&err); 3619 ret = parse_events(evlist, "probe:vfs_getname*", &err); 3620 parse_events_error__exit(&err); 3621 if (ret) 3622 return false; 3623 3624 evlist__for_each_entry_safe(evlist, evsel, tmp) { 3625 if (!strstarts(evsel__name(evsel), "probe:vfs_getname")) 3626 continue; 3627 3628 if (evsel__field(evsel, "pathname")) { 3629 evsel->handler = trace__vfs_getname; 3630 found = true; 3631 continue; 3632 } 3633 3634 list_del_init(&evsel->core.node); 3635 evsel->evlist = NULL; 3636 evsel__delete(evsel); 3637 } 3638 3639 return found; 3640 } 3641 3642 static struct evsel *evsel__new_pgfault(u64 config) 3643 { 3644 struct evsel *evsel; 3645 struct perf_event_attr attr = { 3646 .type = PERF_TYPE_SOFTWARE, 3647 .mmap_data = 1, 3648 }; 3649 3650 attr.config = config; 3651 attr.sample_period = 1; 3652 3653 event_attr_init(&attr); 3654 3655 evsel = evsel__new(&attr); 3656 if (evsel) 3657 evsel->handler = trace__pgfault; 3658 3659 return evsel; 3660 } 3661 3662 static void evlist__free_syscall_tp_fields(struct evlist *evlist) 3663 { 3664 struct evsel *evsel; 3665 3666 evlist__for_each_entry(evlist, evsel) { 3667 evsel_trace__delete(evsel->priv); 3668 evsel->priv = NULL; 3669 } 3670 } 3671 3672 static void trace__handle_event(struct trace *trace, union perf_event *event, struct perf_sample *sample) 3673 { 3674 const u32 type = event->header.type; 3675 3676 if (type != PERF_RECORD_SAMPLE) { 3677 trace__process_event(trace, trace->host, event, sample); 3678 return; 3679 } 3680 3681 if (sample->evsel == NULL) 3682 sample->evsel = evlist__id2evsel(trace->evlist, sample->id); 3683 3684 if (sample->evsel == NULL) { 3685 fprintf(trace->output, "Unknown tp ID %" PRIu64 ", skipping...\n", sample->id); 3686 return; 3687 } 3688 3689 if (evswitch__discard(&trace->evswitch, sample->evsel)) 3690 return; 3691 3692 trace__set_base_time(trace, sample); 3693 3694 if (sample->evsel->core.attr.type == PERF_TYPE_TRACEPOINT && 3695 sample->raw_data == NULL) { 3696 fprintf(trace->output, "%s sample with no payload for tid: %d, cpu %d, raw_size=%d, skipping...\n", 3697 evsel__name(sample->evsel), sample->tid, 3698 sample->cpu, sample->raw_size); 3699 } else { 3700 tracepoint_handler handler = sample->evsel->handler; 3701 3702 handler(trace, event, sample); 3703 } 3704 3705 if (trace->nr_events_printed >= trace->max_events && trace->max_events != ULONG_MAX) 3706 interrupted = true; 3707 } 3708 3709 static int trace__add_syscall_newtp(struct trace *trace) 3710 { 3711 int ret = -1; 3712 struct evlist *evlist = trace->evlist; 3713 struct evsel *sys_enter, *sys_exit; 3714 3715 sys_enter = perf_evsel__raw_syscall_newtp("sys_enter", trace__sys_enter); 3716 if (sys_enter == NULL) 3717 goto out; 3718 3719 if (perf_evsel__init_sc_tp_ptr_field(sys_enter, args)) 3720 goto out_delete_sys_enter; 3721 3722 sys_exit = perf_evsel__raw_syscall_newtp("sys_exit", trace__sys_exit); 3723 if (sys_exit == NULL) 3724 goto out_delete_sys_enter; 3725 3726 if (perf_evsel__init_sc_tp_uint_field(sys_exit, ret)) 3727 goto out_delete_sys_exit; 3728 3729 evsel__config_callchain(sys_enter, &trace->opts, &callchain_param); 3730 evsel__config_callchain(sys_exit, &trace->opts, &callchain_param); 3731 3732 evlist__add(evlist, sys_enter); 3733 evlist__add(evlist, sys_exit); 3734 3735 if (callchain_param.enabled && !trace->kernel_syscallchains) { 3736 /* 3737 * We're interested only in the user space callchain 3738 * leading to the syscall, allow overriding that for 3739 * debugging reasons using --kernel_syscall_callchains 3740 */ 3741 sys_exit->core.attr.exclude_callchain_kernel = 1; 3742 } 3743 3744 trace->syscalls.events.sys_enter = sys_enter; 3745 trace->syscalls.events.sys_exit = sys_exit; 3746 3747 ret = 0; 3748 out: 3749 return ret; 3750 3751 out_delete_sys_exit: 3752 evsel__delete_priv(sys_exit); 3753 out_delete_sys_enter: 3754 evsel__delete_priv(sys_enter); 3755 goto out; 3756 } 3757 3758 static int trace__set_ev_qualifier_tp_filter(struct trace *trace) 3759 { 3760 int err = -1; 3761 struct evsel *sys_exit; 3762 char *filter = asprintf_expr_inout_ints("id", !trace->not_ev_qualifier, 3763 trace->ev_qualifier_ids.nr, 3764 trace->ev_qualifier_ids.entries); 3765 3766 if (filter == NULL) 3767 goto out_enomem; 3768 3769 if (!evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter)) { 3770 sys_exit = trace->syscalls.events.sys_exit; 3771 err = evsel__append_tp_filter(sys_exit, filter); 3772 } 3773 3774 free(filter); 3775 out: 3776 return err; 3777 out_enomem: 3778 errno = ENOMEM; 3779 goto out; 3780 } 3781 3782 #ifdef HAVE_LIBBPF_SUPPORT 3783 3784 static struct bpf_program *unaugmented_prog; 3785 3786 static int syscall_arg_fmt__cache_btf_struct(struct syscall_arg_fmt *arg_fmt, struct btf *btf, char *type) 3787 { 3788 int id; 3789 3790 if (arg_fmt->type != NULL) 3791 return -1; 3792 3793 id = btf__find_by_name(btf, type); 3794 if (id < 0) 3795 return -1; 3796 3797 arg_fmt->type = btf__type_by_id(btf, id); 3798 arg_fmt->type_id = id; 3799 3800 return 0; 3801 } 3802 3803 static struct bpf_program *trace__find_syscall_bpf_prog(struct trace *trace __maybe_unused, 3804 struct syscall *sc, 3805 const char *prog_name, const char *type) 3806 { 3807 struct bpf_program *prog; 3808 3809 if (prog_name == NULL) { 3810 char default_prog_name[256]; 3811 scnprintf(default_prog_name, sizeof(default_prog_name), "tp/syscalls/sys_%s_%s", type, sc->name); 3812 prog = augmented_syscalls__find_by_title(default_prog_name); 3813 if (prog != NULL) 3814 goto out_found; 3815 if (sc->fmt && sc->fmt->alias) { 3816 scnprintf(default_prog_name, sizeof(default_prog_name), "tp/syscalls/sys_%s_%s", type, sc->fmt->alias); 3817 prog = augmented_syscalls__find_by_title(default_prog_name); 3818 if (prog != NULL) 3819 goto out_found; 3820 } 3821 goto out_unaugmented; 3822 } 3823 3824 prog = augmented_syscalls__find_by_title(prog_name); 3825 3826 if (prog != NULL) { 3827 out_found: 3828 return prog; 3829 } 3830 3831 pr_debug("Couldn't find BPF prog \"%s\" to associate with syscalls:sys_%s_%s, not augmenting it\n", 3832 prog_name, type, sc->name); 3833 out_unaugmented: 3834 return unaugmented_prog; 3835 } 3836 3837 static void trace__init_syscall_bpf_progs(struct trace *trace, int e_machine, int id) 3838 { 3839 struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, id); 3840 3841 if (sc == NULL) 3842 return; 3843 3844 sc->bpf_prog.sys_enter = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_enter : NULL, "enter"); 3845 sc->bpf_prog.sys_exit = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_exit : NULL, "exit"); 3846 } 3847 3848 static int trace__bpf_prog_sys_enter_fd(struct trace *trace, int e_machine, int id) 3849 { 3850 struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, id); 3851 return sc ? bpf_program__fd(sc->bpf_prog.sys_enter) : bpf_program__fd(unaugmented_prog); 3852 } 3853 3854 static int trace__bpf_prog_sys_exit_fd(struct trace *trace, int e_machine, int id) 3855 { 3856 struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, id); 3857 return sc ? bpf_program__fd(sc->bpf_prog.sys_exit) : bpf_program__fd(unaugmented_prog); 3858 } 3859 3860 static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, int key, unsigned int *beauty_array) 3861 { 3862 struct tep_format_field *field; 3863 struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, key); 3864 const struct btf_type *bt; 3865 char *struct_offset, *tmp, name[32]; 3866 bool can_augment = false; 3867 int i, cnt; 3868 3869 if (sc == NULL) 3870 return -1; 3871 3872 trace__load_vmlinux_btf(trace); 3873 if (trace->btf == NULL) 3874 return -1; 3875 3876 for (i = 0, field = sc->args; field; ++i, field = field->next) { 3877 // XXX We're only collecting pointer payloads _from_ user space 3878 if (!sc->arg_fmt[i].from_user) 3879 continue; 3880 3881 struct_offset = strstr(field->type, "struct "); 3882 if (struct_offset == NULL) 3883 struct_offset = strstr(field->type, "union "); 3884 else 3885 struct_offset++; // "union" is shorter 3886 3887 if (field->flags & TEP_FIELD_IS_POINTER && struct_offset) { /* struct or union (think BPF's attr arg) */ 3888 struct_offset += 6; 3889 3890 /* for 'struct foo *', we only want 'foo' */ 3891 for (tmp = struct_offset, cnt = 0; *tmp != ' ' && *tmp != '\0'; ++tmp, ++cnt) { 3892 } 3893 3894 strncpy(name, struct_offset, cnt); 3895 name[cnt] = '\0'; 3896 3897 /* cache struct's btf_type and type_id */ 3898 if (syscall_arg_fmt__cache_btf_struct(&sc->arg_fmt[i], trace->btf, name)) 3899 continue; 3900 3901 bt = sc->arg_fmt[i].type; 3902 beauty_array[i] = bt->size; 3903 can_augment = true; 3904 } else if (field->flags & TEP_FIELD_IS_POINTER && /* string */ 3905 strcmp(field->type, "const char *") == 0 && 3906 (strstr(field->name, "name") || 3907 strstr(field->name, "path") || 3908 strstr(field->name, "file") || 3909 strstr(field->name, "root") || 3910 strstr(field->name, "key") || 3911 strstr(field->name, "special") || 3912 strstr(field->name, "type") || 3913 strstr(field->name, "description"))) { 3914 beauty_array[i] = 1; 3915 can_augment = true; 3916 } else if (field->flags & TEP_FIELD_IS_POINTER && /* buffer */ 3917 strstr(field->type, "char *") && 3918 (strstr(field->name, "buf") || 3919 strstr(field->name, "val") || 3920 strstr(field->name, "msg"))) { 3921 int j; 3922 struct tep_format_field *field_tmp; 3923 3924 /* find the size of the buffer that appears in pairs with buf */ 3925 for (j = 0, field_tmp = sc->args; field_tmp; ++j, field_tmp = field_tmp->next) { 3926 if (!(field_tmp->flags & TEP_FIELD_IS_POINTER) && /* only integers */ 3927 (strstr(field_tmp->name, "count") || 3928 strstr(field_tmp->name, "siz") || /* size, bufsiz */ 3929 (strstr(field_tmp->name, "len") && strcmp(field_tmp->name, "filename")))) { 3930 /* filename's got 'len' in it, we don't want that */ 3931 beauty_array[i] = -(j + 1); 3932 can_augment = true; 3933 break; 3934 } 3935 } 3936 } 3937 } 3938 3939 if (can_augment) 3940 return 0; 3941 3942 return -1; 3943 } 3944 3945 static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace, 3946 struct syscall *sc) 3947 { 3948 struct tep_format_field *field, *candidate_field; 3949 /* 3950 * We're only interested in syscalls that have a pointer: 3951 */ 3952 for (field = sc->args; field; field = field->next) { 3953 if (field->flags & TEP_FIELD_IS_POINTER) 3954 goto try_to_find_pair; 3955 } 3956 3957 return NULL; 3958 3959 try_to_find_pair: 3960 for (int i = 0, num_idx = syscalltbl__num_idx(sc->e_machine); i < num_idx; ++i) { 3961 int id = syscalltbl__id_at_idx(sc->e_machine, i); 3962 struct syscall *pair = trace__syscall_info(trace, NULL, sc->e_machine, id); 3963 struct bpf_program *pair_prog; 3964 bool is_candidate = false; 3965 3966 if (pair == NULL || pair->id == sc->id || 3967 pair->bpf_prog.sys_enter == unaugmented_prog) 3968 continue; 3969 3970 for (field = sc->args, candidate_field = pair->args; 3971 field && candidate_field; field = field->next, candidate_field = candidate_field->next) { 3972 bool is_pointer = field->flags & TEP_FIELD_IS_POINTER, 3973 candidate_is_pointer = candidate_field->flags & TEP_FIELD_IS_POINTER; 3974 3975 if (is_pointer) { 3976 if (!candidate_is_pointer) { 3977 // The candidate just doesn't copies our pointer arg, might copy other pointers we want. 3978 continue; 3979 } 3980 } else { 3981 if (candidate_is_pointer) { 3982 // The candidate might copy a pointer we don't have, skip it. 3983 goto next_candidate; 3984 } 3985 continue; 3986 } 3987 3988 if (strcmp(field->type, candidate_field->type)) 3989 goto next_candidate; 3990 3991 /* 3992 * This is limited in the BPF program but sys_write 3993 * uses "const char *" for its "buf" arg so we need to 3994 * use some heuristic that is kinda future proof... 3995 */ 3996 if (strcmp(field->type, "const char *") == 0 && 3997 !(strstr(field->name, "name") || 3998 strstr(field->name, "path") || 3999 strstr(field->name, "file") || 4000 strstr(field->name, "root") || 4001 strstr(field->name, "description"))) 4002 goto next_candidate; 4003 4004 is_candidate = true; 4005 } 4006 4007 if (!is_candidate) 4008 goto next_candidate; 4009 4010 /* 4011 * Check if the tentative pair syscall augmenter has more pointers, if it has, 4012 * then it may be collecting that and we then can't use it, as it would collect 4013 * more than what is common to the two syscalls. 4014 */ 4015 if (candidate_field) { 4016 for (candidate_field = candidate_field->next; candidate_field; candidate_field = candidate_field->next) 4017 if (candidate_field->flags & TEP_FIELD_IS_POINTER) 4018 goto next_candidate; 4019 } 4020 4021 pair_prog = pair->bpf_prog.sys_enter; 4022 /* 4023 * If the pair isn't enabled, then its bpf_prog.sys_enter will not 4024 * have been searched for, so search it here and if it returns the 4025 * unaugmented one, then ignore it, otherwise we'll reuse that BPF 4026 * program for a filtered syscall on a non-filtered one. 4027 * 4028 * For instance, we have "!syscalls:sys_enter_renameat" and that is 4029 * useful for "renameat2". 4030 */ 4031 if (pair_prog == NULL) { 4032 pair_prog = trace__find_syscall_bpf_prog(trace, pair, pair->fmt ? pair->fmt->bpf_prog_name.sys_enter : NULL, "enter"); 4033 if (pair_prog == unaugmented_prog) 4034 goto next_candidate; 4035 } 4036 4037 pr_debug("Reusing \"%s\" BPF sys_enter augmenter for \"%s\"\n", pair->name, 4038 sc->name); 4039 return pair_prog; 4040 next_candidate: 4041 continue; 4042 } 4043 4044 return NULL; 4045 } 4046 4047 static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace, int e_machine) 4048 { 4049 int map_enter_fd; 4050 int map_exit_fd; 4051 int beauty_map_fd; 4052 int err = 0; 4053 unsigned int beauty_array[6]; 4054 4055 if (augmented_syscalls__get_map_fds(&map_enter_fd, &map_exit_fd, &beauty_map_fd) < 0) 4056 return -1; 4057 4058 unaugmented_prog = augmented_syscalls__unaugmented(); 4059 4060 for (int i = 0, num_idx = syscalltbl__num_idx(e_machine); i < num_idx; ++i) { 4061 int prog_fd, key = syscalltbl__id_at_idx(e_machine, i); 4062 4063 if (!trace__syscall_enabled(trace, key)) 4064 continue; 4065 4066 trace__init_syscall_bpf_progs(trace, e_machine, key); 4067 4068 // It'll get at least the "!raw_syscalls:unaugmented" 4069 prog_fd = trace__bpf_prog_sys_enter_fd(trace, e_machine, key); 4070 err = bpf_map_update_elem(map_enter_fd, &key, &prog_fd, BPF_ANY); 4071 if (err) 4072 break; 4073 prog_fd = trace__bpf_prog_sys_exit_fd(trace, e_machine, key); 4074 err = bpf_map_update_elem(map_exit_fd, &key, &prog_fd, BPF_ANY); 4075 if (err) 4076 break; 4077 4078 /* use beauty_map to tell BPF how many bytes to collect, set beauty_map's value here */ 4079 memset(beauty_array, 0, sizeof(beauty_array)); 4080 err = trace__bpf_sys_enter_beauty_map(trace, e_machine, key, (unsigned int *)beauty_array); 4081 if (err) 4082 continue; 4083 err = bpf_map_update_elem(beauty_map_fd, &key, beauty_array, BPF_ANY); 4084 if (err) 4085 break; 4086 } 4087 4088 /* 4089 * Now lets do a second pass looking for enabled syscalls without 4090 * an augmenter that have a signature that is a superset of another 4091 * syscall with an augmenter so that we can auto-reuse it. 4092 * 4093 * I.e. if we have an augmenter for the "open" syscall that has 4094 * this signature: 4095 * 4096 * int open(const char *pathname, int flags, mode_t mode); 4097 * 4098 * I.e. that will collect just the first string argument, then we 4099 * can reuse it for the 'creat' syscall, that has this signature: 4100 * 4101 * int creat(const char *pathname, mode_t mode); 4102 * 4103 * and for: 4104 * 4105 * int stat(const char *pathname, struct stat *statbuf); 4106 * int lstat(const char *pathname, struct stat *statbuf); 4107 * 4108 * Because the 'open' augmenter will collect the first arg as a string, 4109 * and leave alone all the other args, which already helps with 4110 * beautifying 'stat' and 'lstat''s pathname arg. 4111 * 4112 * Then, in time, when 'stat' gets an augmenter that collects both 4113 * first and second arg (this one on the raw_syscalls:sys_exit prog 4114 * array tail call, then that one will be used. 4115 */ 4116 for (int i = 0, num_idx = syscalltbl__num_idx(e_machine); i < num_idx; ++i) { 4117 int key = syscalltbl__id_at_idx(e_machine, i); 4118 struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, key); 4119 struct bpf_program *pair_prog; 4120 int prog_fd; 4121 4122 if (sc == NULL || sc->bpf_prog.sys_enter == NULL) 4123 continue; 4124 4125 /* 4126 * For now we're just reusing the sys_enter prog, and if it 4127 * already has an augmenter, we don't need to find one. 4128 */ 4129 if (sc->bpf_prog.sys_enter != unaugmented_prog) 4130 continue; 4131 4132 /* 4133 * Look at all the other syscalls for one that has a signature 4134 * that is close enough that we can share: 4135 */ 4136 pair_prog = trace__find_usable_bpf_prog_entry(trace, sc); 4137 if (pair_prog == NULL) 4138 continue; 4139 4140 sc->bpf_prog.sys_enter = pair_prog; 4141 4142 /* 4143 * Update the BPF_MAP_TYPE_PROG_SHARED for raw_syscalls:sys_enter 4144 * with the fd for the program we're reusing: 4145 */ 4146 prog_fd = bpf_program__fd(sc->bpf_prog.sys_enter); 4147 err = bpf_map_update_elem(map_enter_fd, &key, &prog_fd, BPF_ANY); 4148 if (err) 4149 break; 4150 } 4151 4152 return err; 4153 } 4154 #else // !HAVE_LIBBPF_SUPPORT 4155 static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace __maybe_unused, 4156 int e_machine __maybe_unused) 4157 { 4158 return -1; 4159 } 4160 #endif // HAVE_LIBBPF_SUPPORT 4161 4162 static int trace__set_ev_qualifier_filter(struct trace *trace) 4163 { 4164 if (trace->syscalls.events.sys_enter) 4165 return trace__set_ev_qualifier_tp_filter(trace); 4166 return 0; 4167 } 4168 4169 static int trace__set_filter_loop_pids(struct trace *trace) 4170 { 4171 unsigned int nr = 1, err; 4172 pid_t pids[32] = { 4173 getpid(), 4174 }; 4175 struct thread *thread = machine__find_thread(trace->host, pids[0], pids[0]); 4176 4177 while (thread && nr < ARRAY_SIZE(pids)) { 4178 struct thread *parent = machine__find_thread(trace->host, 4179 thread__ppid(thread), 4180 thread__ppid(thread)); 4181 4182 if (parent == NULL) 4183 break; 4184 4185 if (!strcmp(thread__comm_str(parent), "sshd") || 4186 strstarts(thread__comm_str(parent), "gnome-terminal")) { 4187 pids[nr++] = thread__tid(parent); 4188 thread__put(parent); 4189 break; 4190 } 4191 thread__put(thread); 4192 thread = parent; 4193 } 4194 thread__put(thread); 4195 4196 err = evlist__append_tp_filter_pids(trace->evlist, nr, pids); 4197 if (!err) 4198 err = augmented_syscalls__set_filter_pids(nr, pids); 4199 4200 return err; 4201 } 4202 4203 static int trace__set_filter_pids(struct trace *trace) 4204 { 4205 int err = 0; 4206 /* 4207 * Better not use !target__has_task() here because we need to cover the 4208 * case where no threads were specified in the command line, but a 4209 * workload was, and in that case we will fill in the thread_map when 4210 * we fork the workload in evlist__prepare_workload. 4211 */ 4212 if (trace->filter_pids.nr > 0) { 4213 err = evlist__append_tp_filter_pids(trace->evlist, trace->filter_pids.nr, 4214 trace->filter_pids.entries); 4215 if (!err) { 4216 err = augmented_syscalls__set_filter_pids(trace->filter_pids.nr, 4217 trace->filter_pids.entries); 4218 } 4219 } else if (perf_thread_map__pid(trace->evlist->core.threads, 0) == -1) { 4220 err = trace__set_filter_loop_pids(trace); 4221 } 4222 4223 return err; 4224 } 4225 4226 static int __trace__deliver_event(struct trace *trace, union perf_event *event) 4227 { 4228 struct evlist *evlist = trace->evlist; 4229 struct perf_sample sample; 4230 int err; 4231 4232 perf_sample__init(&sample, /*all=*/false); 4233 err = evlist__parse_sample(evlist, event, &sample); 4234 if (err) 4235 fprintf(trace->output, "Can't parse sample, err = %d, skipping...\n", err); 4236 else 4237 trace__handle_event(trace, event, &sample); 4238 4239 perf_sample__exit(&sample); 4240 return 0; 4241 } 4242 4243 static int __trace__flush_events(struct trace *trace) 4244 { 4245 u64 first = ordered_events__first_time(&trace->oe.data); 4246 u64 flush = trace->oe.last - NSEC_PER_SEC; 4247 4248 /* Is there some thing to flush.. */ 4249 if (first && first < flush) 4250 return ordered_events__flush_time(&trace->oe.data, flush); 4251 4252 return 0; 4253 } 4254 4255 static int trace__flush_events(struct trace *trace) 4256 { 4257 return !trace->sort_events ? 0 : __trace__flush_events(trace); 4258 } 4259 4260 static int trace__deliver_event(struct trace *trace, union perf_event *event) 4261 { 4262 int err; 4263 4264 if (!trace->sort_events) 4265 return __trace__deliver_event(trace, event); 4266 4267 err = evlist__parse_sample_timestamp(trace->evlist, event, &trace->oe.last); 4268 if (err && err != -1) 4269 return err; 4270 4271 err = ordered_events__queue(&trace->oe.data, event, trace->oe.last, 0, NULL); 4272 if (err) 4273 return err; 4274 4275 return trace__flush_events(trace); 4276 } 4277 4278 static int ordered_events__deliver_event(struct ordered_events *oe, 4279 struct ordered_event *event) 4280 { 4281 struct trace *trace = container_of(oe, struct trace, oe.data); 4282 4283 return __trace__deliver_event(trace, event->event); 4284 } 4285 4286 static struct syscall_arg_fmt *evsel__find_syscall_arg_fmt_by_name(struct evsel *evsel, char *arg, 4287 char **type) 4288 { 4289 struct syscall_arg_fmt *fmt = __evsel__syscall_arg_fmt(evsel); 4290 const struct tep_event *tp_format; 4291 4292 if (!fmt) 4293 return NULL; 4294 4295 tp_format = evsel__tp_format(evsel); 4296 if (!tp_format) 4297 return NULL; 4298 4299 for (const struct tep_format_field *field = tp_format->format.fields; field; 4300 field = field->next, ++fmt) { 4301 if (strcmp(field->name, arg) == 0) { 4302 *type = field->type; 4303 return fmt; 4304 } 4305 } 4306 4307 return NULL; 4308 } 4309 4310 static int trace__expand_filter(struct trace *trace, struct evsel *evsel) 4311 { 4312 char *tok, *left = evsel->filter, *new_filter = evsel->filter; 4313 4314 while ((tok = strpbrk(left, "=<>!")) != NULL) { 4315 char *right = tok + 1, *right_end; 4316 4317 if (*right == '=') 4318 ++right; 4319 4320 while (isspace(*right)) 4321 ++right; 4322 4323 if (*right == '\0') 4324 break; 4325 4326 while (!isalpha(*left)) 4327 if (++left == tok) { 4328 /* 4329 * Bail out, can't find the name of the argument that is being 4330 * used in the filter, let it try to set this filter, will fail later. 4331 */ 4332 return 0; 4333 } 4334 4335 right_end = right + 1; 4336 while (isalnum(*right_end) || *right_end == '_' || *right_end == '|') 4337 ++right_end; 4338 4339 if (isalpha(*right)) { 4340 struct syscall_arg_fmt *fmt; 4341 int left_size = tok - left, 4342 right_size = right_end - right; 4343 char arg[128], *type; 4344 4345 while (isspace(left[left_size - 1])) 4346 --left_size; 4347 4348 scnprintf(arg, sizeof(arg), "%.*s", left_size, left); 4349 4350 fmt = evsel__find_syscall_arg_fmt_by_name(evsel, arg, &type); 4351 if (fmt == NULL) { 4352 pr_err("\"%s\" not found in \"%s\", can't set filter \"%s\"\n", 4353 arg, evsel->name, evsel->filter); 4354 return -1; 4355 } 4356 4357 pr_debug2("trying to expand \"%s\" \"%.*s\" \"%.*s\" -> ", 4358 arg, (int)(right - tok), tok, right_size, right); 4359 4360 if (fmt->strtoul) { 4361 u64 val; 4362 struct syscall_arg syscall_arg = { 4363 .trace = trace, 4364 .fmt = fmt, 4365 .type_name = type, 4366 .parm = fmt->parm, 4367 }; 4368 4369 if (fmt->strtoul(right, right_size, &syscall_arg, &val)) { 4370 char *n, expansion[19]; 4371 int expansion_lenght = scnprintf(expansion, sizeof(expansion), "%#" PRIx64, val); 4372 int expansion_offset = right - new_filter; 4373 4374 pr_debug("%s", expansion); 4375 4376 if (asprintf(&n, "%.*s%s%s", expansion_offset, new_filter, expansion, right_end) < 0) { 4377 pr_debug(" out of memory!\n"); 4378 free(new_filter); 4379 return -1; 4380 } 4381 if (new_filter != evsel->filter) 4382 free(new_filter); 4383 left = n + expansion_offset + expansion_lenght; 4384 new_filter = n; 4385 } else { 4386 pr_err("\"%.*s\" not found for \"%s\" in \"%s\", can't set filter \"%s\"\n", 4387 right_size, right, arg, evsel->name, evsel->filter); 4388 return -1; 4389 } 4390 } else { 4391 pr_err("No resolver (strtoul) for \"%s\" in \"%s\", can't set filter \"%s\"\n", 4392 arg, evsel->name, evsel->filter); 4393 return -1; 4394 } 4395 4396 pr_debug("\n"); 4397 } else { 4398 left = right_end; 4399 } 4400 } 4401 4402 if (new_filter != evsel->filter) { 4403 pr_debug("New filter for %s: %s\n", evsel->name, new_filter); 4404 evsel__set_filter(evsel, new_filter); 4405 free(new_filter); 4406 } 4407 4408 return 0; 4409 } 4410 4411 static int trace__expand_filters(struct trace *trace, struct evsel **err_evsel) 4412 { 4413 struct evlist *evlist = trace->evlist; 4414 struct evsel *evsel; 4415 4416 evlist__for_each_entry(evlist, evsel) { 4417 if (evsel->filter == NULL) 4418 continue; 4419 4420 if (trace__expand_filter(trace, evsel)) { 4421 *err_evsel = evsel; 4422 return -1; 4423 } 4424 } 4425 4426 return 0; 4427 } 4428 4429 static int trace__run(struct trace *trace, int argc, const char **argv) 4430 { 4431 struct evlist *evlist = trace->evlist; 4432 struct evsel *evsel, *pgfault_maj = NULL, *pgfault_min = NULL; 4433 int err = -1, i; 4434 unsigned long before; 4435 const bool forks = argc > 0; 4436 bool draining = false; 4437 4438 trace->live = true; 4439 4440 if (trace->summary_bpf) { 4441 if (trace_prepare_bpf_summary(trace->summary_mode) < 0) 4442 goto out_delete_evlist; 4443 4444 if (trace->summary_only) 4445 goto create_maps; 4446 } 4447 4448 if (!trace->raw_augmented_syscalls) { 4449 if (trace->trace_syscalls && trace__add_syscall_newtp(trace)) 4450 goto out_error_raw_syscalls; 4451 4452 if (trace->trace_syscalls) 4453 trace->vfs_getname = evlist__add_vfs_getname(evlist); 4454 } 4455 4456 if ((trace->trace_pgfaults & TRACE_PFMAJ)) { 4457 pgfault_maj = evsel__new_pgfault(PERF_COUNT_SW_PAGE_FAULTS_MAJ); 4458 if (pgfault_maj == NULL) 4459 goto out_error_mem; 4460 evsel__config_callchain(pgfault_maj, &trace->opts, &callchain_param); 4461 evlist__add(evlist, pgfault_maj); 4462 } 4463 4464 if ((trace->trace_pgfaults & TRACE_PFMIN)) { 4465 pgfault_min = evsel__new_pgfault(PERF_COUNT_SW_PAGE_FAULTS_MIN); 4466 if (pgfault_min == NULL) 4467 goto out_error_mem; 4468 evsel__config_callchain(pgfault_min, &trace->opts, &callchain_param); 4469 evlist__add(evlist, pgfault_min); 4470 } 4471 4472 /* Enable ignoring missing threads when -p option is defined. */ 4473 trace->opts.ignore_missing_thread = trace->opts.target.pid; 4474 4475 if (trace->sched && 4476 evlist__add_newtp(evlist, "sched", "sched_stat_runtime", trace__sched_stat_runtime)) 4477 goto out_error_sched_stat_runtime; 4478 /* 4479 * If a global cgroup was set, apply it to all the events without an 4480 * explicit cgroup. I.e.: 4481 * 4482 * trace -G A -e sched:*switch 4483 * 4484 * Will set all raw_syscalls:sys_{enter,exit}, pgfault, vfs_getname, etc 4485 * _and_ sched:sched_switch to the 'A' cgroup, while: 4486 * 4487 * trace -e sched:*switch -G A 4488 * 4489 * will only set the sched:sched_switch event to the 'A' cgroup, all the 4490 * other events (raw_syscalls:sys_{enter,exit}, etc are left "without" 4491 * a cgroup (on the root cgroup, sys wide, etc). 4492 * 4493 * Multiple cgroups: 4494 * 4495 * trace -G A -e sched:*switch -G B 4496 * 4497 * the syscall ones go to the 'A' cgroup, the sched:sched_switch goes 4498 * to the 'B' cgroup. 4499 * 4500 * evlist__set_default_cgroup() grabs a reference of the passed cgroup 4501 * only for the evsels still without a cgroup, i.e. evsel->cgroup == NULL. 4502 */ 4503 if (trace->cgroup) 4504 evlist__set_default_cgroup(trace->evlist, trace->cgroup); 4505 4506 create_maps: 4507 err = evlist__create_maps(evlist, &trace->opts.target); 4508 if (err < 0) { 4509 fprintf(trace->output, "Problems parsing the target to trace, check your options!\n"); 4510 goto out_delete_evlist; 4511 } 4512 4513 err = trace__symbols_init(trace, argc, argv, evlist); 4514 if (err < 0) { 4515 fprintf(trace->output, "Problems initializing symbol libraries!\n"); 4516 goto out_delete_evlist; 4517 } 4518 4519 if (trace->summary_mode == SUMMARY__BY_TOTAL && !trace->summary_bpf) { 4520 trace->syscall_stats = alloc_syscall_stats(); 4521 if (!trace->syscall_stats) 4522 goto out_delete_evlist; 4523 } 4524 4525 evlist__config(evlist, &trace->opts, &callchain_param); 4526 4527 if (forks) { 4528 err = evlist__prepare_workload(evlist, &trace->opts.target, argv, false, NULL); 4529 if (err < 0) { 4530 fprintf(trace->output, "Couldn't run the workload!\n"); 4531 goto out_delete_evlist; 4532 } 4533 workload_pid = evlist->workload.pid; 4534 } 4535 4536 err = evlist__open(evlist); 4537 if (err < 0) 4538 goto out_error_open; 4539 4540 augmented_syscalls__setup_bpf_output(); 4541 4542 err = trace__set_filter_pids(trace); 4543 if (err < 0) 4544 goto out_error_mem; 4545 4546 /* 4547 * TODO: Initialize for all host binary machine types, not just 4548 * those matching the perf binary. 4549 */ 4550 trace__init_syscalls_bpf_prog_array_maps(trace, EM_HOST); 4551 4552 if (trace->ev_qualifier_ids.nr > 0) { 4553 err = trace__set_ev_qualifier_filter(trace); 4554 if (err < 0) 4555 goto out_errno; 4556 4557 if (trace->syscalls.events.sys_exit) { 4558 pr_debug("event qualifier tracepoint filter: %s\n", 4559 trace->syscalls.events.sys_exit->filter); 4560 } 4561 } 4562 4563 /* 4564 * If the "close" syscall is not traced, then we will not have the 4565 * opportunity to, in syscall_arg__scnprintf_close_fd() invalidate the 4566 * fd->pathname table and were ending up showing the last value set by 4567 * syscalls opening a pathname and associating it with a descriptor or 4568 * reading it from /proc/pid/fd/ in cases where that doesn't make 4569 * sense. 4570 * 4571 * So just disable this beautifier (SCA_FD, SCA_FDAT) when 'close' is 4572 * not in use. 4573 */ 4574 /* TODO: support for more than just perf binary machine type close. */ 4575 trace->fd_path_disabled = !trace__syscall_enabled(trace, syscalltbl__id(EM_HOST, "close")); 4576 4577 err = trace__expand_filters(trace, &evsel); 4578 if (err) 4579 goto out_delete_evlist; 4580 err = evlist__apply_filters(evlist, &evsel, &trace->opts.target); 4581 if (err < 0) 4582 goto out_error_apply_filters; 4583 4584 if (!trace->summary_only || !trace->summary_bpf) { 4585 err = evlist__mmap(evlist, trace->opts.mmap_pages); 4586 if (err < 0) 4587 goto out_error_mmap; 4588 } 4589 4590 if (!target__none(&trace->opts.target) && !trace->opts.target.initial_delay) 4591 evlist__enable(evlist); 4592 4593 if (forks) 4594 evlist__start_workload(evlist); 4595 4596 if (trace->opts.target.initial_delay) { 4597 usleep(trace->opts.target.initial_delay * 1000); 4598 evlist__enable(evlist); 4599 } 4600 4601 if (trace->summary_bpf) 4602 trace_start_bpf_summary(); 4603 4604 trace->multiple_threads = perf_thread_map__pid(evlist->core.threads, 0) == -1 || 4605 perf_thread_map__nr(evlist->core.threads) > 1 || 4606 evlist__first(evlist)->core.attr.inherit; 4607 4608 /* 4609 * Now that we already used evsel->core.attr to ask the kernel to setup the 4610 * events, lets reuse evsel->core.attr.sample_max_stack as the limit in 4611 * trace__resolve_callchain(), allowing per-event max-stack settings 4612 * to override an explicitly set --max-stack global setting. 4613 */ 4614 evlist__for_each_entry(evlist, evsel) { 4615 if (evsel__has_callchain(evsel) && 4616 evsel->core.attr.sample_max_stack == 0) 4617 evsel->core.attr.sample_max_stack = trace->max_stack; 4618 } 4619 again: 4620 before = trace->nr_events; 4621 4622 for (i = 0; i < evlist->core.nr_mmaps; i++) { 4623 union perf_event *event; 4624 struct mmap *md; 4625 4626 md = &evlist->mmap[i]; 4627 if (perf_mmap__read_init(&md->core) < 0) 4628 continue; 4629 4630 while ((event = perf_mmap__read_event(&md->core)) != NULL) { 4631 ++trace->nr_events; 4632 4633 err = trace__deliver_event(trace, event); 4634 if (err) 4635 goto out_disable; 4636 4637 perf_mmap__consume(&md->core); 4638 4639 if (interrupted) 4640 goto out_disable; 4641 4642 if (done && !draining) { 4643 evlist__disable(evlist); 4644 draining = true; 4645 } 4646 } 4647 perf_mmap__read_done(&md->core); 4648 } 4649 4650 if (trace->nr_events == before) { 4651 int timeout = done ? 100 : -1; 4652 4653 if (!draining && evlist__poll(evlist, timeout) > 0) { 4654 if (evlist__filter_pollfd(evlist, POLLERR | POLLHUP | POLLNVAL) == 0) 4655 draining = true; 4656 4657 goto again; 4658 } else { 4659 if (trace__flush_events(trace)) 4660 goto out_disable; 4661 } 4662 } else { 4663 goto again; 4664 } 4665 4666 out_disable: 4667 thread__zput(trace->current); 4668 4669 evlist__disable(evlist); 4670 4671 if (trace->summary_bpf) 4672 trace_end_bpf_summary(); 4673 4674 if (trace->sort_events) 4675 ordered_events__flush(&trace->oe.data, OE_FLUSH__FINAL); 4676 4677 if (!err) { 4678 if (trace->summary) { 4679 if (trace->summary_bpf) 4680 trace_print_bpf_summary(trace->output, trace->max_summary); 4681 else if (trace->summary_mode == SUMMARY__BY_TOTAL) 4682 trace__fprintf_total_summary(trace, trace->output); 4683 else 4684 trace__fprintf_thread_summary(trace, trace->output); 4685 } 4686 4687 if (trace->show_tool_stats) { 4688 fprintf(trace->output, "Stats:\n " 4689 " vfs_getname : %" PRIu64 "\n" 4690 " proc_getname: %" PRIu64 "\n", 4691 trace->stats.vfs_getname, 4692 trace->stats.proc_getname); 4693 } 4694 } 4695 4696 out_delete_evlist: 4697 trace_cleanup_bpf_summary(); 4698 delete_syscall_stats(trace->syscall_stats); 4699 trace__symbols__exit(trace); 4700 evlist__free_syscall_tp_fields(evlist); 4701 evlist__delete(evlist); 4702 cgroup__put(trace->cgroup); 4703 trace->evlist = NULL; 4704 trace->live = false; 4705 return err; 4706 { 4707 char errbuf[BUFSIZ]; 4708 4709 out_error_sched_stat_runtime: 4710 tracing_path__strerror_open_tp(errno, errbuf, sizeof(errbuf), "sched", "sched_stat_runtime"); 4711 goto out_error; 4712 4713 out_error_raw_syscalls: 4714 tracing_path__strerror_open_tp(errno, errbuf, sizeof(errbuf), "raw_syscalls", "sys_(enter|exit)"); 4715 goto out_error; 4716 4717 out_error_mmap: 4718 evlist__strerror_mmap(evlist, errno, errbuf, sizeof(errbuf)); 4719 goto out_error; 4720 4721 out_error_open: 4722 evlist__strerror_open(evlist, errno, errbuf, sizeof(errbuf)); 4723 4724 out_error: 4725 fprintf(trace->output, "%s\n", errbuf); 4726 goto out_delete_evlist; 4727 4728 out_error_apply_filters: 4729 fprintf(trace->output, 4730 "Failed to set filter \"%s\" on event %s: %m\n", 4731 evsel->filter, evsel__name(evsel)); 4732 goto out_delete_evlist; 4733 } 4734 out_error_mem: 4735 fprintf(trace->output, "Not enough memory to run!\n"); 4736 goto out_delete_evlist; 4737 4738 out_errno: 4739 fprintf(trace->output, "%m\n"); 4740 goto out_delete_evlist; 4741 } 4742 4743 static int trace__replay(struct trace *trace) 4744 { 4745 const struct evsel_str_handler handlers[] = { 4746 { "probe:vfs_getname", trace__vfs_getname, }, 4747 }; 4748 struct perf_data data = { 4749 .path = input_name, 4750 .mode = PERF_DATA_MODE_READ, 4751 .force = trace->force, 4752 }; 4753 struct perf_session *session; 4754 struct evsel *evsel; 4755 int err = -1; 4756 4757 perf_tool__init(&trace->tool, /*ordered_events=*/true); 4758 trace->tool.sample = trace__process_sample; 4759 trace->tool.mmap = perf_event__process_mmap; 4760 trace->tool.mmap2 = perf_event__process_mmap2; 4761 trace->tool.comm = perf_event__process_comm; 4762 trace->tool.exit = perf_event__process_exit; 4763 trace->tool.fork = perf_event__process_fork; 4764 trace->tool.attr = perf_event__process_attr; 4765 trace->tool.tracing_data = perf_event__process_tracing_data; 4766 trace->tool.build_id = perf_event__process_build_id; 4767 trace->tool.namespaces = perf_event__process_namespaces; 4768 4769 trace->tool.ordered_events = true; 4770 trace->tool.ordering_requires_timestamps = true; 4771 4772 /* add tid to output */ 4773 trace->multiple_threads = true; 4774 4775 session = perf_session__new(&data, &trace->tool); 4776 if (IS_ERR(session)) 4777 return PTR_ERR(session); 4778 4779 if (trace->opts.target.pid) 4780 symbol_conf.pid_list_str = strdup(trace->opts.target.pid); 4781 4782 if (trace->opts.target.tid) 4783 symbol_conf.tid_list_str = strdup(trace->opts.target.tid); 4784 4785 if (symbol__init(perf_session__env(session)) < 0) 4786 goto out; 4787 4788 trace->host = &session->machines.host; 4789 4790 err = perf_session__set_tracepoints_handlers(session, handlers); 4791 if (err) 4792 goto out; 4793 4794 evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_enter"); 4795 trace->syscalls.events.sys_enter = evsel; 4796 /* older kernels have syscalls tp versus raw_syscalls */ 4797 if (evsel == NULL) 4798 evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_enter"); 4799 4800 if (evsel && 4801 (evsel__init_raw_syscall_tp(evsel, trace__sys_enter) < 0 || 4802 perf_evsel__init_sc_tp_ptr_field(evsel, args))) { 4803 pr_err("Error during initialize raw_syscalls:sys_enter event\n"); 4804 goto out; 4805 } 4806 4807 evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_exit"); 4808 trace->syscalls.events.sys_exit = evsel; 4809 if (evsel == NULL) 4810 evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_exit"); 4811 if (evsel && 4812 (evsel__init_raw_syscall_tp(evsel, trace__sys_exit) < 0 || 4813 perf_evsel__init_sc_tp_uint_field(evsel, ret))) { 4814 pr_err("Error during initialize raw_syscalls:sys_exit event\n"); 4815 goto out; 4816 } 4817 4818 evlist__for_each_entry(session->evlist, evsel) { 4819 if (evsel->core.attr.type == PERF_TYPE_SOFTWARE && 4820 (evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ || 4821 evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MIN || 4822 evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS)) 4823 evsel->handler = trace__pgfault; 4824 } 4825 4826 if (trace->summary_mode == SUMMARY__BY_TOTAL) { 4827 trace->syscall_stats = alloc_syscall_stats(); 4828 if (!trace->syscall_stats) 4829 goto out; 4830 } 4831 4832 setup_pager(); 4833 4834 err = perf_session__process_events(session); 4835 if (err) 4836 pr_err("Failed to process events, error %d", err); 4837 4838 else if (trace->summary) 4839 trace__fprintf_thread_summary(trace, trace->output); 4840 4841 out: 4842 delete_syscall_stats(trace->syscall_stats); 4843 perf_session__delete(session); 4844 4845 return err; 4846 } 4847 4848 static size_t trace__fprintf_summary_header(FILE *fp) 4849 { 4850 size_t printed; 4851 4852 printed = fprintf(fp, "\n Summary of events:\n\n"); 4853 4854 return printed; 4855 } 4856 4857 struct syscall_entry { 4858 struct syscall_stats *stats; 4859 double msecs; 4860 int syscall; 4861 }; 4862 4863 static int entry_cmp(const void *e1, const void *e2) 4864 { 4865 const struct syscall_entry *entry1 = e1; 4866 const struct syscall_entry *entry2 = e2; 4867 4868 return entry1->msecs > entry2->msecs ? -1 : 1; 4869 } 4870 4871 static struct syscall_entry *syscall__sort_stats(struct hashmap *syscall_stats) 4872 { 4873 struct syscall_entry *entry; 4874 struct hashmap_entry *pos; 4875 unsigned bkt, i, nr; 4876 4877 nr = syscall_stats->sz; 4878 entry = malloc(nr * sizeof(*entry)); 4879 if (entry == NULL) 4880 return NULL; 4881 4882 i = 0; 4883 hashmap__for_each_entry(syscall_stats, pos, bkt) { 4884 struct syscall_stats *ss = pos->pvalue; 4885 struct stats *st = &ss->stats; 4886 4887 entry[i].stats = ss; 4888 entry[i].msecs = (u64)st->n * (avg_stats(st) / NSEC_PER_MSEC); 4889 entry[i].syscall = pos->key; 4890 i++; 4891 } 4892 assert(i == nr); 4893 4894 qsort(entry, nr, sizeof(*entry), entry_cmp); 4895 return entry; 4896 } 4897 4898 static size_t syscall__dump_stats(struct trace *trace, int e_machine, FILE *fp, 4899 struct hashmap *syscall_stats) 4900 { 4901 size_t printed = 0; 4902 int lines = 0; 4903 struct syscall *sc; 4904 struct syscall_entry *entries; 4905 4906 entries = syscall__sort_stats(syscall_stats); 4907 if (entries == NULL) 4908 return 0; 4909 4910 printed += fprintf(fp, "\n"); 4911 4912 printed += fprintf(fp, " syscall calls errors total min avg max stddev\n"); 4913 printed += fprintf(fp, " (msec) (msec) (msec) (msec) (%%)\n"); 4914 printed += fprintf(fp, " --------------- -------- ------ -------- --------- --------- --------- ------\n"); 4915 4916 for (size_t i = 0; i < syscall_stats->sz; i++) { 4917 struct syscall_entry *entry = &entries[i]; 4918 struct syscall_stats *stats = entry->stats; 4919 4920 if (stats) { 4921 double min = (double)(stats->stats.min) / NSEC_PER_MSEC; 4922 double max = (double)(stats->stats.max) / NSEC_PER_MSEC; 4923 double avg = avg_stats(&stats->stats); 4924 double pct; 4925 u64 n = (u64)stats->stats.n; 4926 4927 pct = avg ? 100.0 * stddev_stats(&stats->stats) / avg : 0.0; 4928 avg /= NSEC_PER_MSEC; 4929 4930 sc = trace__syscall_info(trace, /*evsel=*/NULL, e_machine, entry->syscall); 4931 if (!sc) 4932 continue; 4933 4934 printed += fprintf(fp, " %-15s", sc->name); 4935 printed += fprintf(fp, " %8" PRIu64 " %6" PRIu64 " %9.3f %9.3f %9.3f", 4936 n, stats->nr_failures, entry->msecs, min, avg); 4937 printed += fprintf(fp, " %9.3f %9.2f%%\n", max, pct); 4938 4939 if (trace->errno_summary && stats->nr_failures) { 4940 int e; 4941 4942 for (e = 0; e < stats->max_errno; ++e) { 4943 if (stats->errnos[e] != 0) 4944 fprintf(fp, "\t\t\t\t%s: %d\n", 4945 perf_env__arch_strerrno(e_machine, e + 1), 4946 stats->errnos[e]); 4947 } 4948 } 4949 lines++; 4950 } 4951 4952 if (trace->max_summary && trace->max_summary <= lines) 4953 break; 4954 } 4955 4956 free(entries); 4957 printed += fprintf(fp, "\n\n"); 4958 4959 return printed; 4960 } 4961 4962 static size_t thread__dump_stats(struct thread_trace *ttrace, 4963 struct trace *trace, int e_machine, FILE *fp) 4964 { 4965 return syscall__dump_stats(trace, e_machine, fp, ttrace->syscall_stats); 4966 } 4967 4968 static size_t system__dump_stats(struct trace *trace, int e_machine, FILE *fp) 4969 { 4970 return syscall__dump_stats(trace, e_machine, fp, trace->syscall_stats); 4971 } 4972 4973 static size_t trace__fprintf_thread(FILE *fp, struct thread *thread, struct trace *trace) 4974 { 4975 size_t printed = 0; 4976 struct thread_trace *ttrace = thread__priv(thread); 4977 int e_machine = thread__e_machine(thread, trace->host, /*e_flags=*/NULL); 4978 double ratio; 4979 4980 if (ttrace == NULL) 4981 return 0; 4982 4983 ratio = (double)ttrace->nr_events / trace->nr_events * 100.0; 4984 4985 printed += fprintf(fp, " %s (%d), ", thread__comm_str(thread), thread__tid(thread)); 4986 printed += fprintf(fp, "%lu events, ", ttrace->nr_events); 4987 printed += fprintf(fp, "%.1f%%", ratio); 4988 if (ttrace->pfmaj) 4989 printed += fprintf(fp, ", %lu majfaults", ttrace->pfmaj); 4990 if (ttrace->pfmin) 4991 printed += fprintf(fp, ", %lu minfaults", ttrace->pfmin); 4992 if (trace->sched) 4993 printed += fprintf(fp, ", %.3f msec\n", ttrace->runtime_ms); 4994 else if (fputc('\n', fp) != EOF) 4995 ++printed; 4996 4997 printed += thread__dump_stats(ttrace, trace, e_machine, fp); 4998 4999 return printed; 5000 } 5001 5002 static unsigned long thread__nr_events(struct thread_trace *ttrace) 5003 { 5004 return ttrace ? ttrace->nr_events : 0; 5005 } 5006 5007 static int trace_nr_events_cmp(void *priv __maybe_unused, 5008 const struct list_head *la, 5009 const struct list_head *lb) 5010 { 5011 struct thread_list *a = list_entry(la, struct thread_list, list); 5012 struct thread_list *b = list_entry(lb, struct thread_list, list); 5013 unsigned long a_nr_events = thread__nr_events(thread__priv(a->thread)); 5014 unsigned long b_nr_events = thread__nr_events(thread__priv(b->thread)); 5015 5016 if (a_nr_events != b_nr_events) 5017 return a_nr_events < b_nr_events ? -1 : 1; 5018 5019 /* Identical number of threads, place smaller tids first. */ 5020 return thread__tid(a->thread) < thread__tid(b->thread) 5021 ? -1 5022 : (thread__tid(a->thread) > thread__tid(b->thread) ? 1 : 0); 5023 } 5024 5025 static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp) 5026 { 5027 size_t printed = trace__fprintf_summary_header(fp); 5028 LIST_HEAD(threads); 5029 5030 if (machine__thread_list(trace->host, &threads) == 0) { 5031 struct thread_list *pos; 5032 5033 list_sort(NULL, &threads, trace_nr_events_cmp); 5034 5035 list_for_each_entry(pos, &threads, list) 5036 printed += trace__fprintf_thread(fp, pos->thread, trace); 5037 } 5038 thread_list__delete(&threads); 5039 return printed; 5040 } 5041 5042 static size_t trace__fprintf_total_summary(struct trace *trace, FILE *fp) 5043 { 5044 size_t printed = trace__fprintf_summary_header(fp); 5045 5046 printed += fprintf(fp, " total, "); 5047 printed += fprintf(fp, "%lu events", trace->nr_events); 5048 5049 if (trace->pfmaj) 5050 printed += fprintf(fp, ", %lu majfaults", trace->pfmaj); 5051 if (trace->pfmin) 5052 printed += fprintf(fp, ", %lu minfaults", trace->pfmin); 5053 if (trace->sched) 5054 printed += fprintf(fp, ", %.3f msec\n", trace->runtime_ms); 5055 else if (fputc('\n', fp) != EOF) 5056 ++printed; 5057 5058 /* TODO: get all system e_machines. */ 5059 printed += system__dump_stats(trace, EM_HOST, fp); 5060 5061 return printed; 5062 } 5063 5064 static int trace__set_duration(const struct option *opt, const char *str, 5065 int unset __maybe_unused) 5066 { 5067 struct trace *trace = opt->value; 5068 5069 trace->duration_filter = atof(str); 5070 return 0; 5071 } 5072 5073 static int trace__set_filter_pids_from_option(const struct option *opt, const char *str, 5074 int unset __maybe_unused) 5075 { 5076 int ret = -1; 5077 size_t i; 5078 struct trace *trace = opt->value; 5079 /* 5080 * FIXME: introduce a intarray class, plain parse csv and create a 5081 * { int nr, int entries[] } struct... 5082 */ 5083 struct intlist *list = intlist__new(str); 5084 5085 if (list == NULL) 5086 return -1; 5087 5088 i = trace->filter_pids.nr = intlist__nr_entries(list) + 1; 5089 trace->filter_pids.entries = calloc(i, sizeof(pid_t)); 5090 5091 if (trace->filter_pids.entries == NULL) 5092 goto out; 5093 5094 trace->filter_pids.entries[0] = getpid(); 5095 5096 for (i = 1; i < trace->filter_pids.nr; ++i) 5097 trace->filter_pids.entries[i] = intlist__entry(list, i - 1)->i; 5098 5099 intlist__delete(list); 5100 ret = 0; 5101 out: 5102 return ret; 5103 } 5104 5105 static int trace__open_output(struct trace *trace, const char *filename) 5106 { 5107 struct stat st; 5108 5109 if (!stat(filename, &st) && st.st_size) { 5110 char oldname[PATH_MAX]; 5111 5112 scnprintf(oldname, sizeof(oldname), "%s.old", filename); 5113 unlink(oldname); 5114 rename(filename, oldname); 5115 } 5116 5117 trace->output = fopen(filename, "w"); 5118 5119 return trace->output == NULL ? -errno : 0; 5120 } 5121 5122 static int parse_pagefaults(const struct option *opt, const char *str, 5123 int unset __maybe_unused) 5124 { 5125 int *trace_pgfaults = opt->value; 5126 5127 if (strcmp(str, "all") == 0) 5128 *trace_pgfaults |= TRACE_PFMAJ | TRACE_PFMIN; 5129 else if (strcmp(str, "maj") == 0) 5130 *trace_pgfaults |= TRACE_PFMAJ; 5131 else if (strcmp(str, "min") == 0) 5132 *trace_pgfaults |= TRACE_PFMIN; 5133 else 5134 return -1; 5135 5136 return 0; 5137 } 5138 5139 static void evlist__set_default_evsel_handler(struct evlist *evlist, void *handler) 5140 { 5141 struct evsel *evsel; 5142 5143 evlist__for_each_entry(evlist, evsel) { 5144 if (evsel->handler == NULL) 5145 evsel->handler = handler; 5146 } 5147 } 5148 5149 static void evsel__set_syscall_arg_fmt(struct evsel *evsel, const char *name) 5150 { 5151 struct syscall_arg_fmt *fmt = evsel__syscall_arg_fmt(evsel); 5152 5153 if (fmt) { 5154 const struct syscall_fmt *scfmt = syscall_fmt__find(name); 5155 5156 if (scfmt) { 5157 const struct tep_event *tp_format = evsel__tp_format(evsel); 5158 5159 if (tp_format) { 5160 int skip = 0; 5161 5162 if (strcmp(tp_format->format.fields->name, "__syscall_nr") == 0 || 5163 strcmp(tp_format->format.fields->name, "nr") == 0) 5164 ++skip; 5165 5166 memcpy(fmt + skip, scfmt->arg, 5167 (tp_format->format.nr_fields - skip) * sizeof(*fmt)); 5168 } 5169 } 5170 } 5171 } 5172 5173 static int evlist__set_syscall_tp_fields(struct evlist *evlist, bool *use_btf) 5174 { 5175 struct evsel *evsel; 5176 5177 evlist__for_each_entry(evlist, evsel) { 5178 const struct tep_event *tp_format; 5179 5180 if (evsel->priv) 5181 continue; 5182 5183 tp_format = evsel__tp_format(evsel); 5184 if (!tp_format) 5185 continue; 5186 5187 if (strcmp(tp_format->system, "syscalls")) { 5188 evsel__init_tp_arg_scnprintf(evsel, use_btf); 5189 continue; 5190 } 5191 5192 if (evsel__init_syscall_tp(evsel)) 5193 return -1; 5194 5195 if (!strncmp(tp_format->name, "sys_enter_", 10)) { 5196 struct syscall_tp *sc = __evsel__syscall_tp(evsel); 5197 5198 if (__tp_field__init_ptr(&sc->args, sc->id.offset + sizeof(u64))) 5199 return -1; 5200 5201 evsel__set_syscall_arg_fmt(evsel, 5202 tp_format->name + sizeof("sys_enter_") - 1); 5203 } else if (!strncmp(tp_format->name, "sys_exit_", 9)) { 5204 struct syscall_tp *sc = __evsel__syscall_tp(evsel); 5205 5206 if (__tp_field__init_uint(&sc->ret, sizeof(u64), 5207 sc->id.offset + sizeof(u64), 5208 evsel->needs_swap)) 5209 return -1; 5210 5211 evsel__set_syscall_arg_fmt(evsel, 5212 tp_format->name + sizeof("sys_exit_") - 1); 5213 } 5214 } 5215 5216 return 0; 5217 } 5218 5219 /* 5220 * XXX: Hackish, just splitting the combined -e+--event (syscalls 5221 * (raw_syscalls:{sys_{enter,exit}} + events (tracepoints, HW, SW, etc) to use 5222 * existing facilities unchanged (trace->ev_qualifier + parse_options()). 5223 * 5224 * It'd be better to introduce a parse_options() variant that would return a 5225 * list with the terms it didn't match to an event... 5226 */ 5227 static int trace__parse_events_option(const struct option *opt, const char *str, 5228 int unset __maybe_unused) 5229 { 5230 struct trace *trace = (struct trace *)opt->value; 5231 const char *s; 5232 char *strd, *sep = NULL, *lists[2] = { NULL, NULL, }; 5233 int len = strlen(str) + 1, err = -1, list, idx; 5234 char *strace_groups_dir = system_path(STRACE_GROUPS_DIR); 5235 char group_name[PATH_MAX]; 5236 const struct syscall_fmt *fmt; 5237 5238 if (strace_groups_dir == NULL) 5239 return -1; 5240 5241 s = strd = strdup(str); 5242 if (strd == NULL) 5243 return -1; 5244 5245 if (*s == '!') { 5246 ++s; 5247 trace->not_ev_qualifier = true; 5248 } 5249 5250 while (1) { 5251 if ((sep = strchr((char *)s, ',')) != NULL) 5252 *sep = '\0'; 5253 5254 list = 0; 5255 /* TODO: support for more than just perf binary machine type syscalls. */ 5256 if (syscalltbl__id(EM_HOST, s) >= 0 || 5257 syscalltbl__strglobmatch_first(EM_HOST, s, &idx) >= 0) { 5258 list = 1; 5259 goto do_concat; 5260 } 5261 5262 fmt = syscall_fmt__find_by_alias(s); 5263 if (fmt != NULL) { 5264 list = 1; 5265 s = fmt->name; 5266 } else { 5267 path__join(group_name, sizeof(group_name), strace_groups_dir, s); 5268 if (access(group_name, R_OK) == 0) 5269 list = 1; 5270 } 5271 do_concat: 5272 if (lists[list]) { 5273 sprintf(lists[list] + strlen(lists[list]), ",%s", s); 5274 } else { 5275 lists[list] = malloc(len); 5276 if (lists[list] == NULL) 5277 goto out; 5278 strcpy(lists[list], s); 5279 } 5280 5281 if (!sep) 5282 break; 5283 5284 *sep = ','; 5285 s = sep + 1; 5286 } 5287 5288 if (lists[1] != NULL) { 5289 struct strlist_config slist_config = { 5290 .dirname = strace_groups_dir, 5291 }; 5292 5293 trace->ev_qualifier = strlist__new(lists[1], &slist_config); 5294 if (trace->ev_qualifier == NULL) { 5295 fputs("Not enough memory to parse event qualifier", trace->output); 5296 goto out; 5297 } 5298 5299 if (trace__validate_ev_qualifier(trace)) 5300 goto out; 5301 trace->trace_syscalls = true; 5302 } 5303 5304 err = 0; 5305 5306 if (lists[0]) { 5307 struct parse_events_option_args parse_events_option_args = { 5308 .evlistp = &trace->evlist, 5309 }; 5310 struct option o = { 5311 .value = &parse_events_option_args, 5312 }; 5313 err = parse_events_option(&o, lists[0], 0); 5314 } 5315 out: 5316 free(strace_groups_dir); 5317 free(lists[0]); 5318 free(lists[1]); 5319 free(strd); 5320 5321 return err; 5322 } 5323 5324 static int trace__parse_cgroups(const struct option *opt, const char *str, int unset) 5325 { 5326 struct trace *trace = opt->value; 5327 5328 if (!list_empty(&trace->evlist->core.entries)) { 5329 struct option o = { 5330 .value = &trace->evlist, 5331 }; 5332 return parse_cgroups(&o, str, unset); 5333 } 5334 trace->cgroup = evlist__findnew_cgroup(trace->evlist, str); 5335 5336 return 0; 5337 } 5338 5339 static int trace__parse_summary_mode(const struct option *opt, const char *str, 5340 int unset __maybe_unused) 5341 { 5342 struct trace *trace = opt->value; 5343 5344 if (!strcmp(str, "thread")) { 5345 trace->summary_mode = SUMMARY__BY_THREAD; 5346 } else if (!strcmp(str, "total")) { 5347 trace->summary_mode = SUMMARY__BY_TOTAL; 5348 } else if (!strcmp(str, "cgroup")) { 5349 trace->summary_mode = SUMMARY__BY_CGROUP; 5350 } else { 5351 pr_err("Unknown summary mode: %s\n", str); 5352 return -1; 5353 } 5354 5355 return 0; 5356 } 5357 5358 static int trace_parse_callchain_opt(const struct option *opt, 5359 const char *arg, 5360 int unset) 5361 { 5362 return record_opts__parse_callchain(opt->value, &callchain_param, arg, unset); 5363 } 5364 5365 static int trace__config(const char *var, const char *value, void *arg) 5366 { 5367 struct trace *trace = arg; 5368 int err = 0; 5369 5370 if (!strcmp(var, "trace.add_events")) { 5371 trace->perfconfig_events = strdup(value); 5372 if (trace->perfconfig_events == NULL) { 5373 pr_err("Not enough memory for %s\n", "trace.add_events"); 5374 return -1; 5375 } 5376 } else if (!strcmp(var, "trace.show_timestamp")) { 5377 trace->show_tstamp = perf_config_bool(var, value); 5378 } else if (!strcmp(var, "trace.show_duration")) { 5379 trace->show_duration = perf_config_bool(var, value); 5380 } else if (!strcmp(var, "trace.show_arg_names")) { 5381 trace->show_arg_names = perf_config_bool(var, value); 5382 if (!trace->show_arg_names) 5383 trace->show_zeros = true; 5384 } else if (!strcmp(var, "trace.show_zeros")) { 5385 bool new_show_zeros = perf_config_bool(var, value); 5386 if (!trace->show_arg_names && !new_show_zeros) { 5387 pr_warning("trace.show_zeros has to be set when trace.show_arg_names=no\n"); 5388 goto out; 5389 } 5390 trace->show_zeros = new_show_zeros; 5391 } else if (!strcmp(var, "trace.show_prefix")) { 5392 trace->show_string_prefix = perf_config_bool(var, value); 5393 } else if (!strcmp(var, "trace.no_inherit")) { 5394 trace->opts.no_inherit = perf_config_bool(var, value); 5395 } else if (!strcmp(var, "trace.args_alignment")) { 5396 int args_alignment = 0; 5397 if (perf_config_int(&args_alignment, var, value) == 0) 5398 trace->args_alignment = args_alignment; 5399 } else if (!strcmp(var, "trace.tracepoint_beautifiers")) { 5400 if (strcasecmp(value, "libtraceevent") == 0) 5401 trace->libtraceevent_print = true; 5402 else if (strcasecmp(value, "libbeauty") == 0) 5403 trace->libtraceevent_print = false; 5404 } 5405 out: 5406 return err; 5407 } 5408 5409 static void trace__exit(struct trace *trace) 5410 { 5411 thread__zput(trace->current); 5412 strlist__delete(trace->ev_qualifier); 5413 zfree(&trace->ev_qualifier_ids.entries); 5414 if (trace->syscalls.table) { 5415 for (size_t i = 0; i < trace->syscalls.table_size; i++) 5416 syscall__delete(trace->syscalls.table[i]); 5417 zfree(&trace->syscalls.table); 5418 } 5419 zfree(&trace->perfconfig_events); 5420 evlist__delete(trace->evlist); 5421 trace->evlist = NULL; 5422 ordered_events__free(&trace->oe.data); 5423 #ifdef HAVE_LIBBPF_SUPPORT 5424 btf__free(trace->btf); 5425 trace->btf = NULL; 5426 #endif 5427 } 5428 5429 int cmd_trace(int argc, const char **argv) 5430 { 5431 const char *trace_usage[] = { 5432 "perf trace [<options>] [<command>]", 5433 "perf trace [<options>] -- <command> [<options>]", 5434 "perf trace record [<options>] [<command>]", 5435 "perf trace record [<options>] -- <command> [<options>]", 5436 NULL 5437 }; 5438 struct trace trace = { 5439 .opts = { 5440 .target = { 5441 .uses_mmap = true, 5442 }, 5443 .user_freq = UINT_MAX, 5444 .user_interval = ULLONG_MAX, 5445 .no_buffering = true, 5446 .mmap_pages = UINT_MAX, 5447 }, 5448 .output = stderr, 5449 .show_comm = true, 5450 .show_tstamp = true, 5451 .show_duration = true, 5452 .show_arg_names = true, 5453 .args_alignment = 70, 5454 .trace_syscalls = false, 5455 .kernel_syscallchains = false, 5456 .max_stack = UINT_MAX, 5457 .max_events = ULONG_MAX, 5458 }; 5459 const char *output_name = NULL; 5460 const struct option trace_options[] = { 5461 OPT_CALLBACK('e', "event", &trace, "event", 5462 "event/syscall selector. use 'perf list' to list available events", 5463 trace__parse_events_option), 5464 OPT_CALLBACK(0, "filter", &trace.evlist, "filter", 5465 "event filter", parse_filter), 5466 OPT_BOOLEAN(0, "comm", &trace.show_comm, 5467 "show the thread COMM next to its id"), 5468 OPT_BOOLEAN(0, "tool_stats", &trace.show_tool_stats, "show tool stats"), 5469 OPT_CALLBACK(0, "expr", &trace, "expr", "list of syscalls/events to trace", 5470 trace__parse_events_option), 5471 OPT_STRING('o', "output", &output_name, "file", "output file name"), 5472 OPT_STRING('i', "input", &input_name, "file", "Analyze events in file"), 5473 OPT_STRING('p', "pid", &trace.opts.target.pid, "pid", 5474 "trace events on existing process id"), 5475 OPT_STRING('t', "tid", &trace.opts.target.tid, "tid", 5476 "trace events on existing thread id"), 5477 OPT_CALLBACK(0, "filter-pids", &trace, "CSV list of pids", 5478 "pids to filter (by the kernel)", trace__set_filter_pids_from_option), 5479 OPT_BOOLEAN('a', "all-cpus", &trace.opts.target.system_wide, 5480 "system-wide collection from all CPUs"), 5481 OPT_STRING('C', "cpu", &trace.opts.target.cpu_list, "cpu", 5482 "list of cpus to monitor"), 5483 OPT_BOOLEAN(0, "no-inherit", &trace.opts.no_inherit, 5484 "child tasks do not inherit counters"), 5485 OPT_CALLBACK('m', "mmap-pages", &trace.opts.mmap_pages, "pages", 5486 "number of mmap data pages", evlist__parse_mmap_pages), 5487 OPT_STRING('u', "uid", &trace.uid_str, "user", "user to profile"), 5488 OPT_BOOLEAN(0, "show-cpu", &trace.show_cpu, "show cpu id"), 5489 OPT_CALLBACK(0, "duration", &trace, "float", 5490 "show only events with duration > N.M ms", 5491 trace__set_duration), 5492 OPT_BOOLEAN(0, "sched", &trace.sched, "show blocking scheduler events"), 5493 OPT_INCR('v', "verbose", &verbose, "be more verbose"), 5494 OPT_BOOLEAN('T', "time", &trace.full_time, 5495 "Show full timestamp, not time relative to first start"), 5496 OPT_BOOLEAN(0, "failure", &trace.failure_only, 5497 "Show only syscalls that failed"), 5498 OPT_BOOLEAN('s', "summary", &trace.summary_only, 5499 "Show only syscall summary with statistics"), 5500 OPT_BOOLEAN('S', "with-summary", &trace.summary, 5501 "Show all syscalls and summary with statistics"), 5502 OPT_BOOLEAN(0, "errno-summary", &trace.errno_summary, 5503 "Show errno stats per syscall, use with -s or -S"), 5504 OPT_CALLBACK(0, "summary-mode", &trace, "mode", 5505 "How to show summary: select thread (default), total or cgroup", 5506 trace__parse_summary_mode), 5507 OPT_CALLBACK_DEFAULT('F', "pf", &trace.trace_pgfaults, "all|maj|min", 5508 "Trace pagefaults", parse_pagefaults, "maj"), 5509 OPT_BOOLEAN(0, "syscalls", &trace.trace_syscalls, "Trace syscalls"), 5510 OPT_BOOLEAN('f', "force", &trace.force, "don't complain, do it"), 5511 OPT_CALLBACK(0, "call-graph", &trace.opts, 5512 "record_mode[,record_size]", record_callchain_help, 5513 &trace_parse_callchain_opt), 5514 OPT_BOOLEAN(0, "libtraceevent_print", &trace.libtraceevent_print, 5515 "Use libtraceevent to print the tracepoint arguments."), 5516 OPT_BOOLEAN(0, "kernel-syscall-graph", &trace.kernel_syscallchains, 5517 "Show the kernel callchains on the syscall exit path"), 5518 OPT_ULONG(0, "max-events", &trace.max_events, 5519 "Set the maximum number of events to print, exit after that is reached. "), 5520 OPT_UINTEGER(0, "min-stack", &trace.min_stack, 5521 "Set the minimum stack depth when parsing the callchain, " 5522 "anything below the specified depth will be ignored."), 5523 OPT_UINTEGER(0, "max-stack", &trace.max_stack, 5524 "Set the maximum stack depth when parsing the callchain, " 5525 "anything beyond the specified depth will be ignored. " 5526 "Default: kernel.perf_event_max_stack or " __stringify(PERF_MAX_STACK_DEPTH)), 5527 OPT_BOOLEAN(0, "sort-events", &trace.sort_events, 5528 "Sort batch of events before processing, use if getting out of order events"), 5529 OPT_BOOLEAN(0, "print-sample", &trace.print_sample, 5530 "print the PERF_RECORD_SAMPLE PERF_SAMPLE_ info, for debugging"), 5531 OPT_UINTEGER(0, "proc-map-timeout", &proc_map_timeout, 5532 "per thread proc mmap processing timeout in ms"), 5533 OPT_CALLBACK('G', "cgroup", &trace, "name", "monitor event in cgroup name only", 5534 trace__parse_cgroups), 5535 OPT_INTEGER('D', "delay", &trace.opts.target.initial_delay, 5536 "ms to wait before starting measurement after program " 5537 "start"), 5538 OPT_BOOLEAN(0, "force-btf", &trace.force_btf, "Prefer btf_dump general pretty printer" 5539 "to customized ones"), 5540 OPT_BOOLEAN(0, "bpf-summary", &trace.summary_bpf, "Summary syscall stats in BPF"), 5541 OPT_INTEGER(0, "max-summary", &trace.max_summary, 5542 "Max number of entries in the summary."), 5543 OPTS_EVSWITCH(&trace.evswitch), 5544 OPT_END() 5545 }; 5546 bool __maybe_unused max_stack_user_set = true; 5547 bool mmap_pages_user_set = true; 5548 struct evsel *evsel; 5549 const char * const trace_subcommands[] = { "record", NULL }; 5550 int err = -1; 5551 char bf[BUFSIZ]; 5552 struct sigaction sigchld_act; 5553 5554 signal(SIGSEGV, sighandler_dump_stack); 5555 signal(SIGFPE, sighandler_dump_stack); 5556 signal(SIGINT, sighandler_interrupt); 5557 5558 memset(&sigchld_act, 0, sizeof(sigchld_act)); 5559 sigchld_act.sa_flags = SA_SIGINFO; 5560 sigchld_act.sa_sigaction = sighandler_chld; 5561 sigaction(SIGCHLD, &sigchld_act, NULL); 5562 5563 ordered_events__init(&trace.oe.data, ordered_events__deliver_event, &trace); 5564 ordered_events__set_copy_on_queue(&trace.oe.data, true); 5565 5566 trace.evlist = evlist__new(); 5567 5568 if (trace.evlist == NULL) { 5569 pr_err("Not enough memory to run!\n"); 5570 err = -ENOMEM; 5571 goto out; 5572 } 5573 5574 /* 5575 * Parsing .perfconfig may entail creating a BPF event, that may need 5576 * to create BPF maps, so bump RLIM_MEMLOCK as the default 64K setting 5577 * is too small. This affects just this process, not touching the 5578 * global setting. If it fails we'll get something in 'perf trace -v' 5579 * to help diagnose the problem. 5580 */ 5581 rlimit__bump_memlock(); 5582 5583 err = perf_config(trace__config, &trace); 5584 if (err) 5585 goto out; 5586 5587 argc = parse_options_subcommand(argc, argv, trace_options, trace_subcommands, 5588 trace_usage, PARSE_OPT_STOP_AT_NON_OPTION); 5589 5590 /* 5591 * Here we already passed thru trace__parse_events_option() and it has 5592 * already figured out if -e syscall_name, if not but if --event 5593 * foo:bar was used, the user is interested _just_ in those, say, 5594 * tracepoint events, not in the strace-like syscall-name-based mode. 5595 * 5596 * This is important because we need to check if strace-like mode is 5597 * needed to decided if we should filter out the eBPF 5598 * __augmented_syscalls__ code, if it is in the mix, say, via 5599 * .perfconfig trace.add_events, and filter those out. 5600 */ 5601 if (!trace.trace_syscalls && !trace.trace_pgfaults && 5602 trace.evlist->core.nr_entries == 0 /* Was --events used? */) { 5603 trace.trace_syscalls = true; 5604 } 5605 /* 5606 * Now that we have --verbose figured out, lets see if we need to parse 5607 * events from .perfconfig, so that if those events fail parsing, say some 5608 * BPF program fails, then we'll be able to use --verbose to see what went 5609 * wrong in more detail. 5610 */ 5611 if (trace.perfconfig_events != NULL) { 5612 struct parse_events_error parse_err; 5613 5614 parse_events_error__init(&parse_err); 5615 err = parse_events(trace.evlist, trace.perfconfig_events, &parse_err); 5616 if (err) 5617 parse_events_error__print(&parse_err, trace.perfconfig_events); 5618 parse_events_error__exit(&parse_err); 5619 if (err) 5620 goto out; 5621 } 5622 5623 if (trace.show_cpu) 5624 trace.opts.sample_cpu = true; 5625 5626 if ((nr_cgroups || trace.cgroup) && !trace.opts.target.system_wide) { 5627 usage_with_options_msg(trace_usage, trace_options, 5628 "cgroup monitoring only available in system-wide mode"); 5629 } 5630 5631 if (!trace.trace_syscalls) 5632 goto skip_augmentation; 5633 5634 if ((argc >= 1) && (strcmp(argv[0], "record") == 0)) { 5635 pr_debug("Syscall augmentation fails with record, disabling augmentation"); 5636 goto skip_augmentation; 5637 } 5638 5639 if (trace.summary_bpf) { 5640 if (!trace.opts.target.system_wide) { 5641 /* TODO: Add filters in the BPF to support other targets. */ 5642 pr_err("Error: --bpf-summary only works for system-wide mode.\n"); 5643 goto out; 5644 } 5645 if (trace.summary_only) 5646 goto skip_augmentation; 5647 } 5648 5649 err = augmented_syscalls__prepare(); 5650 if (err < 0) 5651 goto skip_augmentation; 5652 5653 trace__add_syscall_newtp(&trace); 5654 5655 err = augmented_syscalls__create_bpf_output(trace.evlist); 5656 if (err == 0) 5657 trace.syscalls.events.bpf_output = evlist__last(trace.evlist); 5658 5659 skip_augmentation: 5660 err = -1; 5661 5662 if (trace.trace_pgfaults) { 5663 trace.opts.sample_address = true; 5664 trace.opts.sample_time = true; 5665 } 5666 5667 if (trace.opts.mmap_pages == UINT_MAX) 5668 mmap_pages_user_set = false; 5669 5670 if (trace.max_stack == UINT_MAX) { 5671 trace.max_stack = input_name ? PERF_MAX_STACK_DEPTH : sysctl__max_stack(); 5672 max_stack_user_set = false; 5673 } 5674 5675 #ifdef HAVE_DWARF_UNWIND_SUPPORT 5676 if ((trace.min_stack || max_stack_user_set) && !callchain_param.enabled) { 5677 record_opts__parse_callchain(&trace.opts, &callchain_param, "dwarf", false); 5678 } 5679 #endif 5680 5681 if (callchain_param.enabled) { 5682 if (!mmap_pages_user_set && geteuid() == 0) 5683 trace.opts.mmap_pages = perf_event_mlock_kb_in_pages() * 4; 5684 5685 symbol_conf.use_callchain = true; 5686 } 5687 5688 if (trace.evlist->core.nr_entries > 0) { 5689 bool use_btf = false; 5690 5691 evlist__set_default_evsel_handler(trace.evlist, trace__event_handler); 5692 if (evlist__set_syscall_tp_fields(trace.evlist, &use_btf)) { 5693 perror("failed to set syscalls:* tracepoint fields"); 5694 goto out; 5695 } 5696 5697 if (use_btf) 5698 trace__load_vmlinux_btf(&trace); 5699 } 5700 5701 /* 5702 * If we are augmenting syscalls, then combine what we put in the 5703 * __augmented_syscalls__ BPF map with what is in the 5704 * syscalls:sys_exit_FOO tracepoints, i.e. just like we do without BPF, 5705 * combining raw_syscalls:sys_enter with raw_syscalls:sys_exit. 5706 * 5707 * We'll switch to look at two BPF maps, one for sys_enter and the 5708 * other for sys_exit when we start augmenting the sys_exit paths with 5709 * buffers that are being copied from kernel to userspace, think 'read' 5710 * syscall. 5711 */ 5712 if (trace.syscalls.events.bpf_output) { 5713 evlist__for_each_entry(trace.evlist, evsel) { 5714 bool raw_syscalls_sys_exit = evsel__name_is(evsel, "raw_syscalls:sys_exit"); 5715 5716 if (raw_syscalls_sys_exit) { 5717 trace.raw_augmented_syscalls = true; 5718 goto init_augmented_syscall_tp; 5719 } 5720 5721 if (trace.syscalls.events.bpf_output->priv == NULL && 5722 strstr(evsel__name(evsel), "syscalls:sys_enter")) { 5723 struct evsel *augmented = trace.syscalls.events.bpf_output; 5724 if (evsel__init_augmented_syscall_tp(augmented, evsel) || 5725 evsel__init_augmented_syscall_tp_args(augmented)) 5726 goto out; 5727 /* 5728 * Augmented is __augmented_syscalls__ BPF_OUTPUT event 5729 * Above we made sure we can get from the payload the tp fields 5730 * that we get from syscalls:sys_enter tracefs format file. 5731 */ 5732 augmented->handler = trace__sys_enter; 5733 /* 5734 * Now we do the same for the *syscalls:sys_enter event so that 5735 * if we handle it directly, i.e. if the BPF prog returns 0 so 5736 * as not to filter it, then we'll handle it just like we would 5737 * for the BPF_OUTPUT one: 5738 */ 5739 if (evsel__init_augmented_syscall_tp(evsel, evsel) || 5740 evsel__init_augmented_syscall_tp_args(evsel)) 5741 goto out; 5742 evsel->handler = trace__sys_enter; 5743 } 5744 5745 if (strstarts(evsel__name(evsel), "syscalls:sys_exit_")) { 5746 struct syscall_tp *sc; 5747 init_augmented_syscall_tp: 5748 if (evsel__init_augmented_syscall_tp(evsel, evsel)) 5749 goto out; 5750 sc = __evsel__syscall_tp(evsel); 5751 /* 5752 * For now with BPF raw_augmented we hook into 5753 * raw_syscalls:sys_enter and there we get all 5754 * 6 syscall args plus the tracepoint common 5755 * fields and the syscall_nr (another long). 5756 * So we check if that is the case and if so 5757 * don't look after the sc->args_size but 5758 * always after the full raw_syscalls:sys_enter 5759 * payload, which is fixed. 5760 * 5761 * We'll revisit this later to pass 5762 * s->args_size to the BPF augmenter (now 5763 * tools/perf/examples/bpf/augmented_raw_syscalls.c, 5764 * so that it copies only what we need for each 5765 * syscall, like what happens when we use 5766 * syscalls:sys_enter_NAME, so that we reduce 5767 * the kernel/userspace traffic to just what is 5768 * needed for each syscall. 5769 */ 5770 if (trace.raw_augmented_syscalls) 5771 trace.raw_augmented_syscalls_args_size = (6 + 1) * sizeof(long) + sc->id.offset; 5772 evsel__init_augmented_syscall_tp_ret(evsel); 5773 evsel->handler = trace__sys_exit; 5774 } 5775 } 5776 } 5777 5778 if ((argc >= 1) && (strcmp(argv[0], "record") == 0)) { 5779 err = trace__record(&trace, argc-1, &argv[1]); 5780 goto out; 5781 } 5782 5783 /* Using just --errno-summary will trigger --summary */ 5784 if (trace.errno_summary && !trace.summary && !trace.summary_only) 5785 trace.summary_only = true; 5786 5787 /* summary_only implies summary option, but don't overwrite summary if set */ 5788 if (trace.summary_only) 5789 trace.summary = trace.summary_only; 5790 5791 /* Keep exited threads, otherwise information might be lost for summary */ 5792 if (trace.summary) { 5793 symbol_conf.keep_exited_threads = true; 5794 if (trace.summary_mode == SUMMARY__NONE) 5795 trace.summary_mode = SUMMARY__BY_THREAD; 5796 5797 if (!trace.summary_bpf && trace.summary_mode == SUMMARY__BY_CGROUP) { 5798 pr_err("Error: --summary-mode=cgroup only works with --bpf-summary\n"); 5799 err = -EINVAL; 5800 goto out; 5801 } 5802 } 5803 5804 if (output_name != NULL) { 5805 err = trace__open_output(&trace, output_name); 5806 if (err < 0) { 5807 perror("failed to create output file"); 5808 goto out; 5809 } 5810 } 5811 5812 err = evswitch__init(&trace.evswitch, trace.evlist, stderr); 5813 if (err) 5814 goto out_close; 5815 5816 err = target__validate(&trace.opts.target); 5817 if (err) { 5818 target__strerror(&trace.opts.target, err, bf, sizeof(bf)); 5819 fprintf(trace.output, "%s", bf); 5820 goto out_close; 5821 } 5822 5823 if (trace.uid_str) { 5824 uid_t uid = parse_uid(trace.uid_str); 5825 5826 if (uid == UINT_MAX) { 5827 ui__error("Invalid User: %s", trace.uid_str); 5828 err = -EINVAL; 5829 goto out_close; 5830 } 5831 err = parse_uid_filter(trace.evlist, uid); 5832 if (err) 5833 goto out_close; 5834 5835 trace.opts.target.system_wide = true; 5836 } 5837 5838 if (!argc && target__none(&trace.opts.target)) 5839 trace.opts.target.system_wide = true; 5840 5841 if (input_name) 5842 err = trace__replay(&trace); 5843 else 5844 err = trace__run(&trace, argc, argv); 5845 5846 out_close: 5847 if (output_name != NULL) 5848 fclose(trace.output); 5849 out: 5850 trace__exit(&trace); 5851 augmented_syscalls__cleanup(); 5852 return err; 5853 } 5854