1 /* 2 * builtin-trace.c 3 * 4 * Builtin 'trace' command: 5 * 6 * Display a continuously updated trace of any workload, CPU, specific PID, 7 * system wide, etc. Default format is loosely strace like, but any other 8 * event may be specified using --event. 9 * 10 * Copyright (C) 2012, 2013, 2014, 2015 Red Hat Inc, Arnaldo Carvalho de Melo <acme@redhat.com> 11 * 12 * Initially based on the 'trace' prototype by Thomas Gleixner: 13 * 14 * http://lwn.net/Articles/415728/ ("Announcing a new utility: 'trace'") 15 */ 16 17 #include "util/record.h" 18 #include <api/fs/tracing_path.h> 19 #ifdef HAVE_LIBBPF_SUPPORT 20 #include <bpf/bpf.h> 21 #include <bpf/libbpf.h> 22 #include <bpf/btf.h> 23 #endif 24 #include "util/rlimit.h" 25 #include "builtin.h" 26 #include "util/cgroup.h" 27 #include "util/color.h" 28 #include "util/config.h" 29 #include "util/debug.h" 30 #include "util/dso.h" 31 #include "util/env.h" 32 #include "util/event.h" 33 #include "util/evsel.h" 34 #include "util/evsel_fprintf.h" 35 #include "util/synthetic-events.h" 36 #include "util/evlist.h" 37 #include "util/evswitch.h" 38 #include "util/hashmap.h" 39 #include "util/mmap.h" 40 #include <subcmd/pager.h> 41 #include <subcmd/exec-cmd.h> 42 #include "util/machine.h" 43 #include "util/map.h" 44 #include "util/symbol.h" 45 #include "util/path.h" 46 #include "util/session.h" 47 #include "util/thread.h" 48 #include <subcmd/parse-options.h> 49 #include "util/strlist.h" 50 #include "util/intlist.h" 51 #include "util/thread_map.h" 52 #include "util/stat.h" 53 #include "util/tool.h" 54 #include "util/trace.h" 55 #include "util/util.h" 56 #include "trace/beauty/beauty.h" 57 #include "trace-event.h" 58 #include "util/parse-events.h" 59 #include "util/tracepoint.h" 60 #include "callchain.h" 61 #include "print_binary.h" 62 #include "string2.h" 63 #include "trace/beauty/syscalltbl.h" 64 #include "../perf.h" 65 #include "trace_augment.h" 66 #include "dwarf-regs.h" 67 68 #include <errno.h> 69 #include <sys/stat.h> 70 #include <inttypes.h> 71 #include <poll.h> 72 #include <signal.h> 73 #include <stdlib.h> 74 #include <string.h> 75 #include <linux/err.h> 76 #include <linux/filter.h> 77 #include <linux/kernel.h> 78 #include <linux/list_sort.h> 79 #include <linux/random.h> 80 #include <linux/stringify.h> 81 #include <linux/time64.h> 82 #include <linux/zalloc.h> 83 #include <fcntl.h> 84 #include <sys/sysmacros.h> 85 86 #include <linux/ctype.h> 87 #include <perf/mmap.h> 88 #include <tools/libc_compat.h> 89 90 #ifdef HAVE_LIBTRACEEVENT 91 #include <event-parse.h> 92 #endif 93 94 #ifndef O_CLOEXEC 95 # define O_CLOEXEC 02000000 96 #endif 97 98 #ifndef F_LINUX_SPECIFIC_BASE 99 # define F_LINUX_SPECIFIC_BASE 1024 100 #endif 101 102 #define RAW_SYSCALL_ARGS_NUM 6 103 104 /* 105 * strtoul: Go from a string to a value, i.e. for msr: MSR_FS_BASE to 0xc0000100 106 * 107 * We have to explicitely mark the direction of the flow of data, if from the 108 * kernel to user space or the other way around, since the BPF collector we 109 * have so far copies only from user to kernel space, mark the arguments that 110 * go that direction, so that we don´t end up collecting the previous contents 111 * for syscall args that goes from kernel to user space. 112 */ 113 struct syscall_arg_fmt { 114 size_t (*scnprintf)(char *bf, size_t size, struct syscall_arg *arg); 115 bool (*strtoul)(char *bf, size_t size, struct syscall_arg *arg, u64 *val); 116 unsigned long (*mask_val)(struct syscall_arg *arg, unsigned long val); 117 void *parm; 118 const char *name; 119 u16 nr_entries; // for arrays 120 bool from_user; 121 bool show_zero; 122 #ifdef HAVE_LIBBPF_SUPPORT 123 const struct btf_type *type; 124 int type_id; /* used in btf_dump */ 125 #endif 126 }; 127 128 struct syscall_fmt { 129 const char *name; 130 const char *alias; 131 struct { 132 const char *sys_enter, 133 *sys_exit; 134 } bpf_prog_name; 135 struct syscall_arg_fmt arg[RAW_SYSCALL_ARGS_NUM]; 136 u8 nr_args; 137 bool errpid; 138 bool timeout; 139 bool hexret; 140 }; 141 142 struct trace { 143 struct perf_env host_env; 144 struct perf_tool tool; 145 struct { 146 /** Sorted sycall numbers used by the trace. */ 147 struct syscall **table; 148 /** Size of table. */ 149 size_t table_size; 150 struct { 151 struct evsel *sys_enter, 152 *sys_exit, 153 *bpf_output; 154 } events; 155 } syscalls; 156 #ifdef HAVE_LIBBPF_SUPPORT 157 struct btf *btf; 158 #endif 159 struct record_opts opts; 160 struct evlist *evlist; 161 struct machine *host; 162 struct thread *current; 163 struct cgroup *cgroup; 164 u64 base_time; 165 FILE *output; 166 unsigned long nr_events; 167 unsigned long nr_events_printed; 168 unsigned long max_events; 169 struct evswitch evswitch; 170 struct strlist *ev_qualifier; 171 struct { 172 size_t nr; 173 int *entries; 174 } ev_qualifier_ids; 175 struct { 176 size_t nr; 177 pid_t *entries; 178 struct bpf_map *map; 179 } filter_pids; 180 /* 181 * TODO: The map is from an ID (aka system call number) to struct 182 * syscall_stats. If there is >1 e_machine, such as i386 and x86-64 183 * processes, then the stats here will gather wrong the statistics for 184 * the non EM_HOST system calls. A fix would be to add the e_machine 185 * into the key, but this would make the code inconsistent with the 186 * per-thread version. 187 */ 188 struct hashmap *syscall_stats; 189 double duration_filter; 190 double runtime_ms; 191 unsigned long pfmaj, pfmin; 192 struct { 193 u64 vfs_getname, 194 proc_getname; 195 } stats; 196 unsigned int max_stack; 197 unsigned int min_stack; 198 enum trace_summary_mode summary_mode; 199 int max_summary; 200 int raw_augmented_syscalls_args_size; 201 bool raw_augmented_syscalls; 202 bool fd_path_disabled; 203 bool sort_events; 204 bool not_ev_qualifier; 205 bool live; 206 bool full_time; 207 bool sched; 208 bool multiple_threads; 209 bool summary; 210 bool summary_only; 211 bool errno_summary; 212 bool failure_only; 213 bool show_comm; 214 bool print_sample; 215 bool show_tool_stats; 216 bool trace_syscalls; 217 bool libtraceevent_print; 218 bool kernel_syscallchains; 219 s16 args_alignment; 220 bool show_tstamp; 221 bool show_cpu; 222 bool show_duration; 223 bool show_zeros; 224 bool show_arg_names; 225 bool show_string_prefix; 226 bool force; 227 bool vfs_getname; 228 bool force_btf; 229 bool summary_bpf; 230 int trace_pgfaults; 231 char *perfconfig_events; 232 struct { 233 struct ordered_events data; 234 u64 last; 235 } oe; 236 const char *uid_str; 237 }; 238 239 bool trace__show_zeros(const struct trace *trace) 240 { 241 return trace->show_zeros; 242 } 243 244 struct machine *trace__host(const struct trace *trace) 245 { 246 return trace->host; 247 } 248 249 static void trace__load_vmlinux_btf(struct trace *trace __maybe_unused) 250 { 251 #ifdef HAVE_LIBBPF_SUPPORT 252 if (trace->btf != NULL) 253 return; 254 255 trace->btf = btf__load_vmlinux_btf(); 256 if (verbose > 0) { 257 fprintf(trace->output, trace->btf ? "vmlinux BTF loaded\n" : 258 "Failed to load vmlinux BTF\n"); 259 } 260 #endif 261 } 262 263 struct tp_field { 264 int offset; 265 union { 266 u64 (*integer)(struct tp_field *field, struct perf_sample *sample); 267 void *(*pointer)(struct tp_field *field, struct perf_sample *sample); 268 }; 269 }; 270 271 #define TP_UINT_FIELD(bits) \ 272 static u64 tp_field__u##bits(struct tp_field *field, struct perf_sample *sample) \ 273 { \ 274 u##bits value; \ 275 memcpy(&value, sample->raw_data + field->offset, sizeof(value)); \ 276 return value; \ 277 } 278 279 TP_UINT_FIELD(8); 280 TP_UINT_FIELD(16); 281 TP_UINT_FIELD(32); 282 TP_UINT_FIELD(64); 283 284 #define TP_UINT_FIELD__SWAPPED(bits) \ 285 static u64 tp_field__swapped_u##bits(struct tp_field *field, struct perf_sample *sample) \ 286 { \ 287 u##bits value; \ 288 memcpy(&value, sample->raw_data + field->offset, sizeof(value)); \ 289 return bswap_##bits(value);\ 290 } 291 292 TP_UINT_FIELD__SWAPPED(16); 293 TP_UINT_FIELD__SWAPPED(32); 294 TP_UINT_FIELD__SWAPPED(64); 295 296 static int __tp_field__init_uint(struct tp_field *field, int size, int offset, bool needs_swap) 297 { 298 field->offset = offset; 299 300 switch (size) { 301 case 1: 302 field->integer = tp_field__u8; 303 break; 304 case 2: 305 field->integer = needs_swap ? tp_field__swapped_u16 : tp_field__u16; 306 break; 307 case 4: 308 field->integer = needs_swap ? tp_field__swapped_u32 : tp_field__u32; 309 break; 310 case 8: 311 field->integer = needs_swap ? tp_field__swapped_u64 : tp_field__u64; 312 break; 313 default: 314 return -1; 315 } 316 317 return 0; 318 } 319 320 static int tp_field__init_uint(struct tp_field *field, struct tep_format_field *format_field, bool needs_swap) 321 { 322 return __tp_field__init_uint(field, format_field->size, format_field->offset, needs_swap); 323 } 324 325 static void *tp_field__ptr(struct tp_field *field, struct perf_sample *sample) 326 { 327 return sample->raw_data + field->offset; 328 } 329 330 static int __tp_field__init_ptr(struct tp_field *field, int offset) 331 { 332 field->offset = offset; 333 field->pointer = tp_field__ptr; 334 return 0; 335 } 336 337 static int tp_field__init_ptr(struct tp_field *field, struct tep_format_field *format_field) 338 { 339 return __tp_field__init_ptr(field, format_field->offset); 340 } 341 342 struct syscall_tp { 343 struct tp_field id; 344 union { 345 struct tp_field args, ret; 346 }; 347 }; 348 349 /* 350 * The evsel->priv as used by 'perf trace' 351 * sc: for raw_syscalls:sys_{enter,exit} and syscalls:sys_{enter,exit}_SYSCALLNAME 352 * fmt: for all the other tracepoints 353 */ 354 struct evsel_trace { 355 struct syscall_tp sc; 356 struct syscall_arg_fmt *fmt; 357 }; 358 359 static struct evsel_trace *evsel_trace__new(void) 360 { 361 return zalloc(sizeof(struct evsel_trace)); 362 } 363 364 static void evsel_trace__delete(struct evsel_trace *et) 365 { 366 if (et == NULL) 367 return; 368 369 zfree(&et->fmt); 370 free(et); 371 } 372 373 /* 374 * Used with raw_syscalls:sys_{enter,exit} and with the 375 * syscalls:sys_{enter,exit}_SYSCALL tracepoints 376 */ 377 static inline struct syscall_tp *__evsel__syscall_tp(struct evsel *evsel) 378 { 379 struct evsel_trace *et = evsel->priv; 380 381 return &et->sc; 382 } 383 384 static struct syscall_tp *evsel__syscall_tp(struct evsel *evsel) 385 { 386 if (evsel->priv == NULL) { 387 evsel->priv = evsel_trace__new(); 388 if (evsel->priv == NULL) 389 return NULL; 390 } 391 392 return __evsel__syscall_tp(evsel); 393 } 394 395 /* 396 * Used with all the other tracepoints. 397 */ 398 static inline struct syscall_arg_fmt *__evsel__syscall_arg_fmt(struct evsel *evsel) 399 { 400 struct evsel_trace *et = evsel->priv; 401 402 return et->fmt; 403 } 404 405 static struct syscall_arg_fmt *evsel__syscall_arg_fmt(struct evsel *evsel) 406 { 407 struct evsel_trace *et = evsel->priv; 408 409 if (evsel->priv == NULL) { 410 et = evsel->priv = evsel_trace__new(); 411 412 if (et == NULL) 413 return NULL; 414 } 415 416 if (et->fmt == NULL) { 417 const struct tep_event *tp_format = evsel__tp_format(evsel); 418 419 if (tp_format == NULL) 420 goto out_delete; 421 422 et->fmt = calloc(tp_format->format.nr_fields, sizeof(struct syscall_arg_fmt)); 423 if (et->fmt == NULL) 424 goto out_delete; 425 } 426 427 return __evsel__syscall_arg_fmt(evsel); 428 429 out_delete: 430 evsel_trace__delete(evsel->priv); 431 evsel->priv = NULL; 432 return NULL; 433 } 434 435 static int evsel__init_tp_uint_field(struct evsel *evsel, struct tp_field *field, const char *name) 436 { 437 struct tep_format_field *format_field = evsel__field(evsel, name); 438 439 if (format_field == NULL) 440 return -1; 441 442 return tp_field__init_uint(field, format_field, evsel->needs_swap); 443 } 444 445 #define perf_evsel__init_sc_tp_uint_field(evsel, name) \ 446 ({ struct syscall_tp *sc = __evsel__syscall_tp(evsel);\ 447 evsel__init_tp_uint_field(evsel, &sc->name, #name); }) 448 449 static int evsel__init_tp_ptr_field(struct evsel *evsel, struct tp_field *field, const char *name) 450 { 451 struct tep_format_field *format_field = evsel__field(evsel, name); 452 453 if (format_field == NULL) 454 return -1; 455 456 return tp_field__init_ptr(field, format_field); 457 } 458 459 #define perf_evsel__init_sc_tp_ptr_field(evsel, name) \ 460 ({ struct syscall_tp *sc = __evsel__syscall_tp(evsel);\ 461 evsel__init_tp_ptr_field(evsel, &sc->name, #name); }) 462 463 static void evsel__delete_priv(struct evsel *evsel) 464 { 465 zfree(&evsel->priv); 466 evsel__delete(evsel); 467 } 468 469 static int evsel__init_syscall_tp(struct evsel *evsel) 470 { 471 struct syscall_tp *sc = evsel__syscall_tp(evsel); 472 473 if (sc != NULL) { 474 if (evsel__init_tp_uint_field(evsel, &sc->id, "__syscall_nr") && 475 evsel__init_tp_uint_field(evsel, &sc->id, "nr")) 476 return -ENOENT; 477 478 return 0; 479 } 480 481 return -ENOMEM; 482 } 483 484 static int evsel__init_augmented_syscall_tp(struct evsel *evsel, struct evsel *tp) 485 { 486 struct syscall_tp *sc = evsel__syscall_tp(evsel); 487 488 if (sc != NULL) { 489 struct tep_format_field *syscall_id = evsel__field(tp, "id"); 490 if (syscall_id == NULL) 491 syscall_id = evsel__field(tp, "__syscall_nr"); 492 if (syscall_id == NULL || 493 __tp_field__init_uint(&sc->id, syscall_id->size, syscall_id->offset, evsel->needs_swap)) 494 return -EINVAL; 495 496 return 0; 497 } 498 499 return -ENOMEM; 500 } 501 502 static int evsel__init_augmented_syscall_tp_args(struct evsel *evsel) 503 { 504 struct syscall_tp *sc = __evsel__syscall_tp(evsel); 505 506 return __tp_field__init_ptr(&sc->args, sc->id.offset + sizeof(u64)); 507 } 508 509 static int evsel__init_augmented_syscall_tp_ret(struct evsel *evsel) 510 { 511 struct syscall_tp *sc = __evsel__syscall_tp(evsel); 512 513 return __tp_field__init_uint(&sc->ret, sizeof(u64), sc->id.offset + sizeof(u64), evsel->needs_swap); 514 } 515 516 static int evsel__init_raw_syscall_tp(struct evsel *evsel, void *handler) 517 { 518 if (evsel__syscall_tp(evsel) != NULL) { 519 if (perf_evsel__init_sc_tp_uint_field(evsel, id)) 520 return -ENOENT; 521 522 evsel->handler = handler; 523 return 0; 524 } 525 526 return -ENOMEM; 527 } 528 529 static struct evsel *perf_evsel__raw_syscall_newtp(const char *direction, void *handler) 530 { 531 struct evsel *evsel = evsel__newtp("raw_syscalls", direction); 532 533 /* older kernel (e.g., RHEL6) use syscalls:{enter,exit} */ 534 if (IS_ERR(evsel)) 535 evsel = evsel__newtp("syscalls", direction); 536 537 if (IS_ERR(evsel)) 538 return NULL; 539 540 if (evsel__init_raw_syscall_tp(evsel, handler)) 541 goto out_delete; 542 543 return evsel; 544 545 out_delete: 546 evsel__delete_priv(evsel); 547 return NULL; 548 } 549 550 #define perf_evsel__sc_tp_uint(name, sample) \ 551 ({ struct syscall_tp *fields = __evsel__syscall_tp(sample->evsel); \ 552 fields->name.integer(&fields->name, sample); }) 553 554 #define perf_evsel__sc_tp_ptr(name, sample) \ 555 ({ struct syscall_tp *fields = __evsel__syscall_tp(sample->evsel); \ 556 fields->name.pointer(&fields->name, sample); }) 557 558 size_t strarray__scnprintf_suffix(struct strarray *sa, char *bf, size_t size, const char *intfmt, bool show_suffix, int val) 559 { 560 int idx = val - sa->offset; 561 562 if (idx < 0 || idx >= sa->nr_entries || sa->entries[idx] == NULL) { 563 size_t printed = scnprintf(bf, size, intfmt, val); 564 if (show_suffix) 565 printed += scnprintf(bf + printed, size - printed, " /* %s??? */", sa->prefix); 566 return printed; 567 } 568 569 return scnprintf(bf, size, "%s%s", sa->entries[idx], show_suffix ? sa->prefix : ""); 570 } 571 572 size_t strarray__scnprintf(struct strarray *sa, char *bf, size_t size, const char *intfmt, bool show_prefix, int val) 573 { 574 int idx = val - sa->offset; 575 576 if (idx < 0 || idx >= sa->nr_entries || sa->entries[idx] == NULL) { 577 size_t printed = scnprintf(bf, size, intfmt, val); 578 if (show_prefix) 579 printed += scnprintf(bf + printed, size - printed, " /* %s??? */", sa->prefix); 580 return printed; 581 } 582 583 return scnprintf(bf, size, "%s%s", show_prefix ? sa->prefix : "", sa->entries[idx]); 584 } 585 586 static size_t __syscall_arg__scnprintf_strarray(char *bf, size_t size, 587 const char *intfmt, 588 struct syscall_arg *arg) 589 { 590 return strarray__scnprintf(arg->parm, bf, size, intfmt, arg->show_string_prefix, arg->val); 591 } 592 593 static size_t syscall_arg__scnprintf_strarray(char *bf, size_t size, 594 struct syscall_arg *arg) 595 { 596 return __syscall_arg__scnprintf_strarray(bf, size, "%d", arg); 597 } 598 599 #define SCA_STRARRAY syscall_arg__scnprintf_strarray 600 601 bool syscall_arg__strtoul_strarray(char *bf, size_t size, struct syscall_arg *arg, u64 *ret) 602 { 603 return strarray__strtoul(arg->parm, bf, size, ret); 604 } 605 606 bool syscall_arg__strtoul_strarray_flags(char *bf, size_t size, struct syscall_arg *arg, u64 *ret) 607 { 608 return strarray__strtoul_flags(arg->parm, bf, size, ret); 609 } 610 611 bool syscall_arg__strtoul_strarrays(char *bf, size_t size, struct syscall_arg *arg, u64 *ret) 612 { 613 return strarrays__strtoul(arg->parm, bf, size, ret); 614 } 615 616 size_t syscall_arg__scnprintf_strarray_flags(char *bf, size_t size, struct syscall_arg *arg) 617 { 618 return strarray__scnprintf_flags(arg->parm, bf, size, arg->show_string_prefix, arg->val); 619 } 620 621 size_t strarrays__scnprintf(struct strarrays *sas, char *bf, size_t size, const char *intfmt, bool show_prefix, int val) 622 { 623 size_t printed; 624 int i; 625 626 for (i = 0; i < sas->nr_entries; ++i) { 627 struct strarray *sa = sas->entries[i]; 628 int idx = val - sa->offset; 629 630 if (idx >= 0 && idx < sa->nr_entries) { 631 if (sa->entries[idx] == NULL) 632 break; 633 return scnprintf(bf, size, "%s%s", show_prefix ? sa->prefix : "", sa->entries[idx]); 634 } 635 } 636 637 printed = scnprintf(bf, size, intfmt, val); 638 if (show_prefix) 639 printed += scnprintf(bf + printed, size - printed, " /* %s??? */", sas->entries[0]->prefix); 640 return printed; 641 } 642 643 bool strarray__strtoul(struct strarray *sa, char *bf, size_t size, u64 *ret) 644 { 645 int i; 646 647 for (i = 0; i < sa->nr_entries; ++i) { 648 if (sa->entries[i] && strncmp(sa->entries[i], bf, size) == 0 && sa->entries[i][size] == '\0') { 649 *ret = sa->offset + i; 650 return true; 651 } 652 } 653 654 return false; 655 } 656 657 bool strarray__strtoul_flags(struct strarray *sa, char *bf, size_t size, u64 *ret) 658 { 659 u64 val = 0; 660 char *tok = bf, *sep, *end; 661 662 *ret = 0; 663 664 while (size != 0) { 665 int toklen = size; 666 667 sep = memchr(tok, '|', size); 668 if (sep != NULL) { 669 size -= sep - tok + 1; 670 671 end = sep - 1; 672 while (end > tok && isspace(*end)) 673 --end; 674 675 toklen = end - tok + 1; 676 } 677 678 while (isspace(*tok)) 679 ++tok; 680 681 if (isalpha(*tok) || *tok == '_') { 682 if (!strarray__strtoul(sa, tok, toklen, &val)) 683 return false; 684 } else 685 val = strtoul(tok, NULL, 0); 686 687 *ret |= (1 << (val - 1)); 688 689 if (sep == NULL) 690 break; 691 tok = sep + 1; 692 } 693 694 return true; 695 } 696 697 bool strarrays__strtoul(struct strarrays *sas, char *bf, size_t size, u64 *ret) 698 { 699 int i; 700 701 for (i = 0; i < sas->nr_entries; ++i) { 702 struct strarray *sa = sas->entries[i]; 703 704 if (strarray__strtoul(sa, bf, size, ret)) 705 return true; 706 } 707 708 return false; 709 } 710 711 size_t syscall_arg__scnprintf_strarrays(char *bf, size_t size, 712 struct syscall_arg *arg) 713 { 714 return strarrays__scnprintf(arg->parm, bf, size, "%d", arg->show_string_prefix, arg->val); 715 } 716 717 #ifndef AT_FDCWD 718 #define AT_FDCWD -100 719 #endif 720 721 static size_t syscall_arg__scnprintf_fd_at(char *bf, size_t size, 722 struct syscall_arg *arg) 723 { 724 int fd = arg->val; 725 const char *prefix = "AT_FD"; 726 727 if (fd == AT_FDCWD) 728 return scnprintf(bf, size, "%s%s", arg->show_string_prefix ? prefix : "", "CWD"); 729 730 return syscall_arg__scnprintf_fd(bf, size, arg); 731 } 732 733 #define SCA_FDAT syscall_arg__scnprintf_fd_at 734 735 static size_t syscall_arg__scnprintf_close_fd(char *bf, size_t size, 736 struct syscall_arg *arg); 737 738 #define SCA_CLOSE_FD syscall_arg__scnprintf_close_fd 739 740 size_t syscall_arg__scnprintf_hex(char *bf, size_t size, struct syscall_arg *arg) 741 { 742 return scnprintf(bf, size, "%#lx", arg->val); 743 } 744 745 size_t syscall_arg__scnprintf_ptr(char *bf, size_t size, struct syscall_arg *arg) 746 { 747 if (arg->val == 0) 748 return scnprintf(bf, size, "NULL"); 749 return syscall_arg__scnprintf_hex(bf, size, arg); 750 } 751 752 size_t syscall_arg__scnprintf_int(char *bf, size_t size, struct syscall_arg *arg) 753 { 754 return scnprintf(bf, size, "%d", arg->val); 755 } 756 757 size_t syscall_arg__scnprintf_long(char *bf, size_t size, struct syscall_arg *arg) 758 { 759 return scnprintf(bf, size, "%ld", arg->val); 760 } 761 762 static size_t syscall_arg__scnprintf_char_array(char *bf, size_t size, struct syscall_arg *arg) 763 { 764 // XXX Hey, maybe for sched:sched_switch prev/next comm fields we can 765 // fill missing comms using thread__set_comm()... 766 // here or in a special syscall_arg__scnprintf_pid_sched_tp... 767 return scnprintf(bf, size, "\"%-.*s\"", arg->fmt->nr_entries ?: arg->len, arg->val); 768 } 769 770 #define SCA_CHAR_ARRAY syscall_arg__scnprintf_char_array 771 772 static const char *bpf_cmd[] = { 773 "MAP_CREATE", "MAP_LOOKUP_ELEM", "MAP_UPDATE_ELEM", "MAP_DELETE_ELEM", 774 "MAP_GET_NEXT_KEY", "PROG_LOAD", "OBJ_PIN", "OBJ_GET", "PROG_ATTACH", 775 "PROG_DETACH", "PROG_TEST_RUN", "PROG_GET_NEXT_ID", "MAP_GET_NEXT_ID", 776 "PROG_GET_FD_BY_ID", "MAP_GET_FD_BY_ID", "OBJ_GET_INFO_BY_FD", 777 "PROG_QUERY", "RAW_TRACEPOINT_OPEN", "BTF_LOAD", "BTF_GET_FD_BY_ID", 778 "TASK_FD_QUERY", "MAP_LOOKUP_AND_DELETE_ELEM", "MAP_FREEZE", 779 "BTF_GET_NEXT_ID", "MAP_LOOKUP_BATCH", "MAP_LOOKUP_AND_DELETE_BATCH", 780 "MAP_UPDATE_BATCH", "MAP_DELETE_BATCH", "LINK_CREATE", "LINK_UPDATE", 781 "LINK_GET_FD_BY_ID", "LINK_GET_NEXT_ID", "ENABLE_STATS", "ITER_CREATE", 782 "LINK_DETACH", "PROG_BIND_MAP", 783 }; 784 static DEFINE_STRARRAY(bpf_cmd, "BPF_"); 785 786 static const char *epoll_ctl_ops[] = { "ADD", "DEL", "MOD", }; 787 static DEFINE_STRARRAY_OFFSET(epoll_ctl_ops, "EPOLL_CTL_", 1); 788 789 static const char *itimers[] = { "REAL", "VIRTUAL", "PROF", }; 790 static DEFINE_STRARRAY(itimers, "ITIMER_"); 791 792 static const char *keyctl_options[] = { 793 "GET_KEYRING_ID", "JOIN_SESSION_KEYRING", "UPDATE", "REVOKE", "CHOWN", 794 "SETPERM", "DESCRIBE", "CLEAR", "LINK", "UNLINK", "SEARCH", "READ", 795 "INSTANTIATE", "NEGATE", "SET_REQKEY_KEYRING", "SET_TIMEOUT", 796 "ASSUME_AUTHORITY", "GET_SECURITY", "SESSION_TO_PARENT", "REJECT", 797 "INSTANTIATE_IOV", "INVALIDATE", "GET_PERSISTENT", 798 }; 799 static DEFINE_STRARRAY(keyctl_options, "KEYCTL_"); 800 801 static const char *whences[] = { "SET", "CUR", "END", 802 #ifdef SEEK_DATA 803 "DATA", 804 #endif 805 #ifdef SEEK_HOLE 806 "HOLE", 807 #endif 808 }; 809 static DEFINE_STRARRAY(whences, "SEEK_"); 810 811 static const char *fcntl_cmds[] = { 812 "DUPFD", "GETFD", "SETFD", "GETFL", "SETFL", "GETLK", "SETLK", 813 "SETLKW", "SETOWN", "GETOWN", "SETSIG", "GETSIG", "GETLK64", 814 "SETLK64", "SETLKW64", "SETOWN_EX", "GETOWN_EX", 815 "GETOWNER_UIDS", 816 }; 817 static DEFINE_STRARRAY(fcntl_cmds, "F_"); 818 819 static const char *fcntl_linux_specific_cmds[] = { 820 "SETLEASE", "GETLEASE", "NOTIFY", "DUPFD_QUERY", [5] = "CANCELLK", "DUPFD_CLOEXEC", 821 "SETPIPE_SZ", "GETPIPE_SZ", "ADD_SEALS", "GET_SEALS", 822 "GET_RW_HINT", "SET_RW_HINT", "GET_FILE_RW_HINT", "SET_FILE_RW_HINT", 823 }; 824 825 static DEFINE_STRARRAY_OFFSET(fcntl_linux_specific_cmds, "F_", F_LINUX_SPECIFIC_BASE); 826 827 static struct strarray *fcntl_cmds_arrays[] = { 828 &strarray__fcntl_cmds, 829 &strarray__fcntl_linux_specific_cmds, 830 }; 831 832 static DEFINE_STRARRAYS(fcntl_cmds_arrays); 833 834 static const char *rlimit_resources[] = { 835 "CPU", "FSIZE", "DATA", "STACK", "CORE", "RSS", "NPROC", "NOFILE", 836 "MEMLOCK", "AS", "LOCKS", "SIGPENDING", "MSGQUEUE", "NICE", "RTPRIO", 837 "RTTIME", 838 }; 839 static DEFINE_STRARRAY(rlimit_resources, "RLIMIT_"); 840 841 static const char *sighow[] = { "BLOCK", "UNBLOCK", "SETMASK", }; 842 static DEFINE_STRARRAY(sighow, "SIG_"); 843 844 static const char *clockid[] = { 845 "REALTIME", "MONOTONIC", "PROCESS_CPUTIME_ID", "THREAD_CPUTIME_ID", 846 "MONOTONIC_RAW", "REALTIME_COARSE", "MONOTONIC_COARSE", "BOOTTIME", 847 "REALTIME_ALARM", "BOOTTIME_ALARM", "SGI_CYCLE", "TAI" 848 }; 849 static DEFINE_STRARRAY(clockid, "CLOCK_"); 850 851 static size_t syscall_arg__scnprintf_access_mode(char *bf, size_t size, 852 struct syscall_arg *arg) 853 { 854 bool show_prefix = arg->show_string_prefix; 855 const char *suffix = "_OK"; 856 size_t printed = 0; 857 int mode = arg->val; 858 859 if (mode == F_OK) /* 0 */ 860 return scnprintf(bf, size, "F%s", show_prefix ? suffix : ""); 861 #define P_MODE(n) \ 862 if (mode & n##_OK) { \ 863 printed += scnprintf(bf + printed, size - printed, "%s%s", #n, show_prefix ? suffix : ""); \ 864 mode &= ~n##_OK; \ 865 } 866 867 P_MODE(R); 868 P_MODE(W); 869 P_MODE(X); 870 #undef P_MODE 871 872 if (mode) 873 printed += scnprintf(bf + printed, size - printed, "|%#x", mode); 874 875 return printed; 876 } 877 878 #define SCA_ACCMODE syscall_arg__scnprintf_access_mode 879 880 static size_t syscall_arg__scnprintf_filename(char *bf, size_t size, 881 struct syscall_arg *arg); 882 883 #define SCA_FILENAME syscall_arg__scnprintf_filename 884 885 // 'argname' is just documentational at this point, to remove the previous comment with that info 886 #define SCA_FILENAME_FROM_USER(argname) \ 887 { .scnprintf = SCA_FILENAME, \ 888 .from_user = true, } 889 890 static size_t syscall_arg__scnprintf_buf(char *bf, size_t size, struct syscall_arg *arg); 891 892 #define SCA_BUF syscall_arg__scnprintf_buf 893 894 static size_t syscall_arg__scnprintf_pipe_flags(char *bf, size_t size, 895 struct syscall_arg *arg) 896 { 897 bool show_prefix = arg->show_string_prefix; 898 const char *prefix = "O_"; 899 int printed = 0, flags = arg->val; 900 901 #define P_FLAG(n) \ 902 if (flags & O_##n) { \ 903 printed += scnprintf(bf + printed, size - printed, "%s%s%s", printed ? "|" : "", show_prefix ? prefix : "", #n); \ 904 flags &= ~O_##n; \ 905 } 906 907 P_FLAG(CLOEXEC); 908 P_FLAG(NONBLOCK); 909 #undef P_FLAG 910 911 if (flags) 912 printed += scnprintf(bf + printed, size - printed, "%s%#x", printed ? "|" : "", flags); 913 914 return printed; 915 } 916 917 #define SCA_PIPE_FLAGS syscall_arg__scnprintf_pipe_flags 918 919 #ifndef GRND_NONBLOCK 920 #define GRND_NONBLOCK 0x0001 921 #endif 922 #ifndef GRND_RANDOM 923 #define GRND_RANDOM 0x0002 924 #endif 925 926 static size_t syscall_arg__scnprintf_getrandom_flags(char *bf, size_t size, 927 struct syscall_arg *arg) 928 { 929 bool show_prefix = arg->show_string_prefix; 930 const char *prefix = "GRND_"; 931 int printed = 0, flags = arg->val; 932 933 #define P_FLAG(n) \ 934 if (flags & GRND_##n) { \ 935 printed += scnprintf(bf + printed, size - printed, "%s%s%s", printed ? "|" : "", show_prefix ? prefix : "", #n); \ 936 flags &= ~GRND_##n; \ 937 } 938 939 P_FLAG(RANDOM); 940 P_FLAG(NONBLOCK); 941 #undef P_FLAG 942 943 if (flags) 944 printed += scnprintf(bf + printed, size - printed, "%s%#x", printed ? "|" : "", flags); 945 946 return printed; 947 } 948 949 #define SCA_GETRANDOM_FLAGS syscall_arg__scnprintf_getrandom_flags 950 951 #ifdef HAVE_LIBBPF_SUPPORT 952 static void syscall_arg_fmt__cache_btf_enum(struct syscall_arg_fmt *arg_fmt, struct btf *btf, char *type) 953 { 954 int id; 955 956 type = strstr(type, "enum "); 957 if (type == NULL) 958 return; 959 960 type += 5; // skip "enum " to get the enumeration name 961 962 id = btf__find_by_name(btf, type); 963 if (id < 0) 964 return; 965 966 arg_fmt->type = btf__type_by_id(btf, id); 967 } 968 969 static bool syscall_arg__strtoul_btf_enum(char *bf, size_t size, struct syscall_arg *arg, u64 *val) 970 { 971 const struct btf_type *bt = arg->fmt->type; 972 struct btf *btf = arg->trace->btf; 973 struct btf_enum *be = btf_enum(bt); 974 975 for (int i = 0; i < btf_vlen(bt); ++i, ++be) { 976 const char *name = btf__name_by_offset(btf, be->name_off); 977 int max_len = max(size, strlen(name)); 978 979 if (strncmp(name, bf, max_len) == 0) { 980 *val = be->val; 981 return true; 982 } 983 } 984 985 return false; 986 } 987 988 static bool syscall_arg__strtoul_btf_type(char *bf, size_t size, struct syscall_arg *arg, u64 *val) 989 { 990 const struct btf_type *bt; 991 char *type = arg->type_name; 992 struct btf *btf; 993 994 trace__load_vmlinux_btf(arg->trace); 995 996 btf = arg->trace->btf; 997 if (btf == NULL) 998 return false; 999 1000 if (arg->fmt->type == NULL) { 1001 // See if this is an enum 1002 syscall_arg_fmt__cache_btf_enum(arg->fmt, btf, type); 1003 } 1004 1005 // Now let's see if we have a BTF type resolved 1006 bt = arg->fmt->type; 1007 if (bt == NULL) 1008 return false; 1009 1010 // If it is an enum: 1011 if (btf_is_enum(arg->fmt->type)) 1012 return syscall_arg__strtoul_btf_enum(bf, size, arg, val); 1013 1014 return false; 1015 } 1016 1017 static size_t btf_enum_scnprintf(const struct btf_type *type, struct btf *btf, char *bf, size_t size, int val) 1018 { 1019 struct btf_enum *be = btf_enum(type); 1020 const int nr_entries = btf_vlen(type); 1021 1022 for (int i = 0; i < nr_entries; ++i, ++be) { 1023 if (be->val == val) { 1024 return scnprintf(bf, size, "%s", 1025 btf__name_by_offset(btf, be->name_off)); 1026 } 1027 } 1028 1029 return 0; 1030 } 1031 1032 struct trace_btf_dump_snprintf_ctx { 1033 char *bf; 1034 size_t printed, size; 1035 }; 1036 1037 static void trace__btf_dump_snprintf(void *vctx, const char *fmt, va_list args) 1038 { 1039 struct trace_btf_dump_snprintf_ctx *ctx = vctx; 1040 1041 ctx->printed += vscnprintf(ctx->bf + ctx->printed, ctx->size - ctx->printed, fmt, args); 1042 } 1043 1044 static size_t btf_struct_scnprintf(const struct btf_type *type, struct btf *btf, char *bf, size_t size, struct syscall_arg *arg) 1045 { 1046 struct trace_btf_dump_snprintf_ctx ctx = { 1047 .bf = bf, 1048 .size = size, 1049 }; 1050 struct augmented_arg *augmented_arg = arg->augmented.args; 1051 int type_id = arg->fmt->type_id, consumed; 1052 struct btf_dump *btf_dump; 1053 1054 LIBBPF_OPTS(btf_dump_opts, dump_opts); 1055 LIBBPF_OPTS(btf_dump_type_data_opts, dump_data_opts); 1056 1057 if (arg == NULL || arg->augmented.args == NULL) 1058 return 0; 1059 1060 dump_data_opts.compact = true; 1061 dump_data_opts.skip_names = !arg->trace->show_arg_names; 1062 1063 btf_dump = btf_dump__new(btf, trace__btf_dump_snprintf, &ctx, &dump_opts); 1064 if (btf_dump == NULL) 1065 return 0; 1066 1067 /* pretty print the struct data here */ 1068 if (btf_dump__dump_type_data(btf_dump, type_id, arg->augmented.args->value, type->size, &dump_data_opts) == 0) 1069 return 0; 1070 1071 consumed = sizeof(*augmented_arg) + augmented_arg->size; 1072 arg->augmented.args = ((void *)arg->augmented.args) + consumed; 1073 arg->augmented.size -= consumed; 1074 1075 btf_dump__free(btf_dump); 1076 1077 return ctx.printed; 1078 } 1079 1080 static size_t trace__btf_scnprintf(struct trace *trace, struct syscall_arg *arg, char *bf, 1081 size_t size, int val, char *type) 1082 { 1083 struct syscall_arg_fmt *arg_fmt = arg->fmt; 1084 1085 if (trace->btf == NULL) 1086 return 0; 1087 1088 if (arg_fmt->type == NULL) { 1089 // Check if this is an enum and if we have the BTF type for it. 1090 syscall_arg_fmt__cache_btf_enum(arg_fmt, trace->btf, type); 1091 } 1092 1093 // Did we manage to find a BTF type for the syscall/tracepoint argument? 1094 if (arg_fmt->type == NULL) 1095 return 0; 1096 1097 if (btf_is_enum(arg_fmt->type)) 1098 return btf_enum_scnprintf(arg_fmt->type, trace->btf, bf, size, val); 1099 else if (btf_is_struct(arg_fmt->type) || btf_is_union(arg_fmt->type)) 1100 return btf_struct_scnprintf(arg_fmt->type, trace->btf, bf, size, arg); 1101 1102 return 0; 1103 } 1104 1105 #else // HAVE_LIBBPF_SUPPORT 1106 static size_t trace__btf_scnprintf(struct trace *trace __maybe_unused, struct syscall_arg *arg __maybe_unused, 1107 char *bf __maybe_unused, size_t size __maybe_unused, int val __maybe_unused, 1108 char *type __maybe_unused) 1109 { 1110 return 0; 1111 } 1112 1113 static bool syscall_arg__strtoul_btf_type(char *bf __maybe_unused, size_t size __maybe_unused, 1114 struct syscall_arg *arg __maybe_unused, u64 *val __maybe_unused) 1115 { 1116 return false; 1117 } 1118 #endif // HAVE_LIBBPF_SUPPORT 1119 1120 #define STUL_BTF_TYPE syscall_arg__strtoul_btf_type 1121 1122 #define STRARRAY(name, array) \ 1123 { .scnprintf = SCA_STRARRAY, \ 1124 .strtoul = STUL_STRARRAY, \ 1125 .parm = &strarray__##array, \ 1126 .show_zero = true, } 1127 1128 #define STRARRAY_FLAGS(name, array) \ 1129 { .scnprintf = SCA_STRARRAY_FLAGS, \ 1130 .strtoul = STUL_STRARRAY_FLAGS, \ 1131 .parm = &strarray__##array, \ 1132 .show_zero = true, } 1133 1134 static const struct syscall_fmt syscall_fmts[] = { 1135 { .name = "access", 1136 .arg = { [1] = { .scnprintf = SCA_ACCMODE, /* mode */ }, }, }, 1137 { .name = "arch_prctl", 1138 .arg = { [0] = { .scnprintf = SCA_X86_ARCH_PRCTL_CODE, /* code */ }, 1139 [1] = { .scnprintf = SCA_PTR, /* arg2 */ }, }, }, 1140 { .name = "bind", 1141 .arg = { [0] = { .scnprintf = SCA_INT, /* fd */ }, 1142 [1] = SCA_SOCKADDR_FROM_USER(umyaddr), 1143 [2] = { .scnprintf = SCA_INT, /* addrlen */ }, }, }, 1144 { .name = "bpf", 1145 .arg = { [0] = STRARRAY(cmd, bpf_cmd), 1146 [1] = { .from_user = true /* attr */, }, } }, 1147 { .name = "brk", .hexret = true, 1148 .arg = { [0] = { .scnprintf = SCA_PTR, /* brk */ }, }, }, 1149 { .name = "clock_gettime", 1150 .arg = { [0] = STRARRAY(clk_id, clockid), }, }, 1151 { .name = "clock_nanosleep", 1152 .arg = { [2] = SCA_TIMESPEC_FROM_USER(req), }, }, 1153 { .name = "clone", .errpid = true, .nr_args = 5, 1154 .arg = { [0] = { .name = "flags", .scnprintf = SCA_CLONE_FLAGS, }, 1155 [1] = { .name = "child_stack", .scnprintf = SCA_HEX, }, 1156 [2] = { .name = "parent_tidptr", .scnprintf = SCA_HEX, }, 1157 [3] = { .name = "child_tidptr", .scnprintf = SCA_HEX, }, 1158 [4] = { .name = "tls", .scnprintf = SCA_HEX, }, }, }, 1159 { .name = "close", 1160 .arg = { [0] = { .scnprintf = SCA_CLOSE_FD, /* fd */ }, }, }, 1161 { .name = "connect", 1162 .arg = { [0] = { .scnprintf = SCA_INT, /* fd */ }, 1163 [1] = SCA_SOCKADDR_FROM_USER(servaddr), 1164 [2] = { .scnprintf = SCA_INT, /* addrlen */ }, }, }, 1165 { .name = "epoll_ctl", 1166 .arg = { [1] = STRARRAY(op, epoll_ctl_ops), }, }, 1167 { .name = "eventfd2", 1168 .arg = { [1] = { .scnprintf = SCA_EFD_FLAGS, /* flags */ }, }, }, 1169 { .name = "faccessat", 1170 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dirfd */ }, 1171 [1] = SCA_FILENAME_FROM_USER(pathname), 1172 [2] = { .scnprintf = SCA_ACCMODE, /* mode */ }, }, }, 1173 { .name = "faccessat2", 1174 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dirfd */ }, 1175 [1] = SCA_FILENAME_FROM_USER(pathname), 1176 [2] = { .scnprintf = SCA_ACCMODE, /* mode */ }, 1177 [3] = { .scnprintf = SCA_FACCESSAT2_FLAGS, /* flags */ }, }, }, 1178 { .name = "fchmodat", 1179 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, }, 1180 { .name = "fchownat", 1181 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, }, 1182 { .name = "fcntl", 1183 .arg = { [1] = { .scnprintf = SCA_FCNTL_CMD, /* cmd */ 1184 .strtoul = STUL_STRARRAYS, 1185 .parm = &strarrays__fcntl_cmds_arrays, 1186 .show_zero = true, }, 1187 [2] = { .scnprintf = SCA_FCNTL_ARG, /* arg */ }, }, }, 1188 { .name = "flock", 1189 .arg = { [1] = { .scnprintf = SCA_FLOCK, /* cmd */ }, }, }, 1190 { .name = "fsconfig", 1191 .arg = { [1] = STRARRAY(cmd, fsconfig_cmds), }, }, 1192 { .name = "fsmount", 1193 .arg = { [1] = { .scnprintf = SCA_FSMOUNT_FLAGS, /* fsmount_flags */ 1194 .strtoul = STUL_STRARRAYS, 1195 .show_zero = true, }, 1196 [2] = { .scnprintf = SCA_FSMOUNT_ATTR_FLAGS, /* attr_flags */ }, }, }, 1197 { .name = "fspick", 1198 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, 1199 [1] = SCA_FILENAME_FROM_USER(path), 1200 [2] = { .scnprintf = SCA_FSPICK_FLAGS, /* flags */ }, }, }, 1201 { .name = "fstat", .alias = "newfstat", }, 1202 { .name = "futex", 1203 .arg = { [1] = { .scnprintf = SCA_FUTEX_OP, /* op */ }, 1204 [5] = { .scnprintf = SCA_FUTEX_VAL3, /* val3 */ }, }, }, 1205 { .name = "futimesat", 1206 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, }, 1207 { .name = "getitimer", 1208 .arg = { [0] = STRARRAY(which, itimers), }, }, 1209 { .name = "getpid", .errpid = true, }, 1210 { .name = "getpgid", .errpid = true, }, 1211 { .name = "getppid", .errpid = true, }, 1212 { .name = "getrandom", 1213 .arg = { [2] = { .scnprintf = SCA_GETRANDOM_FLAGS, /* flags */ }, }, }, 1214 { .name = "getrlimit", 1215 .arg = { [0] = STRARRAY(resource, rlimit_resources), }, }, 1216 { .name = "getsockopt", 1217 .arg = { [1] = STRARRAY(level, socket_level), }, }, 1218 { .name = "gettid", .errpid = true, }, 1219 { .name = "ioctl", 1220 .arg = { 1221 #if defined(__i386__) || defined(__x86_64__) 1222 /* 1223 * FIXME: Make this available to all arches. 1224 */ 1225 [1] = { .scnprintf = SCA_IOCTL_CMD, /* cmd */ }, 1226 [2] = { .scnprintf = SCA_HEX, /* arg */ }, }, }, 1227 #else 1228 [2] = { .scnprintf = SCA_HEX, /* arg */ }, }, }, 1229 #endif 1230 { .name = "kcmp", .nr_args = 5, 1231 .arg = { [0] = { .name = "pid1", .scnprintf = SCA_PID, }, 1232 [1] = { .name = "pid2", .scnprintf = SCA_PID, }, 1233 [2] = { .name = "type", .scnprintf = SCA_KCMP_TYPE, }, 1234 [3] = { .name = "idx1", .scnprintf = SCA_KCMP_IDX, }, 1235 [4] = { .name = "idx2", .scnprintf = SCA_KCMP_IDX, }, }, }, 1236 { .name = "keyctl", 1237 .arg = { [0] = STRARRAY(option, keyctl_options), }, }, 1238 { .name = "kill", 1239 .arg = { [1] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, }, 1240 { .name = "linkat", 1241 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, }, 1242 { .name = "lseek", 1243 .arg = { [2] = STRARRAY(whence, whences), }, }, 1244 { .name = "lstat", .alias = "newlstat", }, 1245 { .name = "madvise", 1246 .arg = { [0] = { .scnprintf = SCA_HEX, /* start */ }, 1247 [2] = { .scnprintf = SCA_MADV_BHV, /* behavior */ }, }, }, 1248 { .name = "mkdirat", 1249 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, }, 1250 { .name = "mknodat", 1251 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, }, 1252 { .name = "mmap", .hexret = true, 1253 /* The standard mmap maps to old_mmap on s390x */ 1254 #if defined(__s390x__) 1255 .alias = "old_mmap", 1256 #endif 1257 .arg = { [2] = { .scnprintf = SCA_MMAP_PROT, .show_zero = true, /* prot */ }, 1258 [3] = { .scnprintf = SCA_MMAP_FLAGS, /* flags */ 1259 .strtoul = STUL_STRARRAY_FLAGS, 1260 .parm = &strarray__mmap_flags, }, 1261 [5] = { .scnprintf = SCA_HEX, /* offset */ }, }, }, 1262 { .name = "mount", 1263 .arg = { [0] = SCA_FILENAME_FROM_USER(devname), 1264 [3] = { .scnprintf = SCA_MOUNT_FLAGS, /* flags */ 1265 .mask_val = SCAMV_MOUNT_FLAGS, /* flags */ }, }, }, 1266 { .name = "move_mount", 1267 .arg = { [0] = { .scnprintf = SCA_FDAT, /* from_dfd */ }, 1268 [1] = SCA_FILENAME_FROM_USER(pathname), 1269 [2] = { .scnprintf = SCA_FDAT, /* to_dfd */ }, 1270 [3] = SCA_FILENAME_FROM_USER(pathname), 1271 [4] = { .scnprintf = SCA_MOVE_MOUNT_FLAGS, /* flags */ }, }, }, 1272 { .name = "mprotect", 1273 .arg = { [0] = { .scnprintf = SCA_HEX, /* start */ }, 1274 [2] = { .scnprintf = SCA_MMAP_PROT, .show_zero = true, /* prot */ }, }, }, 1275 { .name = "mq_unlink", 1276 .arg = { [0] = SCA_FILENAME_FROM_USER(u_name), }, }, 1277 { .name = "mremap", .hexret = true, 1278 .arg = { [3] = { .scnprintf = SCA_MREMAP_FLAGS, /* flags */ }, }, }, 1279 { .name = "name_to_handle_at", 1280 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, }, 1281 { .name = "nanosleep", 1282 .arg = { [0] = SCA_TIMESPEC_FROM_USER(req), }, }, 1283 { .name = "newfstatat", .alias = "fstatat", 1284 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dirfd */ }, 1285 [1] = SCA_FILENAME_FROM_USER(pathname), 1286 [3] = { .scnprintf = SCA_FS_AT_FLAGS, /* flags */ }, }, }, 1287 { .name = "open", 1288 .arg = { [1] = { .scnprintf = SCA_OPEN_FLAGS, /* flags */ }, }, }, 1289 { .name = "open_by_handle_at", 1290 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, 1291 [2] = { .scnprintf = SCA_OPEN_FLAGS, /* flags */ }, }, }, 1292 { .name = "openat", 1293 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, 1294 [2] = { .scnprintf = SCA_OPEN_FLAGS, /* flags */ }, }, }, 1295 { .name = "perf_event_open", 1296 .arg = { [0] = SCA_PERF_ATTR_FROM_USER(attr), 1297 [2] = { .scnprintf = SCA_INT, /* cpu */ }, 1298 [3] = { .scnprintf = SCA_FD, /* group_fd */ }, 1299 [4] = { .scnprintf = SCA_PERF_FLAGS, /* flags */ }, }, }, 1300 { .name = "pipe2", 1301 .arg = { [1] = { .scnprintf = SCA_PIPE_FLAGS, /* flags */ }, }, }, 1302 { .name = "pkey_alloc", 1303 .arg = { [1] = { .scnprintf = SCA_PKEY_ALLOC_ACCESS_RIGHTS, /* access_rights */ }, }, }, 1304 { .name = "pkey_free", 1305 .arg = { [0] = { .scnprintf = SCA_INT, /* key */ }, }, }, 1306 { .name = "pkey_mprotect", 1307 .arg = { [0] = { .scnprintf = SCA_HEX, /* start */ }, 1308 [2] = { .scnprintf = SCA_MMAP_PROT, .show_zero = true, /* prot */ }, 1309 [3] = { .scnprintf = SCA_INT, /* pkey */ }, }, }, 1310 { .name = "poll", .timeout = true, }, 1311 { .name = "ppoll", .timeout = true, }, 1312 { .name = "prctl", 1313 .arg = { [0] = { .scnprintf = SCA_PRCTL_OPTION, /* option */ 1314 .strtoul = STUL_STRARRAY, 1315 .parm = &strarray__prctl_options, }, 1316 [1] = { .scnprintf = SCA_PRCTL_ARG2, /* arg2 */ }, 1317 [2] = { .scnprintf = SCA_PRCTL_ARG3, /* arg3 */ }, }, }, 1318 { .name = "pread", .alias = "pread64", }, 1319 { .name = "preadv", .alias = "pread", }, 1320 { .name = "prlimit64", 1321 .arg = { [1] = STRARRAY(resource, rlimit_resources), 1322 [2] = { .from_user = true /* new_rlim */, }, }, }, 1323 { .name = "pwrite", .alias = "pwrite64", }, 1324 { .name = "readlinkat", 1325 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, }, 1326 { .name = "recvfrom", 1327 .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, }, 1328 { .name = "recvmmsg", 1329 .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, }, 1330 { .name = "recvmsg", 1331 .arg = { [2] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, }, 1332 { .name = "renameat", 1333 .arg = { [0] = { .scnprintf = SCA_FDAT, /* olddirfd */ }, 1334 [2] = { .scnprintf = SCA_FDAT, /* newdirfd */ }, }, }, 1335 { .name = "renameat2", 1336 .arg = { [0] = { .scnprintf = SCA_FDAT, /* olddirfd */ }, 1337 [2] = { .scnprintf = SCA_FDAT, /* newdirfd */ }, 1338 [4] = { .scnprintf = SCA_RENAMEAT2_FLAGS, /* flags */ }, }, }, 1339 { .name = "rseq", 1340 .arg = { [0] = { .from_user = true /* rseq */, }, }, }, 1341 { .name = "rt_sigaction", 1342 .arg = { [0] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, }, 1343 { .name = "rt_sigprocmask", 1344 .arg = { [0] = STRARRAY(how, sighow), }, }, 1345 { .name = "rt_sigqueueinfo", 1346 .arg = { [1] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, }, 1347 { .name = "rt_tgsigqueueinfo", 1348 .arg = { [2] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, }, 1349 { .name = "sched_setscheduler", 1350 .arg = { [1] = { .scnprintf = SCA_SCHED_POLICY, /* policy */ }, }, }, 1351 { .name = "seccomp", 1352 .arg = { [0] = { .scnprintf = SCA_SECCOMP_OP, /* op */ }, 1353 [1] = { .scnprintf = SCA_SECCOMP_FLAGS, /* flags */ }, }, }, 1354 { .name = "select", .timeout = true, }, 1355 { .name = "sendfile", .alias = "sendfile64", }, 1356 { .name = "sendmmsg", 1357 .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, }, 1358 { .name = "sendmsg", 1359 .arg = { [2] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, }, 1360 { .name = "sendto", 1361 .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, 1362 [4] = SCA_SOCKADDR_FROM_USER(addr), }, }, 1363 { .name = "set_robust_list", 1364 .arg = { [0] = { .from_user = true /* head */, }, }, }, 1365 { .name = "set_tid_address", .errpid = true, }, 1366 { .name = "setitimer", 1367 .arg = { [0] = STRARRAY(which, itimers), }, }, 1368 { .name = "setrlimit", 1369 .arg = { [0] = STRARRAY(resource, rlimit_resources), 1370 [1] = { .from_user = true /* rlim */, }, }, }, 1371 { .name = "setsockopt", 1372 .arg = { [1] = STRARRAY(level, socket_level), }, }, 1373 { .name = "socket", 1374 .arg = { [0] = STRARRAY(family, socket_families), 1375 [1] = { .scnprintf = SCA_SK_TYPE, /* type */ }, 1376 [2] = { .scnprintf = SCA_SK_PROTO, /* protocol */ }, }, }, 1377 { .name = "socketpair", 1378 .arg = { [0] = STRARRAY(family, socket_families), 1379 [1] = { .scnprintf = SCA_SK_TYPE, /* type */ }, 1380 [2] = { .scnprintf = SCA_SK_PROTO, /* protocol */ }, }, }, 1381 { .name = "stat", .alias = "newstat", }, 1382 { .name = "statx", 1383 .arg = { [0] = { .scnprintf = SCA_FDAT, /* fdat */ }, 1384 [2] = { .scnprintf = SCA_FS_AT_FLAGS, /* flags */ } , 1385 [3] = { .scnprintf = SCA_STATX_MASK, /* mask */ }, }, }, 1386 { .name = "swapoff", 1387 .arg = { [0] = SCA_FILENAME_FROM_USER(specialfile), }, }, 1388 { .name = "swapon", 1389 .arg = { [0] = SCA_FILENAME_FROM_USER(specialfile), }, }, 1390 { .name = "symlinkat", 1391 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, }, 1392 { .name = "sync_file_range", 1393 .arg = { [3] = { .scnprintf = SCA_SYNC_FILE_RANGE_FLAGS, /* flags */ }, }, }, 1394 { .name = "tgkill", 1395 .arg = { [2] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, }, 1396 { .name = "tkill", 1397 .arg = { [1] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, }, 1398 { .name = "umount2", .alias = "umount", 1399 .arg = { [0] = SCA_FILENAME_FROM_USER(name), }, }, 1400 { .name = "uname", .alias = "newuname", }, 1401 { .name = "unlinkat", 1402 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, 1403 [1] = SCA_FILENAME_FROM_USER(pathname), 1404 [2] = { .scnprintf = SCA_FS_AT_FLAGS, /* flags */ }, }, }, 1405 { .name = "utimensat", 1406 .arg = { [0] = { .scnprintf = SCA_FDAT, /* dirfd */ }, }, }, 1407 { .name = "wait4", .errpid = true, 1408 .arg = { [2] = { .scnprintf = SCA_WAITID_OPTIONS, /* options */ }, }, }, 1409 { .name = "waitid", .errpid = true, 1410 .arg = { [3] = { .scnprintf = SCA_WAITID_OPTIONS, /* options */ }, }, }, 1411 { .name = "write", 1412 .arg = { [1] = { .scnprintf = SCA_BUF /* buf */, .from_user = true, }, }, }, 1413 }; 1414 1415 static int syscall_fmt__cmp(const void *name, const void *fmtp) 1416 { 1417 const struct syscall_fmt *fmt = fmtp; 1418 return strcmp(name, fmt->name); 1419 } 1420 1421 static const struct syscall_fmt *__syscall_fmt__find(const struct syscall_fmt *fmts, 1422 const int nmemb, 1423 const char *name) 1424 { 1425 return bsearch(name, fmts, nmemb, sizeof(struct syscall_fmt), syscall_fmt__cmp); 1426 } 1427 1428 static const struct syscall_fmt *syscall_fmt__find(const char *name) 1429 { 1430 const int nmemb = ARRAY_SIZE(syscall_fmts); 1431 return __syscall_fmt__find(syscall_fmts, nmemb, name); 1432 } 1433 1434 static const struct syscall_fmt *__syscall_fmt__find_by_alias(const struct syscall_fmt *fmts, 1435 const int nmemb, const char *alias) 1436 { 1437 int i; 1438 1439 for (i = 0; i < nmemb; ++i) { 1440 if (fmts[i].alias && strcmp(fmts[i].alias, alias) == 0) 1441 return &fmts[i]; 1442 } 1443 1444 return NULL; 1445 } 1446 1447 static const struct syscall_fmt *syscall_fmt__find_by_alias(const char *alias) 1448 { 1449 const int nmemb = ARRAY_SIZE(syscall_fmts); 1450 return __syscall_fmt__find_by_alias(syscall_fmts, nmemb, alias); 1451 } 1452 1453 /** 1454 * struct syscall 1455 */ 1456 struct syscall { 1457 /** @e_machine: The ELF machine associated with the entry. */ 1458 int e_machine; 1459 /** @id: id value from the tracepoint, the system call number. */ 1460 int id; 1461 struct tep_event *tp_format; 1462 int nr_args; 1463 /** 1464 * @args_size: sum of the sizes of the syscall arguments, anything 1465 * after that is augmented stuff: pathname for openat, etc. 1466 */ 1467 1468 int args_size; 1469 struct { 1470 struct bpf_program *sys_enter, 1471 *sys_exit; 1472 } bpf_prog; 1473 /** @is_exit: is this "exit" or "exit_group"? */ 1474 bool is_exit; 1475 /** 1476 * @is_open: is this "open" or "openat"? To associate the fd returned in 1477 * sys_exit with the pathname in sys_enter. 1478 */ 1479 bool is_open; 1480 /** 1481 * @nonexistent: Name lookup failed. Just a hole in the syscall table, 1482 * syscall id not allocated. 1483 */ 1484 bool nonexistent; 1485 bool use_btf; 1486 struct tep_format_field *args; 1487 const char *name; 1488 const struct syscall_fmt *fmt; 1489 struct syscall_arg_fmt *arg_fmt; 1490 }; 1491 1492 /* 1493 * We need to have this 'calculated' boolean because in some cases we really 1494 * don't know what is the duration of a syscall, for instance, when we start 1495 * a session and some threads are waiting for a syscall to finish, say 'poll', 1496 * in which case all we can do is to print "( ? ) for duration and for the 1497 * start timestamp. 1498 */ 1499 static size_t fprintf_duration(unsigned long t, bool calculated, FILE *fp) 1500 { 1501 double duration = (double)t / NSEC_PER_MSEC; 1502 size_t printed = fprintf(fp, "("); 1503 1504 if (!calculated) 1505 printed += fprintf(fp, " "); 1506 else if (duration >= 1.0) 1507 printed += color_fprintf(fp, PERF_COLOR_RED, "%6.3f ms", duration); 1508 else if (duration >= 0.01) 1509 printed += color_fprintf(fp, PERF_COLOR_YELLOW, "%6.3f ms", duration); 1510 else 1511 printed += color_fprintf(fp, PERF_COLOR_NORMAL, "%6.3f ms", duration); 1512 return printed + fprintf(fp, "): "); 1513 } 1514 1515 /** 1516 * filename.ptr: The filename char pointer that will be vfs_getname'd 1517 * filename.entry_str_pos: Where to insert the string translated from 1518 * filename.ptr by the vfs_getname tracepoint/kprobe. 1519 * ret_scnprintf: syscall args may set this to a different syscall return 1520 * formatter, for instance, fcntl may return fds, file flags, etc. 1521 */ 1522 struct thread_trace { 1523 u64 entry_time; 1524 u32 entry_cpu; 1525 bool entry_pending; 1526 unsigned long nr_events; 1527 unsigned long pfmaj, pfmin; 1528 char *entry_str; 1529 double runtime_ms; 1530 size_t (*ret_scnprintf)(char *bf, size_t size, struct syscall_arg *arg); 1531 struct { 1532 unsigned long ptr; 1533 short int entry_str_pos; 1534 bool pending_open; 1535 unsigned int namelen; 1536 char *name; 1537 } filename; 1538 struct { 1539 int max; 1540 struct file *table; 1541 } files; 1542 1543 struct hashmap *syscall_stats; 1544 }; 1545 1546 static size_t syscall_id_hash(long key, void *ctx __maybe_unused) 1547 { 1548 return key; 1549 } 1550 1551 static bool syscall_id_equal(long key1, long key2, void *ctx __maybe_unused) 1552 { 1553 return key1 == key2; 1554 } 1555 1556 static struct hashmap *alloc_syscall_stats(void) 1557 { 1558 struct hashmap *result = hashmap__new(syscall_id_hash, syscall_id_equal, NULL); 1559 1560 return IS_ERR(result) ? NULL : result; 1561 } 1562 1563 static void delete_syscall_stats(struct hashmap *syscall_stats) 1564 { 1565 struct hashmap_entry *pos; 1566 size_t bkt; 1567 1568 if (!syscall_stats) 1569 return; 1570 1571 hashmap__for_each_entry(syscall_stats, pos, bkt) 1572 zfree(&pos->pvalue); 1573 hashmap__free(syscall_stats); 1574 } 1575 1576 static struct thread_trace *thread_trace__new(struct trace *trace) 1577 { 1578 struct thread_trace *ttrace = zalloc(sizeof(struct thread_trace)); 1579 1580 if (ttrace) { 1581 ttrace->files.max = -1; 1582 if (trace->summary) { 1583 ttrace->syscall_stats = alloc_syscall_stats(); 1584 if (!ttrace->syscall_stats) 1585 zfree(&ttrace); 1586 } 1587 } 1588 1589 return ttrace; 1590 } 1591 1592 static void thread_trace__free_files(struct thread_trace *ttrace); 1593 1594 static void thread_trace__delete(void *pttrace) 1595 { 1596 struct thread_trace *ttrace = pttrace; 1597 1598 if (!ttrace) 1599 return; 1600 1601 delete_syscall_stats(ttrace->syscall_stats); 1602 ttrace->syscall_stats = NULL; 1603 thread_trace__free_files(ttrace); 1604 zfree(&ttrace->entry_str); 1605 free(ttrace); 1606 } 1607 1608 static struct thread_trace *thread__trace(struct thread *thread, struct trace *trace) 1609 { 1610 struct thread_trace *ttrace; 1611 1612 if (thread == NULL) 1613 goto fail; 1614 1615 if (thread__priv(thread) == NULL) 1616 thread__set_priv(thread, thread_trace__new(trace)); 1617 1618 if (thread__priv(thread) == NULL) 1619 goto fail; 1620 1621 ttrace = thread__priv(thread); 1622 ++ttrace->nr_events; 1623 1624 return ttrace; 1625 fail: 1626 color_fprintf(trace->output, PERF_COLOR_RED, 1627 "WARNING: not enough memory, dropping samples!\n"); 1628 return NULL; 1629 } 1630 1631 1632 void syscall_arg__set_ret_scnprintf(struct syscall_arg *arg, 1633 size_t (*ret_scnprintf)(char *bf, size_t size, struct syscall_arg *arg)) 1634 { 1635 struct thread_trace *ttrace = thread__priv(arg->thread); 1636 1637 ttrace->ret_scnprintf = ret_scnprintf; 1638 } 1639 1640 #define TRACE_PFMAJ (1 << 0) 1641 #define TRACE_PFMIN (1 << 1) 1642 1643 static const size_t trace__entry_str_size = 2048; 1644 1645 static void thread_trace__free_files(struct thread_trace *ttrace) 1646 { 1647 for (int i = 0; i <= ttrace->files.max; ++i) { 1648 struct file *file = ttrace->files.table + i; 1649 zfree(&file->pathname); 1650 } 1651 1652 zfree(&ttrace->files.table); 1653 ttrace->files.max = -1; 1654 } 1655 1656 static struct file *thread_trace__files_entry(struct thread_trace *ttrace, int fd) 1657 { 1658 if (fd < 0) 1659 return NULL; 1660 1661 if (fd > ttrace->files.max) { 1662 struct file *nfiles = realloc(ttrace->files.table, (fd + 1) * sizeof(struct file)); 1663 1664 if (nfiles == NULL) 1665 return NULL; 1666 1667 if (ttrace->files.max != -1) { 1668 memset(nfiles + ttrace->files.max + 1, 0, 1669 (fd - ttrace->files.max) * sizeof(struct file)); 1670 } else { 1671 memset(nfiles, 0, (fd + 1) * sizeof(struct file)); 1672 } 1673 1674 ttrace->files.table = nfiles; 1675 ttrace->files.max = fd; 1676 } 1677 1678 return ttrace->files.table + fd; 1679 } 1680 1681 struct file *thread__files_entry(struct thread *thread, int fd) 1682 { 1683 return thread_trace__files_entry(thread__priv(thread), fd); 1684 } 1685 1686 static int trace__set_fd_pathname(struct thread *thread, int fd, const char *pathname) 1687 { 1688 struct thread_trace *ttrace = thread__priv(thread); 1689 struct file *file = thread_trace__files_entry(ttrace, fd); 1690 1691 if (file != NULL) { 1692 struct stat st; 1693 1694 if (stat(pathname, &st) == 0) 1695 file->dev_maj = major(st.st_rdev); 1696 file->pathname = strdup(pathname); 1697 if (file->pathname) 1698 return 0; 1699 } 1700 1701 return -1; 1702 } 1703 1704 static int thread__read_fd_path(struct thread *thread, int fd) 1705 { 1706 char linkname[PATH_MAX], pathname[PATH_MAX]; 1707 struct stat st; 1708 int ret; 1709 1710 if (thread__pid(thread) == thread__tid(thread)) { 1711 scnprintf(linkname, sizeof(linkname), 1712 "/proc/%d/fd/%d", thread__pid(thread), fd); 1713 } else { 1714 scnprintf(linkname, sizeof(linkname), 1715 "/proc/%d/task/%d/fd/%d", 1716 thread__pid(thread), thread__tid(thread), fd); 1717 } 1718 1719 if (lstat(linkname, &st) < 0 || st.st_size + 1 > (off_t)sizeof(pathname)) 1720 return -1; 1721 1722 ret = readlink(linkname, pathname, sizeof(pathname)); 1723 1724 if (ret < 0 || ret > st.st_size) 1725 return -1; 1726 1727 pathname[ret] = '\0'; 1728 return trace__set_fd_pathname(thread, fd, pathname); 1729 } 1730 1731 static const char *thread__fd_path(struct thread *thread, int fd, 1732 struct trace *trace) 1733 { 1734 struct thread_trace *ttrace = thread__priv(thread); 1735 1736 if (ttrace == NULL || trace->fd_path_disabled) 1737 return NULL; 1738 1739 if (fd < 0) 1740 return NULL; 1741 1742 if ((fd > ttrace->files.max || ttrace->files.table[fd].pathname == NULL)) { 1743 if (!trace->live) 1744 return NULL; 1745 ++trace->stats.proc_getname; 1746 if (thread__read_fd_path(thread, fd)) 1747 return NULL; 1748 } 1749 1750 return ttrace->files.table[fd].pathname; 1751 } 1752 1753 size_t syscall_arg__scnprintf_fd(char *bf, size_t size, struct syscall_arg *arg) 1754 { 1755 int fd = arg->val; 1756 size_t printed = scnprintf(bf, size, "%d", fd); 1757 const char *path = thread__fd_path(arg->thread, fd, arg->trace); 1758 1759 if (path) 1760 printed += scnprintf(bf + printed, size - printed, "<%s>", path); 1761 1762 return printed; 1763 } 1764 1765 size_t pid__scnprintf_fd(struct trace *trace, pid_t pid, int fd, char *bf, size_t size) 1766 { 1767 size_t printed = scnprintf(bf, size, "%d", fd); 1768 struct thread *thread = machine__find_thread(trace->host, pid, pid); 1769 1770 if (thread) { 1771 const char *path = thread__fd_path(thread, fd, trace); 1772 1773 if (path) 1774 printed += scnprintf(bf + printed, size - printed, "<%s>", path); 1775 1776 thread__put(thread); 1777 } 1778 1779 return printed; 1780 } 1781 1782 static size_t syscall_arg__scnprintf_close_fd(char *bf, size_t size, 1783 struct syscall_arg *arg) 1784 { 1785 int fd = arg->val; 1786 size_t printed = syscall_arg__scnprintf_fd(bf, size, arg); 1787 struct thread_trace *ttrace = thread__priv(arg->thread); 1788 1789 if (ttrace && fd >= 0 && fd <= ttrace->files.max) 1790 zfree(&ttrace->files.table[fd].pathname); 1791 1792 return printed; 1793 } 1794 1795 static void thread__set_filename_pos(struct thread *thread, const char *bf, 1796 unsigned long ptr) 1797 { 1798 struct thread_trace *ttrace = thread__priv(thread); 1799 1800 ttrace->filename.ptr = ptr; 1801 ttrace->filename.entry_str_pos = bf - ttrace->entry_str; 1802 } 1803 1804 static size_t syscall_arg__scnprintf_augmented_string(struct syscall_arg *arg, char *bf, size_t size) 1805 { 1806 struct augmented_arg *augmented_arg = arg->augmented.args; 1807 size_t printed = scnprintf(bf, size, "\"%.*s\"", augmented_arg->size, augmented_arg->value); 1808 /* 1809 * So that the next arg with a payload can consume its augmented arg, i.e. for rename* syscalls 1810 * we would have two strings, each prefixed by its size. 1811 */ 1812 int consumed = sizeof(*augmented_arg) + augmented_arg->size; 1813 1814 arg->augmented.args = ((void *)arg->augmented.args) + consumed; 1815 arg->augmented.size -= consumed; 1816 1817 return printed; 1818 } 1819 1820 static size_t syscall_arg__scnprintf_filename(char *bf, size_t size, 1821 struct syscall_arg *arg) 1822 { 1823 unsigned long ptr = arg->val; 1824 1825 if (arg->augmented.args) 1826 return syscall_arg__scnprintf_augmented_string(arg, bf, size); 1827 1828 if (!arg->trace->vfs_getname) 1829 return scnprintf(bf, size, "%#x", ptr); 1830 1831 thread__set_filename_pos(arg->thread, bf, ptr); 1832 return 0; 1833 } 1834 1835 #define MAX_CONTROL_CHAR 31 1836 #define MAX_ASCII 127 1837 1838 static size_t syscall_arg__scnprintf_buf(char *bf, size_t size, struct syscall_arg *arg) 1839 { 1840 struct augmented_arg *augmented_arg = arg->augmented.args; 1841 unsigned char *orig = (unsigned char *)augmented_arg->value; 1842 size_t printed = 0; 1843 int consumed; 1844 1845 if (augmented_arg == NULL) 1846 return 0; 1847 1848 for (int j = 0; j < augmented_arg->size; ++j) { 1849 bool control_char = orig[j] <= MAX_CONTROL_CHAR || orig[j] >= MAX_ASCII; 1850 /* print control characters (0~31 and 127), and non-ascii characters in \(digits) */ 1851 printed += scnprintf(bf + printed, size - printed, control_char ? "\\%d" : "%c", (int)orig[j]); 1852 } 1853 1854 consumed = sizeof(*augmented_arg) + augmented_arg->size; 1855 arg->augmented.args = ((void *)arg->augmented.args) + consumed; 1856 arg->augmented.size -= consumed; 1857 1858 return printed; 1859 } 1860 1861 static bool trace__filter_duration(struct trace *trace, double t) 1862 { 1863 return t < (trace->duration_filter * NSEC_PER_MSEC); 1864 } 1865 1866 static size_t __trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp) 1867 { 1868 double ts = (double)(tstamp - trace->base_time) / NSEC_PER_MSEC; 1869 1870 return fprintf(fp, "%10.3f ", ts); 1871 } 1872 1873 /* 1874 * We're handling tstamp=0 as an undefined tstamp, i.e. like when we are 1875 * using ttrace->entry_time for a thread that receives a sys_exit without 1876 * first having received a sys_enter ("poll" issued before tracing session 1877 * starts, lost sys_enter exit due to ring buffer overflow). 1878 */ 1879 static size_t trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp) 1880 { 1881 if (tstamp > 0) 1882 return __trace__fprintf_tstamp(trace, tstamp, fp); 1883 1884 return fprintf(fp, " ? "); 1885 } 1886 1887 /** 1888 * trace__fprintf_cpu - Print the CPU ID to a given file stream 1889 * @cpu: The CPU ID to print 1890 * @fp: The file stream to write to 1891 * 1892 * Formats and prints the specified CPU ID enclosed in brackets 1893 * (e.g., "[003] ") to the provided file pointer. It is used to 1894 * align and display the CPU ID consistently within the trace output. 1895 * 1896 * Return: The number of characters printed. 1897 */ 1898 static size_t trace__fprintf_cpu(u32 cpu, FILE *fp) 1899 { 1900 size_t printed = 0; 1901 1902 if (cpu != (u32)-1) 1903 printed += fprintf(fp, "[%03u] ", cpu); 1904 1905 return printed; 1906 } 1907 1908 static pid_t workload_pid = -1; 1909 static volatile sig_atomic_t done = false; 1910 static volatile sig_atomic_t interrupted = false; 1911 1912 static void sighandler_interrupt(int sig __maybe_unused) 1913 { 1914 done = interrupted = true; 1915 } 1916 1917 static void sighandler_chld(int sig __maybe_unused, siginfo_t *info, 1918 void *context __maybe_unused) 1919 { 1920 if (info->si_pid == workload_pid) 1921 done = true; 1922 } 1923 1924 static size_t trace__fprintf_comm_tid(struct trace *trace, struct thread *thread, FILE *fp) 1925 { 1926 size_t printed = 0; 1927 1928 if (trace->multiple_threads) { 1929 if (trace->show_comm) 1930 printed += fprintf(fp, "%.14s/", thread__comm_str(thread)); 1931 printed += fprintf(fp, "%d ", thread__tid(thread)); 1932 } 1933 1934 return printed; 1935 } 1936 1937 static size_t trace__fprintf_entry_head(struct trace *trace, struct thread *thread, 1938 u64 duration, bool duration_calculated, 1939 u64 tstamp, u32 cpu, FILE *fp) 1940 { 1941 size_t printed = 0; 1942 1943 if (trace->show_tstamp) 1944 printed = trace__fprintf_tstamp(trace, tstamp, fp); 1945 if (trace->show_cpu && cpu != (u32)-1) 1946 printed += trace__fprintf_cpu(cpu, fp); 1947 if (trace->show_duration) 1948 printed += fprintf_duration(duration, duration_calculated, fp); 1949 return printed + trace__fprintf_comm_tid(trace, thread, fp); 1950 } 1951 1952 static int trace__process_event(struct trace *trace, struct machine *machine, 1953 union perf_event *event, struct perf_sample *sample) 1954 { 1955 int ret = 0; 1956 1957 switch (event->header.type) { 1958 case PERF_RECORD_LOST: 1959 color_fprintf(trace->output, PERF_COLOR_RED, 1960 "LOST %" PRIu64 " events!\n", (u64)event->lost.lost); 1961 ret = machine__process_lost_event(machine, event, sample); 1962 break; 1963 default: 1964 ret = machine__process_event(machine, event, sample); 1965 break; 1966 } 1967 1968 return ret; 1969 } 1970 1971 static int trace__tool_process(const struct perf_tool *tool, 1972 union perf_event *event, 1973 struct perf_sample *sample, 1974 struct machine *machine) 1975 { 1976 struct trace *trace = container_of(tool, struct trace, tool); 1977 return trace__process_event(trace, machine, event, sample); 1978 } 1979 1980 static char *trace__machine__resolve_kernel_addr(void *vmachine, unsigned long long *addrp, char **modp) 1981 { 1982 struct machine *machine = vmachine; 1983 1984 if (machine->kptr_restrict_warned) 1985 return NULL; 1986 1987 if (symbol_conf.kptr_restrict) { 1988 pr_warning("Kernel address maps (/proc/{kallsyms,modules}) are restricted.\n\n" 1989 "Check /proc/sys/kernel/kptr_restrict and /proc/sys/kernel/perf_event_paranoid.\n\n" 1990 "Kernel samples will not be resolved.\n"); 1991 machine->kptr_restrict_warned = true; 1992 return NULL; 1993 } 1994 1995 return machine__resolve_kernel_addr(vmachine, addrp, modp); 1996 } 1997 1998 static int trace__symbols_init(struct trace *trace, int argc, const char **argv, 1999 struct evlist *evlist) 2000 { 2001 int err = symbol__init(NULL); 2002 2003 if (err) 2004 return err; 2005 2006 perf_env__init(&trace->host_env); 2007 err = perf_env__set_cmdline(&trace->host_env, argc, argv); 2008 if (err) 2009 goto out; 2010 2011 trace->host = machine__new_host(&trace->host_env); 2012 if (trace->host == NULL) { 2013 err = -ENOMEM; 2014 goto out; 2015 } 2016 thread__set_priv_destructor(thread_trace__delete); 2017 2018 err = trace_event__register_resolver(trace->host, trace__machine__resolve_kernel_addr); 2019 if (err < 0) 2020 goto out; 2021 2022 if (trace->summary_only && trace->summary_mode != SUMMARY__BY_THREAD) 2023 goto out; 2024 2025 err = __machine__synthesize_threads(trace->host, &trace->tool, &trace->opts.target, 2026 evlist->core.threads, trace__tool_process, 2027 /*needs_mmap=*/callchain_param.enabled && 2028 !trace->summary_only, 2029 /*mmap_data=*/false, 2030 /*nr_threads_synthesize=*/1); 2031 out: 2032 if (err) { 2033 perf_env__exit(&trace->host_env); 2034 symbol__exit(); 2035 } 2036 return err; 2037 } 2038 2039 static void trace__symbols__exit(struct trace *trace) 2040 { 2041 machine__exit(trace->host); 2042 trace->host = NULL; 2043 2044 perf_env__exit(&trace->host_env); 2045 symbol__exit(); 2046 } 2047 2048 static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args) 2049 { 2050 int idx; 2051 2052 if (nr_args == RAW_SYSCALL_ARGS_NUM && sc->fmt && sc->fmt->nr_args != 0) 2053 nr_args = sc->fmt->nr_args; 2054 2055 sc->arg_fmt = calloc(nr_args, sizeof(*sc->arg_fmt)); 2056 if (sc->arg_fmt == NULL) 2057 return -1; 2058 2059 for (idx = 0; idx < nr_args; ++idx) { 2060 if (sc->fmt) 2061 sc->arg_fmt[idx] = sc->fmt->arg[idx]; 2062 } 2063 2064 sc->nr_args = nr_args; 2065 return 0; 2066 } 2067 2068 static const struct syscall_arg_fmt syscall_arg_fmts__by_name[] = { 2069 { .name = "msr", .scnprintf = SCA_X86_MSR, .strtoul = STUL_X86_MSR, }, 2070 { .name = "vector", .scnprintf = SCA_X86_IRQ_VECTORS, .strtoul = STUL_X86_IRQ_VECTORS, }, 2071 }; 2072 2073 static int syscall_arg_fmt__cmp(const void *name, const void *fmtp) 2074 { 2075 const struct syscall_arg_fmt *fmt = fmtp; 2076 return strcmp(name, fmt->name); 2077 } 2078 2079 static const struct syscall_arg_fmt * 2080 __syscall_arg_fmt__find_by_name(const struct syscall_arg_fmt *fmts, const int nmemb, 2081 const char *name) 2082 { 2083 return bsearch(name, fmts, nmemb, sizeof(struct syscall_arg_fmt), syscall_arg_fmt__cmp); 2084 } 2085 2086 static const struct syscall_arg_fmt *syscall_arg_fmt__find_by_name(const char *name) 2087 { 2088 const int nmemb = ARRAY_SIZE(syscall_arg_fmts__by_name); 2089 return __syscall_arg_fmt__find_by_name(syscall_arg_fmts__by_name, nmemb, name); 2090 } 2091 2092 /* 2093 * v6.19 kernel added new fields to read userspace memory for event tracing. 2094 * But it's not used by perf and confuses the syscall parameters. 2095 */ 2096 static bool is_internal_field(struct tep_format_field *field) 2097 { 2098 return !strcmp(field->type, "__data_loc char[]"); 2099 } 2100 2101 static struct tep_format_field * 2102 syscall_arg_fmt__init_array(struct syscall_arg_fmt *arg, struct tep_format_field *field, 2103 bool *use_btf) 2104 { 2105 struct tep_format_field *last_field = NULL; 2106 int len; 2107 2108 for (; field; field = field->next, ++arg) { 2109 /* assume it's the last argument */ 2110 if (is_internal_field(field)) 2111 continue; 2112 2113 last_field = field; 2114 2115 if (arg->scnprintf) 2116 continue; 2117 2118 len = strlen(field->name); 2119 2120 // As far as heuristics (or intention) goes this seems to hold true, and makes sense! 2121 if ((field->flags & TEP_FIELD_IS_POINTER) && strstarts(field->type, "const ")) 2122 arg->from_user = true; 2123 2124 if (strcmp(field->type, "const char *") == 0 && 2125 ((len >= 4 && strcmp(field->name + len - 4, "name") == 0) || 2126 strstr(field->name, "path") != NULL)) { 2127 arg->scnprintf = SCA_FILENAME; 2128 } else if ((field->flags & TEP_FIELD_IS_POINTER) || strstr(field->name, "addr")) 2129 arg->scnprintf = SCA_PTR; 2130 else if (strcmp(field->type, "pid_t") == 0) 2131 arg->scnprintf = SCA_PID; 2132 else if (strcmp(field->type, "umode_t") == 0) 2133 arg->scnprintf = SCA_MODE_T; 2134 else if ((field->flags & TEP_FIELD_IS_ARRAY) && strstr(field->type, "char")) { 2135 arg->scnprintf = SCA_CHAR_ARRAY; 2136 arg->nr_entries = field->arraylen; 2137 } else if ((strcmp(field->type, "int") == 0 || 2138 strcmp(field->type, "unsigned int") == 0 || 2139 strcmp(field->type, "long") == 0) && 2140 len >= 2 && strcmp(field->name + len - 2, "fd") == 0) { 2141 /* 2142 * /sys/kernel/tracing/events/syscalls/sys_enter* 2143 * grep -E 'field:.*fd;' .../format|sed -r 's/.*field:([a-z ]+) [a-z_]*fd.+/\1/g'|sort|uniq -c 2144 * 65 int 2145 * 23 unsigned int 2146 * 7 unsigned long 2147 */ 2148 arg->scnprintf = SCA_FD; 2149 } else if (strstr(field->type, "enum") && use_btf != NULL) { 2150 *use_btf = true; 2151 arg->strtoul = STUL_BTF_TYPE; 2152 } else { 2153 const struct syscall_arg_fmt *fmt = 2154 syscall_arg_fmt__find_by_name(field->name); 2155 2156 if (fmt) { 2157 arg->scnprintf = fmt->scnprintf; 2158 arg->strtoul = fmt->strtoul; 2159 } 2160 } 2161 } 2162 2163 return last_field; 2164 } 2165 2166 static int syscall__set_arg_fmts(struct syscall *sc) 2167 { 2168 struct tep_format_field *last_field = syscall_arg_fmt__init_array(sc->arg_fmt, sc->args, 2169 &sc->use_btf); 2170 2171 if (last_field) 2172 sc->args_size = last_field->offset + last_field->size; 2173 2174 return 0; 2175 } 2176 2177 static int syscall__read_info(struct syscall *sc, struct trace *trace) 2178 { 2179 char tp_name[128]; 2180 const char *name; 2181 struct tep_format_field *field; 2182 int err; 2183 2184 if (sc->nonexistent) 2185 return -EEXIST; 2186 2187 if (sc->name) { 2188 /* Info already read. */ 2189 return 0; 2190 } 2191 2192 name = syscalltbl__name(sc->e_machine, sc->id); 2193 if (name == NULL) { 2194 sc->nonexistent = true; 2195 return -EEXIST; 2196 } 2197 2198 sc->name = name; 2199 sc->fmt = syscall_fmt__find(sc->name); 2200 2201 snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->name); 2202 sc->tp_format = trace_event__tp_format("syscalls", tp_name); 2203 2204 if (IS_ERR(sc->tp_format) && sc->fmt && sc->fmt->alias) { 2205 snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->fmt->alias); 2206 sc->tp_format = trace_event__tp_format("syscalls", tp_name); 2207 } 2208 2209 /* 2210 * Fails to read trace point format via sysfs node, so the trace point 2211 * doesn't exist. Set the 'nonexistent' flag as true. 2212 */ 2213 if (IS_ERR(sc->tp_format)) { 2214 sc->nonexistent = true; 2215 err = PTR_ERR(sc->tp_format); 2216 sc->tp_format = NULL; 2217 return err; 2218 } 2219 2220 /* 2221 * The tracepoint format contains __syscall_nr field, so it's one more 2222 * than the actual number of syscall arguments. 2223 */ 2224 if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1)) 2225 return -ENOMEM; 2226 2227 sc->args = sc->tp_format->format.fields; 2228 /* 2229 * We need to check and discard the first variable '__syscall_nr' 2230 * or 'nr' that mean the syscall number. It is needless here. 2231 * So drop '__syscall_nr' or 'nr' field but does not exist on older kernels. 2232 */ 2233 if (sc->args && (!strcmp(sc->args->name, "__syscall_nr") || !strcmp(sc->args->name, "nr"))) { 2234 sc->args = sc->args->next; 2235 --sc->nr_args; 2236 } 2237 2238 field = sc->args; 2239 while (field) { 2240 if (is_internal_field(field)) 2241 --sc->nr_args; 2242 field = field->next; 2243 } 2244 2245 sc->is_exit = !strcmp(name, "exit_group") || !strcmp(name, "exit"); 2246 sc->is_open = !strcmp(name, "open") || !strcmp(name, "openat"); 2247 2248 err = syscall__set_arg_fmts(sc); 2249 2250 /* after calling syscall__set_arg_fmts() we'll know whether use_btf is true */ 2251 if (sc->use_btf) 2252 trace__load_vmlinux_btf(trace); 2253 2254 return err; 2255 } 2256 2257 static int evsel__init_tp_arg_scnprintf(struct evsel *evsel, bool *use_btf) 2258 { 2259 struct syscall_arg_fmt *fmt = evsel__syscall_arg_fmt(evsel); 2260 2261 if (fmt != NULL) { 2262 const struct tep_event *tp_format = evsel__tp_format(evsel); 2263 2264 if (tp_format) { 2265 syscall_arg_fmt__init_array(fmt, tp_format->format.fields, use_btf); 2266 return 0; 2267 } 2268 } 2269 2270 return -ENOMEM; 2271 } 2272 2273 static int intcmp(const void *a, const void *b) 2274 { 2275 const int *one = a, *another = b; 2276 2277 return *one - *another; 2278 } 2279 2280 static int trace__validate_ev_qualifier(struct trace *trace) 2281 { 2282 int err = 0; 2283 bool printed_invalid_prefix = false; 2284 struct str_node *pos; 2285 size_t nr_used = 0, nr_allocated = strlist__nr_entries(trace->ev_qualifier); 2286 2287 trace->ev_qualifier_ids.entries = calloc(nr_allocated, sizeof(trace->ev_qualifier_ids.entries[0])); 2288 if (trace->ev_qualifier_ids.entries == NULL) { 2289 fputs("Error:\tNot enough memory for allocating events qualifier ids\n", 2290 trace->output); 2291 err = -EINVAL; 2292 goto out; 2293 } 2294 2295 strlist__for_each_entry(pos, trace->ev_qualifier) { 2296 const char *sc = pos->s; 2297 /* 2298 * TODO: Assume more than the validation/warnings are all for 2299 * the same binary type as perf. 2300 */ 2301 int id = syscalltbl__id(EM_HOST, sc), match_next = -1; 2302 2303 if (id < 0) { 2304 id = syscalltbl__strglobmatch_first(EM_HOST, sc, &match_next); 2305 if (id >= 0) 2306 goto matches; 2307 2308 if (!printed_invalid_prefix) { 2309 pr_debug("Skipping unknown syscalls: "); 2310 printed_invalid_prefix = true; 2311 } else { 2312 pr_debug(", "); 2313 } 2314 2315 pr_debug("%s", sc); 2316 continue; 2317 } 2318 matches: 2319 trace->ev_qualifier_ids.entries[nr_used++] = id; 2320 if (match_next == -1) 2321 continue; 2322 2323 while (1) { 2324 id = syscalltbl__strglobmatch_next(EM_HOST, sc, &match_next); 2325 if (id < 0) 2326 break; 2327 if (nr_allocated == nr_used) { 2328 void *entries; 2329 2330 nr_allocated += 8; 2331 entries = realloc(trace->ev_qualifier_ids.entries, 2332 nr_allocated * sizeof(trace->ev_qualifier_ids.entries[0])); 2333 if (entries == NULL) { 2334 err = -ENOMEM; 2335 fputs("\nError:\t Not enough memory for parsing\n", trace->output); 2336 goto out_free; 2337 } 2338 trace->ev_qualifier_ids.entries = entries; 2339 } 2340 trace->ev_qualifier_ids.entries[nr_used++] = id; 2341 } 2342 } 2343 2344 trace->ev_qualifier_ids.nr = nr_used; 2345 qsort(trace->ev_qualifier_ids.entries, nr_used, sizeof(int), intcmp); 2346 out: 2347 if (printed_invalid_prefix) 2348 pr_debug("\n"); 2349 return err; 2350 out_free: 2351 zfree(&trace->ev_qualifier_ids.entries); 2352 trace->ev_qualifier_ids.nr = 0; 2353 goto out; 2354 } 2355 2356 static __maybe_unused bool trace__syscall_enabled(struct trace *trace, int id) 2357 { 2358 bool in_ev_qualifier; 2359 2360 if (trace->ev_qualifier_ids.nr == 0) 2361 return true; 2362 2363 in_ev_qualifier = bsearch(&id, trace->ev_qualifier_ids.entries, 2364 trace->ev_qualifier_ids.nr, sizeof(int), intcmp) != NULL; 2365 2366 if (in_ev_qualifier) 2367 return !trace->not_ev_qualifier; 2368 2369 return trace->not_ev_qualifier; 2370 } 2371 2372 /* 2373 * args is to be interpreted as a series of longs but we need to handle 2374 * 8-byte unaligned accesses. args points to raw_data within the event 2375 * and raw_data is guaranteed to be 8-byte unaligned because it is 2376 * preceded by raw_size which is a u32. So we need to copy args to a temp 2377 * variable to read it. Most notably this avoids extended load instructions 2378 * on unaligned addresses 2379 */ 2380 unsigned long syscall_arg__val(struct syscall_arg *arg, u8 idx) 2381 { 2382 unsigned long val; 2383 unsigned char *p = arg->args + sizeof(unsigned long) * idx; 2384 2385 memcpy(&val, p, sizeof(val)); 2386 return val; 2387 } 2388 2389 static size_t syscall__scnprintf_name(struct syscall *sc, char *bf, size_t size, 2390 struct syscall_arg *arg) 2391 { 2392 if (sc->arg_fmt && sc->arg_fmt[arg->idx].name) 2393 return scnprintf(bf, size, "%s: ", sc->arg_fmt[arg->idx].name); 2394 2395 return scnprintf(bf, size, "arg%d: ", arg->idx); 2396 } 2397 2398 /* 2399 * Check if the value is in fact zero, i.e. mask whatever needs masking, such 2400 * as mount 'flags' argument that needs ignoring some magic flag, see comment 2401 * in tools/perf/trace/beauty/mount_flags.c 2402 */ 2403 static unsigned long syscall_arg_fmt__mask_val(struct syscall_arg_fmt *fmt, struct syscall_arg *arg, unsigned long val) 2404 { 2405 if (fmt && fmt->mask_val) 2406 return fmt->mask_val(arg, val); 2407 2408 return val; 2409 } 2410 2411 static size_t syscall_arg_fmt__scnprintf_val(struct syscall_arg_fmt *fmt, char *bf, size_t size, 2412 struct syscall_arg *arg, unsigned long val) 2413 { 2414 if (fmt && fmt->scnprintf) { 2415 arg->val = val; 2416 if (fmt->parm) 2417 arg->parm = fmt->parm; 2418 return fmt->scnprintf(bf, size, arg); 2419 } 2420 return scnprintf(bf, size, "%ld", val); 2421 } 2422 2423 static size_t syscall__scnprintf_args(struct syscall *sc, char *bf, size_t size, 2424 unsigned char *args, void *augmented_args, int augmented_args_size, 2425 struct trace *trace, struct thread *thread) 2426 { 2427 size_t printed = 0, btf_printed; 2428 unsigned long val; 2429 u8 bit = 1; 2430 struct syscall_arg arg = { 2431 .args = args, 2432 .augmented = { 2433 .size = augmented_args_size, 2434 .args = augmented_args, 2435 }, 2436 .idx = 0, 2437 .mask = 0, 2438 .trace = trace, 2439 .thread = thread, 2440 .show_string_prefix = trace->show_string_prefix, 2441 }; 2442 struct thread_trace *ttrace = thread__priv(thread); 2443 void *default_scnprintf; 2444 2445 /* 2446 * Things like fcntl will set this in its 'cmd' formatter to pick the 2447 * right formatter for the return value (an fd? file flags?), which is 2448 * not needed for syscalls that always return a given type, say an fd. 2449 */ 2450 ttrace->ret_scnprintf = NULL; 2451 2452 if (sc->args != NULL) { 2453 struct tep_format_field *field; 2454 2455 for (field = sc->args; field; 2456 field = field->next, ++arg.idx, bit <<= 1) { 2457 if (arg.mask & bit) 2458 continue; 2459 2460 arg.fmt = &sc->arg_fmt[arg.idx]; 2461 val = syscall_arg__val(&arg, arg.idx); 2462 /* 2463 * Some syscall args need some mask, most don't and 2464 * return val untouched. 2465 */ 2466 val = syscall_arg_fmt__mask_val(&sc->arg_fmt[arg.idx], &arg, val); 2467 2468 /* 2469 * Suppress this argument if its value is zero and show_zero 2470 * property isn't set. 2471 * 2472 * If it has a BTF type, then override the zero suppression knob 2473 * as the common case is for zero in an enum to have an associated entry. 2474 */ 2475 if (val == 0 && !trace->show_zeros && 2476 !(sc->arg_fmt && sc->arg_fmt[arg.idx].show_zero) && 2477 !(sc->arg_fmt && sc->arg_fmt[arg.idx].strtoul == STUL_BTF_TYPE)) 2478 continue; 2479 2480 printed += scnprintf(bf + printed, size - printed, "%s", printed ? ", " : ""); 2481 2482 if (trace->show_arg_names) 2483 printed += scnprintf(bf + printed, size - printed, "%s: ", field->name); 2484 2485 default_scnprintf = sc->arg_fmt[arg.idx].scnprintf; 2486 2487 if (trace->force_btf || default_scnprintf == NULL || default_scnprintf == SCA_PTR) { 2488 btf_printed = trace__btf_scnprintf(trace, &arg, bf + printed, 2489 size - printed, val, field->type); 2490 if (btf_printed) { 2491 printed += btf_printed; 2492 continue; 2493 } 2494 } 2495 2496 printed += syscall_arg_fmt__scnprintf_val(&sc->arg_fmt[arg.idx], 2497 bf + printed, size - printed, &arg, val); 2498 } 2499 } else if (IS_ERR(sc->tp_format)) { 2500 /* 2501 * If we managed to read the tracepoint /format file, then we 2502 * may end up not having any args, like with gettid(), so only 2503 * print the raw args when we didn't manage to read it. 2504 */ 2505 while (arg.idx < sc->nr_args) { 2506 if (arg.mask & bit) 2507 goto next_arg; 2508 val = syscall_arg__val(&arg, arg.idx); 2509 if (printed) 2510 printed += scnprintf(bf + printed, size - printed, ", "); 2511 printed += syscall__scnprintf_name(sc, bf + printed, size - printed, &arg); 2512 printed += syscall_arg_fmt__scnprintf_val(&sc->arg_fmt[arg.idx], bf + printed, size - printed, &arg, val); 2513 next_arg: 2514 ++arg.idx; 2515 bit <<= 1; 2516 } 2517 } 2518 2519 return printed; 2520 } 2521 2522 static struct syscall *syscall__new(int e_machine, int id) 2523 { 2524 struct syscall *sc = zalloc(sizeof(*sc)); 2525 2526 if (!sc) 2527 return NULL; 2528 2529 sc->e_machine = e_machine; 2530 sc->id = id; 2531 return sc; 2532 } 2533 2534 static void syscall__delete(struct syscall *sc) 2535 { 2536 if (!sc) 2537 return; 2538 2539 free(sc->arg_fmt); 2540 free(sc); 2541 } 2542 2543 static int syscall__bsearch_cmp(const void *key, const void *entry) 2544 { 2545 const struct syscall *a = key, *b = *((const struct syscall **)entry); 2546 2547 if (a->e_machine != b->e_machine) 2548 return a->e_machine - b->e_machine; 2549 2550 return a->id - b->id; 2551 } 2552 2553 static int syscall__cmp(const void *va, const void *vb) 2554 { 2555 const struct syscall *a = *((const struct syscall **)va); 2556 const struct syscall *b = *((const struct syscall **)vb); 2557 2558 if (a->e_machine != b->e_machine) 2559 return a->e_machine - b->e_machine; 2560 2561 return a->id - b->id; 2562 } 2563 2564 static struct syscall *trace__find_syscall(struct trace *trace, int e_machine, int id) 2565 { 2566 struct syscall key = { 2567 .e_machine = e_machine, 2568 .id = id, 2569 }; 2570 struct syscall *sc, **tmp; 2571 2572 if (trace->syscalls.table) { 2573 struct syscall **sc_entry = bsearch(&key, trace->syscalls.table, 2574 trace->syscalls.table_size, 2575 sizeof(trace->syscalls.table[0]), 2576 syscall__bsearch_cmp); 2577 2578 if (sc_entry) 2579 return *sc_entry; 2580 } 2581 2582 sc = syscall__new(e_machine, id); 2583 if (!sc) 2584 return NULL; 2585 2586 tmp = reallocarray(trace->syscalls.table, trace->syscalls.table_size + 1, 2587 sizeof(trace->syscalls.table[0])); 2588 if (!tmp) { 2589 syscall__delete(sc); 2590 return NULL; 2591 } 2592 2593 trace->syscalls.table = tmp; 2594 trace->syscalls.table[trace->syscalls.table_size++] = sc; 2595 qsort(trace->syscalls.table, trace->syscalls.table_size, sizeof(trace->syscalls.table[0]), 2596 syscall__cmp); 2597 return sc; 2598 } 2599 2600 typedef int (*tracepoint_handler)(struct trace *trace, 2601 union perf_event *event, 2602 struct perf_sample *sample); 2603 2604 static struct syscall *trace__syscall_info(struct trace *trace, struct evsel *evsel, 2605 int e_machine, int id) 2606 { 2607 struct syscall *sc; 2608 int err = 0; 2609 2610 if (id < 0) { 2611 2612 /* 2613 * XXX: Noticed on x86_64, reproduced as far back as 3.0.36, haven't tried 2614 * before that, leaving at a higher verbosity level till that is 2615 * explained. Reproduced with plain ftrace with: 2616 * 2617 * echo 1 > /t/events/raw_syscalls/sys_exit/enable 2618 * grep "NR -1 " /t/trace_pipe 2619 * 2620 * After generating some load on the machine. 2621 */ 2622 if (verbose > 1) { 2623 static u64 n; 2624 fprintf(trace->output, "Invalid syscall %d id, skipping (%s, %" PRIu64 ") ...\n", 2625 id, evsel__name(evsel), ++n); 2626 } 2627 return NULL; 2628 } 2629 2630 err = -EINVAL; 2631 2632 sc = trace__find_syscall(trace, e_machine, id); 2633 if (sc) 2634 err = syscall__read_info(sc, trace); 2635 2636 if (err && verbose > 0) { 2637 errno = -err; 2638 fprintf(trace->output, "Problems reading syscall %d: %m", id); 2639 if (sc && sc->name) 2640 fprintf(trace->output, " (%s)", sc->name); 2641 fputs(" information\n", trace->output); 2642 } 2643 return err ? NULL : sc; 2644 } 2645 2646 struct syscall_stats { 2647 struct stats stats; 2648 u64 nr_failures; 2649 int max_errno; 2650 u32 *errnos; 2651 }; 2652 2653 static void thread__update_stats(struct thread *thread, struct thread_trace *ttrace, 2654 int id, struct perf_sample *sample, long err, 2655 struct trace *trace) 2656 { 2657 struct hashmap *syscall_stats = ttrace->syscall_stats; 2658 struct syscall_stats *stats = NULL; 2659 u64 duration = 0; 2660 2661 if (trace->summary_bpf) 2662 return; 2663 2664 if (trace->summary_mode == SUMMARY__BY_TOTAL) 2665 syscall_stats = trace->syscall_stats; 2666 2667 if (!hashmap__find(syscall_stats, id, &stats)) { 2668 stats = zalloc(sizeof(*stats)); 2669 if (stats == NULL) 2670 return; 2671 2672 init_stats(&stats->stats); 2673 if (hashmap__add(syscall_stats, id, stats) < 0) { 2674 free(stats); 2675 return; 2676 } 2677 } 2678 2679 if (ttrace->entry_time && sample->time > ttrace->entry_time) 2680 duration = sample->time - ttrace->entry_time; 2681 2682 update_stats(&stats->stats, duration); 2683 2684 if (err < 0) { 2685 ++stats->nr_failures; 2686 2687 if (!trace->errno_summary) 2688 return; 2689 2690 err = -err; 2691 if (err > stats->max_errno) { 2692 u32 *new_errnos = realloc(stats->errnos, err * sizeof(u32)); 2693 2694 if (new_errnos) { 2695 memset(new_errnos + stats->max_errno, 0, (err - stats->max_errno) * sizeof(u32)); 2696 } else { 2697 pr_debug("Not enough memory for errno stats for thread \"%s\"(%d/%d), results will be incomplete\n", 2698 thread__comm_str(thread), thread__pid(thread), 2699 thread__tid(thread)); 2700 return; 2701 } 2702 2703 stats->errnos = new_errnos; 2704 stats->max_errno = err; 2705 } 2706 2707 ++stats->errnos[err - 1]; 2708 } 2709 } 2710 2711 static int trace__printf_interrupted_entry(struct trace *trace) 2712 { 2713 struct thread_trace *ttrace; 2714 size_t printed; 2715 int len; 2716 2717 if (trace->failure_only || trace->current == NULL) 2718 return 0; 2719 2720 ttrace = thread__priv(trace->current); 2721 2722 if (!ttrace->entry_pending) 2723 return 0; 2724 2725 printed = trace__fprintf_entry_head(trace, trace->current, 0, false, 2726 ttrace->entry_time, ttrace->entry_cpu, 2727 trace->output); 2728 printed += len = fprintf(trace->output, "%s)", ttrace->entry_str); 2729 2730 if (len < trace->args_alignment - 4) 2731 printed += fprintf(trace->output, "%-*s", trace->args_alignment - 4 - len, " "); 2732 2733 printed += fprintf(trace->output, " ...\n"); 2734 2735 ttrace->entry_pending = false; 2736 ++trace->nr_events_printed; 2737 2738 return printed; 2739 } 2740 2741 static int trace__fprintf_sample(struct trace *trace, struct perf_sample *sample, 2742 struct thread *thread) 2743 { 2744 int printed = 0; 2745 2746 if (trace->print_sample) { 2747 double ts = (double)sample->time / NSEC_PER_MSEC; 2748 2749 printed += fprintf(trace->output, "%22s %10.3f %s %d/%d [%d]\n", 2750 evsel__name(sample->evsel), ts, 2751 thread__comm_str(thread), 2752 sample->pid, sample->tid, sample->cpu); 2753 } 2754 2755 return printed; 2756 } 2757 2758 static void *syscall__augmented_args(struct syscall *sc, struct perf_sample *sample, int *augmented_args_size, int raw_augmented_args_size) 2759 { 2760 /* 2761 * For now with BPF raw_augmented we hook into raw_syscalls:sys_enter 2762 * and there we get all 6 syscall args plus the tracepoint common fields 2763 * that gets calculated at the start and the syscall_nr (another long). 2764 * So we check if that is the case and if so don't look after the 2765 * sc->args_size but always after the full raw_syscalls:sys_enter payload, 2766 * which is fixed. 2767 * 2768 * We'll revisit this later to pass s->args_size to the BPF augmenter 2769 * (now tools/perf/examples/bpf/augmented_raw_syscalls.c, so that it 2770 * copies only what we need for each syscall, like what happens when we 2771 * use syscalls:sys_enter_NAME, so that we reduce the kernel/userspace 2772 * traffic to just what is needed for each syscall. 2773 */ 2774 int args_size = raw_augmented_args_size ?: sc->args_size; 2775 2776 *augmented_args_size = sample->raw_size - args_size; 2777 if (*augmented_args_size > 0) { 2778 static uintptr_t argbuf[1024]; /* assuming single-threaded */ 2779 2780 if ((size_t)(*augmented_args_size) > sizeof(argbuf)) 2781 return NULL; 2782 2783 /* 2784 * The perf ring-buffer is 8-byte aligned but sample->raw_data 2785 * is not because it's preceded by u32 size. Later, beautifier 2786 * will use the augmented args with stricter alignments like in 2787 * some struct. To make sure it's aligned, let's copy the args 2788 * into a static buffer as it's single-threaded for now. 2789 */ 2790 memcpy(argbuf, sample->raw_data + args_size, *augmented_args_size); 2791 2792 return argbuf; 2793 } 2794 return NULL; 2795 } 2796 2797 static int trace__sys_enter(struct trace *trace, 2798 union perf_event *event __maybe_unused, 2799 struct perf_sample *sample) 2800 { 2801 struct evsel *evsel = sample->evsel; 2802 char *msg; 2803 void *args; 2804 int printed = 0; 2805 struct thread *thread; 2806 int id = perf_evsel__sc_tp_uint(id, sample), err = -1; 2807 int augmented_args_size = 0, e_machine; 2808 void *augmented_args = NULL; 2809 struct syscall *sc; 2810 struct thread_trace *ttrace; 2811 2812 thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 2813 e_machine = thread__e_machine(thread, trace->host, /*e_flags=*/NULL); 2814 sc = trace__syscall_info(trace, evsel, e_machine, id); 2815 if (sc == NULL) 2816 goto out_put; 2817 ttrace = thread__trace(thread, trace); 2818 if (ttrace == NULL) 2819 goto out_put; 2820 2821 trace__fprintf_sample(trace, sample, thread); 2822 2823 args = perf_evsel__sc_tp_ptr(args, sample); 2824 2825 if (ttrace->entry_str == NULL) { 2826 ttrace->entry_str = malloc(trace__entry_str_size); 2827 if (!ttrace->entry_str) 2828 goto out_put; 2829 } 2830 2831 if (!(trace->duration_filter || trace->summary_only || trace->min_stack)) 2832 trace__printf_interrupted_entry(trace); 2833 /* 2834 * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible 2835 * arguments, even if the syscall being handled, say "openat", uses only 4 arguments 2836 * this breaks syscall__augmented_args() check for augmented args, as we calculate 2837 * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file, 2838 * so when handling, say the openat syscall, we end up getting 6 args for the 2839 * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly 2840 * thinking that the extra 2 u64 args are the augmented filename, so just check 2841 * here and avoid using augmented syscalls when the evsel is the raw_syscalls one. 2842 */ 2843 if (evsel != trace->syscalls.events.sys_enter) 2844 augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size); 2845 ttrace->entry_time = sample->time; 2846 ttrace->entry_cpu = sample->cpu; 2847 msg = ttrace->entry_str; 2848 printed += scnprintf(msg + printed, trace__entry_str_size - printed, "%s(", sc->name); 2849 2850 printed += syscall__scnprintf_args(sc, msg + printed, trace__entry_str_size - printed, 2851 args, augmented_args, augmented_args_size, trace, thread); 2852 2853 if (sc->is_exit) { 2854 if (!(trace->duration_filter || trace->summary_only || trace->failure_only || trace->min_stack)) { 2855 int alignment = 0; 2856 2857 trace__fprintf_entry_head(trace, thread, 0, false, 2858 ttrace->entry_time, 2859 sample->cpu, trace->output); 2860 printed = fprintf(trace->output, "%s)", ttrace->entry_str); 2861 if (trace->args_alignment > printed) 2862 alignment = trace->args_alignment - printed; 2863 fprintf(trace->output, "%*s= ?\n", alignment, " "); 2864 } 2865 } else { 2866 ttrace->entry_pending = true; 2867 /* See trace__vfs_getname & trace__sys_exit */ 2868 ttrace->filename.pending_open = false; 2869 } 2870 2871 if (trace->current != thread) { 2872 thread__put(trace->current); 2873 trace->current = thread__get(thread); 2874 } 2875 err = 0; 2876 out_put: 2877 thread__put(thread); 2878 return err; 2879 } 2880 2881 static int trace__fprintf_sys_enter(struct trace *trace, struct perf_sample *sample) 2882 { 2883 struct thread_trace *ttrace; 2884 struct thread *thread; 2885 int id = perf_evsel__sc_tp_uint(id, sample), err = -1; 2886 struct syscall *sc; 2887 char msg[1024]; 2888 void *args, *augmented_args = NULL; 2889 int augmented_args_size, e_machine; 2890 size_t printed = 0; 2891 2892 2893 thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 2894 e_machine = thread__e_machine(thread, trace->host, /*e_flags=*/NULL); 2895 sc = trace__syscall_info(trace, sample->evsel, e_machine, id); 2896 if (sc == NULL) 2897 goto out_put; 2898 ttrace = thread__trace(thread, trace); 2899 /* 2900 * We need to get ttrace just to make sure it is there when syscall__scnprintf_args() 2901 * and the rest of the beautifiers accessing it via struct syscall_arg touches it. 2902 */ 2903 if (ttrace == NULL) 2904 goto out_put; 2905 2906 args = perf_evsel__sc_tp_ptr(args, sample); 2907 augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size); 2908 printed += syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread); 2909 fprintf(trace->output, "%.*s", (int)printed, msg); 2910 err = 0; 2911 out_put: 2912 thread__put(thread); 2913 return err; 2914 } 2915 2916 static int trace__resolve_callchain(struct trace *trace, 2917 struct perf_sample *sample, 2918 struct callchain_cursor *cursor) 2919 { 2920 struct evsel *evsel = sample->evsel; 2921 struct addr_location al; 2922 int max_stack = evsel->core.attr.sample_max_stack ? 2923 evsel->core.attr.sample_max_stack : 2924 trace->max_stack; 2925 int err = -1; 2926 2927 addr_location__init(&al); 2928 if (machine__resolve(trace->host, &al, sample) < 0) 2929 goto out; 2930 2931 err = thread__resolve_callchain(al.thread, cursor, sample, NULL, NULL, max_stack); 2932 out: 2933 addr_location__exit(&al); 2934 return err; 2935 } 2936 2937 static int trace__fprintf_callchain(struct trace *trace, struct perf_sample *sample) 2938 { 2939 /* TODO: user-configurable print_opts */ 2940 const unsigned int print_opts = EVSEL__PRINT_SYM | 2941 EVSEL__PRINT_DSO | 2942 EVSEL__PRINT_UNKNOWN_AS_ADDR; 2943 2944 return sample__fprintf_callchain(sample, 38, print_opts, get_tls_callchain_cursor(), symbol_conf.bt_stop_list, trace->output); 2945 } 2946 2947 static int trace__sys_exit(struct trace *trace, 2948 union perf_event *event __maybe_unused, 2949 struct perf_sample *sample) 2950 { 2951 struct evsel *evsel = sample->evsel; 2952 long ret; 2953 u64 duration = 0; 2954 bool duration_calculated = false; 2955 struct thread *thread; 2956 int id = perf_evsel__sc_tp_uint(id, sample), err = -1, callchain_ret = 0, printed = 0; 2957 int alignment = trace->args_alignment, e_machine; 2958 struct syscall *sc; 2959 struct thread_trace *ttrace; 2960 2961 thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 2962 e_machine = thread__e_machine(thread, trace->host, /*e_flags=*/NULL); 2963 sc = trace__syscall_info(trace, evsel, e_machine, id); 2964 if (sc == NULL) 2965 goto out_put; 2966 ttrace = thread__trace(thread, trace); 2967 if (ttrace == NULL) 2968 goto out_put; 2969 2970 trace__fprintf_sample(trace, sample, thread); 2971 2972 ret = perf_evsel__sc_tp_uint(ret, sample); 2973 2974 if (trace->summary) 2975 thread__update_stats(thread, ttrace, id, sample, ret, trace); 2976 2977 if (!trace->fd_path_disabled && sc->is_open && ret >= 0 && ttrace->filename.pending_open) { 2978 trace__set_fd_pathname(thread, ret, ttrace->filename.name); 2979 ttrace->filename.pending_open = false; 2980 ++trace->stats.vfs_getname; 2981 } 2982 2983 if (ttrace->entry_time && sample->time >= ttrace->entry_time) { 2984 duration = sample->time - ttrace->entry_time; 2985 if (trace__filter_duration(trace, duration)) 2986 goto out; 2987 duration_calculated = true; 2988 } else if (trace->duration_filter) 2989 goto out; 2990 2991 if (sample->callchain) { 2992 struct callchain_cursor *cursor = get_tls_callchain_cursor(); 2993 2994 callchain_ret = trace__resolve_callchain(trace, sample, cursor); 2995 if (callchain_ret == 0) { 2996 if (cursor->nr < trace->min_stack) 2997 goto out; 2998 callchain_ret = 1; 2999 } 3000 } 3001 3002 if (trace->summary_only || (ret >= 0 && trace->failure_only)) 3003 goto out; 3004 3005 trace__fprintf_entry_head(trace, thread, duration, 3006 duration_calculated, ttrace->entry_time, 3007 sample->cpu, trace->output); 3008 3009 if (ttrace->entry_pending) { 3010 printed = fprintf(trace->output, "%s", ttrace->entry_str); 3011 } else { 3012 printed += fprintf(trace->output, " ... ["); 3013 color_fprintf(trace->output, PERF_COLOR_YELLOW, "continued"); 3014 printed += 9; 3015 printed += fprintf(trace->output, "]: %s()", sc->name); 3016 } 3017 3018 printed++; /* the closing ')' */ 3019 3020 if (alignment > printed) 3021 alignment -= printed; 3022 else 3023 alignment = 0; 3024 3025 fprintf(trace->output, ")%*s= ", alignment, " "); 3026 3027 if (sc->fmt == NULL) { 3028 if (ret < 0) 3029 goto errno_print; 3030 signed_print: 3031 fprintf(trace->output, "%ld", ret); 3032 } else if (ret < 0) { 3033 errno_print: { 3034 char bf[STRERR_BUFSIZE]; 3035 struct perf_env *env = evsel__env(evsel) ?: &trace->host_env; 3036 const char *emsg = str_error_r(-ret, bf, sizeof(bf)); 3037 const char *e = perf_env__arch_strerrno(env, err); 3038 3039 fprintf(trace->output, "-1 %s (%s)", e, emsg); 3040 } 3041 } else if (ret == 0 && sc->fmt->timeout) 3042 fprintf(trace->output, "0 (Timeout)"); 3043 else if (ttrace->ret_scnprintf) { 3044 char bf[1024]; 3045 struct syscall_arg arg = { 3046 .val = ret, 3047 .thread = thread, 3048 .trace = trace, 3049 }; 3050 ttrace->ret_scnprintf(bf, sizeof(bf), &arg); 3051 ttrace->ret_scnprintf = NULL; 3052 fprintf(trace->output, "%s", bf); 3053 } else if (sc->fmt->hexret) 3054 fprintf(trace->output, "%#lx", ret); 3055 else if (sc->fmt->errpid) { 3056 struct thread *child = machine__find_thread(trace->host, ret, ret); 3057 3058 fprintf(trace->output, "%ld", ret); 3059 if (child != NULL) { 3060 if (thread__comm_set(child)) 3061 fprintf(trace->output, " (%s)", thread__comm_str(child)); 3062 thread__put(child); 3063 } 3064 } else 3065 goto signed_print; 3066 3067 fputc('\n', trace->output); 3068 3069 /* 3070 * We only consider an 'event' for the sake of --max-events a non-filtered 3071 * sys_enter + sys_exit and other tracepoint events. 3072 */ 3073 if (++trace->nr_events_printed == trace->max_events && trace->max_events != ULONG_MAX) 3074 interrupted = true; 3075 3076 if (callchain_ret > 0) 3077 trace__fprintf_callchain(trace, sample); 3078 else if (callchain_ret < 0) 3079 pr_err("Problem processing %s callchain, skipping...\n", evsel__name(evsel)); 3080 out: 3081 ttrace->entry_pending = false; 3082 err = 0; 3083 out_put: 3084 thread__put(thread); 3085 return err; 3086 } 3087 3088 static int trace__vfs_getname(struct trace *trace, 3089 union perf_event *event __maybe_unused, 3090 struct perf_sample *sample) 3091 { 3092 struct thread *thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 3093 struct thread_trace *ttrace; 3094 size_t filename_len, entry_str_len, to_move; 3095 ssize_t remaining_space; 3096 char *pos; 3097 const char *filename = perf_sample__strval(sample, "pathname"); 3098 3099 if (!thread) 3100 goto out; 3101 3102 ttrace = thread__priv(thread); 3103 if (!ttrace) 3104 goto out_put; 3105 3106 filename_len = strlen(filename); 3107 if (filename_len == 0) 3108 goto out_put; 3109 3110 if (ttrace->filename.namelen < filename_len) { 3111 char *f = realloc(ttrace->filename.name, filename_len + 1); 3112 3113 if (f == NULL) 3114 goto out_put; 3115 3116 ttrace->filename.namelen = filename_len; 3117 ttrace->filename.name = f; 3118 } 3119 3120 strcpy(ttrace->filename.name, filename); 3121 ttrace->filename.pending_open = true; 3122 3123 if (!ttrace->filename.ptr) 3124 goto out_put; 3125 3126 entry_str_len = strlen(ttrace->entry_str); 3127 remaining_space = trace__entry_str_size - entry_str_len - 1; /* \0 */ 3128 if (remaining_space <= 0) 3129 goto out_put; 3130 3131 if (filename_len > (size_t)remaining_space) { 3132 filename += filename_len - remaining_space; 3133 filename_len = remaining_space; 3134 } 3135 3136 to_move = entry_str_len - ttrace->filename.entry_str_pos + 1; /* \0 */ 3137 pos = ttrace->entry_str + ttrace->filename.entry_str_pos; 3138 memmove(pos + filename_len, pos, to_move); 3139 memcpy(pos, filename, filename_len); 3140 3141 ttrace->filename.ptr = 0; 3142 ttrace->filename.entry_str_pos = 0; 3143 out_put: 3144 thread__put(thread); 3145 out: 3146 return 0; 3147 } 3148 3149 static int trace__sched_stat_runtime(struct trace *trace, 3150 union perf_event *event __maybe_unused, 3151 struct perf_sample *sample) 3152 { 3153 u64 runtime = perf_sample__intval(sample, "runtime"); 3154 double runtime_ms = (double)runtime / NSEC_PER_MSEC; 3155 struct thread *thread = machine__findnew_thread(trace->host, 3156 sample->pid, 3157 sample->tid); 3158 struct thread_trace *ttrace = thread__trace(thread, trace); 3159 3160 if (ttrace == NULL) 3161 goto out_dump; 3162 3163 ttrace->runtime_ms += runtime_ms; 3164 trace->runtime_ms += runtime_ms; 3165 out_put: 3166 thread__put(thread); 3167 return 0; 3168 3169 out_dump: 3170 fprintf(trace->output, "%s: comm=%s,pid=%u,runtime=%" PRIu64 ",vruntime=%" PRIu64 ")\n", 3171 sample->evsel->name, 3172 perf_sample__strval(sample, "comm"), 3173 (pid_t)perf_sample__intval(sample, "pid"), 3174 runtime, 3175 perf_sample__intval(sample, "vruntime")); 3176 goto out_put; 3177 } 3178 3179 static int bpf_output__printer(enum binary_printer_ops op, 3180 unsigned int val, void *extra __maybe_unused, FILE *fp) 3181 { 3182 unsigned char ch = (unsigned char)val; 3183 3184 switch (op) { 3185 case BINARY_PRINT_CHAR_DATA: 3186 return fprintf(fp, "%c", isprint(ch) ? ch : '.'); 3187 case BINARY_PRINT_DATA_BEGIN: 3188 case BINARY_PRINT_LINE_BEGIN: 3189 case BINARY_PRINT_ADDR: 3190 case BINARY_PRINT_NUM_DATA: 3191 case BINARY_PRINT_NUM_PAD: 3192 case BINARY_PRINT_SEP: 3193 case BINARY_PRINT_CHAR_PAD: 3194 case BINARY_PRINT_LINE_END: 3195 case BINARY_PRINT_DATA_END: 3196 default: 3197 break; 3198 } 3199 3200 return 0; 3201 } 3202 3203 static void bpf_output__fprintf(struct trace *trace, 3204 struct perf_sample *sample) 3205 { 3206 binary__fprintf(sample->raw_data, sample->raw_size, 8, 3207 bpf_output__printer, NULL, trace->output); 3208 ++trace->nr_events_printed; 3209 } 3210 3211 static size_t trace__fprintf_tp_fields(struct trace *trace, struct perf_sample *sample, 3212 struct thread *thread, void *augmented_args, int augmented_args_size) 3213 { 3214 struct evsel *evsel = sample->evsel; 3215 char bf[2048]; 3216 size_t size = sizeof(bf); 3217 const struct tep_event *tp_format = evsel__tp_format(evsel); 3218 struct tep_format_field *field = tp_format ? tp_format->format.fields : NULL; 3219 struct syscall_arg_fmt *arg = __evsel__syscall_arg_fmt(evsel); 3220 size_t printed = 0, btf_printed; 3221 unsigned long val; 3222 u8 bit = 1; 3223 struct syscall_arg syscall_arg = { 3224 .augmented = { 3225 .size = augmented_args_size, 3226 .args = augmented_args, 3227 }, 3228 .idx = 0, 3229 .mask = 0, 3230 .trace = trace, 3231 .thread = thread, 3232 .show_string_prefix = trace->show_string_prefix, 3233 }; 3234 3235 for (; field && arg; field = field->next, ++syscall_arg.idx, bit <<= 1, ++arg) { 3236 if (syscall_arg.mask & bit) 3237 continue; 3238 3239 syscall_arg.len = 0; 3240 syscall_arg.fmt = arg; 3241 if (field->flags & TEP_FIELD_IS_ARRAY) { 3242 int offset = field->offset; 3243 3244 if (field->flags & TEP_FIELD_IS_DYNAMIC) { 3245 offset = format_field__intval(field, sample, evsel->needs_swap); 3246 syscall_arg.len = offset >> 16; 3247 offset &= 0xffff; 3248 if (tep_field_is_relative(field->flags)) 3249 offset += field->offset + field->size; 3250 } 3251 3252 val = (uintptr_t)(sample->raw_data + offset); 3253 } else 3254 val = format_field__intval(field, sample, evsel->needs_swap); 3255 /* 3256 * Some syscall args need some mask, most don't and 3257 * return val untouched. 3258 */ 3259 val = syscall_arg_fmt__mask_val(arg, &syscall_arg, val); 3260 3261 /* Suppress this argument if its value is zero and show_zero property isn't set. */ 3262 if (val == 0 && !trace->show_zeros && !arg->show_zero && arg->strtoul != STUL_BTF_TYPE) 3263 continue; 3264 3265 printed += scnprintf(bf + printed, size - printed, "%s", printed ? ", " : ""); 3266 3267 if (trace->show_arg_names) 3268 printed += scnprintf(bf + printed, size - printed, "%s: ", field->name); 3269 3270 btf_printed = trace__btf_scnprintf(trace, &syscall_arg, bf + printed, size - printed, val, field->type); 3271 if (btf_printed) { 3272 printed += btf_printed; 3273 continue; 3274 } 3275 3276 printed += syscall_arg_fmt__scnprintf_val(arg, bf + printed, size - printed, &syscall_arg, val); 3277 } 3278 3279 return fprintf(trace->output, "%.*s", (int)printed, bf); 3280 } 3281 3282 static int trace__event_handler(struct trace *trace, 3283 union perf_event *event __maybe_unused, 3284 struct perf_sample *sample) 3285 { 3286 struct evsel *evsel = sample->evsel; 3287 struct thread *thread; 3288 int callchain_ret = 0; 3289 3290 if (evsel->nr_events_printed >= evsel->max_events) 3291 return 0; 3292 3293 thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 3294 3295 if (sample->callchain) { 3296 struct callchain_cursor *cursor = get_tls_callchain_cursor(); 3297 3298 callchain_ret = trace__resolve_callchain(trace, sample, cursor); 3299 if (callchain_ret == 0) { 3300 if (cursor->nr < trace->min_stack) 3301 goto out; 3302 callchain_ret = 1; 3303 } 3304 } 3305 3306 trace__printf_interrupted_entry(trace); 3307 trace__fprintf_tstamp(trace, sample->time, trace->output); 3308 3309 if (trace->show_cpu) 3310 trace__fprintf_cpu(sample->cpu, trace->output); 3311 3312 if (trace->trace_syscalls && trace->show_duration) 3313 fprintf(trace->output, "( ): "); 3314 3315 if (thread) 3316 trace__fprintf_comm_tid(trace, thread, trace->output); 3317 3318 if (evsel == trace->syscalls.events.bpf_output) { 3319 int id = perf_evsel__sc_tp_uint(id, sample); 3320 int e_machine = thread 3321 ? thread__e_machine(thread, trace->host, /*e_flags=*/NULL) 3322 : EM_HOST; 3323 struct syscall *sc = trace__syscall_info(trace, evsel, e_machine, id); 3324 3325 if (sc) { 3326 fprintf(trace->output, "%s(", sc->name); 3327 trace__fprintf_sys_enter(trace, sample); 3328 fputc(')', trace->output); 3329 goto newline; 3330 } 3331 3332 /* 3333 * XXX: Not having the associated syscall info or not finding/adding 3334 * the thread should never happen, but if it does... 3335 * fall thru and print it as a bpf_output event. 3336 */ 3337 } 3338 3339 fprintf(trace->output, "%s(", evsel->name); 3340 3341 if (evsel__is_bpf_output(evsel)) { 3342 bpf_output__fprintf(trace, sample); 3343 } else { 3344 const struct tep_event *tp_format = evsel__tp_format(evsel); 3345 3346 if (tp_format && (strncmp(tp_format->name, "sys_enter_", 10) || 3347 trace__fprintf_sys_enter(trace, sample))) { 3348 if (trace->libtraceevent_print) { 3349 event_format__fprintf(tp_format, sample->cpu, 3350 sample->raw_data, sample->raw_size, 3351 trace->output); 3352 } else { 3353 trace__fprintf_tp_fields(trace, sample, thread, NULL, 0); 3354 } 3355 } 3356 } 3357 3358 newline: 3359 fprintf(trace->output, ")\n"); 3360 3361 if (callchain_ret > 0) 3362 trace__fprintf_callchain(trace, sample); 3363 else if (callchain_ret < 0) 3364 pr_err("Problem processing %s callchain, skipping...\n", evsel__name(evsel)); 3365 3366 ++trace->nr_events_printed; 3367 3368 if (evsel->max_events != ULONG_MAX && ++evsel->nr_events_printed == evsel->max_events) { 3369 evsel__disable(evsel); 3370 evsel__close(evsel); 3371 } 3372 out: 3373 thread__put(thread); 3374 return 0; 3375 } 3376 3377 static void print_location(FILE *f, struct perf_sample *sample, 3378 struct addr_location *al, 3379 bool print_dso, bool print_sym) 3380 { 3381 3382 if ((verbose > 0 || print_dso) && al->map) 3383 fprintf(f, "%s@", dso__long_name(map__dso(al->map))); 3384 3385 if ((verbose > 0 || print_sym) && al->sym) 3386 fprintf(f, "%s+0x%" PRIx64, al->sym->name, 3387 al->addr - al->sym->start); 3388 else if (al->map) 3389 fprintf(f, "0x%" PRIx64, al->addr); 3390 else 3391 fprintf(f, "0x%" PRIx64, sample->addr); 3392 } 3393 3394 static int trace__pgfault(struct trace *trace, 3395 union perf_event *event __maybe_unused, 3396 struct perf_sample *sample) 3397 { 3398 struct thread *thread; 3399 struct addr_location al; 3400 char map_type = 'd'; 3401 struct thread_trace *ttrace; 3402 int err = -1; 3403 int callchain_ret = 0; 3404 3405 addr_location__init(&al); 3406 thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 3407 3408 if (sample->callchain) { 3409 struct callchain_cursor *cursor = get_tls_callchain_cursor(); 3410 3411 callchain_ret = trace__resolve_callchain(trace, sample, cursor); 3412 if (callchain_ret == 0) { 3413 if (cursor->nr < trace->min_stack) 3414 goto out_put; 3415 callchain_ret = 1; 3416 } 3417 } 3418 3419 ttrace = thread__trace(thread, trace); 3420 if (ttrace == NULL) 3421 goto out_put; 3422 3423 if (sample->evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ) { 3424 ttrace->pfmaj++; 3425 trace->pfmaj++; 3426 } else { 3427 ttrace->pfmin++; 3428 trace->pfmin++; 3429 } 3430 3431 if (trace->summary_only) 3432 goto out; 3433 3434 thread__find_symbol(thread, sample->cpumode, sample->ip, &al); 3435 3436 trace__fprintf_entry_head(trace, thread, 0, true, sample->time, 3437 sample->cpu, trace->output); 3438 3439 fprintf(trace->output, "%sfault [", 3440 sample->evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ? 3441 "maj" : "min"); 3442 3443 print_location(trace->output, sample, &al, false, true); 3444 3445 fprintf(trace->output, "] => "); 3446 3447 thread__find_symbol(thread, sample->cpumode, sample->addr, &al); 3448 3449 if (!al.map) { 3450 thread__find_symbol(thread, sample->cpumode, sample->addr, &al); 3451 3452 if (al.map) 3453 map_type = 'x'; 3454 else 3455 map_type = '?'; 3456 } 3457 3458 print_location(trace->output, sample, &al, true, false); 3459 3460 fprintf(trace->output, " (%c%c)\n", map_type, al.level); 3461 3462 if (callchain_ret > 0) 3463 trace__fprintf_callchain(trace, sample); 3464 else if (callchain_ret < 0) 3465 pr_err("Problem processing %s callchain, skipping...\n", 3466 evsel__name(sample->evsel)); 3467 3468 ++trace->nr_events_printed; 3469 out: 3470 err = 0; 3471 out_put: 3472 thread__put(thread); 3473 addr_location__exit(&al); 3474 return err; 3475 } 3476 3477 static void trace__set_base_time(struct trace *trace, 3478 struct perf_sample *sample) 3479 { 3480 /* 3481 * BPF events were not setting PERF_SAMPLE_TIME, so be more robust 3482 * and don't use sample->time unconditionally, we may end up having 3483 * some other event in the future without PERF_SAMPLE_TIME for good 3484 * reason, i.e. we may not be interested in its timestamps, just in 3485 * it taking place, picking some piece of information when it 3486 * appears in our event stream (vfs_getname comes to mind). 3487 */ 3488 if (trace->base_time == 0 && !trace->full_time && 3489 (sample->evsel->core.attr.sample_type & PERF_SAMPLE_TIME)) 3490 trace->base_time = sample->time; 3491 } 3492 3493 static int trace__process_sample(const struct perf_tool *tool, 3494 union perf_event *event, 3495 struct perf_sample *sample, 3496 struct machine *machine __maybe_unused) 3497 { 3498 struct trace *trace = container_of(tool, struct trace, tool); 3499 struct evsel *evsel = sample->evsel; 3500 struct thread *thread; 3501 int err = 0; 3502 3503 tracepoint_handler handler = evsel->handler; 3504 3505 thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 3506 if (thread && thread__is_filtered(thread)) 3507 goto out; 3508 3509 trace__set_base_time(trace, sample); 3510 3511 if (handler) { 3512 ++trace->nr_events; 3513 handler(trace, event, sample); 3514 } 3515 out: 3516 thread__put(thread); 3517 return err; 3518 } 3519 3520 static int trace__record(struct trace *trace, int argc, const char **argv) 3521 { 3522 unsigned int rec_argc, i, j; 3523 const char **rec_argv; 3524 const char * const record_args[] = { 3525 "record", 3526 "-R", 3527 "-m", "1024", 3528 "-c", "1", 3529 }; 3530 pid_t pid = getpid(); 3531 char *filter = asprintf__tp_filter_pids(1, &pid); 3532 const char * const sc_args[] = { "-e", }; 3533 unsigned int sc_args_nr = ARRAY_SIZE(sc_args); 3534 const char * const majpf_args[] = { "-e", "major-faults" }; 3535 unsigned int majpf_args_nr = ARRAY_SIZE(majpf_args); 3536 const char * const minpf_args[] = { "-e", "minor-faults" }; 3537 unsigned int minpf_args_nr = ARRAY_SIZE(minpf_args); 3538 int err = -1; 3539 3540 /* +3 is for the event string below and the pid filter */ 3541 rec_argc = ARRAY_SIZE(record_args) + sc_args_nr + 3 + 3542 majpf_args_nr + minpf_args_nr + argc; 3543 rec_argv = calloc(rec_argc + 1, sizeof(char *)); 3544 3545 if (rec_argv == NULL || filter == NULL) 3546 goto out_free; 3547 3548 j = 0; 3549 for (i = 0; i < ARRAY_SIZE(record_args); i++) 3550 rec_argv[j++] = record_args[i]; 3551 3552 if (trace->trace_syscalls) { 3553 for (i = 0; i < sc_args_nr; i++) 3554 rec_argv[j++] = sc_args[i]; 3555 3556 /* event string may be different for older kernels - e.g., RHEL6 */ 3557 if (is_valid_tracepoint("raw_syscalls:sys_enter")) 3558 rec_argv[j++] = "raw_syscalls:sys_enter,raw_syscalls:sys_exit"; 3559 else if (is_valid_tracepoint("syscalls:sys_enter")) 3560 rec_argv[j++] = "syscalls:sys_enter,syscalls:sys_exit"; 3561 else { 3562 pr_err("Neither raw_syscalls nor syscalls events exist.\n"); 3563 goto out_free; 3564 } 3565 } 3566 3567 rec_argv[j++] = "--filter"; 3568 rec_argv[j++] = filter; 3569 3570 if (trace->trace_pgfaults & TRACE_PFMAJ) 3571 for (i = 0; i < majpf_args_nr; i++) 3572 rec_argv[j++] = majpf_args[i]; 3573 3574 if (trace->trace_pgfaults & TRACE_PFMIN) 3575 for (i = 0; i < minpf_args_nr; i++) 3576 rec_argv[j++] = minpf_args[i]; 3577 3578 for (i = 0; i < (unsigned int)argc; i++) 3579 rec_argv[j++] = argv[i]; 3580 3581 err = cmd_record(j, rec_argv); 3582 out_free: 3583 free(filter); 3584 free(rec_argv); 3585 return err; 3586 } 3587 3588 static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp); 3589 static size_t trace__fprintf_total_summary(struct trace *trace, FILE *fp); 3590 3591 static bool evlist__add_vfs_getname(struct evlist *evlist) 3592 { 3593 bool found = false; 3594 struct evsel *evsel, *tmp; 3595 struct parse_events_error err; 3596 int ret; 3597 3598 parse_events_error__init(&err); 3599 ret = parse_events(evlist, "probe:vfs_getname*", &err); 3600 parse_events_error__exit(&err); 3601 if (ret) 3602 return false; 3603 3604 evlist__for_each_entry_safe(evlist, evsel, tmp) { 3605 if (!strstarts(evsel__name(evsel), "probe:vfs_getname")) 3606 continue; 3607 3608 if (evsel__field(evsel, "pathname")) { 3609 evsel->handler = trace__vfs_getname; 3610 found = true; 3611 continue; 3612 } 3613 3614 list_del_init(&evsel->core.node); 3615 evsel->evlist = NULL; 3616 evsel__delete(evsel); 3617 } 3618 3619 return found; 3620 } 3621 3622 static struct evsel *evsel__new_pgfault(u64 config) 3623 { 3624 struct evsel *evsel; 3625 struct perf_event_attr attr = { 3626 .type = PERF_TYPE_SOFTWARE, 3627 .mmap_data = 1, 3628 }; 3629 3630 attr.config = config; 3631 attr.sample_period = 1; 3632 3633 event_attr_init(&attr); 3634 3635 evsel = evsel__new(&attr); 3636 if (evsel) 3637 evsel->handler = trace__pgfault; 3638 3639 return evsel; 3640 } 3641 3642 static void evlist__free_syscall_tp_fields(struct evlist *evlist) 3643 { 3644 struct evsel *evsel; 3645 3646 evlist__for_each_entry(evlist, evsel) { 3647 evsel_trace__delete(evsel->priv); 3648 evsel->priv = NULL; 3649 } 3650 } 3651 3652 static void trace__handle_event(struct trace *trace, union perf_event *event, struct perf_sample *sample) 3653 { 3654 const u32 type = event->header.type; 3655 3656 if (type != PERF_RECORD_SAMPLE) { 3657 trace__process_event(trace, trace->host, event, sample); 3658 return; 3659 } 3660 3661 if (sample->evsel == NULL) 3662 sample->evsel = evlist__id2evsel(trace->evlist, sample->id); 3663 3664 if (sample->evsel == NULL) { 3665 fprintf(trace->output, "Unknown tp ID %" PRIu64 ", skipping...\n", sample->id); 3666 return; 3667 } 3668 3669 if (evswitch__discard(&trace->evswitch, sample->evsel)) 3670 return; 3671 3672 trace__set_base_time(trace, sample); 3673 3674 if (sample->evsel->core.attr.type == PERF_TYPE_TRACEPOINT && 3675 sample->raw_data == NULL) { 3676 fprintf(trace->output, "%s sample with no payload for tid: %d, cpu %d, raw_size=%d, skipping...\n", 3677 evsel__name(sample->evsel), sample->tid, 3678 sample->cpu, sample->raw_size); 3679 } else { 3680 tracepoint_handler handler = sample->evsel->handler; 3681 3682 handler(trace, event, sample); 3683 } 3684 3685 if (trace->nr_events_printed >= trace->max_events && trace->max_events != ULONG_MAX) 3686 interrupted = true; 3687 } 3688 3689 static int trace__add_syscall_newtp(struct trace *trace) 3690 { 3691 int ret = -1; 3692 struct evlist *evlist = trace->evlist; 3693 struct evsel *sys_enter, *sys_exit; 3694 3695 sys_enter = perf_evsel__raw_syscall_newtp("sys_enter", trace__sys_enter); 3696 if (sys_enter == NULL) 3697 goto out; 3698 3699 if (perf_evsel__init_sc_tp_ptr_field(sys_enter, args)) 3700 goto out_delete_sys_enter; 3701 3702 sys_exit = perf_evsel__raw_syscall_newtp("sys_exit", trace__sys_exit); 3703 if (sys_exit == NULL) 3704 goto out_delete_sys_enter; 3705 3706 if (perf_evsel__init_sc_tp_uint_field(sys_exit, ret)) 3707 goto out_delete_sys_exit; 3708 3709 evsel__config_callchain(sys_enter, &trace->opts, &callchain_param); 3710 evsel__config_callchain(sys_exit, &trace->opts, &callchain_param); 3711 3712 evlist__add(evlist, sys_enter); 3713 evlist__add(evlist, sys_exit); 3714 3715 if (callchain_param.enabled && !trace->kernel_syscallchains) { 3716 /* 3717 * We're interested only in the user space callchain 3718 * leading to the syscall, allow overriding that for 3719 * debugging reasons using --kernel_syscall_callchains 3720 */ 3721 sys_exit->core.attr.exclude_callchain_kernel = 1; 3722 } 3723 3724 trace->syscalls.events.sys_enter = sys_enter; 3725 trace->syscalls.events.sys_exit = sys_exit; 3726 3727 ret = 0; 3728 out: 3729 return ret; 3730 3731 out_delete_sys_exit: 3732 evsel__delete_priv(sys_exit); 3733 out_delete_sys_enter: 3734 evsel__delete_priv(sys_enter); 3735 goto out; 3736 } 3737 3738 static int trace__set_ev_qualifier_tp_filter(struct trace *trace) 3739 { 3740 int err = -1; 3741 struct evsel *sys_exit; 3742 char *filter = asprintf_expr_inout_ints("id", !trace->not_ev_qualifier, 3743 trace->ev_qualifier_ids.nr, 3744 trace->ev_qualifier_ids.entries); 3745 3746 if (filter == NULL) 3747 goto out_enomem; 3748 3749 if (!evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter)) { 3750 sys_exit = trace->syscalls.events.sys_exit; 3751 err = evsel__append_tp_filter(sys_exit, filter); 3752 } 3753 3754 free(filter); 3755 out: 3756 return err; 3757 out_enomem: 3758 errno = ENOMEM; 3759 goto out; 3760 } 3761 3762 #ifdef HAVE_LIBBPF_SUPPORT 3763 3764 static struct bpf_program *unaugmented_prog; 3765 3766 static int syscall_arg_fmt__cache_btf_struct(struct syscall_arg_fmt *arg_fmt, struct btf *btf, char *type) 3767 { 3768 int id; 3769 3770 if (arg_fmt->type != NULL) 3771 return -1; 3772 3773 id = btf__find_by_name(btf, type); 3774 if (id < 0) 3775 return -1; 3776 3777 arg_fmt->type = btf__type_by_id(btf, id); 3778 arg_fmt->type_id = id; 3779 3780 return 0; 3781 } 3782 3783 static struct bpf_program *trace__find_syscall_bpf_prog(struct trace *trace __maybe_unused, 3784 struct syscall *sc, 3785 const char *prog_name, const char *type) 3786 { 3787 struct bpf_program *prog; 3788 3789 if (prog_name == NULL) { 3790 char default_prog_name[256]; 3791 scnprintf(default_prog_name, sizeof(default_prog_name), "tp/syscalls/sys_%s_%s", type, sc->name); 3792 prog = augmented_syscalls__find_by_title(default_prog_name); 3793 if (prog != NULL) 3794 goto out_found; 3795 if (sc->fmt && sc->fmt->alias) { 3796 scnprintf(default_prog_name, sizeof(default_prog_name), "tp/syscalls/sys_%s_%s", type, sc->fmt->alias); 3797 prog = augmented_syscalls__find_by_title(default_prog_name); 3798 if (prog != NULL) 3799 goto out_found; 3800 } 3801 goto out_unaugmented; 3802 } 3803 3804 prog = augmented_syscalls__find_by_title(prog_name); 3805 3806 if (prog != NULL) { 3807 out_found: 3808 return prog; 3809 } 3810 3811 pr_debug("Couldn't find BPF prog \"%s\" to associate with syscalls:sys_%s_%s, not augmenting it\n", 3812 prog_name, type, sc->name); 3813 out_unaugmented: 3814 return unaugmented_prog; 3815 } 3816 3817 static void trace__init_syscall_bpf_progs(struct trace *trace, int e_machine, int id) 3818 { 3819 struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, id); 3820 3821 if (sc == NULL) 3822 return; 3823 3824 sc->bpf_prog.sys_enter = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_enter : NULL, "enter"); 3825 sc->bpf_prog.sys_exit = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_exit : NULL, "exit"); 3826 } 3827 3828 static int trace__bpf_prog_sys_enter_fd(struct trace *trace, int e_machine, int id) 3829 { 3830 struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, id); 3831 return sc ? bpf_program__fd(sc->bpf_prog.sys_enter) : bpf_program__fd(unaugmented_prog); 3832 } 3833 3834 static int trace__bpf_prog_sys_exit_fd(struct trace *trace, int e_machine, int id) 3835 { 3836 struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, id); 3837 return sc ? bpf_program__fd(sc->bpf_prog.sys_exit) : bpf_program__fd(unaugmented_prog); 3838 } 3839 3840 static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, int key, unsigned int *beauty_array) 3841 { 3842 struct tep_format_field *field; 3843 struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, key); 3844 const struct btf_type *bt; 3845 char *struct_offset, *tmp, name[32]; 3846 bool can_augment = false; 3847 int i, cnt; 3848 3849 if (sc == NULL) 3850 return -1; 3851 3852 trace__load_vmlinux_btf(trace); 3853 if (trace->btf == NULL) 3854 return -1; 3855 3856 for (i = 0, field = sc->args; field; ++i, field = field->next) { 3857 // XXX We're only collecting pointer payloads _from_ user space 3858 if (!sc->arg_fmt[i].from_user) 3859 continue; 3860 3861 struct_offset = strstr(field->type, "struct "); 3862 if (struct_offset == NULL) 3863 struct_offset = strstr(field->type, "union "); 3864 else 3865 struct_offset++; // "union" is shorter 3866 3867 if (field->flags & TEP_FIELD_IS_POINTER && struct_offset) { /* struct or union (think BPF's attr arg) */ 3868 struct_offset += 6; 3869 3870 /* for 'struct foo *', we only want 'foo' */ 3871 for (tmp = struct_offset, cnt = 0; *tmp != ' ' && *tmp != '\0'; ++tmp, ++cnt) { 3872 } 3873 3874 strncpy(name, struct_offset, cnt); 3875 name[cnt] = '\0'; 3876 3877 /* cache struct's btf_type and type_id */ 3878 if (syscall_arg_fmt__cache_btf_struct(&sc->arg_fmt[i], trace->btf, name)) 3879 continue; 3880 3881 bt = sc->arg_fmt[i].type; 3882 beauty_array[i] = bt->size; 3883 can_augment = true; 3884 } else if (field->flags & TEP_FIELD_IS_POINTER && /* string */ 3885 strcmp(field->type, "const char *") == 0 && 3886 (strstr(field->name, "name") || 3887 strstr(field->name, "path") || 3888 strstr(field->name, "file") || 3889 strstr(field->name, "root") || 3890 strstr(field->name, "key") || 3891 strstr(field->name, "special") || 3892 strstr(field->name, "type") || 3893 strstr(field->name, "description"))) { 3894 beauty_array[i] = 1; 3895 can_augment = true; 3896 } else if (field->flags & TEP_FIELD_IS_POINTER && /* buffer */ 3897 strstr(field->type, "char *") && 3898 (strstr(field->name, "buf") || 3899 strstr(field->name, "val") || 3900 strstr(field->name, "msg"))) { 3901 int j; 3902 struct tep_format_field *field_tmp; 3903 3904 /* find the size of the buffer that appears in pairs with buf */ 3905 for (j = 0, field_tmp = sc->args; field_tmp; ++j, field_tmp = field_tmp->next) { 3906 if (!(field_tmp->flags & TEP_FIELD_IS_POINTER) && /* only integers */ 3907 (strstr(field_tmp->name, "count") || 3908 strstr(field_tmp->name, "siz") || /* size, bufsiz */ 3909 (strstr(field_tmp->name, "len") && strcmp(field_tmp->name, "filename")))) { 3910 /* filename's got 'len' in it, we don't want that */ 3911 beauty_array[i] = -(j + 1); 3912 can_augment = true; 3913 break; 3914 } 3915 } 3916 } 3917 } 3918 3919 if (can_augment) 3920 return 0; 3921 3922 return -1; 3923 } 3924 3925 static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace, 3926 struct syscall *sc) 3927 { 3928 struct tep_format_field *field, *candidate_field; 3929 /* 3930 * We're only interested in syscalls that have a pointer: 3931 */ 3932 for (field = sc->args; field; field = field->next) { 3933 if (field->flags & TEP_FIELD_IS_POINTER) 3934 goto try_to_find_pair; 3935 } 3936 3937 return NULL; 3938 3939 try_to_find_pair: 3940 for (int i = 0, num_idx = syscalltbl__num_idx(sc->e_machine); i < num_idx; ++i) { 3941 int id = syscalltbl__id_at_idx(sc->e_machine, i); 3942 struct syscall *pair = trace__syscall_info(trace, NULL, sc->e_machine, id); 3943 struct bpf_program *pair_prog; 3944 bool is_candidate = false; 3945 3946 if (pair == NULL || pair->id == sc->id || 3947 pair->bpf_prog.sys_enter == unaugmented_prog) 3948 continue; 3949 3950 for (field = sc->args, candidate_field = pair->args; 3951 field && candidate_field; field = field->next, candidate_field = candidate_field->next) { 3952 bool is_pointer = field->flags & TEP_FIELD_IS_POINTER, 3953 candidate_is_pointer = candidate_field->flags & TEP_FIELD_IS_POINTER; 3954 3955 if (is_pointer) { 3956 if (!candidate_is_pointer) { 3957 // The candidate just doesn't copies our pointer arg, might copy other pointers we want. 3958 continue; 3959 } 3960 } else { 3961 if (candidate_is_pointer) { 3962 // The candidate might copy a pointer we don't have, skip it. 3963 goto next_candidate; 3964 } 3965 continue; 3966 } 3967 3968 if (strcmp(field->type, candidate_field->type)) 3969 goto next_candidate; 3970 3971 /* 3972 * This is limited in the BPF program but sys_write 3973 * uses "const char *" for its "buf" arg so we need to 3974 * use some heuristic that is kinda future proof... 3975 */ 3976 if (strcmp(field->type, "const char *") == 0 && 3977 !(strstr(field->name, "name") || 3978 strstr(field->name, "path") || 3979 strstr(field->name, "file") || 3980 strstr(field->name, "root") || 3981 strstr(field->name, "description"))) 3982 goto next_candidate; 3983 3984 is_candidate = true; 3985 } 3986 3987 if (!is_candidate) 3988 goto next_candidate; 3989 3990 /* 3991 * Check if the tentative pair syscall augmenter has more pointers, if it has, 3992 * then it may be collecting that and we then can't use it, as it would collect 3993 * more than what is common to the two syscalls. 3994 */ 3995 if (candidate_field) { 3996 for (candidate_field = candidate_field->next; candidate_field; candidate_field = candidate_field->next) 3997 if (candidate_field->flags & TEP_FIELD_IS_POINTER) 3998 goto next_candidate; 3999 } 4000 4001 pair_prog = pair->bpf_prog.sys_enter; 4002 /* 4003 * If the pair isn't enabled, then its bpf_prog.sys_enter will not 4004 * have been searched for, so search it here and if it returns the 4005 * unaugmented one, then ignore it, otherwise we'll reuse that BPF 4006 * program for a filtered syscall on a non-filtered one. 4007 * 4008 * For instance, we have "!syscalls:sys_enter_renameat" and that is 4009 * useful for "renameat2". 4010 */ 4011 if (pair_prog == NULL) { 4012 pair_prog = trace__find_syscall_bpf_prog(trace, pair, pair->fmt ? pair->fmt->bpf_prog_name.sys_enter : NULL, "enter"); 4013 if (pair_prog == unaugmented_prog) 4014 goto next_candidate; 4015 } 4016 4017 pr_debug("Reusing \"%s\" BPF sys_enter augmenter for \"%s\"\n", pair->name, 4018 sc->name); 4019 return pair_prog; 4020 next_candidate: 4021 continue; 4022 } 4023 4024 return NULL; 4025 } 4026 4027 static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace, int e_machine) 4028 { 4029 int map_enter_fd; 4030 int map_exit_fd; 4031 int beauty_map_fd; 4032 int err = 0; 4033 unsigned int beauty_array[6]; 4034 4035 if (augmented_syscalls__get_map_fds(&map_enter_fd, &map_exit_fd, &beauty_map_fd) < 0) 4036 return -1; 4037 4038 unaugmented_prog = augmented_syscalls__unaugmented(); 4039 4040 for (int i = 0, num_idx = syscalltbl__num_idx(e_machine); i < num_idx; ++i) { 4041 int prog_fd, key = syscalltbl__id_at_idx(e_machine, i); 4042 4043 if (!trace__syscall_enabled(trace, key)) 4044 continue; 4045 4046 trace__init_syscall_bpf_progs(trace, e_machine, key); 4047 4048 // It'll get at least the "!raw_syscalls:unaugmented" 4049 prog_fd = trace__bpf_prog_sys_enter_fd(trace, e_machine, key); 4050 err = bpf_map_update_elem(map_enter_fd, &key, &prog_fd, BPF_ANY); 4051 if (err) 4052 break; 4053 prog_fd = trace__bpf_prog_sys_exit_fd(trace, e_machine, key); 4054 err = bpf_map_update_elem(map_exit_fd, &key, &prog_fd, BPF_ANY); 4055 if (err) 4056 break; 4057 4058 /* use beauty_map to tell BPF how many bytes to collect, set beauty_map's value here */ 4059 memset(beauty_array, 0, sizeof(beauty_array)); 4060 err = trace__bpf_sys_enter_beauty_map(trace, e_machine, key, (unsigned int *)beauty_array); 4061 if (err) 4062 continue; 4063 err = bpf_map_update_elem(beauty_map_fd, &key, beauty_array, BPF_ANY); 4064 if (err) 4065 break; 4066 } 4067 4068 /* 4069 * Now lets do a second pass looking for enabled syscalls without 4070 * an augmenter that have a signature that is a superset of another 4071 * syscall with an augmenter so that we can auto-reuse it. 4072 * 4073 * I.e. if we have an augmenter for the "open" syscall that has 4074 * this signature: 4075 * 4076 * int open(const char *pathname, int flags, mode_t mode); 4077 * 4078 * I.e. that will collect just the first string argument, then we 4079 * can reuse it for the 'creat' syscall, that has this signature: 4080 * 4081 * int creat(const char *pathname, mode_t mode); 4082 * 4083 * and for: 4084 * 4085 * int stat(const char *pathname, struct stat *statbuf); 4086 * int lstat(const char *pathname, struct stat *statbuf); 4087 * 4088 * Because the 'open' augmenter will collect the first arg as a string, 4089 * and leave alone all the other args, which already helps with 4090 * beautifying 'stat' and 'lstat''s pathname arg. 4091 * 4092 * Then, in time, when 'stat' gets an augmenter that collects both 4093 * first and second arg (this one on the raw_syscalls:sys_exit prog 4094 * array tail call, then that one will be used. 4095 */ 4096 for (int i = 0, num_idx = syscalltbl__num_idx(e_machine); i < num_idx; ++i) { 4097 int key = syscalltbl__id_at_idx(e_machine, i); 4098 struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, key); 4099 struct bpf_program *pair_prog; 4100 int prog_fd; 4101 4102 if (sc == NULL || sc->bpf_prog.sys_enter == NULL) 4103 continue; 4104 4105 /* 4106 * For now we're just reusing the sys_enter prog, and if it 4107 * already has an augmenter, we don't need to find one. 4108 */ 4109 if (sc->bpf_prog.sys_enter != unaugmented_prog) 4110 continue; 4111 4112 /* 4113 * Look at all the other syscalls for one that has a signature 4114 * that is close enough that we can share: 4115 */ 4116 pair_prog = trace__find_usable_bpf_prog_entry(trace, sc); 4117 if (pair_prog == NULL) 4118 continue; 4119 4120 sc->bpf_prog.sys_enter = pair_prog; 4121 4122 /* 4123 * Update the BPF_MAP_TYPE_PROG_SHARED for raw_syscalls:sys_enter 4124 * with the fd for the program we're reusing: 4125 */ 4126 prog_fd = bpf_program__fd(sc->bpf_prog.sys_enter); 4127 err = bpf_map_update_elem(map_enter_fd, &key, &prog_fd, BPF_ANY); 4128 if (err) 4129 break; 4130 } 4131 4132 return err; 4133 } 4134 #else // !HAVE_LIBBPF_SUPPORT 4135 static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace __maybe_unused, 4136 int e_machine __maybe_unused) 4137 { 4138 return -1; 4139 } 4140 #endif // HAVE_LIBBPF_SUPPORT 4141 4142 static int trace__set_ev_qualifier_filter(struct trace *trace) 4143 { 4144 if (trace->syscalls.events.sys_enter) 4145 return trace__set_ev_qualifier_tp_filter(trace); 4146 return 0; 4147 } 4148 4149 static int trace__set_filter_loop_pids(struct trace *trace) 4150 { 4151 unsigned int nr = 1, err; 4152 pid_t pids[32] = { 4153 getpid(), 4154 }; 4155 struct thread *thread = machine__find_thread(trace->host, pids[0], pids[0]); 4156 4157 while (thread && nr < ARRAY_SIZE(pids)) { 4158 struct thread *parent = machine__find_thread(trace->host, 4159 thread__ppid(thread), 4160 thread__ppid(thread)); 4161 4162 if (parent == NULL) 4163 break; 4164 4165 if (!strcmp(thread__comm_str(parent), "sshd") || 4166 strstarts(thread__comm_str(parent), "gnome-terminal")) { 4167 pids[nr++] = thread__tid(parent); 4168 thread__put(parent); 4169 break; 4170 } 4171 thread__put(thread); 4172 thread = parent; 4173 } 4174 thread__put(thread); 4175 4176 err = evlist__append_tp_filter_pids(trace->evlist, nr, pids); 4177 if (!err) 4178 err = augmented_syscalls__set_filter_pids(nr, pids); 4179 4180 return err; 4181 } 4182 4183 static int trace__set_filter_pids(struct trace *trace) 4184 { 4185 int err = 0; 4186 /* 4187 * Better not use !target__has_task() here because we need to cover the 4188 * case where no threads were specified in the command line, but a 4189 * workload was, and in that case we will fill in the thread_map when 4190 * we fork the workload in evlist__prepare_workload. 4191 */ 4192 if (trace->filter_pids.nr > 0) { 4193 err = evlist__append_tp_filter_pids(trace->evlist, trace->filter_pids.nr, 4194 trace->filter_pids.entries); 4195 if (!err) { 4196 err = augmented_syscalls__set_filter_pids(trace->filter_pids.nr, 4197 trace->filter_pids.entries); 4198 } 4199 } else if (perf_thread_map__pid(trace->evlist->core.threads, 0) == -1) { 4200 err = trace__set_filter_loop_pids(trace); 4201 } 4202 4203 return err; 4204 } 4205 4206 static int __trace__deliver_event(struct trace *trace, union perf_event *event) 4207 { 4208 struct evlist *evlist = trace->evlist; 4209 struct perf_sample sample; 4210 int err; 4211 4212 perf_sample__init(&sample, /*all=*/false); 4213 err = evlist__parse_sample(evlist, event, &sample); 4214 if (err) 4215 fprintf(trace->output, "Can't parse sample, err = %d, skipping...\n", err); 4216 else 4217 trace__handle_event(trace, event, &sample); 4218 4219 perf_sample__exit(&sample); 4220 return 0; 4221 } 4222 4223 static int __trace__flush_events(struct trace *trace) 4224 { 4225 u64 first = ordered_events__first_time(&trace->oe.data); 4226 u64 flush = trace->oe.last - NSEC_PER_SEC; 4227 4228 /* Is there some thing to flush.. */ 4229 if (first && first < flush) 4230 return ordered_events__flush_time(&trace->oe.data, flush); 4231 4232 return 0; 4233 } 4234 4235 static int trace__flush_events(struct trace *trace) 4236 { 4237 return !trace->sort_events ? 0 : __trace__flush_events(trace); 4238 } 4239 4240 static int trace__deliver_event(struct trace *trace, union perf_event *event) 4241 { 4242 int err; 4243 4244 if (!trace->sort_events) 4245 return __trace__deliver_event(trace, event); 4246 4247 err = evlist__parse_sample_timestamp(trace->evlist, event, &trace->oe.last); 4248 if (err && err != -1) 4249 return err; 4250 4251 err = ordered_events__queue(&trace->oe.data, event, trace->oe.last, 0, NULL); 4252 if (err) 4253 return err; 4254 4255 return trace__flush_events(trace); 4256 } 4257 4258 static int ordered_events__deliver_event(struct ordered_events *oe, 4259 struct ordered_event *event) 4260 { 4261 struct trace *trace = container_of(oe, struct trace, oe.data); 4262 4263 return __trace__deliver_event(trace, event->event); 4264 } 4265 4266 static struct syscall_arg_fmt *evsel__find_syscall_arg_fmt_by_name(struct evsel *evsel, char *arg, 4267 char **type) 4268 { 4269 struct syscall_arg_fmt *fmt = __evsel__syscall_arg_fmt(evsel); 4270 const struct tep_event *tp_format; 4271 4272 if (!fmt) 4273 return NULL; 4274 4275 tp_format = evsel__tp_format(evsel); 4276 if (!tp_format) 4277 return NULL; 4278 4279 for (const struct tep_format_field *field = tp_format->format.fields; field; 4280 field = field->next, ++fmt) { 4281 if (strcmp(field->name, arg) == 0) { 4282 *type = field->type; 4283 return fmt; 4284 } 4285 } 4286 4287 return NULL; 4288 } 4289 4290 static int trace__expand_filter(struct trace *trace, struct evsel *evsel) 4291 { 4292 char *tok, *left = evsel->filter, *new_filter = evsel->filter; 4293 4294 while ((tok = strpbrk(left, "=<>!")) != NULL) { 4295 char *right = tok + 1, *right_end; 4296 4297 if (*right == '=') 4298 ++right; 4299 4300 while (isspace(*right)) 4301 ++right; 4302 4303 if (*right == '\0') 4304 break; 4305 4306 while (!isalpha(*left)) 4307 if (++left == tok) { 4308 /* 4309 * Bail out, can't find the name of the argument that is being 4310 * used in the filter, let it try to set this filter, will fail later. 4311 */ 4312 return 0; 4313 } 4314 4315 right_end = right + 1; 4316 while (isalnum(*right_end) || *right_end == '_' || *right_end == '|') 4317 ++right_end; 4318 4319 if (isalpha(*right)) { 4320 struct syscall_arg_fmt *fmt; 4321 int left_size = tok - left, 4322 right_size = right_end - right; 4323 char arg[128], *type; 4324 4325 while (isspace(left[left_size - 1])) 4326 --left_size; 4327 4328 scnprintf(arg, sizeof(arg), "%.*s", left_size, left); 4329 4330 fmt = evsel__find_syscall_arg_fmt_by_name(evsel, arg, &type); 4331 if (fmt == NULL) { 4332 pr_err("\"%s\" not found in \"%s\", can't set filter \"%s\"\n", 4333 arg, evsel->name, evsel->filter); 4334 return -1; 4335 } 4336 4337 pr_debug2("trying to expand \"%s\" \"%.*s\" \"%.*s\" -> ", 4338 arg, (int)(right - tok), tok, right_size, right); 4339 4340 if (fmt->strtoul) { 4341 u64 val; 4342 struct syscall_arg syscall_arg = { 4343 .trace = trace, 4344 .fmt = fmt, 4345 .type_name = type, 4346 .parm = fmt->parm, 4347 }; 4348 4349 if (fmt->strtoul(right, right_size, &syscall_arg, &val)) { 4350 char *n, expansion[19]; 4351 int expansion_lenght = scnprintf(expansion, sizeof(expansion), "%#" PRIx64, val); 4352 int expansion_offset = right - new_filter; 4353 4354 pr_debug("%s", expansion); 4355 4356 if (asprintf(&n, "%.*s%s%s", expansion_offset, new_filter, expansion, right_end) < 0) { 4357 pr_debug(" out of memory!\n"); 4358 free(new_filter); 4359 return -1; 4360 } 4361 if (new_filter != evsel->filter) 4362 free(new_filter); 4363 left = n + expansion_offset + expansion_lenght; 4364 new_filter = n; 4365 } else { 4366 pr_err("\"%.*s\" not found for \"%s\" in \"%s\", can't set filter \"%s\"\n", 4367 right_size, right, arg, evsel->name, evsel->filter); 4368 return -1; 4369 } 4370 } else { 4371 pr_err("No resolver (strtoul) for \"%s\" in \"%s\", can't set filter \"%s\"\n", 4372 arg, evsel->name, evsel->filter); 4373 return -1; 4374 } 4375 4376 pr_debug("\n"); 4377 } else { 4378 left = right_end; 4379 } 4380 } 4381 4382 if (new_filter != evsel->filter) { 4383 pr_debug("New filter for %s: %s\n", evsel->name, new_filter); 4384 evsel__set_filter(evsel, new_filter); 4385 free(new_filter); 4386 } 4387 4388 return 0; 4389 } 4390 4391 static int trace__expand_filters(struct trace *trace, struct evsel **err_evsel) 4392 { 4393 struct evlist *evlist = trace->evlist; 4394 struct evsel *evsel; 4395 4396 evlist__for_each_entry(evlist, evsel) { 4397 if (evsel->filter == NULL) 4398 continue; 4399 4400 if (trace__expand_filter(trace, evsel)) { 4401 *err_evsel = evsel; 4402 return -1; 4403 } 4404 } 4405 4406 return 0; 4407 } 4408 4409 static int trace__run(struct trace *trace, int argc, const char **argv) 4410 { 4411 struct evlist *evlist = trace->evlist; 4412 struct evsel *evsel, *pgfault_maj = NULL, *pgfault_min = NULL; 4413 int err = -1, i; 4414 unsigned long before; 4415 const bool forks = argc > 0; 4416 bool draining = false; 4417 4418 trace->live = true; 4419 4420 if (trace->summary_bpf) { 4421 if (trace_prepare_bpf_summary(trace->summary_mode) < 0) 4422 goto out_delete_evlist; 4423 4424 if (trace->summary_only) 4425 goto create_maps; 4426 } 4427 4428 if (!trace->raw_augmented_syscalls) { 4429 if (trace->trace_syscalls && trace__add_syscall_newtp(trace)) 4430 goto out_error_raw_syscalls; 4431 4432 if (trace->trace_syscalls) 4433 trace->vfs_getname = evlist__add_vfs_getname(evlist); 4434 } 4435 4436 if ((trace->trace_pgfaults & TRACE_PFMAJ)) { 4437 pgfault_maj = evsel__new_pgfault(PERF_COUNT_SW_PAGE_FAULTS_MAJ); 4438 if (pgfault_maj == NULL) 4439 goto out_error_mem; 4440 evsel__config_callchain(pgfault_maj, &trace->opts, &callchain_param); 4441 evlist__add(evlist, pgfault_maj); 4442 } 4443 4444 if ((trace->trace_pgfaults & TRACE_PFMIN)) { 4445 pgfault_min = evsel__new_pgfault(PERF_COUNT_SW_PAGE_FAULTS_MIN); 4446 if (pgfault_min == NULL) 4447 goto out_error_mem; 4448 evsel__config_callchain(pgfault_min, &trace->opts, &callchain_param); 4449 evlist__add(evlist, pgfault_min); 4450 } 4451 4452 /* Enable ignoring missing threads when -p option is defined. */ 4453 trace->opts.ignore_missing_thread = trace->opts.target.pid; 4454 4455 if (trace->sched && 4456 evlist__add_newtp(evlist, "sched", "sched_stat_runtime", trace__sched_stat_runtime)) 4457 goto out_error_sched_stat_runtime; 4458 /* 4459 * If a global cgroup was set, apply it to all the events without an 4460 * explicit cgroup. I.e.: 4461 * 4462 * trace -G A -e sched:*switch 4463 * 4464 * Will set all raw_syscalls:sys_{enter,exit}, pgfault, vfs_getname, etc 4465 * _and_ sched:sched_switch to the 'A' cgroup, while: 4466 * 4467 * trace -e sched:*switch -G A 4468 * 4469 * will only set the sched:sched_switch event to the 'A' cgroup, all the 4470 * other events (raw_syscalls:sys_{enter,exit}, etc are left "without" 4471 * a cgroup (on the root cgroup, sys wide, etc). 4472 * 4473 * Multiple cgroups: 4474 * 4475 * trace -G A -e sched:*switch -G B 4476 * 4477 * the syscall ones go to the 'A' cgroup, the sched:sched_switch goes 4478 * to the 'B' cgroup. 4479 * 4480 * evlist__set_default_cgroup() grabs a reference of the passed cgroup 4481 * only for the evsels still without a cgroup, i.e. evsel->cgroup == NULL. 4482 */ 4483 if (trace->cgroup) 4484 evlist__set_default_cgroup(trace->evlist, trace->cgroup); 4485 4486 create_maps: 4487 err = evlist__create_maps(evlist, &trace->opts.target); 4488 if (err < 0) { 4489 fprintf(trace->output, "Problems parsing the target to trace, check your options!\n"); 4490 goto out_delete_evlist; 4491 } 4492 4493 err = trace__symbols_init(trace, argc, argv, evlist); 4494 if (err < 0) { 4495 fprintf(trace->output, "Problems initializing symbol libraries!\n"); 4496 goto out_delete_evlist; 4497 } 4498 4499 if (trace->summary_mode == SUMMARY__BY_TOTAL && !trace->summary_bpf) { 4500 trace->syscall_stats = alloc_syscall_stats(); 4501 if (!trace->syscall_stats) 4502 goto out_delete_evlist; 4503 } 4504 4505 evlist__config(evlist, &trace->opts, &callchain_param); 4506 4507 if (forks) { 4508 err = evlist__prepare_workload(evlist, &trace->opts.target, argv, false, NULL); 4509 if (err < 0) { 4510 fprintf(trace->output, "Couldn't run the workload!\n"); 4511 goto out_delete_evlist; 4512 } 4513 workload_pid = evlist->workload.pid; 4514 } 4515 4516 err = evlist__open(evlist); 4517 if (err < 0) 4518 goto out_error_open; 4519 4520 augmented_syscalls__setup_bpf_output(); 4521 4522 err = trace__set_filter_pids(trace); 4523 if (err < 0) 4524 goto out_error_mem; 4525 4526 /* 4527 * TODO: Initialize for all host binary machine types, not just 4528 * those matching the perf binary. 4529 */ 4530 trace__init_syscalls_bpf_prog_array_maps(trace, EM_HOST); 4531 4532 if (trace->ev_qualifier_ids.nr > 0) { 4533 err = trace__set_ev_qualifier_filter(trace); 4534 if (err < 0) 4535 goto out_errno; 4536 4537 if (trace->syscalls.events.sys_exit) { 4538 pr_debug("event qualifier tracepoint filter: %s\n", 4539 trace->syscalls.events.sys_exit->filter); 4540 } 4541 } 4542 4543 /* 4544 * If the "close" syscall is not traced, then we will not have the 4545 * opportunity to, in syscall_arg__scnprintf_close_fd() invalidate the 4546 * fd->pathname table and were ending up showing the last value set by 4547 * syscalls opening a pathname and associating it with a descriptor or 4548 * reading it from /proc/pid/fd/ in cases where that doesn't make 4549 * sense. 4550 * 4551 * So just disable this beautifier (SCA_FD, SCA_FDAT) when 'close' is 4552 * not in use. 4553 */ 4554 /* TODO: support for more than just perf binary machine type close. */ 4555 trace->fd_path_disabled = !trace__syscall_enabled(trace, syscalltbl__id(EM_HOST, "close")); 4556 4557 err = trace__expand_filters(trace, &evsel); 4558 if (err) 4559 goto out_delete_evlist; 4560 err = evlist__apply_filters(evlist, &evsel, &trace->opts.target); 4561 if (err < 0) 4562 goto out_error_apply_filters; 4563 4564 if (!trace->summary_only || !trace->summary_bpf) { 4565 err = evlist__mmap(evlist, trace->opts.mmap_pages); 4566 if (err < 0) 4567 goto out_error_mmap; 4568 } 4569 4570 if (!target__none(&trace->opts.target) && !trace->opts.target.initial_delay) 4571 evlist__enable(evlist); 4572 4573 if (forks) 4574 evlist__start_workload(evlist); 4575 4576 if (trace->opts.target.initial_delay) { 4577 usleep(trace->opts.target.initial_delay * 1000); 4578 evlist__enable(evlist); 4579 } 4580 4581 if (trace->summary_bpf) 4582 trace_start_bpf_summary(); 4583 4584 trace->multiple_threads = perf_thread_map__pid(evlist->core.threads, 0) == -1 || 4585 perf_thread_map__nr(evlist->core.threads) > 1 || 4586 evlist__first(evlist)->core.attr.inherit; 4587 4588 /* 4589 * Now that we already used evsel->core.attr to ask the kernel to setup the 4590 * events, lets reuse evsel->core.attr.sample_max_stack as the limit in 4591 * trace__resolve_callchain(), allowing per-event max-stack settings 4592 * to override an explicitly set --max-stack global setting. 4593 */ 4594 evlist__for_each_entry(evlist, evsel) { 4595 if (evsel__has_callchain(evsel) && 4596 evsel->core.attr.sample_max_stack == 0) 4597 evsel->core.attr.sample_max_stack = trace->max_stack; 4598 } 4599 again: 4600 before = trace->nr_events; 4601 4602 for (i = 0; i < evlist->core.nr_mmaps; i++) { 4603 union perf_event *event; 4604 struct mmap *md; 4605 4606 md = &evlist->mmap[i]; 4607 if (perf_mmap__read_init(&md->core) < 0) 4608 continue; 4609 4610 while ((event = perf_mmap__read_event(&md->core)) != NULL) { 4611 ++trace->nr_events; 4612 4613 err = trace__deliver_event(trace, event); 4614 if (err) 4615 goto out_disable; 4616 4617 perf_mmap__consume(&md->core); 4618 4619 if (interrupted) 4620 goto out_disable; 4621 4622 if (done && !draining) { 4623 evlist__disable(evlist); 4624 draining = true; 4625 } 4626 } 4627 perf_mmap__read_done(&md->core); 4628 } 4629 4630 if (trace->nr_events == before) { 4631 int timeout = done ? 100 : -1; 4632 4633 if (!draining && evlist__poll(evlist, timeout) > 0) { 4634 if (evlist__filter_pollfd(evlist, POLLERR | POLLHUP | POLLNVAL) == 0) 4635 draining = true; 4636 4637 goto again; 4638 } else { 4639 if (trace__flush_events(trace)) 4640 goto out_disable; 4641 } 4642 } else { 4643 goto again; 4644 } 4645 4646 out_disable: 4647 thread__zput(trace->current); 4648 4649 evlist__disable(evlist); 4650 4651 if (trace->summary_bpf) 4652 trace_end_bpf_summary(); 4653 4654 if (trace->sort_events) 4655 ordered_events__flush(&trace->oe.data, OE_FLUSH__FINAL); 4656 4657 if (!err) { 4658 if (trace->summary) { 4659 if (trace->summary_bpf) 4660 trace_print_bpf_summary(trace->output, trace->max_summary); 4661 else if (trace->summary_mode == SUMMARY__BY_TOTAL) 4662 trace__fprintf_total_summary(trace, trace->output); 4663 else 4664 trace__fprintf_thread_summary(trace, trace->output); 4665 } 4666 4667 if (trace->show_tool_stats) { 4668 fprintf(trace->output, "Stats:\n " 4669 " vfs_getname : %" PRIu64 "\n" 4670 " proc_getname: %" PRIu64 "\n", 4671 trace->stats.vfs_getname, 4672 trace->stats.proc_getname); 4673 } 4674 } 4675 4676 out_delete_evlist: 4677 trace_cleanup_bpf_summary(); 4678 delete_syscall_stats(trace->syscall_stats); 4679 trace__symbols__exit(trace); 4680 evlist__free_syscall_tp_fields(evlist); 4681 evlist__delete(evlist); 4682 cgroup__put(trace->cgroup); 4683 trace->evlist = NULL; 4684 trace->live = false; 4685 return err; 4686 { 4687 char errbuf[BUFSIZ]; 4688 4689 out_error_sched_stat_runtime: 4690 tracing_path__strerror_open_tp(errno, errbuf, sizeof(errbuf), "sched", "sched_stat_runtime"); 4691 goto out_error; 4692 4693 out_error_raw_syscalls: 4694 tracing_path__strerror_open_tp(errno, errbuf, sizeof(errbuf), "raw_syscalls", "sys_(enter|exit)"); 4695 goto out_error; 4696 4697 out_error_mmap: 4698 evlist__strerror_mmap(evlist, errno, errbuf, sizeof(errbuf)); 4699 goto out_error; 4700 4701 out_error_open: 4702 evlist__strerror_open(evlist, errno, errbuf, sizeof(errbuf)); 4703 4704 out_error: 4705 fprintf(trace->output, "%s\n", errbuf); 4706 goto out_delete_evlist; 4707 4708 out_error_apply_filters: 4709 fprintf(trace->output, 4710 "Failed to set filter \"%s\" on event %s: %m\n", 4711 evsel->filter, evsel__name(evsel)); 4712 goto out_delete_evlist; 4713 } 4714 out_error_mem: 4715 fprintf(trace->output, "Not enough memory to run!\n"); 4716 goto out_delete_evlist; 4717 4718 out_errno: 4719 fprintf(trace->output, "%m\n"); 4720 goto out_delete_evlist; 4721 } 4722 4723 static int trace__replay(struct trace *trace) 4724 { 4725 const struct evsel_str_handler handlers[] = { 4726 { "probe:vfs_getname", trace__vfs_getname, }, 4727 }; 4728 struct perf_data data = { 4729 .path = input_name, 4730 .mode = PERF_DATA_MODE_READ, 4731 .force = trace->force, 4732 }; 4733 struct perf_session *session; 4734 struct evsel *evsel; 4735 int err = -1; 4736 4737 perf_tool__init(&trace->tool, /*ordered_events=*/true); 4738 trace->tool.sample = trace__process_sample; 4739 trace->tool.mmap = perf_event__process_mmap; 4740 trace->tool.mmap2 = perf_event__process_mmap2; 4741 trace->tool.comm = perf_event__process_comm; 4742 trace->tool.exit = perf_event__process_exit; 4743 trace->tool.fork = perf_event__process_fork; 4744 trace->tool.attr = perf_event__process_attr; 4745 trace->tool.tracing_data = perf_event__process_tracing_data; 4746 trace->tool.build_id = perf_event__process_build_id; 4747 trace->tool.namespaces = perf_event__process_namespaces; 4748 4749 trace->tool.ordered_events = true; 4750 trace->tool.ordering_requires_timestamps = true; 4751 4752 /* add tid to output */ 4753 trace->multiple_threads = true; 4754 4755 session = perf_session__new(&data, &trace->tool); 4756 if (IS_ERR(session)) 4757 return PTR_ERR(session); 4758 4759 if (trace->opts.target.pid) 4760 symbol_conf.pid_list_str = strdup(trace->opts.target.pid); 4761 4762 if (trace->opts.target.tid) 4763 symbol_conf.tid_list_str = strdup(trace->opts.target.tid); 4764 4765 if (symbol__init(perf_session__env(session)) < 0) 4766 goto out; 4767 4768 trace->host = &session->machines.host; 4769 4770 err = perf_session__set_tracepoints_handlers(session, handlers); 4771 if (err) 4772 goto out; 4773 4774 evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_enter"); 4775 trace->syscalls.events.sys_enter = evsel; 4776 /* older kernels have syscalls tp versus raw_syscalls */ 4777 if (evsel == NULL) 4778 evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_enter"); 4779 4780 if (evsel && 4781 (evsel__init_raw_syscall_tp(evsel, trace__sys_enter) < 0 || 4782 perf_evsel__init_sc_tp_ptr_field(evsel, args))) { 4783 pr_err("Error during initialize raw_syscalls:sys_enter event\n"); 4784 goto out; 4785 } 4786 4787 evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_exit"); 4788 trace->syscalls.events.sys_exit = evsel; 4789 if (evsel == NULL) 4790 evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_exit"); 4791 if (evsel && 4792 (evsel__init_raw_syscall_tp(evsel, trace__sys_exit) < 0 || 4793 perf_evsel__init_sc_tp_uint_field(evsel, ret))) { 4794 pr_err("Error during initialize raw_syscalls:sys_exit event\n"); 4795 goto out; 4796 } 4797 4798 evlist__for_each_entry(session->evlist, evsel) { 4799 if (evsel->core.attr.type == PERF_TYPE_SOFTWARE && 4800 (evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ || 4801 evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MIN || 4802 evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS)) 4803 evsel->handler = trace__pgfault; 4804 } 4805 4806 if (trace->summary_mode == SUMMARY__BY_TOTAL) { 4807 trace->syscall_stats = alloc_syscall_stats(); 4808 if (!trace->syscall_stats) 4809 goto out; 4810 } 4811 4812 setup_pager(); 4813 4814 err = perf_session__process_events(session); 4815 if (err) 4816 pr_err("Failed to process events, error %d", err); 4817 4818 else if (trace->summary) 4819 trace__fprintf_thread_summary(trace, trace->output); 4820 4821 out: 4822 delete_syscall_stats(trace->syscall_stats); 4823 perf_session__delete(session); 4824 4825 return err; 4826 } 4827 4828 static size_t trace__fprintf_summary_header(FILE *fp) 4829 { 4830 size_t printed; 4831 4832 printed = fprintf(fp, "\n Summary of events:\n\n"); 4833 4834 return printed; 4835 } 4836 4837 struct syscall_entry { 4838 struct syscall_stats *stats; 4839 double msecs; 4840 int syscall; 4841 }; 4842 4843 static int entry_cmp(const void *e1, const void *e2) 4844 { 4845 const struct syscall_entry *entry1 = e1; 4846 const struct syscall_entry *entry2 = e2; 4847 4848 return entry1->msecs > entry2->msecs ? -1 : 1; 4849 } 4850 4851 static struct syscall_entry *syscall__sort_stats(struct hashmap *syscall_stats) 4852 { 4853 struct syscall_entry *entry; 4854 struct hashmap_entry *pos; 4855 unsigned bkt, i, nr; 4856 4857 nr = syscall_stats->sz; 4858 entry = malloc(nr * sizeof(*entry)); 4859 if (entry == NULL) 4860 return NULL; 4861 4862 i = 0; 4863 hashmap__for_each_entry(syscall_stats, pos, bkt) { 4864 struct syscall_stats *ss = pos->pvalue; 4865 struct stats *st = &ss->stats; 4866 4867 entry[i].stats = ss; 4868 entry[i].msecs = (u64)st->n * (avg_stats(st) / NSEC_PER_MSEC); 4869 entry[i].syscall = pos->key; 4870 i++; 4871 } 4872 assert(i == nr); 4873 4874 qsort(entry, nr, sizeof(*entry), entry_cmp); 4875 return entry; 4876 } 4877 4878 static size_t syscall__dump_stats(struct trace *trace, int e_machine, FILE *fp, 4879 struct hashmap *syscall_stats) 4880 { 4881 size_t printed = 0; 4882 int lines = 0; 4883 struct syscall *sc; 4884 struct syscall_entry *entries; 4885 4886 entries = syscall__sort_stats(syscall_stats); 4887 if (entries == NULL) 4888 return 0; 4889 4890 printed += fprintf(fp, "\n"); 4891 4892 printed += fprintf(fp, " syscall calls errors total min avg max stddev\n"); 4893 printed += fprintf(fp, " (msec) (msec) (msec) (msec) (%%)\n"); 4894 printed += fprintf(fp, " --------------- -------- ------ -------- --------- --------- --------- ------\n"); 4895 4896 for (size_t i = 0; i < syscall_stats->sz; i++) { 4897 struct syscall_entry *entry = &entries[i]; 4898 struct syscall_stats *stats = entry->stats; 4899 4900 if (stats) { 4901 double min = (double)(stats->stats.min) / NSEC_PER_MSEC; 4902 double max = (double)(stats->stats.max) / NSEC_PER_MSEC; 4903 double avg = avg_stats(&stats->stats); 4904 double pct; 4905 u64 n = (u64)stats->stats.n; 4906 4907 pct = avg ? 100.0 * stddev_stats(&stats->stats) / avg : 0.0; 4908 avg /= NSEC_PER_MSEC; 4909 4910 sc = trace__syscall_info(trace, /*evsel=*/NULL, e_machine, entry->syscall); 4911 if (!sc) 4912 continue; 4913 4914 printed += fprintf(fp, " %-15s", sc->name); 4915 printed += fprintf(fp, " %8" PRIu64 " %6" PRIu64 " %9.3f %9.3f %9.3f", 4916 n, stats->nr_failures, entry->msecs, min, avg); 4917 printed += fprintf(fp, " %9.3f %9.2f%%\n", max, pct); 4918 4919 if (trace->errno_summary && stats->nr_failures) { 4920 int e; 4921 4922 for (e = 0; e < stats->max_errno; ++e) { 4923 if (stats->errnos[e] != 0) 4924 fprintf(fp, "\t\t\t\t%s: %d\n", perf_env__arch_strerrno(trace->host->env, e + 1), stats->errnos[e]); 4925 } 4926 } 4927 lines++; 4928 } 4929 4930 if (trace->max_summary && trace->max_summary <= lines) 4931 break; 4932 } 4933 4934 free(entries); 4935 printed += fprintf(fp, "\n\n"); 4936 4937 return printed; 4938 } 4939 4940 static size_t thread__dump_stats(struct thread_trace *ttrace, 4941 struct trace *trace, int e_machine, FILE *fp) 4942 { 4943 return syscall__dump_stats(trace, e_machine, fp, ttrace->syscall_stats); 4944 } 4945 4946 static size_t system__dump_stats(struct trace *trace, int e_machine, FILE *fp) 4947 { 4948 return syscall__dump_stats(trace, e_machine, fp, trace->syscall_stats); 4949 } 4950 4951 static size_t trace__fprintf_thread(FILE *fp, struct thread *thread, struct trace *trace) 4952 { 4953 size_t printed = 0; 4954 struct thread_trace *ttrace = thread__priv(thread); 4955 int e_machine = thread__e_machine(thread, trace->host, /*e_flags=*/NULL); 4956 double ratio; 4957 4958 if (ttrace == NULL) 4959 return 0; 4960 4961 ratio = (double)ttrace->nr_events / trace->nr_events * 100.0; 4962 4963 printed += fprintf(fp, " %s (%d), ", thread__comm_str(thread), thread__tid(thread)); 4964 printed += fprintf(fp, "%lu events, ", ttrace->nr_events); 4965 printed += fprintf(fp, "%.1f%%", ratio); 4966 if (ttrace->pfmaj) 4967 printed += fprintf(fp, ", %lu majfaults", ttrace->pfmaj); 4968 if (ttrace->pfmin) 4969 printed += fprintf(fp, ", %lu minfaults", ttrace->pfmin); 4970 if (trace->sched) 4971 printed += fprintf(fp, ", %.3f msec\n", ttrace->runtime_ms); 4972 else if (fputc('\n', fp) != EOF) 4973 ++printed; 4974 4975 printed += thread__dump_stats(ttrace, trace, e_machine, fp); 4976 4977 return printed; 4978 } 4979 4980 static unsigned long thread__nr_events(struct thread_trace *ttrace) 4981 { 4982 return ttrace ? ttrace->nr_events : 0; 4983 } 4984 4985 static int trace_nr_events_cmp(void *priv __maybe_unused, 4986 const struct list_head *la, 4987 const struct list_head *lb) 4988 { 4989 struct thread_list *a = list_entry(la, struct thread_list, list); 4990 struct thread_list *b = list_entry(lb, struct thread_list, list); 4991 unsigned long a_nr_events = thread__nr_events(thread__priv(a->thread)); 4992 unsigned long b_nr_events = thread__nr_events(thread__priv(b->thread)); 4993 4994 if (a_nr_events != b_nr_events) 4995 return a_nr_events < b_nr_events ? -1 : 1; 4996 4997 /* Identical number of threads, place smaller tids first. */ 4998 return thread__tid(a->thread) < thread__tid(b->thread) 4999 ? -1 5000 : (thread__tid(a->thread) > thread__tid(b->thread) ? 1 : 0); 5001 } 5002 5003 static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp) 5004 { 5005 size_t printed = trace__fprintf_summary_header(fp); 5006 LIST_HEAD(threads); 5007 5008 if (machine__thread_list(trace->host, &threads) == 0) { 5009 struct thread_list *pos; 5010 5011 list_sort(NULL, &threads, trace_nr_events_cmp); 5012 5013 list_for_each_entry(pos, &threads, list) 5014 printed += trace__fprintf_thread(fp, pos->thread, trace); 5015 } 5016 thread_list__delete(&threads); 5017 return printed; 5018 } 5019 5020 static size_t trace__fprintf_total_summary(struct trace *trace, FILE *fp) 5021 { 5022 size_t printed = trace__fprintf_summary_header(fp); 5023 5024 printed += fprintf(fp, " total, "); 5025 printed += fprintf(fp, "%lu events", trace->nr_events); 5026 5027 if (trace->pfmaj) 5028 printed += fprintf(fp, ", %lu majfaults", trace->pfmaj); 5029 if (trace->pfmin) 5030 printed += fprintf(fp, ", %lu minfaults", trace->pfmin); 5031 if (trace->sched) 5032 printed += fprintf(fp, ", %.3f msec\n", trace->runtime_ms); 5033 else if (fputc('\n', fp) != EOF) 5034 ++printed; 5035 5036 /* TODO: get all system e_machines. */ 5037 printed += system__dump_stats(trace, EM_HOST, fp); 5038 5039 return printed; 5040 } 5041 5042 static int trace__set_duration(const struct option *opt, const char *str, 5043 int unset __maybe_unused) 5044 { 5045 struct trace *trace = opt->value; 5046 5047 trace->duration_filter = atof(str); 5048 return 0; 5049 } 5050 5051 static int trace__set_filter_pids_from_option(const struct option *opt, const char *str, 5052 int unset __maybe_unused) 5053 { 5054 int ret = -1; 5055 size_t i; 5056 struct trace *trace = opt->value; 5057 /* 5058 * FIXME: introduce a intarray class, plain parse csv and create a 5059 * { int nr, int entries[] } struct... 5060 */ 5061 struct intlist *list = intlist__new(str); 5062 5063 if (list == NULL) 5064 return -1; 5065 5066 i = trace->filter_pids.nr = intlist__nr_entries(list) + 1; 5067 trace->filter_pids.entries = calloc(i, sizeof(pid_t)); 5068 5069 if (trace->filter_pids.entries == NULL) 5070 goto out; 5071 5072 trace->filter_pids.entries[0] = getpid(); 5073 5074 for (i = 1; i < trace->filter_pids.nr; ++i) 5075 trace->filter_pids.entries[i] = intlist__entry(list, i - 1)->i; 5076 5077 intlist__delete(list); 5078 ret = 0; 5079 out: 5080 return ret; 5081 } 5082 5083 static int trace__open_output(struct trace *trace, const char *filename) 5084 { 5085 struct stat st; 5086 5087 if (!stat(filename, &st) && st.st_size) { 5088 char oldname[PATH_MAX]; 5089 5090 scnprintf(oldname, sizeof(oldname), "%s.old", filename); 5091 unlink(oldname); 5092 rename(filename, oldname); 5093 } 5094 5095 trace->output = fopen(filename, "w"); 5096 5097 return trace->output == NULL ? -errno : 0; 5098 } 5099 5100 static int parse_pagefaults(const struct option *opt, const char *str, 5101 int unset __maybe_unused) 5102 { 5103 int *trace_pgfaults = opt->value; 5104 5105 if (strcmp(str, "all") == 0) 5106 *trace_pgfaults |= TRACE_PFMAJ | TRACE_PFMIN; 5107 else if (strcmp(str, "maj") == 0) 5108 *trace_pgfaults |= TRACE_PFMAJ; 5109 else if (strcmp(str, "min") == 0) 5110 *trace_pgfaults |= TRACE_PFMIN; 5111 else 5112 return -1; 5113 5114 return 0; 5115 } 5116 5117 static void evlist__set_default_evsel_handler(struct evlist *evlist, void *handler) 5118 { 5119 struct evsel *evsel; 5120 5121 evlist__for_each_entry(evlist, evsel) { 5122 if (evsel->handler == NULL) 5123 evsel->handler = handler; 5124 } 5125 } 5126 5127 static void evsel__set_syscall_arg_fmt(struct evsel *evsel, const char *name) 5128 { 5129 struct syscall_arg_fmt *fmt = evsel__syscall_arg_fmt(evsel); 5130 5131 if (fmt) { 5132 const struct syscall_fmt *scfmt = syscall_fmt__find(name); 5133 5134 if (scfmt) { 5135 const struct tep_event *tp_format = evsel__tp_format(evsel); 5136 5137 if (tp_format) { 5138 int skip = 0; 5139 5140 if (strcmp(tp_format->format.fields->name, "__syscall_nr") == 0 || 5141 strcmp(tp_format->format.fields->name, "nr") == 0) 5142 ++skip; 5143 5144 memcpy(fmt + skip, scfmt->arg, 5145 (tp_format->format.nr_fields - skip) * sizeof(*fmt)); 5146 } 5147 } 5148 } 5149 } 5150 5151 static int evlist__set_syscall_tp_fields(struct evlist *evlist, bool *use_btf) 5152 { 5153 struct evsel *evsel; 5154 5155 evlist__for_each_entry(evlist, evsel) { 5156 const struct tep_event *tp_format; 5157 5158 if (evsel->priv) 5159 continue; 5160 5161 tp_format = evsel__tp_format(evsel); 5162 if (!tp_format) 5163 continue; 5164 5165 if (strcmp(tp_format->system, "syscalls")) { 5166 evsel__init_tp_arg_scnprintf(evsel, use_btf); 5167 continue; 5168 } 5169 5170 if (evsel__init_syscall_tp(evsel)) 5171 return -1; 5172 5173 if (!strncmp(tp_format->name, "sys_enter_", 10)) { 5174 struct syscall_tp *sc = __evsel__syscall_tp(evsel); 5175 5176 if (__tp_field__init_ptr(&sc->args, sc->id.offset + sizeof(u64))) 5177 return -1; 5178 5179 evsel__set_syscall_arg_fmt(evsel, 5180 tp_format->name + sizeof("sys_enter_") - 1); 5181 } else if (!strncmp(tp_format->name, "sys_exit_", 9)) { 5182 struct syscall_tp *sc = __evsel__syscall_tp(evsel); 5183 5184 if (__tp_field__init_uint(&sc->ret, sizeof(u64), 5185 sc->id.offset + sizeof(u64), 5186 evsel->needs_swap)) 5187 return -1; 5188 5189 evsel__set_syscall_arg_fmt(evsel, 5190 tp_format->name + sizeof("sys_exit_") - 1); 5191 } 5192 } 5193 5194 return 0; 5195 } 5196 5197 /* 5198 * XXX: Hackish, just splitting the combined -e+--event (syscalls 5199 * (raw_syscalls:{sys_{enter,exit}} + events (tracepoints, HW, SW, etc) to use 5200 * existing facilities unchanged (trace->ev_qualifier + parse_options()). 5201 * 5202 * It'd be better to introduce a parse_options() variant that would return a 5203 * list with the terms it didn't match to an event... 5204 */ 5205 static int trace__parse_events_option(const struct option *opt, const char *str, 5206 int unset __maybe_unused) 5207 { 5208 struct trace *trace = (struct trace *)opt->value; 5209 const char *s; 5210 char *strd, *sep = NULL, *lists[2] = { NULL, NULL, }; 5211 int len = strlen(str) + 1, err = -1, list, idx; 5212 char *strace_groups_dir = system_path(STRACE_GROUPS_DIR); 5213 char group_name[PATH_MAX]; 5214 const struct syscall_fmt *fmt; 5215 5216 if (strace_groups_dir == NULL) 5217 return -1; 5218 5219 s = strd = strdup(str); 5220 if (strd == NULL) 5221 return -1; 5222 5223 if (*s == '!') { 5224 ++s; 5225 trace->not_ev_qualifier = true; 5226 } 5227 5228 while (1) { 5229 if ((sep = strchr((char *)s, ',')) != NULL) 5230 *sep = '\0'; 5231 5232 list = 0; 5233 /* TODO: support for more than just perf binary machine type syscalls. */ 5234 if (syscalltbl__id(EM_HOST, s) >= 0 || 5235 syscalltbl__strglobmatch_first(EM_HOST, s, &idx) >= 0) { 5236 list = 1; 5237 goto do_concat; 5238 } 5239 5240 fmt = syscall_fmt__find_by_alias(s); 5241 if (fmt != NULL) { 5242 list = 1; 5243 s = fmt->name; 5244 } else { 5245 path__join(group_name, sizeof(group_name), strace_groups_dir, s); 5246 if (access(group_name, R_OK) == 0) 5247 list = 1; 5248 } 5249 do_concat: 5250 if (lists[list]) { 5251 sprintf(lists[list] + strlen(lists[list]), ",%s", s); 5252 } else { 5253 lists[list] = malloc(len); 5254 if (lists[list] == NULL) 5255 goto out; 5256 strcpy(lists[list], s); 5257 } 5258 5259 if (!sep) 5260 break; 5261 5262 *sep = ','; 5263 s = sep + 1; 5264 } 5265 5266 if (lists[1] != NULL) { 5267 struct strlist_config slist_config = { 5268 .dirname = strace_groups_dir, 5269 }; 5270 5271 trace->ev_qualifier = strlist__new(lists[1], &slist_config); 5272 if (trace->ev_qualifier == NULL) { 5273 fputs("Not enough memory to parse event qualifier", trace->output); 5274 goto out; 5275 } 5276 5277 if (trace__validate_ev_qualifier(trace)) 5278 goto out; 5279 trace->trace_syscalls = true; 5280 } 5281 5282 err = 0; 5283 5284 if (lists[0]) { 5285 struct parse_events_option_args parse_events_option_args = { 5286 .evlistp = &trace->evlist, 5287 }; 5288 struct option o = { 5289 .value = &parse_events_option_args, 5290 }; 5291 err = parse_events_option(&o, lists[0], 0); 5292 } 5293 out: 5294 free(strace_groups_dir); 5295 free(lists[0]); 5296 free(lists[1]); 5297 free(strd); 5298 5299 return err; 5300 } 5301 5302 static int trace__parse_cgroups(const struct option *opt, const char *str, int unset) 5303 { 5304 struct trace *trace = opt->value; 5305 5306 if (!list_empty(&trace->evlist->core.entries)) { 5307 struct option o = { 5308 .value = &trace->evlist, 5309 }; 5310 return parse_cgroups(&o, str, unset); 5311 } 5312 trace->cgroup = evlist__findnew_cgroup(trace->evlist, str); 5313 5314 return 0; 5315 } 5316 5317 static int trace__parse_summary_mode(const struct option *opt, const char *str, 5318 int unset __maybe_unused) 5319 { 5320 struct trace *trace = opt->value; 5321 5322 if (!strcmp(str, "thread")) { 5323 trace->summary_mode = SUMMARY__BY_THREAD; 5324 } else if (!strcmp(str, "total")) { 5325 trace->summary_mode = SUMMARY__BY_TOTAL; 5326 } else if (!strcmp(str, "cgroup")) { 5327 trace->summary_mode = SUMMARY__BY_CGROUP; 5328 } else { 5329 pr_err("Unknown summary mode: %s\n", str); 5330 return -1; 5331 } 5332 5333 return 0; 5334 } 5335 5336 static int trace_parse_callchain_opt(const struct option *opt, 5337 const char *arg, 5338 int unset) 5339 { 5340 return record_opts__parse_callchain(opt->value, &callchain_param, arg, unset); 5341 } 5342 5343 static int trace__config(const char *var, const char *value, void *arg) 5344 { 5345 struct trace *trace = arg; 5346 int err = 0; 5347 5348 if (!strcmp(var, "trace.add_events")) { 5349 trace->perfconfig_events = strdup(value); 5350 if (trace->perfconfig_events == NULL) { 5351 pr_err("Not enough memory for %s\n", "trace.add_events"); 5352 return -1; 5353 } 5354 } else if (!strcmp(var, "trace.show_timestamp")) { 5355 trace->show_tstamp = perf_config_bool(var, value); 5356 } else if (!strcmp(var, "trace.show_duration")) { 5357 trace->show_duration = perf_config_bool(var, value); 5358 } else if (!strcmp(var, "trace.show_arg_names")) { 5359 trace->show_arg_names = perf_config_bool(var, value); 5360 if (!trace->show_arg_names) 5361 trace->show_zeros = true; 5362 } else if (!strcmp(var, "trace.show_zeros")) { 5363 bool new_show_zeros = perf_config_bool(var, value); 5364 if (!trace->show_arg_names && !new_show_zeros) { 5365 pr_warning("trace.show_zeros has to be set when trace.show_arg_names=no\n"); 5366 goto out; 5367 } 5368 trace->show_zeros = new_show_zeros; 5369 } else if (!strcmp(var, "trace.show_prefix")) { 5370 trace->show_string_prefix = perf_config_bool(var, value); 5371 } else if (!strcmp(var, "trace.no_inherit")) { 5372 trace->opts.no_inherit = perf_config_bool(var, value); 5373 } else if (!strcmp(var, "trace.args_alignment")) { 5374 int args_alignment = 0; 5375 if (perf_config_int(&args_alignment, var, value) == 0) 5376 trace->args_alignment = args_alignment; 5377 } else if (!strcmp(var, "trace.tracepoint_beautifiers")) { 5378 if (strcasecmp(value, "libtraceevent") == 0) 5379 trace->libtraceevent_print = true; 5380 else if (strcasecmp(value, "libbeauty") == 0) 5381 trace->libtraceevent_print = false; 5382 } 5383 out: 5384 return err; 5385 } 5386 5387 static void trace__exit(struct trace *trace) 5388 { 5389 thread__zput(trace->current); 5390 strlist__delete(trace->ev_qualifier); 5391 zfree(&trace->ev_qualifier_ids.entries); 5392 if (trace->syscalls.table) { 5393 for (size_t i = 0; i < trace->syscalls.table_size; i++) 5394 syscall__delete(trace->syscalls.table[i]); 5395 zfree(&trace->syscalls.table); 5396 } 5397 zfree(&trace->perfconfig_events); 5398 evlist__delete(trace->evlist); 5399 trace->evlist = NULL; 5400 ordered_events__free(&trace->oe.data); 5401 #ifdef HAVE_LIBBPF_SUPPORT 5402 btf__free(trace->btf); 5403 trace->btf = NULL; 5404 #endif 5405 } 5406 5407 int cmd_trace(int argc, const char **argv) 5408 { 5409 const char *trace_usage[] = { 5410 "perf trace [<options>] [<command>]", 5411 "perf trace [<options>] -- <command> [<options>]", 5412 "perf trace record [<options>] [<command>]", 5413 "perf trace record [<options>] -- <command> [<options>]", 5414 NULL 5415 }; 5416 struct trace trace = { 5417 .opts = { 5418 .target = { 5419 .uses_mmap = true, 5420 }, 5421 .user_freq = UINT_MAX, 5422 .user_interval = ULLONG_MAX, 5423 .no_buffering = true, 5424 .mmap_pages = UINT_MAX, 5425 }, 5426 .output = stderr, 5427 .show_comm = true, 5428 .show_tstamp = true, 5429 .show_duration = true, 5430 .show_arg_names = true, 5431 .args_alignment = 70, 5432 .trace_syscalls = false, 5433 .kernel_syscallchains = false, 5434 .max_stack = UINT_MAX, 5435 .max_events = ULONG_MAX, 5436 }; 5437 const char *output_name = NULL; 5438 const struct option trace_options[] = { 5439 OPT_CALLBACK('e', "event", &trace, "event", 5440 "event/syscall selector. use 'perf list' to list available events", 5441 trace__parse_events_option), 5442 OPT_CALLBACK(0, "filter", &trace.evlist, "filter", 5443 "event filter", parse_filter), 5444 OPT_BOOLEAN(0, "comm", &trace.show_comm, 5445 "show the thread COMM next to its id"), 5446 OPT_BOOLEAN(0, "tool_stats", &trace.show_tool_stats, "show tool stats"), 5447 OPT_CALLBACK(0, "expr", &trace, "expr", "list of syscalls/events to trace", 5448 trace__parse_events_option), 5449 OPT_STRING('o', "output", &output_name, "file", "output file name"), 5450 OPT_STRING('i', "input", &input_name, "file", "Analyze events in file"), 5451 OPT_STRING('p', "pid", &trace.opts.target.pid, "pid", 5452 "trace events on existing process id"), 5453 OPT_STRING('t', "tid", &trace.opts.target.tid, "tid", 5454 "trace events on existing thread id"), 5455 OPT_CALLBACK(0, "filter-pids", &trace, "CSV list of pids", 5456 "pids to filter (by the kernel)", trace__set_filter_pids_from_option), 5457 OPT_BOOLEAN('a', "all-cpus", &trace.opts.target.system_wide, 5458 "system-wide collection from all CPUs"), 5459 OPT_STRING('C', "cpu", &trace.opts.target.cpu_list, "cpu", 5460 "list of cpus to monitor"), 5461 OPT_BOOLEAN(0, "no-inherit", &trace.opts.no_inherit, 5462 "child tasks do not inherit counters"), 5463 OPT_CALLBACK('m', "mmap-pages", &trace.opts.mmap_pages, "pages", 5464 "number of mmap data pages", evlist__parse_mmap_pages), 5465 OPT_STRING('u', "uid", &trace.uid_str, "user", "user to profile"), 5466 OPT_BOOLEAN(0, "show-cpu", &trace.show_cpu, "show cpu id"), 5467 OPT_CALLBACK(0, "duration", &trace, "float", 5468 "show only events with duration > N.M ms", 5469 trace__set_duration), 5470 OPT_BOOLEAN(0, "sched", &trace.sched, "show blocking scheduler events"), 5471 OPT_INCR('v', "verbose", &verbose, "be more verbose"), 5472 OPT_BOOLEAN('T', "time", &trace.full_time, 5473 "Show full timestamp, not time relative to first start"), 5474 OPT_BOOLEAN(0, "failure", &trace.failure_only, 5475 "Show only syscalls that failed"), 5476 OPT_BOOLEAN('s', "summary", &trace.summary_only, 5477 "Show only syscall summary with statistics"), 5478 OPT_BOOLEAN('S', "with-summary", &trace.summary, 5479 "Show all syscalls and summary with statistics"), 5480 OPT_BOOLEAN(0, "errno-summary", &trace.errno_summary, 5481 "Show errno stats per syscall, use with -s or -S"), 5482 OPT_CALLBACK(0, "summary-mode", &trace, "mode", 5483 "How to show summary: select thread (default), total or cgroup", 5484 trace__parse_summary_mode), 5485 OPT_CALLBACK_DEFAULT('F', "pf", &trace.trace_pgfaults, "all|maj|min", 5486 "Trace pagefaults", parse_pagefaults, "maj"), 5487 OPT_BOOLEAN(0, "syscalls", &trace.trace_syscalls, "Trace syscalls"), 5488 OPT_BOOLEAN('f', "force", &trace.force, "don't complain, do it"), 5489 OPT_CALLBACK(0, "call-graph", &trace.opts, 5490 "record_mode[,record_size]", record_callchain_help, 5491 &trace_parse_callchain_opt), 5492 OPT_BOOLEAN(0, "libtraceevent_print", &trace.libtraceevent_print, 5493 "Use libtraceevent to print the tracepoint arguments."), 5494 OPT_BOOLEAN(0, "kernel-syscall-graph", &trace.kernel_syscallchains, 5495 "Show the kernel callchains on the syscall exit path"), 5496 OPT_ULONG(0, "max-events", &trace.max_events, 5497 "Set the maximum number of events to print, exit after that is reached. "), 5498 OPT_UINTEGER(0, "min-stack", &trace.min_stack, 5499 "Set the minimum stack depth when parsing the callchain, " 5500 "anything below the specified depth will be ignored."), 5501 OPT_UINTEGER(0, "max-stack", &trace.max_stack, 5502 "Set the maximum stack depth when parsing the callchain, " 5503 "anything beyond the specified depth will be ignored. " 5504 "Default: kernel.perf_event_max_stack or " __stringify(PERF_MAX_STACK_DEPTH)), 5505 OPT_BOOLEAN(0, "sort-events", &trace.sort_events, 5506 "Sort batch of events before processing, use if getting out of order events"), 5507 OPT_BOOLEAN(0, "print-sample", &trace.print_sample, 5508 "print the PERF_RECORD_SAMPLE PERF_SAMPLE_ info, for debugging"), 5509 OPT_UINTEGER(0, "proc-map-timeout", &proc_map_timeout, 5510 "per thread proc mmap processing timeout in ms"), 5511 OPT_CALLBACK('G', "cgroup", &trace, "name", "monitor event in cgroup name only", 5512 trace__parse_cgroups), 5513 OPT_INTEGER('D', "delay", &trace.opts.target.initial_delay, 5514 "ms to wait before starting measurement after program " 5515 "start"), 5516 OPT_BOOLEAN(0, "force-btf", &trace.force_btf, "Prefer btf_dump general pretty printer" 5517 "to customized ones"), 5518 OPT_BOOLEAN(0, "bpf-summary", &trace.summary_bpf, "Summary syscall stats in BPF"), 5519 OPT_INTEGER(0, "max-summary", &trace.max_summary, 5520 "Max number of entries in the summary."), 5521 OPTS_EVSWITCH(&trace.evswitch), 5522 OPT_END() 5523 }; 5524 bool __maybe_unused max_stack_user_set = true; 5525 bool mmap_pages_user_set = true; 5526 struct evsel *evsel; 5527 const char * const trace_subcommands[] = { "record", NULL }; 5528 int err = -1; 5529 char bf[BUFSIZ]; 5530 struct sigaction sigchld_act; 5531 5532 signal(SIGSEGV, sighandler_dump_stack); 5533 signal(SIGFPE, sighandler_dump_stack); 5534 signal(SIGINT, sighandler_interrupt); 5535 5536 memset(&sigchld_act, 0, sizeof(sigchld_act)); 5537 sigchld_act.sa_flags = SA_SIGINFO; 5538 sigchld_act.sa_sigaction = sighandler_chld; 5539 sigaction(SIGCHLD, &sigchld_act, NULL); 5540 5541 ordered_events__init(&trace.oe.data, ordered_events__deliver_event, &trace); 5542 ordered_events__set_copy_on_queue(&trace.oe.data, true); 5543 5544 trace.evlist = evlist__new(); 5545 5546 if (trace.evlist == NULL) { 5547 pr_err("Not enough memory to run!\n"); 5548 err = -ENOMEM; 5549 goto out; 5550 } 5551 5552 /* 5553 * Parsing .perfconfig may entail creating a BPF event, that may need 5554 * to create BPF maps, so bump RLIM_MEMLOCK as the default 64K setting 5555 * is too small. This affects just this process, not touching the 5556 * global setting. If it fails we'll get something in 'perf trace -v' 5557 * to help diagnose the problem. 5558 */ 5559 rlimit__bump_memlock(); 5560 5561 err = perf_config(trace__config, &trace); 5562 if (err) 5563 goto out; 5564 5565 argc = parse_options_subcommand(argc, argv, trace_options, trace_subcommands, 5566 trace_usage, PARSE_OPT_STOP_AT_NON_OPTION); 5567 5568 /* 5569 * Here we already passed thru trace__parse_events_option() and it has 5570 * already figured out if -e syscall_name, if not but if --event 5571 * foo:bar was used, the user is interested _just_ in those, say, 5572 * tracepoint events, not in the strace-like syscall-name-based mode. 5573 * 5574 * This is important because we need to check if strace-like mode is 5575 * needed to decided if we should filter out the eBPF 5576 * __augmented_syscalls__ code, if it is in the mix, say, via 5577 * .perfconfig trace.add_events, and filter those out. 5578 */ 5579 if (!trace.trace_syscalls && !trace.trace_pgfaults && 5580 trace.evlist->core.nr_entries == 0 /* Was --events used? */) { 5581 trace.trace_syscalls = true; 5582 } 5583 /* 5584 * Now that we have --verbose figured out, lets see if we need to parse 5585 * events from .perfconfig, so that if those events fail parsing, say some 5586 * BPF program fails, then we'll be able to use --verbose to see what went 5587 * wrong in more detail. 5588 */ 5589 if (trace.perfconfig_events != NULL) { 5590 struct parse_events_error parse_err; 5591 5592 parse_events_error__init(&parse_err); 5593 err = parse_events(trace.evlist, trace.perfconfig_events, &parse_err); 5594 if (err) 5595 parse_events_error__print(&parse_err, trace.perfconfig_events); 5596 parse_events_error__exit(&parse_err); 5597 if (err) 5598 goto out; 5599 } 5600 5601 if (trace.show_cpu) 5602 trace.opts.sample_cpu = true; 5603 5604 if ((nr_cgroups || trace.cgroup) && !trace.opts.target.system_wide) { 5605 usage_with_options_msg(trace_usage, trace_options, 5606 "cgroup monitoring only available in system-wide mode"); 5607 } 5608 5609 if (!trace.trace_syscalls) 5610 goto skip_augmentation; 5611 5612 if ((argc >= 1) && (strcmp(argv[0], "record") == 0)) { 5613 pr_debug("Syscall augmentation fails with record, disabling augmentation"); 5614 goto skip_augmentation; 5615 } 5616 5617 if (trace.summary_bpf) { 5618 if (!trace.opts.target.system_wide) { 5619 /* TODO: Add filters in the BPF to support other targets. */ 5620 pr_err("Error: --bpf-summary only works for system-wide mode.\n"); 5621 goto out; 5622 } 5623 if (trace.summary_only) 5624 goto skip_augmentation; 5625 } 5626 5627 err = augmented_syscalls__prepare(); 5628 if (err < 0) 5629 goto skip_augmentation; 5630 5631 trace__add_syscall_newtp(&trace); 5632 5633 err = augmented_syscalls__create_bpf_output(trace.evlist); 5634 if (err == 0) 5635 trace.syscalls.events.bpf_output = evlist__last(trace.evlist); 5636 5637 skip_augmentation: 5638 err = -1; 5639 5640 if (trace.trace_pgfaults) { 5641 trace.opts.sample_address = true; 5642 trace.opts.sample_time = true; 5643 } 5644 5645 if (trace.opts.mmap_pages == UINT_MAX) 5646 mmap_pages_user_set = false; 5647 5648 if (trace.max_stack == UINT_MAX) { 5649 trace.max_stack = input_name ? PERF_MAX_STACK_DEPTH : sysctl__max_stack(); 5650 max_stack_user_set = false; 5651 } 5652 5653 #ifdef HAVE_DWARF_UNWIND_SUPPORT 5654 if ((trace.min_stack || max_stack_user_set) && !callchain_param.enabled) { 5655 record_opts__parse_callchain(&trace.opts, &callchain_param, "dwarf", false); 5656 } 5657 #endif 5658 5659 if (callchain_param.enabled) { 5660 if (!mmap_pages_user_set && geteuid() == 0) 5661 trace.opts.mmap_pages = perf_event_mlock_kb_in_pages() * 4; 5662 5663 symbol_conf.use_callchain = true; 5664 } 5665 5666 if (trace.evlist->core.nr_entries > 0) { 5667 bool use_btf = false; 5668 5669 evlist__set_default_evsel_handler(trace.evlist, trace__event_handler); 5670 if (evlist__set_syscall_tp_fields(trace.evlist, &use_btf)) { 5671 perror("failed to set syscalls:* tracepoint fields"); 5672 goto out; 5673 } 5674 5675 if (use_btf) 5676 trace__load_vmlinux_btf(&trace); 5677 } 5678 5679 /* 5680 * If we are augmenting syscalls, then combine what we put in the 5681 * __augmented_syscalls__ BPF map with what is in the 5682 * syscalls:sys_exit_FOO tracepoints, i.e. just like we do without BPF, 5683 * combining raw_syscalls:sys_enter with raw_syscalls:sys_exit. 5684 * 5685 * We'll switch to look at two BPF maps, one for sys_enter and the 5686 * other for sys_exit when we start augmenting the sys_exit paths with 5687 * buffers that are being copied from kernel to userspace, think 'read' 5688 * syscall. 5689 */ 5690 if (trace.syscalls.events.bpf_output) { 5691 evlist__for_each_entry(trace.evlist, evsel) { 5692 bool raw_syscalls_sys_exit = evsel__name_is(evsel, "raw_syscalls:sys_exit"); 5693 5694 if (raw_syscalls_sys_exit) { 5695 trace.raw_augmented_syscalls = true; 5696 goto init_augmented_syscall_tp; 5697 } 5698 5699 if (trace.syscalls.events.bpf_output->priv == NULL && 5700 strstr(evsel__name(evsel), "syscalls:sys_enter")) { 5701 struct evsel *augmented = trace.syscalls.events.bpf_output; 5702 if (evsel__init_augmented_syscall_tp(augmented, evsel) || 5703 evsel__init_augmented_syscall_tp_args(augmented)) 5704 goto out; 5705 /* 5706 * Augmented is __augmented_syscalls__ BPF_OUTPUT event 5707 * Above we made sure we can get from the payload the tp fields 5708 * that we get from syscalls:sys_enter tracefs format file. 5709 */ 5710 augmented->handler = trace__sys_enter; 5711 /* 5712 * Now we do the same for the *syscalls:sys_enter event so that 5713 * if we handle it directly, i.e. if the BPF prog returns 0 so 5714 * as not to filter it, then we'll handle it just like we would 5715 * for the BPF_OUTPUT one: 5716 */ 5717 if (evsel__init_augmented_syscall_tp(evsel, evsel) || 5718 evsel__init_augmented_syscall_tp_args(evsel)) 5719 goto out; 5720 evsel->handler = trace__sys_enter; 5721 } 5722 5723 if (strstarts(evsel__name(evsel), "syscalls:sys_exit_")) { 5724 struct syscall_tp *sc; 5725 init_augmented_syscall_tp: 5726 if (evsel__init_augmented_syscall_tp(evsel, evsel)) 5727 goto out; 5728 sc = __evsel__syscall_tp(evsel); 5729 /* 5730 * For now with BPF raw_augmented we hook into 5731 * raw_syscalls:sys_enter and there we get all 5732 * 6 syscall args plus the tracepoint common 5733 * fields and the syscall_nr (another long). 5734 * So we check if that is the case and if so 5735 * don't look after the sc->args_size but 5736 * always after the full raw_syscalls:sys_enter 5737 * payload, which is fixed. 5738 * 5739 * We'll revisit this later to pass 5740 * s->args_size to the BPF augmenter (now 5741 * tools/perf/examples/bpf/augmented_raw_syscalls.c, 5742 * so that it copies only what we need for each 5743 * syscall, like what happens when we use 5744 * syscalls:sys_enter_NAME, so that we reduce 5745 * the kernel/userspace traffic to just what is 5746 * needed for each syscall. 5747 */ 5748 if (trace.raw_augmented_syscalls) 5749 trace.raw_augmented_syscalls_args_size = (6 + 1) * sizeof(long) + sc->id.offset; 5750 evsel__init_augmented_syscall_tp_ret(evsel); 5751 evsel->handler = trace__sys_exit; 5752 } 5753 } 5754 } 5755 5756 if ((argc >= 1) && (strcmp(argv[0], "record") == 0)) { 5757 err = trace__record(&trace, argc-1, &argv[1]); 5758 goto out; 5759 } 5760 5761 /* Using just --errno-summary will trigger --summary */ 5762 if (trace.errno_summary && !trace.summary && !trace.summary_only) 5763 trace.summary_only = true; 5764 5765 /* summary_only implies summary option, but don't overwrite summary if set */ 5766 if (trace.summary_only) 5767 trace.summary = trace.summary_only; 5768 5769 /* Keep exited threads, otherwise information might be lost for summary */ 5770 if (trace.summary) { 5771 symbol_conf.keep_exited_threads = true; 5772 if (trace.summary_mode == SUMMARY__NONE) 5773 trace.summary_mode = SUMMARY__BY_THREAD; 5774 5775 if (!trace.summary_bpf && trace.summary_mode == SUMMARY__BY_CGROUP) { 5776 pr_err("Error: --summary-mode=cgroup only works with --bpf-summary\n"); 5777 err = -EINVAL; 5778 goto out; 5779 } 5780 } 5781 5782 if (output_name != NULL) { 5783 err = trace__open_output(&trace, output_name); 5784 if (err < 0) { 5785 perror("failed to create output file"); 5786 goto out; 5787 } 5788 } 5789 5790 err = evswitch__init(&trace.evswitch, trace.evlist, stderr); 5791 if (err) 5792 goto out_close; 5793 5794 err = target__validate(&trace.opts.target); 5795 if (err) { 5796 target__strerror(&trace.opts.target, err, bf, sizeof(bf)); 5797 fprintf(trace.output, "%s", bf); 5798 goto out_close; 5799 } 5800 5801 if (trace.uid_str) { 5802 uid_t uid = parse_uid(trace.uid_str); 5803 5804 if (uid == UINT_MAX) { 5805 ui__error("Invalid User: %s", trace.uid_str); 5806 err = -EINVAL; 5807 goto out_close; 5808 } 5809 err = parse_uid_filter(trace.evlist, uid); 5810 if (err) 5811 goto out_close; 5812 5813 trace.opts.target.system_wide = true; 5814 } 5815 5816 if (!argc && target__none(&trace.opts.target)) 5817 trace.opts.target.system_wide = true; 5818 5819 if (input_name) 5820 err = trace__replay(&trace); 5821 else 5822 err = trace__run(&trace, argc, argv); 5823 5824 out_close: 5825 if (output_name != NULL) 5826 fclose(trace.output); 5827 out: 5828 trace__exit(&trace); 5829 augmented_syscalls__cleanup(); 5830 return err; 5831 } 5832