add new system file

hc

2024-02-20 102a0743326a03cd1a1202ceda21e175b7d3575c

 kernel/tools/perf/builtin-trace.c
..
..
@@ -12,21 +12,33 @@
12
12
  * Initially based on the 'trace' prototype by Thomas Gleixner:
13
13
  *
14
14
  * http://lwn.net/Articles/415728/ ("Announcing a new utility: 'trace'")
15
- *
16
- * Released under the GPL v2. (and only v2, not any later version)
17
15
  */
18
16
 
17
+#include "util/record.h"
19
18
 #include <traceevent/event-parse.h>
20
19
 #include <api/fs/tracing_path.h>
20
+#include <bpf/bpf.h>
21
+#include "util/bpf_map.h"
22
+#include "util/rlimit.h"
21
23
 #include "builtin.h"
22
24
 #include "util/cgroup.h"
23
25
 #include "util/color.h"
26
+#include "util/config.h"
24
27
 #include "util/debug.h"
28
+#include "util/dso.h"
25
29
 #include "util/env.h"
26
30
 #include "util/event.h"
31
+#include "util/evsel.h"
32
+#include "util/evsel_fprintf.h"
33
+#include "util/synthetic-events.h"
27
34
 #include "util/evlist.h"
35
+#include "util/evswitch.h"
36
+#include "util/mmap.h"
37
+#include <subcmd/pager.h>
28
38
 #include <subcmd/exec-cmd.h>
29
39
 #include "util/machine.h"
40
+#include "util/map.h"
41
+#include "util/symbol.h"
30
42
 #include "util/path.h"
31
43
 #include "util/session.h"
32
44
 #include "util/thread.h"
..
..
@@ -35,6 +47,8 @@
35
47
 #include "util/intlist.h"
36
48
 #include "util/thread_map.h"
37
49
 #include "util/stat.h"
50
+#include "util/tool.h"
51
+#include "util/util.h"
38
52
 #include "trace/beauty/beauty.h"
39
53
 #include "trace-event.h"
40
54
 #include "util/parse-events.h"
..
..
@@ -44,6 +58,7 @@
44
58
 #include "string2.h"
45
59
 #include "syscalltbl.h"
46
60
 #include "rb_resort.h"
61
+#include "../perf.h"
47
62
 
48
63
 #include <errno.h>
49
64
 #include <inttypes.h>
..
..
@@ -57,9 +72,12 @@
57
72
 #include <linux/random.h>
58
73
 #include <linux/stringify.h>
59
74
 #include <linux/time64.h>
75
+#include <linux/zalloc.h>
60
76
 #include <fcntl.h>
77
+#include <sys/sysmacros.h>
61
78
 
62
-#include "sane_ctype.h"
79
+#include <linux/ctype.h>
80
+#include <perf/mmap.h>
63
81
 
64
82
 #ifndef O_CLOEXEC
65
83
 # define O_CLOEXEC		02000000
..
..
@@ -69,26 +87,67 @@
69
87
 # define F_LINUX_SPECIFIC_BASE	1024
70
88
 #endif
71
89
 
90
+#define RAW_SYSCALL_ARGS_NUM	6
91
+
92
+/*
93
+ * strtoul: Go from a string to a value, i.e. for msr: MSR_FS_BASE to 0xc0000100
94
+ */
95
+struct syscall_arg_fmt {
96
+	size_t	   (*scnprintf)(char *bf, size_t size, struct syscall_arg *arg);
97
+	bool	   (*strtoul)(char *bf, size_t size, struct syscall_arg *arg, u64 *val);
98
+	unsigned long (*mask_val)(struct syscall_arg *arg, unsigned long val);
99
+	void	   *parm;
100
+	const char *name;
101
+	u16	   nr_entries; // for arrays
102
+	bool	   show_zero;
103
+};
104
+
105
+struct syscall_fmt {
106
+	const char *name;
107
+	const char *alias;
108
+	struct {
109
+		const char *sys_enter,
110
+			   *sys_exit;
111
+	}	   bpf_prog_name;
112
+	struct syscall_arg_fmt arg[RAW_SYSCALL_ARGS_NUM];
113
+	u8	   nr_args;
114
+	bool	   errpid;
115
+	bool	   timeout;
116
+	bool	   hexret;
117
+};
118
+
72
119
 struct trace {
73
120
 	struct perf_tool	tool;
74
121
 	struct syscalltbl	*sctbl;
75
122
 	struct {
76
-		int		max;
77
123
 		struct syscall  *table;
124
+		struct bpf_map  *map;
125
+		struct { // per syscall BPF_MAP_TYPE_PROG_ARRAY
126
+			struct bpf_map  *sys_enter,
127
+					*sys_exit;
128
+		}		prog_array;
78
129
 		struct {
79
-			struct perf_evsel *sys_enter,
130
+			struct evsel *sys_enter,
80
131
 					  *sys_exit,
81
132
 					  *augmented;
82
133
 		}		events;
134
+		struct bpf_program *unaugmented_prog;
83
135
 	} syscalls;
136
+	struct {
137
+		struct bpf_map *map;
138
+	} dump;
84
139
 	struct record_opts	opts;
85
-	struct perf_evlist	*evlist;
140
+	struct evlist	*evlist;
86
141
 	struct machine		*host;
87
142
 	struct thread		*current;
143
+	struct bpf_object	*bpf_obj;
88
144
 	struct cgroup		*cgroup;
89
145
 	u64			base_time;
90
146
 	FILE			*output;
91
147
 	unsigned long		nr_events;
148
+	unsigned long		nr_events_printed;
149
+	unsigned long		max_events;
150
+	struct evswitch		evswitch;
92
151
 	struct strlist		*ev_qualifier;
93
152
 	struct {
94
153
 		size_t		nr;
..
..
@@ -97,6 +156,7 @@
97
156
 	struct {
98
157
 		size_t		nr;
99
158
 		pid_t		*entries;
159
+		struct bpf_map  *map;
100
160
 	}			filter_pids;
101
161
 	double			duration_filter;
102
162
 	double			runtime_ms;
..
..
@@ -106,6 +166,10 @@
106
166
 	} stats;
107
167
 	unsigned int		max_stack;
108
168
 	unsigned int		min_stack;
169
+	int			raw_augmented_syscalls_args_size;
170
+	bool			raw_augmented_syscalls;
171
+	bool			fd_path_disabled;
172
+	bool			sort_events;
109
173
 	bool			not_ev_qualifier;
110
174
 	bool			live;
111
175
 	bool			full_time;
..
..
@@ -113,15 +177,28 @@
113
177
 	bool			multiple_threads;
114
178
 	bool			summary;
115
179
 	bool			summary_only;
180
+	bool			errno_summary;
116
181
 	bool			failure_only;
117
182
 	bool			show_comm;
118
183
 	bool			print_sample;
119
184
 	bool			show_tool_stats;
120
185
 	bool			trace_syscalls;
186
+	bool			libtraceevent_print;
121
187
 	bool			kernel_syscallchains;
188
+	s16			args_alignment;
189
+	bool			show_tstamp;
190
+	bool			show_duration;
191
+	bool			show_zeros;
192
+	bool			show_arg_names;
193
+	bool			show_string_prefix;
122
194
 	bool			force;
123
195
 	bool			vfs_getname;
124
196
 	int			trace_pgfaults;
197
+	char			*perfconfig_events;
198
+	struct {
199
+		struct ordered_events	data;
200
+		u64			last;
201
+	} oe;
125
202
 };
126
203
 
127
204
 struct tp_field {
..
..
@@ -181,7 +258,7 @@
181
258
 	return 0;
182
259
 }
183
260
 
184
-static int tp_field__init_uint(struct tp_field *field, struct format_field *format_field, bool needs_swap)
261
+static int tp_field__init_uint(struct tp_field *field, struct tep_format_field *format_field, bool needs_swap)
185
262
 {
186
263
 	return __tp_field__init_uint(field, format_field->size, format_field->offset, needs_swap);
187
264
 }
..
..
@@ -198,7 +275,7 @@
198
275
 	return 0;
199
276
 }
200
277
 
201
-static int tp_field__init_ptr(struct tp_field *field, struct format_field *format_field)
278
+static int tp_field__init_ptr(struct tp_field *field, struct tep_format_field *format_field)
202
279
 {
203
280
 	return __tp_field__init_ptr(field, format_field->offset);
204
281
 }
..
..
@@ -210,11 +287,90 @@
210
287
 	};
211
288
 };
212
289
 
213
-static int perf_evsel__init_tp_uint_field(struct perf_evsel *evsel,
214
-					  struct tp_field *field,
215
-					  const char *name)
290
+/*
291
+ * The evsel->priv as used by 'perf trace'
292
+ * sc:	for raw_syscalls:sys_{enter,exit} and syscalls:sys_{enter,exit}_SYSCALLNAME
293
+ * fmt: for all the other tracepoints
294
+ */
295
+struct evsel_trace {
296
+	struct syscall_tp	sc;
297
+	struct syscall_arg_fmt  *fmt;
298
+};
299
+
300
+static struct evsel_trace *evsel_trace__new(void)
216
301
 {
217
-	struct format_field *format_field = perf_evsel__field(evsel, name);
302
+	return zalloc(sizeof(struct evsel_trace));
303
+}
304
+
305
+static void evsel_trace__delete(struct evsel_trace *et)
306
+{
307
+	if (et == NULL)
308
+		return;
309
+
310
+	zfree(&et->fmt);
311
+	free(et);
312
+}
313
+
314
+/*
315
+ * Used with raw_syscalls:sys_{enter,exit} and with the
316
+ * syscalls:sys_{enter,exit}_SYSCALL tracepoints
317
+ */
318
+static inline struct syscall_tp *__evsel__syscall_tp(struct evsel *evsel)
319
+{
320
+	struct evsel_trace *et = evsel->priv;
321
+
322
+	return &et->sc;
323
+}
324
+
325
+static struct syscall_tp *evsel__syscall_tp(struct evsel *evsel)
326
+{
327
+	if (evsel->priv == NULL) {
328
+		evsel->priv = evsel_trace__new();
329
+		if (evsel->priv == NULL)
330
+			return NULL;
331
+	}
332
+
333
+	return __evsel__syscall_tp(evsel);
334
+}
335
+
336
+/*
337
+ * Used with all the other tracepoints.
338
+ */
339
+static inline struct syscall_arg_fmt *__evsel__syscall_arg_fmt(struct evsel *evsel)
340
+{
341
+	struct evsel_trace *et = evsel->priv;
342
+
343
+	return et->fmt;
344
+}
345
+
346
+static struct syscall_arg_fmt *evsel__syscall_arg_fmt(struct evsel *evsel)
347
+{
348
+	struct evsel_trace *et = evsel->priv;
349
+
350
+	if (evsel->priv == NULL) {
351
+		et = evsel->priv = evsel_trace__new();
352
+
353
+		if (et == NULL)
354
+			return NULL;
355
+	}
356
+
357
+	if (et->fmt == NULL) {
358
+		et->fmt = calloc(evsel->tp_format->format.nr_fields, sizeof(struct syscall_arg_fmt));
359
+		if (et->fmt == NULL)
360
+			goto out_delete;
361
+	}
362
+
363
+	return __evsel__syscall_arg_fmt(evsel);
364
+
365
+out_delete:
366
+	evsel_trace__delete(evsel->priv);
367
+	evsel->priv = NULL;
368
+	return NULL;
369
+}
370
+
371
+static int evsel__init_tp_uint_field(struct evsel *evsel, struct tp_field *field, const char *name)
372
+{
373
+	struct tep_format_field *format_field = evsel__field(evsel, name);
218
374
 
219
375
 	if (format_field == NULL)
220
376
 		return -1;
..
..
@@ -223,14 +379,12 @@
223
379
 }
224
380
 
225
381
 #define perf_evsel__init_sc_tp_uint_field(evsel, name) \
226
-	({ struct syscall_tp *sc = evsel->priv;\
227
-	   perf_evsel__init_tp_uint_field(evsel, &sc->name, #name); })
382
+	({ struct syscall_tp *sc = __evsel__syscall_tp(evsel);\
383
+	   evsel__init_tp_uint_field(evsel, &sc->name, #name); })
228
384
 
229
-static int perf_evsel__init_tp_ptr_field(struct perf_evsel *evsel,
230
-					 struct tp_field *field,
231
-					 const char *name)
385
+static int evsel__init_tp_ptr_field(struct evsel *evsel, struct tp_field *field, const char *name)
232
386
 {
233
-	struct format_field *format_field = perf_evsel__field(evsel, name);
387
+	struct tep_format_field *format_field = evsel__field(evsel, name);
234
388
 
235
389
 	if (format_field == NULL)
236
390
 		return -1;
..
..
@@ -239,117 +393,136 @@
239
393
 }
240
394
 
241
395
 #define perf_evsel__init_sc_tp_ptr_field(evsel, name) \
242
-	({ struct syscall_tp *sc = evsel->priv;\
243
-	   perf_evsel__init_tp_ptr_field(evsel, &sc->name, #name); })
396
+	({ struct syscall_tp *sc = __evsel__syscall_tp(evsel);\
397
+	   evsel__init_tp_ptr_field(evsel, &sc->name, #name); })
244
398
 
245
-static void perf_evsel__delete_priv(struct perf_evsel *evsel)
399
+static void evsel__delete_priv(struct evsel *evsel)
246
400
 {
247
401
 	zfree(&evsel->priv);
248
-	perf_evsel__delete(evsel);
402
+	evsel__delete(evsel);
249
403
 }
250
404
 
251
-static int perf_evsel__init_syscall_tp(struct perf_evsel *evsel)
405
+static int evsel__init_syscall_tp(struct evsel *evsel)
252
406
 {
253
-	struct syscall_tp *sc = evsel->priv = malloc(sizeof(struct syscall_tp));
407
+	struct syscall_tp *sc = evsel__syscall_tp(evsel);
254
408
 
255
-	if (evsel->priv != NULL) {
256
-		if (perf_evsel__init_tp_uint_field(evsel, &sc->id, "__syscall_nr"))
257
-			goto out_delete;
409
+	if (sc != NULL) {
410
+		if (evsel__init_tp_uint_field(evsel, &sc->id, "__syscall_nr") &&
411
+		    evsel__init_tp_uint_field(evsel, &sc->id, "nr"))
412
+			return -ENOENT;
258
413
 		return 0;
259
414
 	}
260
415
 
261
416
 	return -ENOMEM;
262
-out_delete:
263
-	zfree(&evsel->priv);
264
-	return -ENOENT;
265
417
 }
266
418
 
267
-static int perf_evsel__init_augmented_syscall_tp(struct perf_evsel *evsel)
419
+static int evsel__init_augmented_syscall_tp(struct evsel *evsel, struct evsel *tp)
268
420
 {
269
-	struct syscall_tp *sc = evsel->priv = malloc(sizeof(struct syscall_tp));
421
+	struct syscall_tp *sc = evsel__syscall_tp(evsel);
270
422
 
271
-	if (evsel->priv != NULL) {       /* field, sizeof_field, offsetof_field */
272
-		if (__tp_field__init_uint(&sc->id, sizeof(long), sizeof(long long), evsel->needs_swap))
273
-			goto out_delete;
423
+	if (sc != NULL) {
424
+		struct tep_format_field *syscall_id = evsel__field(tp, "id");
425
+		if (syscall_id == NULL)
426
+			syscall_id = evsel__field(tp, "__syscall_nr");
427
+		if (syscall_id == NULL ||
428
+		    __tp_field__init_uint(&sc->id, syscall_id->size, syscall_id->offset, evsel->needs_swap))
429
+			return -EINVAL;
274
430
 
275
431
 		return 0;
276
432
 	}
277
433
 
278
434
 	return -ENOMEM;
279
-out_delete:
280
-	zfree(&evsel->priv);
281
-	return -EINVAL;
282
435
 }
283
436
 
284
-static int perf_evsel__init_augmented_syscall_tp_args(struct perf_evsel *evsel)
437
+static int evsel__init_augmented_syscall_tp_args(struct evsel *evsel)
285
438
 {
286
-	struct syscall_tp *sc = evsel->priv;
439
+	struct syscall_tp *sc = __evsel__syscall_tp(evsel);
287
440
 
288
441
 	return __tp_field__init_ptr(&sc->args, sc->id.offset + sizeof(u64));
289
442
 }
290
443
 
291
-static int perf_evsel__init_raw_syscall_tp(struct perf_evsel *evsel, void *handler)
444
+static int evsel__init_augmented_syscall_tp_ret(struct evsel *evsel)
292
445
 {
293
-	evsel->priv = malloc(sizeof(struct syscall_tp));
294
-	if (evsel->priv != NULL) {
446
+	struct syscall_tp *sc = __evsel__syscall_tp(evsel);
447
+
448
+	return __tp_field__init_uint(&sc->ret, sizeof(u64), sc->id.offset + sizeof(u64), evsel->needs_swap);
449
+}
450
+
451
+static int evsel__init_raw_syscall_tp(struct evsel *evsel, void *handler)
452
+{
453
+	if (evsel__syscall_tp(evsel) != NULL) {
295
454
 		if (perf_evsel__init_sc_tp_uint_field(evsel, id))
296
-			goto out_delete;
455
+			return -ENOENT;
297
456
 
298
457
 		evsel->handler = handler;
299
458
 		return 0;
300
459
 	}
301
460
 
302
461
 	return -ENOMEM;
303
-
304
-out_delete:
305
-	zfree(&evsel->priv);
306
-	return -ENOENT;
307
462
 }
308
463
 
309
-static struct perf_evsel *perf_evsel__raw_syscall_newtp(const char *direction, void *handler)
464
+static struct evsel *perf_evsel__raw_syscall_newtp(const char *direction, void *handler)
310
465
 {
311
-	struct perf_evsel *evsel = perf_evsel__newtp("raw_syscalls", direction);
466
+	struct evsel *evsel = evsel__newtp("raw_syscalls", direction);
312
467
 
313
468
 	/* older kernel (e.g., RHEL6) use syscalls:{enter,exit} */
314
469
 	if (IS_ERR(evsel))
315
-		evsel = perf_evsel__newtp("syscalls", direction);
470
+		evsel = evsel__newtp("syscalls", direction);
316
471
 
317
472
 	if (IS_ERR(evsel))
318
473
 		return NULL;
319
474
 
320
-	if (perf_evsel__init_raw_syscall_tp(evsel, handler))
475
+	if (evsel__init_raw_syscall_tp(evsel, handler))
321
476
 		goto out_delete;
322
477
 
323
478
 	return evsel;
324
479
 
325
480
 out_delete:
326
-	perf_evsel__delete_priv(evsel);
481
+	evsel__delete_priv(evsel);
327
482
 	return NULL;
328
483
 }
329
484
 
330
485
 #define perf_evsel__sc_tp_uint(evsel, name, sample) \
331
-	({ struct syscall_tp *fields = evsel->priv; \
486
+	({ struct syscall_tp *fields = __evsel__syscall_tp(evsel); \
332
487
 	   fields->name.integer(&fields->name, sample); })
333
488
 
334
489
 #define perf_evsel__sc_tp_ptr(evsel, name, sample) \
335
-	({ struct syscall_tp *fields = evsel->priv; \
490
+	({ struct syscall_tp *fields = __evsel__syscall_tp(evsel); \
336
491
 	   fields->name.pointer(&fields->name, sample); })
337
492
 
338
-size_t strarray__scnprintf(struct strarray *sa, char *bf, size_t size, const char *intfmt, int val)
493
+size_t strarray__scnprintf_suffix(struct strarray *sa, char *bf, size_t size, const char *intfmt, bool show_suffix, int val)
339
494
 {
340
495
 	int idx = val - sa->offset;
341
496
 
342
-	if (idx < 0 || idx >= sa->nr_entries || sa->entries[idx] == NULL)
343
-		return scnprintf(bf, size, intfmt, val);
497
+	if (idx < 0 || idx >= sa->nr_entries || sa->entries[idx] == NULL) {
498
+		size_t printed = scnprintf(bf, size, intfmt, val);
499
+		if (show_suffix)
500
+			printed += scnprintf(bf + printed, size - printed, " /* %s??? */", sa->prefix);
501
+		return printed;
502
+	}
344
503
 
345
-	return scnprintf(bf, size, "%s", sa->entries[idx]);
504
+	return scnprintf(bf, size, "%s%s", sa->entries[idx], show_suffix ? sa->prefix : "");
505
+}
506
+
507
+size_t strarray__scnprintf(struct strarray *sa, char *bf, size_t size, const char *intfmt, bool show_prefix, int val)
508
+{
509
+	int idx = val - sa->offset;
510
+
511
+	if (idx < 0 || idx >= sa->nr_entries || sa->entries[idx] == NULL) {
512
+		size_t printed = scnprintf(bf, size, intfmt, val);
513
+		if (show_prefix)
514
+			printed += scnprintf(bf + printed, size - printed, " /* %s??? */", sa->prefix);
515
+		return printed;
516
+	}
517
+
518
+	return scnprintf(bf, size, "%s%s", show_prefix ? sa->prefix : "", sa->entries[idx]);
346
519
 }
347
520
 
348
521
 static size_t __syscall_arg__scnprintf_strarray(char *bf, size_t size,
349
522
 						const char *intfmt,
350
523
 					        struct syscall_arg *arg)
351
524
 {
352
-	return strarray__scnprintf(arg->parm, bf, size, intfmt, arg->val);
525
+	return strarray__scnprintf(arg->parm, bf, size, intfmt, arg->show_string_prefix, arg->val);
353
526
 }
354
527
 
355
528
 static size_t syscall_arg__scnprintf_strarray(char *bf, size_t size,
..
..
@@ -360,34 +533,123 @@
360
533
 
361
534
 #define SCA_STRARRAY syscall_arg__scnprintf_strarray
362
535
 
363
-struct strarrays {
364
-	int		nr_entries;
365
-	struct strarray **entries;
366
-};
536
+bool syscall_arg__strtoul_strarray(char *bf, size_t size, struct syscall_arg *arg, u64 *ret)
537
+{
538
+	return strarray__strtoul(arg->parm, bf, size, ret);
539
+}
367
540
 
368
-#define DEFINE_STRARRAYS(array) struct strarrays strarrays__##array = { \
369
-	.nr_entries = ARRAY_SIZE(array), \
370
-	.entries = array, \
541
+bool syscall_arg__strtoul_strarray_flags(char *bf, size_t size, struct syscall_arg *arg, u64 *ret)
542
+{
543
+	return strarray__strtoul_flags(arg->parm, bf, size, ret);
544
+}
545
+
546
+bool syscall_arg__strtoul_strarrays(char *bf, size_t size, struct syscall_arg *arg, u64 *ret)
547
+{
548
+	return strarrays__strtoul(arg->parm, bf, size, ret);
549
+}
550
+
551
+size_t syscall_arg__scnprintf_strarray_flags(char *bf, size_t size, struct syscall_arg *arg)
552
+{
553
+	return strarray__scnprintf_flags(arg->parm, bf, size, arg->show_string_prefix, arg->val);
554
+}
555
+
556
+size_t strarrays__scnprintf(struct strarrays *sas, char *bf, size_t size, const char *intfmt, bool show_prefix, int val)
557
+{
558
+	size_t printed;
559
+	int i;
560
+
561
+	for (i = 0; i < sas->nr_entries; ++i) {
562
+		struct strarray *sa = sas->entries[i];
563
+		int idx = val - sa->offset;
564
+
565
+		if (idx >= 0 && idx < sa->nr_entries) {
566
+			if (sa->entries[idx] == NULL)
567
+				break;
568
+			return scnprintf(bf, size, "%s%s", show_prefix ? sa->prefix : "", sa->entries[idx]);
569
+		}
570
+	}
571
+
572
+	printed = scnprintf(bf, size, intfmt, val);
573
+	if (show_prefix)
574
+		printed += scnprintf(bf + printed, size - printed, " /* %s??? */", sas->entries[0]->prefix);
575
+	return printed;
576
+}
577
+
578
+bool strarray__strtoul(struct strarray *sa, char *bf, size_t size, u64 *ret)
579
+{
580
+	int i;
581
+
582
+	for (i = 0; i < sa->nr_entries; ++i) {
583
+		if (sa->entries[i] && strncmp(sa->entries[i], bf, size) == 0 && sa->entries[i][size] == '\0') {
584
+			*ret = sa->offset + i;
585
+			return true;
586
+		}
587
+	}
588
+
589
+	return false;
590
+}
591
+
592
+bool strarray__strtoul_flags(struct strarray *sa, char *bf, size_t size, u64 *ret)
593
+{
594
+	u64 val = 0;
595
+	char *tok = bf, *sep, *end;
596
+
597
+	*ret = 0;
598
+
599
+	while (size != 0) {
600
+		int toklen = size;
601
+
602
+		sep = memchr(tok, '|', size);
603
+		if (sep != NULL) {
604
+			size -= sep - tok + 1;
605
+
606
+			end = sep - 1;
607
+			while (end > tok && isspace(*end))
608
+				--end;
609
+
610
+			toklen = end - tok + 1;
611
+		}
612
+
613
+		while (isspace(*tok))
614
+			++tok;
615
+
616
+		if (isalpha(*tok) || *tok == '_') {
617
+			if (!strarray__strtoul(sa, tok, toklen, &val))
618
+				return false;
619
+		} else {
620
+			bool is_hexa = tok[0] == 0 && (tok[1] = 'x' || tok[1] == 'X');
621
+
622
+			val = strtoul(tok, NULL, is_hexa ? 16 : 0);
623
+		}
624
+
625
+		*ret |= (1 << (val - 1));
626
+
627
+		if (sep == NULL)
628
+			break;
629
+		tok = sep + 1;
630
+	}
631
+
632
+	return true;
633
+}
634
+
635
+bool strarrays__strtoul(struct strarrays *sas, char *bf, size_t size, u64 *ret)
636
+{
637
+	int i;
638
+
639
+	for (i = 0; i < sas->nr_entries; ++i) {
640
+		struct strarray *sa = sas->entries[i];
641
+
642
+		if (strarray__strtoul(sa, bf, size, ret))
643
+			return true;
644
+	}
645
+
646
+	return false;
371
647
 }
372
648
 
373
649
 size_t syscall_arg__scnprintf_strarrays(char *bf, size_t size,
374
650
 					struct syscall_arg *arg)
375
651
 {
376
-	struct strarrays *sas = arg->parm;
377
-	int i;
378
-
379
-	for (i = 0; i < sas->nr_entries; ++i) {
380
-		struct strarray *sa = sas->entries[i];
381
-		int idx = arg->val - sa->offset;
382
-
383
-		if (idx >= 0 && idx < sa->nr_entries) {
384
-			if (sa->entries[idx] == NULL)
385
-				break;
386
-			return scnprintf(bf, size, "%s", sa->entries[idx]);
387
-		}
388
-	}
389
-
390
-	return scnprintf(bf, size, "%d", arg->val);
652
+	return strarrays__scnprintf(arg->parm, bf, size, "%d", arg->show_string_prefix, arg->val);
391
653
 }
392
654
 
393
655
 #ifndef AT_FDCWD
..
..
@@ -398,9 +660,10 @@
398
660
 					   struct syscall_arg *arg)
399
661
 {
400
662
 	int fd = arg->val;
663
+	const char *prefix = "AT_FD";
401
664
 
402
665
 	if (fd == AT_FDCWD)
403
-		return scnprintf(bf, size, "CWD");
666
+		return scnprintf(bf, size, "%s%s", arg->show_string_prefix ? prefix : "", "CWD");
404
667
 
405
668
 	return syscall_arg__scnprintf_fd(bf, size, arg);
406
669
 }
..
..
@@ -417,6 +680,13 @@
417
680
 	return scnprintf(bf, size, "%#lx", arg->val);
418
681
 }
419
682
 
683
+size_t syscall_arg__scnprintf_ptr(char *bf, size_t size, struct syscall_arg *arg)
684
+{
685
+	if (arg->val == 0)
686
+		return scnprintf(bf, size, "NULL");
687
+	return syscall_arg__scnprintf_hex(bf, size, arg);
688
+}
689
+
420
690
 size_t syscall_arg__scnprintf_int(char *bf, size_t size, struct syscall_arg *arg)
421
691
 {
422
692
 	return scnprintf(bf, size, "%d", arg->val);
..
..
@@ -427,17 +697,36 @@
427
697
 	return scnprintf(bf, size, "%ld", arg->val);
428
698
 }
429
699
 
700
+static size_t syscall_arg__scnprintf_char_array(char *bf, size_t size, struct syscall_arg *arg)
701
+{
702
+	// XXX Hey, maybe for sched:sched_switch prev/next comm fields we can
703
+	//     fill missing comms using thread__set_comm()...
704
+	//     here or in a special syscall_arg__scnprintf_pid_sched_tp...
705
+	return scnprintf(bf, size, "\"%-.*s\"", arg->fmt->nr_entries ?: arg->len, arg->val);
706
+}
707
+
708
+#define SCA_CHAR_ARRAY syscall_arg__scnprintf_char_array
709
+
430
710
 static const char *bpf_cmd[] = {
431
711
 	"MAP_CREATE", "MAP_LOOKUP_ELEM", "MAP_UPDATE_ELEM", "MAP_DELETE_ELEM",
432
712
 	"MAP_GET_NEXT_KEY", "PROG_LOAD",
433
713
 };
434
-static DEFINE_STRARRAY(bpf_cmd);
714
+static DEFINE_STRARRAY(bpf_cmd, "BPF_");
715
+
716
+static const char *fsmount_flags[] = {
717
+	[1] = "CLOEXEC",
718
+};
719
+static DEFINE_STRARRAY(fsmount_flags, "FSMOUNT_");
720
+
721
+#include "trace/beauty/generated/fsconfig_arrays.c"
722
+
723
+static DEFINE_STRARRAY(fsconfig_cmds, "FSCONFIG_");
435
724
 
436
725
 static const char *epoll_ctl_ops[] = { "ADD", "DEL", "MOD", };
437
-static DEFINE_STRARRAY_OFFSET(epoll_ctl_ops, 1);
726
+static DEFINE_STRARRAY_OFFSET(epoll_ctl_ops, "EPOLL_CTL_", 1);
438
727
 
439
728
 static const char *itimers[] = { "REAL", "VIRTUAL", "PROF", };
440
-static DEFINE_STRARRAY(itimers);
729
+static DEFINE_STRARRAY(itimers, "ITIMER_");
441
730
 
442
731
 static const char *keyctl_options[] = {
443
732
 	"GET_KEYRING_ID", "JOIN_SESSION_KEYRING", "UPDATE", "REVOKE", "CHOWN",
..
..
@@ -446,7 +735,7 @@
446
735
 	"ASSUME_AUTHORITY", "GET_SECURITY", "SESSION_TO_PARENT", "REJECT",
447
736
 	"INSTANTIATE_IOV", "INVALIDATE", "GET_PERSISTENT",
448
737
 };
449
-static DEFINE_STRARRAY(keyctl_options);
738
+static DEFINE_STRARRAY(keyctl_options, "KEYCTL_");
450
739
 
451
740
 static const char *whences[] = { "SET", "CUR", "END",
452
741
 #ifdef SEEK_DATA
..
..
@@ -456,7 +745,7 @@
456
745
 "HOLE",
457
746
 #endif
458
747
 };
459
-static DEFINE_STRARRAY(whences);
748
+static DEFINE_STRARRAY(whences, "SEEK_");
460
749
 
461
750
 static const char *fcntl_cmds[] = {
462
751
 	"DUPFD", "GETFD", "SETFD", "GETFL", "SETFL", "GETLK", "SETLK",
..
..
@@ -464,7 +753,7 @@
464
753
 	"SETLK64", "SETLKW64", "SETOWN_EX", "GETOWN_EX",
465
754
 	"GETOWNER_UIDS",
466
755
 };
467
-static DEFINE_STRARRAY(fcntl_cmds);
756
+static DEFINE_STRARRAY(fcntl_cmds, "F_");
468
757
 
469
758
 static const char *fcntl_linux_specific_cmds[] = {
470
759
 	"SETLEASE", "GETLEASE", "NOTIFY", [5] =	"CANCELLK", "DUPFD_CLOEXEC",
..
..
@@ -472,7 +761,7 @@
472
761
 	"GET_RW_HINT", "SET_RW_HINT", "GET_FILE_RW_HINT", "SET_FILE_RW_HINT",
473
762
 };
474
763
 
475
-static DEFINE_STRARRAY_OFFSET(fcntl_linux_specific_cmds, F_LINUX_SPECIFIC_BASE);
764
+static DEFINE_STRARRAY_OFFSET(fcntl_linux_specific_cmds, "F_", F_LINUX_SPECIFIC_BASE);
476
765
 
477
766
 static struct strarray *fcntl_cmds_arrays[] = {
478
767
 	&strarray__fcntl_cmds,
..
..
@@ -486,39 +775,31 @@
486
775
 	"MEMLOCK", "AS", "LOCKS", "SIGPENDING", "MSGQUEUE", "NICE", "RTPRIO",
487
776
 	"RTTIME",
488
777
 };
489
-static DEFINE_STRARRAY(rlimit_resources);
778
+static DEFINE_STRARRAY(rlimit_resources, "RLIMIT_");
490
779
 
491
780
 static const char *sighow[] = { "BLOCK", "UNBLOCK", "SETMASK", };
492
-static DEFINE_STRARRAY(sighow);
781
+static DEFINE_STRARRAY(sighow, "SIG_");
493
782
 
494
783
 static const char *clockid[] = {
495
784
 	"REALTIME", "MONOTONIC", "PROCESS_CPUTIME_ID", "THREAD_CPUTIME_ID",
496
785
 	"MONOTONIC_RAW", "REALTIME_COARSE", "MONOTONIC_COARSE", "BOOTTIME",
497
786
 	"REALTIME_ALARM", "BOOTTIME_ALARM", "SGI_CYCLE", "TAI"
498
787
 };
499
-static DEFINE_STRARRAY(clockid);
500
-
501
-static const char *socket_families[] = {
502
-	"UNSPEC", "LOCAL", "INET", "AX25", "IPX", "APPLETALK", "NETROM",
503
-	"BRIDGE", "ATMPVC", "X25", "INET6", "ROSE", "DECnet", "NETBEUI",
504
-	"SECURITY", "KEY", "NETLINK", "PACKET", "ASH", "ECONET", "ATMSVC",
505
-	"RDS", "SNA", "IRDA", "PPPOX", "WANPIPE", "LLC", "IB", "CAN", "TIPC",
506
-	"BLUETOOTH", "IUCV", "RXRPC", "ISDN", "PHONET", "IEEE802154", "CAIF",
507
-	"ALG", "NFC", "VSOCK",
508
-};
509
-static DEFINE_STRARRAY(socket_families);
788
+static DEFINE_STRARRAY(clockid, "CLOCK_");
510
789
 
511
790
 static size_t syscall_arg__scnprintf_access_mode(char *bf, size_t size,
512
791
 						 struct syscall_arg *arg)
513
792
 {
793
+	bool show_prefix = arg->show_string_prefix;
794
+	const char *suffix = "_OK";
514
795
 	size_t printed = 0;
515
796
 	int mode = arg->val;
516
797
 
517
798
 	if (mode == F_OK) /* 0 */
518
-		return scnprintf(bf, size, "F");
799
+		return scnprintf(bf, size, "F%s", show_prefix ? suffix : "");
519
800
 #define	P_MODE(n) \
520
801
 	if (mode & n##_OK) { \
521
-		printed += scnprintf(bf + printed, size - printed, "%s", #n); \
802
+		printed += scnprintf(bf + printed, size - printed, "%s%s", #n, show_prefix ? suffix : ""); \
522
803
 		mode &= ~n##_OK; \
523
804
 	}
524
805
 
..
..
@@ -543,11 +824,13 @@
543
824
 static size_t syscall_arg__scnprintf_pipe_flags(char *bf, size_t size,
544
825
 						struct syscall_arg *arg)
545
826
 {
827
+	bool show_prefix = arg->show_string_prefix;
828
+	const char *prefix = "O_";
546
829
 	int printed = 0, flags = arg->val;
547
830
 
548
831
 #define	P_FLAG(n) \
549
832
 	if (flags & O_##n) { \
550
-		printed += scnprintf(bf + printed, size - printed, "%s%s", printed ? "|" : "", #n); \
833
+		printed += scnprintf(bf + printed, size - printed, "%s%s%s", printed ? "|" : "", show_prefix ? prefix : "", #n); \
551
834
 		flags &= ~O_##n; \
552
835
 	}
553
836
 
..
..
@@ -573,11 +856,13 @@
573
856
 static size_t syscall_arg__scnprintf_getrandom_flags(char *bf, size_t size,
574
857
 						   struct syscall_arg *arg)
575
858
 {
859
+	bool show_prefix = arg->show_string_prefix;
860
+	const char *prefix = "GRND_";
576
861
 	int printed = 0, flags = arg->val;
577
862
 
578
863
 #define	P_FLAG(n) \
579
864
 	if (flags & GRND_##n) { \
580
-		printed += scnprintf(bf + printed, size - printed, "%s%s", printed ? "|" : "", #n); \
865
+		printed += scnprintf(bf + printed, size - printed, "%s%s%s", printed ? "|" : "", show_prefix ? prefix : "", #n); \
581
866
 		flags &= ~GRND_##n; \
582
867
 	}
583
868
 
..
..
@@ -595,6 +880,12 @@
595
880
 
596
881
 #define STRARRAY(name, array) \
597
882
 	  { .scnprintf	= SCA_STRARRAY, \
883
+	    .strtoul	= STUL_STRARRAY, \
884
+	    .parm	= &strarray__##array, }
885
+
886
+#define STRARRAY_FLAGS(name, array) \
887
+	  { .scnprintf	= SCA_STRARRAY_FLAGS, \
888
+	    .strtoul	= STUL_STRARRAY_FLAGS, \
598
889
 	    .parm	= &strarray__##array, }
599
890
 
600
891
 #include "trace/beauty/arch_errno_names.c"
..
..
@@ -613,28 +904,20 @@
613
904
 #include "trace/beauty/socket_type.c"
614
905
 #include "trace/beauty/waitid_options.c"
615
906
 
616
-struct syscall_arg_fmt {
617
-	size_t	   (*scnprintf)(char *bf, size_t size, struct syscall_arg *arg);
618
-	void	   *parm;
619
-	const char *name;
620
-	bool	   show_zero;
621
-};
622
-
623
-static struct syscall_fmt {
624
-	const char *name;
625
-	const char *alias;
626
-	struct syscall_arg_fmt arg[6];
627
-	u8	   nr_args;
628
-	bool	   errpid;
629
-	bool	   timeout;
630
-	bool	   hexret;
631
-} syscall_fmts[] = {
907
+static struct syscall_fmt syscall_fmts[] = {
632
908
 	{ .name	    = "access",
633
909
 	  .arg = { [1] = { .scnprintf = SCA_ACCMODE,  /* mode */ }, }, },
910
+	{ .name	    = "arch_prctl",
911
+	  .arg = { [0] = { .scnprintf = SCA_X86_ARCH_PRCTL_CODE, /* code */ },
912
+		   [1] = { .scnprintf = SCA_PTR, /* arg2 */ }, }, },
913
+	{ .name	    = "bind",
914
+	  .arg = { [0] = { .scnprintf = SCA_INT, /* fd */ },
915
+		   [1] = { .scnprintf = SCA_SOCKADDR, /* umyaddr */ },
916
+		   [2] = { .scnprintf = SCA_INT, /* addrlen */ }, }, },
634
917
 	{ .name	    = "bpf",
635
918
 	  .arg = { [0] = STRARRAY(cmd, bpf_cmd), }, },
636
919
 	{ .name	    = "brk",	    .hexret = true,
637
-	  .arg = { [0] = { .scnprintf = SCA_HEX, /* brk */ }, }, },
920
+	  .arg = { [0] = { .scnprintf = SCA_PTR, /* brk */ }, }, },
638
921
 	{ .name     = "clock_gettime",
639
922
 	  .arg = { [0] = STRARRAY(clk_id, clockid), }, },
640
923
 	{ .name	    = "clone",	    .errpid = true, .nr_args = 5,
..
..
@@ -645,6 +928,10 @@
645
928
 		   [4] = { .name = "tls",	    .scnprintf = SCA_HEX, }, }, },
646
929
 	{ .name	    = "close",
647
930
 	  .arg = { [0] = { .scnprintf = SCA_CLOSE_FD, /* fd */ }, }, },
931
+	{ .name	    = "connect",
932
+	  .arg = { [0] = { .scnprintf = SCA_INT, /* fd */ },
933
+		   [1] = { .scnprintf = SCA_SOCKADDR, /* servaddr */ },
934
+		   [2] = { .scnprintf = SCA_INT, /* addrlen */ }, }, },
648
935
 	{ .name	    = "epoll_ctl",
649
936
 	  .arg = { [1] = STRARRAY(op, epoll_ctl_ops), }, },
650
937
 	{ .name	    = "eventfd2",
..
..
@@ -654,12 +941,22 @@
654
941
 	{ .name	    = "fchownat",
655
942
 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, },
656
943
 	{ .name	    = "fcntl",
657
-	  .arg = { [1] = { .scnprintf = SCA_FCNTL_CMD, /* cmd */
944
+	  .arg = { [1] = { .scnprintf = SCA_FCNTL_CMD,  /* cmd */
945
+			   .strtoul   = STUL_STRARRAYS,
658
946
 			   .parm      = &strarrays__fcntl_cmds_arrays,
659
947
 			   .show_zero = true, },
660
948
 		   [2] = { .scnprintf =  SCA_FCNTL_ARG, /* arg */ }, }, },
661
949
 	{ .name	    = "flock",
662
950
 	  .arg = { [1] = { .scnprintf = SCA_FLOCK, /* cmd */ }, }, },
951
+	{ .name     = "fsconfig",
952
+	  .arg = { [1] = STRARRAY(cmd, fsconfig_cmds), }, },
953
+	{ .name     = "fsmount",
954
+	  .arg = { [1] = STRARRAY_FLAGS(flags, fsmount_flags),
955
+		   [2] = { .scnprintf = SCA_FSMOUNT_ATTR_FLAGS, /* attr_flags */ }, }, },
956
+	{ .name     = "fspick",
957
+	  .arg = { [0] = { .scnprintf = SCA_FDAT,	  /* dfd */ },
958
+		   [1] = { .scnprintf = SCA_FILENAME,	  /* path */ },
959
+		   [2] = { .scnprintf = SCA_FSPICK_FLAGS, /* flags */ }, }, },
663
960
 	{ .name	    = "fstat", .alias = "newfstat", },
664
961
 	{ .name	    = "fstatat", .alias = "newfstatat", },
665
962
 	{ .name	    = "futex",
..
..
@@ -710,31 +1007,33 @@
710
1007
 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, },
711
1008
 	{ .name	    = "mknodat",
712
1009
 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* fd */ }, }, },
713
-	{ .name	    = "mlock",
714
-	  .arg = { [0] = { .scnprintf = SCA_HEX, /* addr */ }, }, },
715
-	{ .name	    = "mlockall",
716
-	  .arg = { [0] = { .scnprintf = SCA_HEX, /* addr */ }, }, },
717
1010
 	{ .name	    = "mmap",	    .hexret = true,
718
1011
 /* The standard mmap maps to old_mmap on s390x */
719
1012
 #if defined(__s390x__)
720
1013
 	.alias = "old_mmap",
721
1014
 #endif
722
-	  .arg = { [0] = { .scnprintf = SCA_HEX,	/* addr */ },
723
-		   [2] = { .scnprintf = SCA_MMAP_PROT,	/* prot */ },
724
-		   [3] = { .scnprintf = SCA_MMAP_FLAGS,	/* flags */ }, }, },
1015
+	  .arg = { [2] = { .scnprintf = SCA_MMAP_PROT,	/* prot */ },
1016
+		   [3] = { .scnprintf = SCA_MMAP_FLAGS,	/* flags */
1017
+			   .strtoul   = STUL_STRARRAY_FLAGS,
1018
+			   .parm      = &strarray__mmap_flags, },
1019
+		   [5] = { .scnprintf = SCA_HEX,	/* offset */ }, }, },
1020
+	{ .name	    = "mount",
1021
+	  .arg = { [0] = { .scnprintf = SCA_FILENAME, /* dev_name */ },
1022
+		   [3] = { .scnprintf = SCA_MOUNT_FLAGS, /* flags */
1023
+			   .mask_val  = SCAMV_MOUNT_FLAGS, /* flags */ }, }, },
1024
+	{ .name	    = "move_mount",
1025
+	  .arg = { [0] = { .scnprintf = SCA_FDAT,	/* from_dfd */ },
1026
+		   [1] = { .scnprintf = SCA_FILENAME, /* from_pathname */ },
1027
+		   [2] = { .scnprintf = SCA_FDAT,	/* to_dfd */ },
1028
+		   [3] = { .scnprintf = SCA_FILENAME, /* to_pathname */ },
1029
+		   [4] = { .scnprintf = SCA_MOVE_MOUNT_FLAGS, /* flags */ }, }, },
725
1030
 	{ .name	    = "mprotect",
726
1031
 	  .arg = { [0] = { .scnprintf = SCA_HEX,	/* start */ },
727
1032
 		   [2] = { .scnprintf = SCA_MMAP_PROT,	/* prot */ }, }, },
728
1033
 	{ .name	    = "mq_unlink",
729
1034
 	  .arg = { [0] = { .scnprintf = SCA_FILENAME, /* u_name */ }, }, },
730
1035
 	{ .name	    = "mremap",	    .hexret = true,
731
-	  .arg = { [0] = { .scnprintf = SCA_HEX,	  /* addr */ },
732
-		   [3] = { .scnprintf = SCA_MREMAP_FLAGS, /* flags */ },
733
-		   [4] = { .scnprintf = SCA_HEX,	  /* new_addr */ }, }, },
734
-	{ .name	    = "munlock",
735
-	  .arg = { [0] = { .scnprintf = SCA_HEX, /* addr */ }, }, },
736
-	{ .name	    = "munmap",
737
-	  .arg = { [0] = { .scnprintf = SCA_HEX, /* addr */ }, }, },
1036
+	  .arg = { [3] = { .scnprintf = SCA_MREMAP_FLAGS, /* flags */ }, }, },
738
1037
 	{ .name	    = "name_to_handle_at",
739
1038
 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, },
740
1039
 	{ .name	    = "newfstatat",
..
..
@@ -763,8 +1062,10 @@
763
1062
 		   [3] = { .scnprintf = SCA_INT,	/* pkey */ }, }, },
764
1063
 	{ .name	    = "poll", .timeout = true, },
765
1064
 	{ .name	    = "ppoll", .timeout = true, },
766
-	{ .name	    = "prctl", .alias = "arch_prctl",
767
-	  .arg = { [0] = { .scnprintf = SCA_PRCTL_OPTION, /* option */ },
1065
+	{ .name	    = "prctl",
1066
+	  .arg = { [0] = { .scnprintf = SCA_PRCTL_OPTION, /* option */
1067
+			   .strtoul   = STUL_STRARRAY,
1068
+			   .parm      = &strarray__prctl_options, },
768
1069
 		   [1] = { .scnprintf = SCA_PRCTL_ARG2, /* arg2 */ },
769
1070
 		   [2] = { .scnprintf = SCA_PRCTL_ARG3, /* arg3 */ }, }, },
770
1071
 	{ .name	    = "pread", .alias = "pread64", },
..
..
@@ -781,7 +1082,12 @@
781
1082
 	{ .name	    = "recvmsg",
782
1083
 	  .arg = { [2] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, },
783
1084
 	{ .name	    = "renameat",
784
-	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, },
1085
+	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* olddirfd */ },
1086
+		   [2] = { .scnprintf = SCA_FDAT, /* newdirfd */ }, }, },
1087
+	{ .name	    = "renameat2",
1088
+	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* olddirfd */ },
1089
+		   [2] = { .scnprintf = SCA_FDAT, /* newdirfd */ },
1090
+		   [4] = { .scnprintf = SCA_RENAMEAT2_FLAGS, /* flags */ }, }, },
785
1091
 	{ .name	    = "rt_sigaction",
786
1092
 	  .arg = { [0] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, },
787
1093
 	{ .name	    = "rt_sigprocmask",
..
..
@@ -796,12 +1102,14 @@
796
1102
 	  .arg = { [0] = { .scnprintf = SCA_SECCOMP_OP,	   /* op */ },
797
1103
 		   [1] = { .scnprintf = SCA_SECCOMP_FLAGS, /* flags */ }, }, },
798
1104
 	{ .name	    = "select", .timeout = true, },
1105
+	{ .name	    = "sendfile", .alias = "sendfile64", },
799
1106
 	{ .name	    = "sendmmsg",
800
1107
 	  .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, },
801
1108
 	{ .name	    = "sendmsg",
802
1109
 	  .arg = { [2] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, },
803
1110
 	{ .name	    = "sendto",
804
-	  .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, },
1111
+	  .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ },
1112
+		   [4] = { .scnprintf = SCA_SOCKADDR, /* addr */ }, }, },
805
1113
 	{ .name	    = "set_tid_address", .errpid = true, },
806
1114
 	{ .name	    = "setitimer",
807
1115
 	  .arg = { [0] = STRARRAY(which, itimers), }, },
..
..
@@ -826,10 +1134,14 @@
826
1134
 	  .arg = { [0] = { .scnprintf = SCA_FILENAME, /* specialfile */ }, }, },
827
1135
 	{ .name	    = "symlinkat",
828
1136
 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, },
1137
+	{ .name	    = "sync_file_range",
1138
+	  .arg = { [3] = { .scnprintf = SCA_SYNC_FILE_RANGE_FLAGS, /* flags */ }, }, },
829
1139
 	{ .name	    = "tgkill",
830
1140
 	  .arg = { [2] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, },
831
1141
 	{ .name	    = "tkill",
832
1142
 	  .arg = { [1] = { .scnprintf = SCA_SIGNUM, /* sig */ }, }, },
1143
+	{ .name     = "umount2", .alias = "umount",
1144
+	  .arg = { [0] = { .scnprintf = SCA_FILENAME, /* name */ }, }, },
833
1145
 	{ .name	    = "uname", .alias = "newuname", },
834
1146
 	{ .name	    = "unlinkat",
835
1147
 	  .arg = { [0] = { .scnprintf = SCA_FDAT, /* dfd */ }, }, },
..
..
@@ -847,25 +1159,66 @@
847
1159
 	return strcmp(name, fmt->name);
848
1160
 }
849
1161
 
1162
+static struct syscall_fmt *__syscall_fmt__find(struct syscall_fmt *fmts, const int nmemb, const char *name)
1163
+{
1164
+	return bsearch(name, fmts, nmemb, sizeof(struct syscall_fmt), syscall_fmt__cmp);
1165
+}
1166
+
850
1167
 static struct syscall_fmt *syscall_fmt__find(const char *name)
851
1168
 {
852
1169
 	const int nmemb = ARRAY_SIZE(syscall_fmts);
853
-	return bsearch(name, syscall_fmts, nmemb, sizeof(struct syscall_fmt), syscall_fmt__cmp);
1170
+	return __syscall_fmt__find(syscall_fmts, nmemb, name);
1171
+}
1172
+
1173
+static struct syscall_fmt *__syscall_fmt__find_by_alias(struct syscall_fmt *fmts, const int nmemb, const char *alias)
1174
+{
1175
+	int i;
1176
+
1177
+	for (i = 0; i < nmemb; ++i) {
1178
+		if (fmts[i].alias && strcmp(fmts[i].alias, alias) == 0)
1179
+			return &fmts[i];
1180
+	}
1181
+
1182
+	return NULL;
1183
+}
1184
+
1185
+static struct syscall_fmt *syscall_fmt__find_by_alias(const char *alias)
1186
+{
1187
+	const int nmemb = ARRAY_SIZE(syscall_fmts);
1188
+	return __syscall_fmt__find_by_alias(syscall_fmts, nmemb, alias);
854
1189
 }
855
1190
 
856
1191
 /*
857
1192
  * is_exit: is this "exit" or "exit_group"?
858
1193
  * is_open: is this "open" or "openat"? To associate the fd returned in sys_exit with the pathname in sys_enter.
1194
+ * args_size: sum of the sizes of the syscall arguments, anything after that is augmented stuff: pathname for openat, etc.
1195
+ * nonexistent: Just a hole in the syscall table, syscall id not allocated
859
1196
  */
860
1197
 struct syscall {
861
-	struct event_format *tp_format;
1198
+	struct tep_event    *tp_format;
862
1199
 	int		    nr_args;
1200
+	int		    args_size;
1201
+	struct {
1202
+		struct bpf_program *sys_enter,
1203
+				   *sys_exit;
1204
+	}		    bpf_prog;
863
1205
 	bool		    is_exit;
864
1206
 	bool		    is_open;
865
-	struct format_field *args;
1207
+	bool		    nonexistent;
1208
+	struct tep_format_field *args;
866
1209
 	const char	    *name;
867
1210
 	struct syscall_fmt  *fmt;
868
1211
 	struct syscall_arg_fmt *arg_fmt;
1212
+};
1213
+
1214
+/*
1215
+ * Must match what is in the BPF program:
1216
+ *
1217
+ * tools/perf/examples/bpf/augmented_raw_syscalls.c
1218
+ */
1219
+struct bpf_map_syscall_entry {
1220
+	bool	enabled;
1221
+	u16	string_args_len[RAW_SYSCALL_ARGS_NUM];
869
1222
 };
870
1223
 
871
1224
 /*
..
..
@@ -914,9 +1267,9 @@
914
1267
 		char	      *name;
915
1268
 	} filename;
916
1269
 	struct {
917
-		int	  max;
918
-		char	  **table;
919
-	} paths;
1270
+		int	      max;
1271
+		struct file   *table;
1272
+	} files;
920
1273
 
921
1274
 	struct intlist *syscall_stats;
922
1275
 };
..
..
@@ -925,10 +1278,10 @@
925
1278
 {
926
1279
 	struct thread_trace *ttrace =  zalloc(sizeof(struct thread_trace));
927
1280
 
928
-	if (ttrace)
929
-		ttrace->paths.max = -1;
930
-
931
-	ttrace->syscall_stats = intlist__new(NULL);
1281
+	if (ttrace) {
1282
+		ttrace->files.max = -1;
1283
+		ttrace->syscall_stats = intlist__new(NULL);
1284
+	}
932
1285
 
933
1286
 	return ttrace;
934
1287
 }
..
..
@@ -970,30 +1323,51 @@
970
1323
 
971
1324
 static const size_t trace__entry_str_size = 2048;
972
1325
 
1326
+static struct file *thread_trace__files_entry(struct thread_trace *ttrace, int fd)
1327
+{
1328
+	if (fd < 0)
1329
+		return NULL;
1330
+
1331
+	if (fd > ttrace->files.max) {
1332
+		struct file *nfiles = realloc(ttrace->files.table, (fd + 1) * sizeof(struct file));
1333
+
1334
+		if (nfiles == NULL)
1335
+			return NULL;
1336
+
1337
+		if (ttrace->files.max != -1) {
1338
+			memset(nfiles + ttrace->files.max + 1, 0,
1339
+			       (fd - ttrace->files.max) * sizeof(struct file));
1340
+		} else {
1341
+			memset(nfiles, 0, (fd + 1) * sizeof(struct file));
1342
+		}
1343
+
1344
+		ttrace->files.table = nfiles;
1345
+		ttrace->files.max   = fd;
1346
+	}
1347
+
1348
+	return ttrace->files.table + fd;
1349
+}
1350
+
1351
+struct file *thread__files_entry(struct thread *thread, int fd)
1352
+{
1353
+	return thread_trace__files_entry(thread__priv(thread), fd);
1354
+}
1355
+
973
1356
 static int trace__set_fd_pathname(struct thread *thread, int fd, const char *pathname)
974
1357
 {
975
1358
 	struct thread_trace *ttrace = thread__priv(thread);
1359
+	struct file *file = thread_trace__files_entry(ttrace, fd);
976
1360
 
977
-	if (fd > ttrace->paths.max) {
978
-		char **npath = realloc(ttrace->paths.table, (fd + 1) * sizeof(char *));
979
-
980
-		if (npath == NULL)
981
-			return -1;
982
-
983
-		if (ttrace->paths.max != -1) {
984
-			memset(npath + ttrace->paths.max + 1, 0,
985
-			       (fd - ttrace->paths.max) * sizeof(char *));
986
-		} else {
987
-			memset(npath, 0, (fd + 1) * sizeof(char *));
988
-		}
989
-
990
-		ttrace->paths.table = npath;
991
-		ttrace->paths.max   = fd;
1361
+	if (file != NULL) {
1362
+		struct stat st;
1363
+		if (stat(pathname, &st) == 0)
1364
+			file->dev_maj = major(st.st_rdev);
1365
+		file->pathname = strdup(pathname);
1366
+		if (file->pathname)
1367
+			return 0;
992
1368
 	}
993
1369
 
994
-	ttrace->paths.table[fd] = strdup(pathname);
995
-
996
-	return ttrace->paths.table[fd] != NULL ? 0 : -1;
1370
+	return -1;
997
1371
 }
998
1372
 
999
1373
 static int thread__read_fd_path(struct thread *thread, int fd)
..
..
@@ -1027,13 +1401,13 @@
1027
1401
 {
1028
1402
 	struct thread_trace *ttrace = thread__priv(thread);
1029
1403
 
1030
-	if (ttrace == NULL)
1404
+	if (ttrace == NULL || trace->fd_path_disabled)
1031
1405
 		return NULL;
1032
1406
 
1033
1407
 	if (fd < 0)
1034
1408
 		return NULL;
1035
1409
 
1036
-	if ((fd > ttrace->paths.max || ttrace->paths.table[fd] == NULL)) {
1410
+	if ((fd > ttrace->files.max || ttrace->files.table[fd].pathname == NULL)) {
1037
1411
 		if (!trace->live)
1038
1412
 			return NULL;
1039
1413
 		++trace->stats.proc_getname;
..
..
@@ -1041,7 +1415,7 @@
1041
1415
 			return NULL;
1042
1416
 	}
1043
1417
 
1044
-	return ttrace->paths.table[fd];
1418
+	return ttrace->files.table[fd].pathname;
1045
1419
 }
1046
1420
 
1047
1421
 size_t syscall_arg__scnprintf_fd(char *bf, size_t size, struct syscall_arg *arg)
..
..
@@ -1080,8 +1454,8 @@
1080
1454
 	size_t printed = syscall_arg__scnprintf_fd(bf, size, arg);
1081
1455
 	struct thread_trace *ttrace = thread__priv(arg->thread);
1082
1456
 
1083
-	if (ttrace && fd >= 0 && fd <= ttrace->paths.max)
1084
-		zfree(&ttrace->paths.table[fd]);
1457
+	if (ttrace && fd >= 0 && fd <= ttrace->files.max)
1458
+		zfree(&ttrace->files.table[fd].pathname);
1085
1459
 
1086
1460
 	return printed;
1087
1461
 }
..
..
@@ -1095,10 +1469,29 @@
1095
1469
 	ttrace->filename.entry_str_pos = bf - ttrace->entry_str;
1096
1470
 }
1097
1471
 
1472
+static size_t syscall_arg__scnprintf_augmented_string(struct syscall_arg *arg, char *bf, size_t size)
1473
+{
1474
+	struct augmented_arg *augmented_arg = arg->augmented.args;
1475
+	size_t printed = scnprintf(bf, size, "\"%.*s\"", augmented_arg->size, augmented_arg->value);
1476
+	/*
1477
+	 * So that the next arg with a payload can consume its augmented arg, i.e. for rename* syscalls
1478
+	 * we would have two strings, each prefixed by its size.
1479
+	 */
1480
+	int consumed = sizeof(*augmented_arg) + augmented_arg->size;
1481
+
1482
+	arg->augmented.args = ((void *)arg->augmented.args) + consumed;
1483
+	arg->augmented.size -= consumed;
1484
+
1485
+	return printed;
1486
+}
1487
+
1098
1488
 static size_t syscall_arg__scnprintf_filename(char *bf, size_t size,
1099
1489
 					      struct syscall_arg *arg)
1100
1490
 {
1101
1491
 	unsigned long ptr = arg->val;
1492
+
1493
+	if (arg->augmented.args)
1494
+		return syscall_arg__scnprintf_augmented_string(arg, bf, size);
1102
1495
 
1103
1496
 	if (!arg->trace->vfs_getname)
1104
1497
 		return scnprintf(bf, size, "%#x", ptr);
..
..
@@ -1142,11 +1535,9 @@
1142
1535
 	interrupted = sig == SIGINT;
1143
1536
 }
1144
1537
 
1145
-static size_t trace__fprintf_entry_head(struct trace *trace, struct thread *thread,
1146
-					u64 duration, bool duration_calculated, u64 tstamp, FILE *fp)
1538
+static size_t trace__fprintf_comm_tid(struct trace *trace, struct thread *thread, FILE *fp)
1147
1539
 {
1148
-	size_t printed = trace__fprintf_tstamp(trace, tstamp, fp);
1149
-	printed += fprintf_duration(duration, duration_calculated, fp);
1540
+	size_t printed = 0;
1150
1541
 
1151
1542
 	if (trace->multiple_threads) {
1152
1543
 		if (trace->show_comm)
..
..
@@ -1155,6 +1546,18 @@
1155
1546
 	}
1156
1547
 
1157
1548
 	return printed;
1549
+}
1550
+
1551
+static size_t trace__fprintf_entry_head(struct trace *trace, struct thread *thread,
1552
+					u64 duration, bool duration_calculated, u64 tstamp, FILE *fp)
1553
+{
1554
+	size_t printed = 0;
1555
+
1556
+	if (trace->show_tstamp)
1557
+		printed = trace__fprintf_tstamp(trace, tstamp, fp);
1558
+	if (trace->show_duration)
1559
+		printed += fprintf_duration(duration, duration_calculated, fp);
1560
+	return printed + trace__fprintf_comm_tid(trace, thread, fp);
1158
1561
 }
1159
1562
 
1160
1563
 static int trace__process_event(struct trace *trace, struct machine *machine,
..
..
@@ -1194,7 +1597,7 @@
1194
1597
 
1195
1598
 	if (symbol_conf.kptr_restrict) {
1196
1599
 		pr_warning("Kernel address maps (/proc/{kallsyms,modules}) are restricted.\n\n"
1197
-			   "Check /proc/sys/kernel/kptr_restrict.\n\n"
1600
+			   "Check /proc/sys/kernel/kptr_restrict and /proc/sys/kernel/perf_event_paranoid.\n\n"
1198
1601
 			   "Kernel samples will not be resolved.\n");
1199
1602
 		machine->kptr_restrict_warned = true;
1200
1603
 		return NULL;
..
..
@@ -1203,7 +1606,7 @@
1203
1606
 	return machine__resolve_kernel_addr(vmachine, addrp, modp);
1204
1607
 }
1205
1608
 
1206
-static int trace__symbols_init(struct trace *trace, struct perf_evlist *evlist)
1609
+static int trace__symbols_init(struct trace *trace, struct evlist *evlist)
1207
1610
 {
1208
1611
 	int err = symbol__init(NULL);
1209
1612
 
..
..
@@ -1219,8 +1622,8 @@
1219
1622
 		goto out;
1220
1623
 
1221
1624
 	err = __machine__synthesize_threads(trace->host, &trace->tool, &trace->opts.target,
1222
-					    evlist->threads, trace__tool_process, false,
1223
-					    trace->opts.proc_map_timeout, 1);
1625
+					    evlist->core.threads, trace__tool_process, false,
1626
+					    1);
1224
1627
 out:
1225
1628
 	if (err)
1226
1629
 		symbol__exit();
..
..
@@ -1240,7 +1643,7 @@
1240
1643
 {
1241
1644
 	int idx;
1242
1645
 
1243
-	if (nr_args == 6 && sc->fmt && sc->fmt->nr_args != 0)
1646
+	if (nr_args == RAW_SYSCALL_ARGS_NUM && sc->fmt && sc->fmt->nr_args != 0)
1244
1647
 		nr_args = sc->fmt->nr_args;
1245
1648
 
1246
1649
 	sc->arg_fmt = calloc(nr_args, sizeof(*sc->arg_fmt));
..
..
@@ -1256,31 +1659,60 @@
1256
1659
 	return 0;
1257
1660
 }
1258
1661
 
1259
-static int syscall__set_arg_fmts(struct syscall *sc)
1260
-{
1261
-	struct format_field *field;
1262
-	int idx = 0, len;
1662
+static struct syscall_arg_fmt syscall_arg_fmts__by_name[] = {
1663
+	{ .name = "msr",	.scnprintf = SCA_X86_MSR,	  .strtoul = STUL_X86_MSR,	   },
1664
+	{ .name = "vector",	.scnprintf = SCA_X86_IRQ_VECTORS, .strtoul = STUL_X86_IRQ_VECTORS, },
1665
+};
1263
1666
 
1264
-	for (field = sc->args; field; field = field->next, ++idx) {
1265
-		if (sc->fmt && sc->fmt->arg[idx].scnprintf)
1667
+static int syscall_arg_fmt__cmp(const void *name, const void *fmtp)
1668
+{
1669
+       const struct syscall_arg_fmt *fmt = fmtp;
1670
+       return strcmp(name, fmt->name);
1671
+}
1672
+
1673
+static struct syscall_arg_fmt *
1674
+__syscall_arg_fmt__find_by_name(struct syscall_arg_fmt *fmts, const int nmemb, const char *name)
1675
+{
1676
+       return bsearch(name, fmts, nmemb, sizeof(struct syscall_arg_fmt), syscall_arg_fmt__cmp);
1677
+}
1678
+
1679
+static struct syscall_arg_fmt *syscall_arg_fmt__find_by_name(const char *name)
1680
+{
1681
+       const int nmemb = ARRAY_SIZE(syscall_arg_fmts__by_name);
1682
+       return __syscall_arg_fmt__find_by_name(syscall_arg_fmts__by_name, nmemb, name);
1683
+}
1684
+
1685
+static struct tep_format_field *
1686
+syscall_arg_fmt__init_array(struct syscall_arg_fmt *arg, struct tep_format_field *field)
1687
+{
1688
+	struct tep_format_field *last_field = NULL;
1689
+	int len;
1690
+
1691
+	for (; field; field = field->next, ++arg) {
1692
+		last_field = field;
1693
+
1694
+		if (arg->scnprintf)
1266
1695
 			continue;
1267
1696
 
1697
+		len = strlen(field->name);
1698
+
1268
1699
 		if (strcmp(field->type, "const char *") == 0 &&
1269
-			 (strcmp(field->name, "filename") == 0 ||
1270
-			  strcmp(field->name, "path") == 0 ||
1271
-			  strcmp(field->name, "pathname") == 0))
1272
-			sc->arg_fmt[idx].scnprintf = SCA_FILENAME;
1273
-		else if (field->flags & FIELD_IS_POINTER)
1274
-			sc->arg_fmt[idx].scnprintf = syscall_arg__scnprintf_hex;
1700
+		    ((len >= 4 && strcmp(field->name + len - 4, "name") == 0) ||
1701
+		     strstr(field->name, "path") != NULL))
1702
+			arg->scnprintf = SCA_FILENAME;
1703
+		else if ((field->flags & TEP_FIELD_IS_POINTER) || strstr(field->name, "addr"))
1704
+			arg->scnprintf = SCA_PTR;
1275
1705
 		else if (strcmp(field->type, "pid_t") == 0)
1276
-			sc->arg_fmt[idx].scnprintf = SCA_PID;
1706
+			arg->scnprintf = SCA_PID;
1277
1707
 		else if (strcmp(field->type, "umode_t") == 0)
1278
-			sc->arg_fmt[idx].scnprintf = SCA_MODE_T;
1279
-		else if ((strcmp(field->type, "int") == 0 ||
1708
+			arg->scnprintf = SCA_MODE_T;
1709
+		else if ((field->flags & TEP_FIELD_IS_ARRAY) && strstr(field->type, "char")) {
1710
+			arg->scnprintf = SCA_CHAR_ARRAY;
1711
+			arg->nr_entries = field->arraylen;
1712
+		} else if ((strcmp(field->type, "int") == 0 ||
1280
1713
 			  strcmp(field->type, "unsigned int") == 0 ||
1281
1714
 			  strcmp(field->type, "long") == 0) &&
1282
-			 (len = strlen(field->name)) >= 2 &&
1283
-			 strcmp(field->name + len - 2, "fd") == 0) {
1715
+			 len >= 2 && strcmp(field->name + len - 2, "fd") == 0) {
1284
1716
 			/*
1285
1717
 			 * /sys/kernel/tracing/events/syscalls/sys_enter*
1286
1718
 			 * egrep 'field:.*fd;' .../format|sed -r 's/.*field:([a-z ]+) [a-z_]*fd.+/\1/g'|sort|uniq -c
..
..
@@ -1288,9 +1720,26 @@
1288
1720
 			 * 23 unsigned int
1289
1721
 			 * 7 unsigned long
1290
1722
 			 */
1291
-			sc->arg_fmt[idx].scnprintf = SCA_FD;
1723
+			arg->scnprintf = SCA_FD;
1724
+               } else {
1725
+			struct syscall_arg_fmt *fmt = syscall_arg_fmt__find_by_name(field->name);
1726
+
1727
+			if (fmt) {
1728
+				arg->scnprintf = fmt->scnprintf;
1729
+				arg->strtoul   = fmt->strtoul;
1730
+			}
1292
1731
 		}
1293
1732
 	}
1733
+
1734
+	return last_field;
1735
+}
1736
+
1737
+static int syscall__set_arg_fmts(struct syscall *sc)
1738
+{
1739
+	struct tep_format_field *last_field = syscall_arg_fmt__init_array(sc->arg_fmt, sc->args);
1740
+
1741
+	if (last_field)
1742
+		sc->args_size = last_field->offset + last_field->size;
1294
1743
 
1295
1744
 	return 0;
1296
1745
 }
..
..
@@ -1301,29 +1750,40 @@
1301
1750
 	struct syscall *sc;
1302
1751
 	const char *name = syscalltbl__name(trace->sctbl, id);
1303
1752
 
1304
-	if (name == NULL)
1305
-		return -1;
1753
+#ifdef HAVE_SYSCALL_TABLE_SUPPORT
1754
+	if (trace->syscalls.table == NULL) {
1755
+		trace->syscalls.table = calloc(trace->sctbl->syscalls.max_id + 1, sizeof(*sc));
1756
+		if (trace->syscalls.table == NULL)
1757
+			return -ENOMEM;
1758
+	}
1759
+#else
1760
+	if (id > trace->sctbl->syscalls.max_id || (id == 0 && trace->syscalls.table == NULL)) {
1761
+		// When using libaudit we don't know beforehand what is the max syscall id
1762
+		struct syscall *table = realloc(trace->syscalls.table, (id + 1) * sizeof(*sc));
1306
1763
 
1307
-	if (id > trace->syscalls.max) {
1308
-		struct syscall *nsyscalls = realloc(trace->syscalls.table, (id + 1) * sizeof(*sc));
1764
+		if (table == NULL)
1765
+			return -ENOMEM;
1309
1766
 
1310
-		if (nsyscalls == NULL)
1311
-			return -1;
1767
+		// Need to memset from offset 0 and +1 members if brand new
1768
+		if (trace->syscalls.table == NULL)
1769
+			memset(table, 0, (id + 1) * sizeof(*sc));
1770
+		else
1771
+			memset(table + trace->sctbl->syscalls.max_id + 1, 0, (id - trace->sctbl->syscalls.max_id) * sizeof(*sc));
1312
1772
 
1313
-		if (trace->syscalls.max != -1) {
1314
-			memset(nsyscalls + trace->syscalls.max + 1, 0,
1315
-			       (id - trace->syscalls.max) * sizeof(*sc));
1316
-		} else {
1317
-			memset(nsyscalls, 0, (id + 1) * sizeof(*sc));
1318
-		}
1773
+		trace->syscalls.table	      = table;
1774
+		trace->sctbl->syscalls.max_id = id;
1775
+	}
1776
+#endif
1777
+	sc = trace->syscalls.table + id;
1778
+	if (sc->nonexistent)
1779
+		return -EEXIST;
1319
1780
 
1320
-		trace->syscalls.table = nsyscalls;
1321
-		trace->syscalls.max   = id;
1781
+	if (name == NULL) {
1782
+		sc->nonexistent = true;
1783
+		return -EEXIST;
1322
1784
 	}
1323
1785
 
1324
-	sc = trace->syscalls.table + id;
1325
1786
 	sc->name = name;
1326
-
1327
1787
 	sc->fmt  = syscall_fmt__find(sc->name);
1328
1788
 
1329
1789
 	snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->name);
..
..
@@ -1334,11 +1794,18 @@
1334
1794
 		sc->tp_format = trace_event__tp_format("syscalls", tp_name);
1335
1795
 	}
1336
1796
 
1337
-	if (syscall__alloc_arg_fmts(sc, IS_ERR(sc->tp_format) ? 6 : sc->tp_format->format.nr_fields))
1338
-		return -1;
1797
+	/*
1798
+	 * Fails to read trace point format via sysfs node, so the trace point
1799
+	 * doesn't exist.  Set the 'nonexistent' flag as true.
1800
+	 */
1801
+	if (IS_ERR(sc->tp_format)) {
1802
+		sc->nonexistent = true;
1803
+		return PTR_ERR(sc->tp_format);
1804
+	}
1339
1805
 
1340
-	if (IS_ERR(sc->tp_format))
1341
-		return -1;
1806
+	if (syscall__alloc_arg_fmts(sc, IS_ERR(sc->tp_format) ?
1807
+					RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields))
1808
+		return -ENOMEM;
1342
1809
 
1343
1810
 	sc->args = sc->tp_format->format.fields;
1344
1811
 	/*
..
..
@@ -1357,14 +1824,33 @@
1357
1824
 	return syscall__set_arg_fmts(sc);
1358
1825
 }
1359
1826
 
1827
+static int evsel__init_tp_arg_scnprintf(struct evsel *evsel)
1828
+{
1829
+	struct syscall_arg_fmt *fmt = evsel__syscall_arg_fmt(evsel);
1830
+
1831
+	if (fmt != NULL) {
1832
+		syscall_arg_fmt__init_array(fmt, evsel->tp_format->format.fields);
1833
+		return 0;
1834
+	}
1835
+
1836
+	return -ENOMEM;
1837
+}
1838
+
1839
+static int intcmp(const void *a, const void *b)
1840
+{
1841
+	const int *one = a, *another = b;
1842
+
1843
+	return *one - *another;
1844
+}
1845
+
1360
1846
 static int trace__validate_ev_qualifier(struct trace *trace)
1361
1847
 {
1362
-	int err = 0, i;
1363
-	size_t nr_allocated;
1848
+	int err = 0;
1849
+	bool printed_invalid_prefix = false;
1364
1850
 	struct str_node *pos;
1851
+	size_t nr_used = 0, nr_allocated = strlist__nr_entries(trace->ev_qualifier);
1365
1852
 
1366
-	trace->ev_qualifier_ids.nr = strlist__nr_entries(trace->ev_qualifier);
1367
-	trace->ev_qualifier_ids.entries = malloc(trace->ev_qualifier_ids.nr *
1853
+	trace->ev_qualifier_ids.entries = malloc(nr_allocated *
1368
1854
 						 sizeof(trace->ev_qualifier_ids.entries[0]));
1369
1855
 
1370
1856
 	if (trace->ev_qualifier_ids.entries == NULL) {
..
..
@@ -1373,9 +1859,6 @@
1373
1859
 		err = -EINVAL;
1374
1860
 		goto out;
1375
1861
 	}
1376
-
1377
-	nr_allocated = trace->ev_qualifier_ids.nr;
1378
-	i = 0;
1379
1862
 
1380
1863
 	strlist__for_each_entry(pos, trace->ev_qualifier) {
1381
1864
 		const char *sc = pos->s;
..
..
@@ -1386,17 +1869,18 @@
1386
1869
 			if (id >= 0)
1387
1870
 				goto matches;
1388
1871
 
1389
-			if (err == 0) {
1390
-				fputs("Error:\tInvalid syscall ", trace->output);
1391
-				err = -EINVAL;
1872
+			if (!printed_invalid_prefix) {
1873
+				pr_debug("Skipping unknown syscalls: ");
1874
+				printed_invalid_prefix = true;
1392
1875
 			} else {
1393
-				fputs(", ", trace->output);
1876
+				pr_debug(", ");
1394
1877
 			}
1395
1878
 
1396
-			fputs(sc, trace->output);
1879
+			pr_debug("%s", sc);
1880
+			continue;
1397
1881
 		}
1398
1882
 matches:
1399
-		trace->ev_qualifier_ids.entries[i++] = id;
1883
+		trace->ev_qualifier_ids.entries[nr_used++] = id;
1400
1884
 		if (match_next == -1)
1401
1885
 			continue;
1402
1886
 
..
..
@@ -1404,7 +1888,7 @@
1404
1888
 			id = syscalltbl__strglobmatch_next(trace->sctbl, sc, &match_next);
1405
1889
 			if (id < 0)
1406
1890
 				break;
1407
-			if (nr_allocated == trace->ev_qualifier_ids.nr) {
1891
+			if (nr_allocated == nr_used) {
1408
1892
 				void *entries;
1409
1893
 
1410
1894
 				nr_allocated += 8;
..
..
@@ -1417,20 +1901,36 @@
1417
1901
 				}
1418
1902
 				trace->ev_qualifier_ids.entries = entries;
1419
1903
 			}
1420
-			trace->ev_qualifier_ids.nr++;
1421
-			trace->ev_qualifier_ids.entries[i++] = id;
1904
+			trace->ev_qualifier_ids.entries[nr_used++] = id;
1422
1905
 		}
1423
1906
 	}
1424
1907
 
1425
-	if (err < 0) {
1426
-		fputs("\nHint:\ttry 'perf list syscalls:sys_enter_*'"
1427
-		      "\nHint:\tand: 'man syscalls'\n", trace->output);
1428
-out_free:
1429
-		zfree(&trace->ev_qualifier_ids.entries);
1430
-		trace->ev_qualifier_ids.nr = 0;
1431
-	}
1908
+	trace->ev_qualifier_ids.nr = nr_used;
1909
+	qsort(trace->ev_qualifier_ids.entries, nr_used, sizeof(int), intcmp);
1432
1910
 out:
1911
+	if (printed_invalid_prefix)
1912
+		pr_debug("\n");
1433
1913
 	return err;
1914
+out_free:
1915
+	zfree(&trace->ev_qualifier_ids.entries);
1916
+	trace->ev_qualifier_ids.nr = 0;
1917
+	goto out;
1918
+}
1919
+
1920
+static __maybe_unused bool trace__syscall_enabled(struct trace *trace, int id)
1921
+{
1922
+	bool in_ev_qualifier;
1923
+
1924
+	if (trace->ev_qualifier_ids.nr == 0)
1925
+		return true;
1926
+
1927
+	in_ev_qualifier = bsearch(&id, trace->ev_qualifier_ids.entries,
1928
+				  trace->ev_qualifier_ids.nr, sizeof(int), intcmp) != NULL;
1929
+
1930
+	if (in_ev_qualifier)
1931
+	       return !trace->not_ev_qualifier;
1932
+
1933
+	return trace->not_ev_qualifier;
1434
1934
 }
1435
1935
 
1436
1936
 /*
..
..
@@ -1459,31 +1959,49 @@
1459
1959
 	return scnprintf(bf, size, "arg%d: ", arg->idx);
1460
1960
 }
1461
1961
 
1462
-static size_t syscall__scnprintf_val(struct syscall *sc, char *bf, size_t size,
1463
-				     struct syscall_arg *arg, unsigned long val)
1962
+/*
1963
+ * Check if the value is in fact zero, i.e. mask whatever needs masking, such
1964
+ * as mount 'flags' argument that needs ignoring some magic flag, see comment
1965
+ * in tools/perf/trace/beauty/mount_flags.c
1966
+ */
1967
+static unsigned long syscall_arg_fmt__mask_val(struct syscall_arg_fmt *fmt, struct syscall_arg *arg, unsigned long val)
1464
1968
 {
1465
-	if (sc->arg_fmt && sc->arg_fmt[arg->idx].scnprintf) {
1969
+	if (fmt && fmt->mask_val)
1970
+		return fmt->mask_val(arg, val);
1971
+
1972
+	return val;
1973
+}
1974
+
1975
+static size_t syscall_arg_fmt__scnprintf_val(struct syscall_arg_fmt *fmt, char *bf, size_t size,
1976
+					     struct syscall_arg *arg, unsigned long val)
1977
+{
1978
+	if (fmt && fmt->scnprintf) {
1466
1979
 		arg->val = val;
1467
-		if (sc->arg_fmt[arg->idx].parm)
1468
-			arg->parm = sc->arg_fmt[arg->idx].parm;
1469
-		return sc->arg_fmt[arg->idx].scnprintf(bf, size, arg);
1980
+		if (fmt->parm)
1981
+			arg->parm = fmt->parm;
1982
+		return fmt->scnprintf(bf, size, arg);
1470
1983
 	}
1471
1984
 	return scnprintf(bf, size, "%ld", val);
1472
1985
 }
1473
1986
 
1474
1987
 static size_t syscall__scnprintf_args(struct syscall *sc, char *bf, size_t size,
1475
-				      unsigned char *args, struct trace *trace,
1476
-				      struct thread *thread)
1988
+				      unsigned char *args, void *augmented_args, int augmented_args_size,
1989
+				      struct trace *trace, struct thread *thread)
1477
1990
 {
1478
1991
 	size_t printed = 0;
1479
1992
 	unsigned long val;
1480
1993
 	u8 bit = 1;
1481
1994
 	struct syscall_arg arg = {
1482
1995
 		.args	= args,
1996
+		.augmented = {
1997
+			.size = augmented_args_size,
1998
+			.args = augmented_args,
1999
+		},
1483
2000
 		.idx	= 0,
1484
2001
 		.mask	= 0,
1485
2002
 		.trace  = trace,
1486
2003
 		.thread = thread,
2004
+		.show_string_prefix = trace->show_string_prefix,
1487
2005
 	};
1488
2006
 	struct thread_trace *ttrace = thread__priv(thread);
1489
2007
 
..
..
@@ -1495,14 +2013,20 @@
1495
2013
 	ttrace->ret_scnprintf = NULL;
1496
2014
 
1497
2015
 	if (sc->args != NULL) {
1498
-		struct format_field *field;
2016
+		struct tep_format_field *field;
1499
2017
 
1500
2018
 		for (field = sc->args; field;
1501
2019
 		     field = field->next, ++arg.idx, bit <<= 1) {
1502
2020
 			if (arg.mask & bit)
1503
2021
 				continue;
1504
2022
 
2023
+			arg.fmt = &sc->arg_fmt[arg.idx];
1505
2024
 			val = syscall_arg__val(&arg, arg.idx);
2025
+			/*
2026
+			 * Some syscall args need some mask, most don't and
2027
+			 * return val untouched.
2028
+			 */
2029
+			val = syscall_arg_fmt__mask_val(&sc->arg_fmt[arg.idx], &arg, val);
1506
2030
 
1507
2031
 			/*
1508
2032
  			 * Suppress this argument if its value is zero and
..
..
@@ -1510,6 +2034,7 @@
1510
2034
  			 * strarray for it.
1511
2035
  			 */
1512
2036
 			if (val == 0 &&
2037
+			    !trace->show_zeros &&
1513
2038
 			    !(sc->arg_fmt &&
1514
2039
 			      (sc->arg_fmt[arg.idx].show_zero ||
1515
2040
 			       sc->arg_fmt[arg.idx].scnprintf == SCA_STRARRAY ||
..
..
@@ -1517,9 +2042,13 @@
1517
2042
 			      sc->arg_fmt[arg.idx].parm))
1518
2043
 				continue;
1519
2044
 
1520
-			printed += scnprintf(bf + printed, size - printed,
1521
-					     "%s%s: ", printed ? ", " : "", field->name);
1522
-			printed += syscall__scnprintf_val(sc, bf + printed, size - printed, &arg, val);
2045
+			printed += scnprintf(bf + printed, size - printed, "%s", printed ? ", " : "");
2046
+
2047
+			if (trace->show_arg_names)
2048
+				printed += scnprintf(bf + printed, size - printed, "%s: ", field->name);
2049
+
2050
+			printed += syscall_arg_fmt__scnprintf_val(&sc->arg_fmt[arg.idx],
2051
+								  bf + printed, size - printed, &arg, val);
1523
2052
 		}
1524
2053
 	} else if (IS_ERR(sc->tp_format)) {
1525
2054
 		/*
..
..
@@ -1534,7 +2063,7 @@
1534
2063
 			if (printed)
1535
2064
 				printed += scnprintf(bf + printed, size - printed, ", ");
1536
2065
 			printed += syscall__scnprintf_name(sc, bf + printed, size - printed, &arg);
1537
-			printed += syscall__scnprintf_val(sc, bf + printed, size - printed, &arg, val);
2066
+			printed += syscall_arg_fmt__scnprintf_val(&sc->arg_fmt[arg.idx], bf + printed, size - printed, &arg, val);
1538
2067
 next_arg:
1539
2068
 			++arg.idx;
1540
2069
 			bit <<= 1;
..
..
@@ -1544,13 +2073,14 @@
1544
2073
 	return printed;
1545
2074
 }
1546
2075
 
1547
-typedef int (*tracepoint_handler)(struct trace *trace, struct perf_evsel *evsel,
2076
+typedef int (*tracepoint_handler)(struct trace *trace, struct evsel *evsel,
1548
2077
 				  union perf_event *event,
1549
2078
 				  struct perf_sample *sample);
1550
2079
 
1551
2080
 static struct syscall *trace__syscall_info(struct trace *trace,
1552
-					   struct perf_evsel *evsel, int id)
2081
+					   struct evsel *evsel, int id)
1553
2082
 {
2083
+	int err = 0;
1554
2084
 
1555
2085
 	if (id < 0) {
1556
2086
 
..
..
@@ -1567,35 +2097,60 @@
1567
2097
 		if (verbose > 1) {
1568
2098
 			static u64 n;
1569
2099
 			fprintf(trace->output, "Invalid syscall %d id, skipping (%s, %" PRIu64 ") ...\n",
1570
-				id, perf_evsel__name(evsel), ++n);
2100
+				id, evsel__name(evsel), ++n);
1571
2101
 		}
1572
2102
 		return NULL;
1573
2103
 	}
1574
2104
 
1575
-	if ((id > trace->syscalls.max || trace->syscalls.table[id].name == NULL) &&
1576
-	    trace__read_syscall_info(trace, id))
2105
+	err = -EINVAL;
2106
+
2107
+#ifdef HAVE_SYSCALL_TABLE_SUPPORT
2108
+	if (id > trace->sctbl->syscalls.max_id) {
2109
+#else
2110
+	if (id >= trace->sctbl->syscalls.max_id) {
2111
+		/*
2112
+		 * With libaudit we don't know beforehand what is the max_id,
2113
+		 * so we let trace__read_syscall_info() figure that out as we
2114
+		 * go on reading syscalls.
2115
+		 */
2116
+		err = trace__read_syscall_info(trace, id);
2117
+		if (err)
2118
+#endif
2119
+		goto out_cant_read;
2120
+	}
2121
+
2122
+	if ((trace->syscalls.table == NULL || trace->syscalls.table[id].name == NULL) &&
2123
+	    (err = trace__read_syscall_info(trace, id)) != 0)
1577
2124
 		goto out_cant_read;
1578
2125
 
1579
-	if ((id > trace->syscalls.max || trace->syscalls.table[id].name == NULL))
2126
+	if (trace->syscalls.table && trace->syscalls.table[id].nonexistent)
1580
2127
 		goto out_cant_read;
1581
2128
 
1582
2129
 	return &trace->syscalls.table[id];
1583
2130
 
1584
2131
 out_cant_read:
1585
2132
 	if (verbose > 0) {
1586
-		fprintf(trace->output, "Problems reading syscall %d", id);
1587
-		if (id <= trace->syscalls.max && trace->syscalls.table[id].name != NULL)
2133
+		char sbuf[STRERR_BUFSIZE];
2134
+		fprintf(trace->output, "Problems reading syscall %d: %d (%s)", id, -err, str_error_r(-err, sbuf, sizeof(sbuf)));
2135
+		if (id <= trace->sctbl->syscalls.max_id && trace->syscalls.table[id].name != NULL)
1588
2136
 			fprintf(trace->output, "(%s)", trace->syscalls.table[id].name);
1589
2137
 		fputs(" information\n", trace->output);
1590
2138
 	}
1591
2139
 	return NULL;
1592
2140
 }
1593
2141
 
1594
-static void thread__update_stats(struct thread_trace *ttrace,
1595
-				 int id, struct perf_sample *sample)
2142
+struct syscall_stats {
2143
+	struct stats stats;
2144
+	u64	     nr_failures;
2145
+	int	     max_errno;
2146
+	u32	     *errnos;
2147
+};
2148
+
2149
+static void thread__update_stats(struct thread *thread, struct thread_trace *ttrace,
2150
+				 int id, struct perf_sample *sample, long err, bool errno_summary)
1596
2151
 {
1597
2152
 	struct int_node *inode;
1598
-	struct stats *stats;
2153
+	struct syscall_stats *stats;
1599
2154
 	u64 duration = 0;
1600
2155
 
1601
2156
 	inode = intlist__findnew(ttrace->syscall_stats, id);
..
..
@@ -1604,23 +2159,53 @@
1604
2159
 
1605
2160
 	stats = inode->priv;
1606
2161
 	if (stats == NULL) {
1607
-		stats = malloc(sizeof(struct stats));
2162
+		stats = malloc(sizeof(*stats));
1608
2163
 		if (stats == NULL)
1609
2164
 			return;
1610
-		init_stats(stats);
2165
+
2166
+		stats->nr_failures = 0;
2167
+		stats->max_errno   = 0;
2168
+		stats->errnos	   = NULL;
2169
+		init_stats(&stats->stats);
1611
2170
 		inode->priv = stats;
1612
2171
 	}
1613
2172
 
1614
2173
 	if (ttrace->entry_time && sample->time > ttrace->entry_time)
1615
2174
 		duration = sample->time - ttrace->entry_time;
1616
2175
 
1617
-	update_stats(stats, duration);
2176
+	update_stats(&stats->stats, duration);
2177
+
2178
+	if (err < 0) {
2179
+		++stats->nr_failures;
2180
+
2181
+		if (!errno_summary)
2182
+			return;
2183
+
2184
+		err = -err;
2185
+		if (err > stats->max_errno) {
2186
+			u32 *new_errnos = realloc(stats->errnos, err * sizeof(u32));
2187
+
2188
+			if (new_errnos) {
2189
+				memset(new_errnos + stats->max_errno, 0, (err - stats->max_errno) * sizeof(u32));
2190
+			} else {
2191
+				pr_debug("Not enough memory for errno stats for thread \"%s\"(%d/%d), results will be incomplete\n",
2192
+					 thread__comm_str(thread), thread->pid_, thread->tid);
2193
+				return;
2194
+			}
2195
+
2196
+			stats->errnos = new_errnos;
2197
+			stats->max_errno = err;
2198
+		}
2199
+
2200
+		++stats->errnos[err - 1];
2201
+	}
1618
2202
 }
1619
2203
 
1620
2204
 static int trace__printf_interrupted_entry(struct trace *trace)
1621
2205
 {
1622
2206
 	struct thread_trace *ttrace;
1623
2207
 	size_t printed;
2208
+	int len;
1624
2209
 
1625
2210
 	if (trace->failure_only || trace->current == NULL)
1626
2211
 		return 0;
..
..
@@ -1631,13 +2216,20 @@
1631
2216
 		return 0;
1632
2217
 
1633
2218
 	printed  = trace__fprintf_entry_head(trace, trace->current, 0, false, ttrace->entry_time, trace->output);
1634
-	printed += fprintf(trace->output, "%-70s) ...\n", ttrace->entry_str);
2219
+	printed += len = fprintf(trace->output, "%s)", ttrace->entry_str);
2220
+
2221
+	if (len < trace->args_alignment - 4)
2222
+		printed += fprintf(trace->output, "%-*s", trace->args_alignment - 4 - len, " ");
2223
+
2224
+	printed += fprintf(trace->output, " ...\n");
2225
+
1635
2226
 	ttrace->entry_pending = false;
2227
+	++trace->nr_events_printed;
1636
2228
 
1637
2229
 	return printed;
1638
2230
 }
1639
2231
 
1640
-static int trace__fprintf_sample(struct trace *trace, struct perf_evsel *evsel,
2232
+static int trace__fprintf_sample(struct trace *trace, struct evsel *evsel,
1641
2233
 				 struct perf_sample *sample, struct thread *thread)
1642
2234
 {
1643
2235
 	int printed = 0;
..
..
@@ -1646,7 +2238,7 @@
1646
2238
 		double ts = (double)sample->time / NSEC_PER_MSEC;
1647
2239
 
1648
2240
 		printed += fprintf(trace->output, "%22s %10.3f %s %d/%d [%d]\n",
1649
-				   perf_evsel__name(evsel), ts,
2241
+				   evsel__name(evsel), ts,
1650
2242
 				   thread__comm_str(thread),
1651
2243
 				   sample->pid, sample->tid, sample->cpu);
1652
2244
 	}
..
..
@@ -1654,15 +2246,43 @@
1654
2246
 	return printed;
1655
2247
 }
1656
2248
 
1657
-static int trace__sys_enter(struct trace *trace, struct perf_evsel *evsel,
2249
+static void *syscall__augmented_args(struct syscall *sc, struct perf_sample *sample, int *augmented_args_size, int raw_augmented_args_size)
2250
+{
2251
+	void *augmented_args = NULL;
2252
+	/*
2253
+	 * For now with BPF raw_augmented we hook into raw_syscalls:sys_enter
2254
+	 * and there we get all 6 syscall args plus the tracepoint common fields
2255
+	 * that gets calculated at the start and the syscall_nr (another long).
2256
+	 * So we check if that is the case and if so don't look after the
2257
+	 * sc->args_size but always after the full raw_syscalls:sys_enter payload,
2258
+	 * which is fixed.
2259
+	 *
2260
+	 * We'll revisit this later to pass s->args_size to the BPF augmenter
2261
+	 * (now tools/perf/examples/bpf/augmented_raw_syscalls.c, so that it
2262
+	 * copies only what we need for each syscall, like what happens when we
2263
+	 * use syscalls:sys_enter_NAME, so that we reduce the kernel/userspace
2264
+	 * traffic to just what is needed for each syscall.
2265
+	 */
2266
+	int args_size = raw_augmented_args_size ?: sc->args_size;
2267
+
2268
+	*augmented_args_size = sample->raw_size - args_size;
2269
+	if (*augmented_args_size > 0)
2270
+		augmented_args = sample->raw_data + args_size;
2271
+
2272
+	return augmented_args;
2273
+}
2274
+
2275
+static int trace__sys_enter(struct trace *trace, struct evsel *evsel,
1658
2276
 			    union perf_event *event __maybe_unused,
1659
2277
 			    struct perf_sample *sample)
1660
2278
 {
1661
2279
 	char *msg;
1662
2280
 	void *args;
1663
-	size_t printed = 0;
2281
+	int printed = 0;
1664
2282
 	struct thread *thread;
1665
2283
 	int id = perf_evsel__sc_tp_uint(evsel, id, sample), err = -1;
2284
+	int augmented_args_size = 0;
2285
+	void *augmented_args = NULL;
1666
2286
 	struct syscall *sc = trace__syscall_info(trace, evsel, id);
1667
2287
 	struct thread_trace *ttrace;
1668
2288
 
..
..
@@ -1686,18 +2306,34 @@
1686
2306
 
1687
2307
 	if (!(trace->duration_filter || trace->summary_only || trace->min_stack))
1688
2308
 		trace__printf_interrupted_entry(trace);
1689
-
2309
+	/*
2310
+	 * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
2311
+	 * arguments, even if the syscall being handled, say "openat", uses only 4 arguments
2312
+	 * this breaks syscall__augmented_args() check for augmented args, as we calculate
2313
+	 * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,
2314
+	 * so when handling, say the openat syscall, we end up getting 6 args for the
2315
+	 * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
2316
+	 * thinking that the extra 2 u64 args are the augmented filename, so just check
2317
+	 * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
2318
+	 */
2319
+	if (evsel != trace->syscalls.events.sys_enter)
2320
+		augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
1690
2321
 	ttrace->entry_time = sample->time;
1691
2322
 	msg = ttrace->entry_str;
1692
2323
 	printed += scnprintf(msg + printed, trace__entry_str_size - printed, "%s(", sc->name);
1693
2324
 
1694
2325
 	printed += syscall__scnprintf_args(sc, msg + printed, trace__entry_str_size - printed,
1695
-					   args, trace, thread);
2326
+					   args, augmented_args, augmented_args_size, trace, thread);
1696
2327
 
1697
2328
 	if (sc->is_exit) {
1698
2329
 		if (!(trace->duration_filter || trace->summary_only || trace->failure_only || trace->min_stack)) {
2330
+			int alignment = 0;
2331
+
1699
2332
 			trace__fprintf_entry_head(trace, thread, 0, false, ttrace->entry_time, trace->output);
1700
-			fprintf(trace->output, "%-70s)\n", ttrace->entry_str);
2333
+			printed = fprintf(trace->output, "%s)", ttrace->entry_str);
2334
+			if (trace->args_alignment > printed)
2335
+				alignment = trace->args_alignment - printed;
2336
+			fprintf(trace->output, "%*s= ?\n", alignment, " ");
1701
2337
 		}
1702
2338
 	} else {
1703
2339
 		ttrace->entry_pending = true;
..
..
@@ -1715,7 +2351,7 @@
1715
2351
 	return err;
1716
2352
 }
1717
2353
 
1718
-static int trace__fprintf_sys_enter(struct trace *trace, struct perf_evsel *evsel,
2354
+static int trace__fprintf_sys_enter(struct trace *trace, struct evsel *evsel,
1719
2355
 				    struct perf_sample *sample)
1720
2356
 {
1721
2357
 	struct thread_trace *ttrace;
..
..
@@ -1723,7 +2359,8 @@
1723
2359
 	int id = perf_evsel__sc_tp_uint(evsel, id, sample), err = -1;
1724
2360
 	struct syscall *sc = trace__syscall_info(trace, evsel, id);
1725
2361
 	char msg[1024];
1726
-	void *args;
2362
+	void *args, *augmented_args = NULL;
2363
+	int augmented_args_size;
1727
2364
 
1728
2365
 	if (sc == NULL)
1729
2366
 		return -1;
..
..
@@ -1738,7 +2375,8 @@
1738
2375
 		goto out_put;
1739
2376
 
1740
2377
 	args = perf_evsel__sc_tp_ptr(evsel, args, sample);
1741
-	syscall__scnprintf_args(sc, msg, sizeof(msg), args, trace, thread);
2378
+	augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
2379
+	syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread);
1742
2380
 	fprintf(trace->output, "%s", msg);
1743
2381
 	err = 0;
1744
2382
 out_put:
..
..
@@ -1746,20 +2384,22 @@
1746
2384
 	return err;
1747
2385
 }
1748
2386
 
1749
-static int trace__resolve_callchain(struct trace *trace, struct perf_evsel *evsel,
2387
+static int trace__resolve_callchain(struct trace *trace, struct evsel *evsel,
1750
2388
 				    struct perf_sample *sample,
1751
2389
 				    struct callchain_cursor *cursor)
1752
2390
 {
1753
2391
 	struct addr_location al;
1754
-	int max_stack = evsel->attr.sample_max_stack ?
1755
-			evsel->attr.sample_max_stack :
2392
+	int max_stack = evsel->core.attr.sample_max_stack ?
2393
+			evsel->core.attr.sample_max_stack :
1756
2394
 			trace->max_stack;
2395
+	int err;
1757
2396
 
1758
-	if (machine__resolve(trace->host, &al, sample) < 0 ||
1759
-	    thread__resolve_callchain(al.thread, cursor, evsel, sample, NULL, NULL, max_stack))
2397
+	if (machine__resolve(trace->host, &al, sample) < 0)
1760
2398
 		return -1;
1761
2399
 
1762
-	return 0;
2400
+	err = thread__resolve_callchain(al.thread, cursor, evsel, sample, NULL, NULL, max_stack);
2401
+	addr_location__put(&al);
2402
+	return err;
1763
2403
 }
1764
2404
 
1765
2405
 static int trace__fprintf_callchain(struct trace *trace, struct perf_sample *sample)
..
..
@@ -1769,18 +2409,18 @@
1769
2409
 				        EVSEL__PRINT_DSO |
1770
2410
 				        EVSEL__PRINT_UNKNOWN_AS_ADDR;
1771
2411
 
1772
-	return sample__fprintf_callchain(sample, 38, print_opts, &callchain_cursor, trace->output);
2412
+	return sample__fprintf_callchain(sample, 38, print_opts, &callchain_cursor, symbol_conf.bt_stop_list, trace->output);
1773
2413
 }
1774
2414
 
1775
-static const char *errno_to_name(struct perf_evsel *evsel, int err)
2415
+static const char *errno_to_name(struct evsel *evsel, int err)
1776
2416
 {
1777
-	struct perf_env *env = perf_evsel__env(evsel);
2417
+	struct perf_env *env = evsel__env(evsel);
1778
2418
 	const char *arch_name = perf_env__arch(env);
1779
2419
 
1780
2420
 	return arch_syscalls__strerrno(arch_name, err);
1781
2421
 }
1782
2422
 
1783
-static int trace__sys_exit(struct trace *trace, struct perf_evsel *evsel,
2423
+static int trace__sys_exit(struct trace *trace, struct evsel *evsel,
1784
2424
 			   union perf_event *event __maybe_unused,
1785
2425
 			   struct perf_sample *sample)
1786
2426
 {
..
..
@@ -1788,7 +2428,8 @@
1788
2428
 	u64 duration = 0;
1789
2429
 	bool duration_calculated = false;
1790
2430
 	struct thread *thread;
1791
-	int id = perf_evsel__sc_tp_uint(evsel, id, sample), err = -1, callchain_ret = 0;
2431
+	int id = perf_evsel__sc_tp_uint(evsel, id, sample), err = -1, callchain_ret = 0, printed = 0;
2432
+	int alignment = trace->args_alignment;
1792
2433
 	struct syscall *sc = trace__syscall_info(trace, evsel, id);
1793
2434
 	struct thread_trace *ttrace;
1794
2435
 
..
..
@@ -1802,12 +2443,12 @@
1802
2443
 
1803
2444
 	trace__fprintf_sample(trace, evsel, sample, thread);
1804
2445
 
1805
-	if (trace->summary)
1806
-		thread__update_stats(ttrace, id, sample);
1807
-
1808
2446
 	ret = perf_evsel__sc_tp_uint(evsel, ret, sample);
1809
2447
 
1810
-	if (sc->is_open && ret >= 0 && ttrace->filename.pending_open) {
2448
+	if (trace->summary)
2449
+		thread__update_stats(thread, ttrace, id, sample, ret, trace->errno_summary);
2450
+
2451
+	if (!trace->fd_path_disabled && sc->is_open && ret >= 0 && ttrace->filename.pending_open) {
1811
2452
 		trace__set_fd_pathname(thread, ret, ttrace->filename.name);
1812
2453
 		ttrace->filename.pending_open = false;
1813
2454
 		++trace->stats.vfs_getname;
..
..
@@ -1836,28 +2477,38 @@
1836
2477
 	trace__fprintf_entry_head(trace, thread, duration, duration_calculated, ttrace->entry_time, trace->output);
1837
2478
 
1838
2479
 	if (ttrace->entry_pending) {
1839
-		fprintf(trace->output, "%-70s", ttrace->entry_str);
2480
+		printed = fprintf(trace->output, "%s", ttrace->entry_str);
1840
2481
 	} else {
1841
-		fprintf(trace->output, " ... [");
2482
+		printed += fprintf(trace->output, " ... [");
1842
2483
 		color_fprintf(trace->output, PERF_COLOR_YELLOW, "continued");
1843
-		fprintf(trace->output, "]: %s()", sc->name);
2484
+		printed += 9;
2485
+		printed += fprintf(trace->output, "]: %s()", sc->name);
1844
2486
 	}
2487
+
2488
+	printed++; /* the closing ')' */
2489
+
2490
+	if (alignment > printed)
2491
+		alignment -= printed;
2492
+	else
2493
+		alignment = 0;
2494
+
2495
+	fprintf(trace->output, ")%*s= ", alignment, " ");
1845
2496
 
1846
2497
 	if (sc->fmt == NULL) {
1847
2498
 		if (ret < 0)
1848
2499
 			goto errno_print;
1849
2500
 signed_print:
1850
-		fprintf(trace->output, ") = %ld", ret);
2501
+		fprintf(trace->output, "%ld", ret);
1851
2502
 	} else if (ret < 0) {
1852
2503
 errno_print: {
1853
2504
 		char bf[STRERR_BUFSIZE];
1854
2505
 		const char *emsg = str_error_r(-ret, bf, sizeof(bf)),
1855
2506
 			   *e = errno_to_name(evsel, -ret);
1856
2507
 
1857
-		fprintf(trace->output, ") = -1 %s %s", e, emsg);
2508
+		fprintf(trace->output, "-1 %s (%s)", e, emsg);
1858
2509
 	}
1859
2510
 	} else if (ret == 0 && sc->fmt->timeout)
1860
-		fprintf(trace->output, ") = 0 Timeout");
2511
+		fprintf(trace->output, "0 (Timeout)");
1861
2512
 	else if (ttrace->ret_scnprintf) {
1862
2513
 		char bf[1024];
1863
2514
 		struct syscall_arg arg = {
..
..
@@ -1867,14 +2518,14 @@
1867
2518
 		};
1868
2519
 		ttrace->ret_scnprintf(bf, sizeof(bf), &arg);
1869
2520
 		ttrace->ret_scnprintf = NULL;
1870
-		fprintf(trace->output, ") = %s", bf);
2521
+		fprintf(trace->output, "%s", bf);
1871
2522
 	} else if (sc->fmt->hexret)
1872
-		fprintf(trace->output, ") = %#lx", ret);
2523
+		fprintf(trace->output, "%#lx", ret);
1873
2524
 	else if (sc->fmt->errpid) {
1874
2525
 		struct thread *child = machine__find_thread(trace->host, ret, ret);
1875
2526
 
1876
2527
 		if (child != NULL) {
1877
-			fprintf(trace->output, ") = %ld", ret);
2528
+			fprintf(trace->output, "%ld", ret);
1878
2529
 			if (child->comm_set)
1879
2530
 				fprintf(trace->output, " (%s)", thread__comm_str(child));
1880
2531
 			thread__put(child);
..
..
@@ -1884,10 +2535,17 @@
1884
2535
 
1885
2536
 	fputc('\n', trace->output);
1886
2537
 
2538
+	/*
2539
+	 * We only consider an 'event' for the sake of --max-events a non-filtered
2540
+	 * sys_enter + sys_exit and other tracepoint events.
2541
+	 */
2542
+	if (++trace->nr_events_printed == trace->max_events && trace->max_events != ULONG_MAX)
2543
+		interrupted = true;
2544
+
1887
2545
 	if (callchain_ret > 0)
1888
2546
 		trace__fprintf_callchain(trace, sample);
1889
2547
 	else if (callchain_ret < 0)
1890
-		pr_err("Problem processing %s callchain, skipping...\n", perf_evsel__name(evsel));
2548
+		pr_err("Problem processing %s callchain, skipping...\n", evsel__name(evsel));
1891
2549
 out:
1892
2550
 	ttrace->entry_pending = false;
1893
2551
 	err = 0;
..
..
@@ -1896,7 +2554,7 @@
1896
2554
 	return err;
1897
2555
 }
1898
2556
 
1899
-static int trace__vfs_getname(struct trace *trace, struct perf_evsel *evsel,
2557
+static int trace__vfs_getname(struct trace *trace, struct evsel *evsel,
1900
2558
 			      union perf_event *event __maybe_unused,
1901
2559
 			      struct perf_sample *sample)
1902
2560
 {
..
..
@@ -1905,7 +2563,7 @@
1905
2563
 	size_t filename_len, entry_str_len, to_move;
1906
2564
 	ssize_t remaining_space;
1907
2565
 	char *pos;
1908
-	const char *filename = perf_evsel__rawptr(evsel, sample, "pathname");
2566
+	const char *filename = evsel__rawptr(evsel, sample, "pathname");
1909
2567
 
1910
2568
 	if (!thread)
1911
2569
 		goto out;
..
..
@@ -1957,11 +2615,11 @@
1957
2615
 	return 0;
1958
2616
 }
1959
2617
 
1960
-static int trace__sched_stat_runtime(struct trace *trace, struct perf_evsel *evsel,
2618
+static int trace__sched_stat_runtime(struct trace *trace, struct evsel *evsel,
1961
2619
 				     union perf_event *event __maybe_unused,
1962
2620
 				     struct perf_sample *sample)
1963
2621
 {
1964
-        u64 runtime = perf_evsel__intval(evsel, sample, "runtime");
2622
+        u64 runtime = evsel__intval(evsel, sample, "runtime");
1965
2623
 	double runtime_ms = (double)runtime / NSEC_PER_MSEC;
1966
2624
 	struct thread *thread = machine__findnew_thread(trace->host,
1967
2625
 							sample->pid,
..
..
@@ -1980,10 +2638,10 @@
1980
2638
 out_dump:
1981
2639
 	fprintf(trace->output, "%s: comm=%s,pid=%u,runtime=%" PRIu64 ",vruntime=%" PRIu64 ")\n",
1982
2640
 	       evsel->name,
1983
-	       perf_evsel__strval(evsel, sample, "comm"),
1984
-	       (pid_t)perf_evsel__intval(evsel, sample, "pid"),
2641
+	       evsel__strval(evsel, sample, "comm"),
2642
+	       (pid_t)evsel__intval(evsel, sample, "pid"),
1985
2643
 	       runtime,
1986
-	       perf_evsel__intval(evsel, sample, "vruntime"));
2644
+	       evsel__intval(evsel, sample, "vruntime"));
1987
2645
 	goto out_put;
1988
2646
 }
1989
2647
 
..
..
@@ -2016,13 +2674,99 @@
2016
2674
 {
2017
2675
 	binary__fprintf(sample->raw_data, sample->raw_size, 8,
2018
2676
 			bpf_output__printer, NULL, trace->output);
2677
+	++trace->nr_events_printed;
2019
2678
 }
2020
2679
 
2021
-static int trace__event_handler(struct trace *trace, struct perf_evsel *evsel,
2680
+static size_t trace__fprintf_tp_fields(struct trace *trace, struct evsel *evsel, struct perf_sample *sample,
2681
+				       struct thread *thread, void *augmented_args, int augmented_args_size)
2682
+{
2683
+	char bf[2048];
2684
+	size_t size = sizeof(bf);
2685
+	struct tep_format_field *field = evsel->tp_format->format.fields;
2686
+	struct syscall_arg_fmt *arg = __evsel__syscall_arg_fmt(evsel);
2687
+	size_t printed = 0;
2688
+	unsigned long val;
2689
+	u8 bit = 1;
2690
+	struct syscall_arg syscall_arg = {
2691
+		.augmented = {
2692
+			.size = augmented_args_size,
2693
+			.args = augmented_args,
2694
+		},
2695
+		.idx	= 0,
2696
+		.mask	= 0,
2697
+		.trace  = trace,
2698
+		.thread = thread,
2699
+		.show_string_prefix = trace->show_string_prefix,
2700
+	};
2701
+
2702
+	for (; field && arg; field = field->next, ++syscall_arg.idx, bit <<= 1, ++arg) {
2703
+		if (syscall_arg.mask & bit)
2704
+			continue;
2705
+
2706
+		syscall_arg.len = 0;
2707
+		syscall_arg.fmt = arg;
2708
+		if (field->flags & TEP_FIELD_IS_ARRAY) {
2709
+			int offset = field->offset;
2710
+
2711
+			if (field->flags & TEP_FIELD_IS_DYNAMIC) {
2712
+				offset = format_field__intval(field, sample, evsel->needs_swap);
2713
+				syscall_arg.len = offset >> 16;
2714
+				offset &= 0xffff;
2715
+			}
2716
+
2717
+			val = (uintptr_t)(sample->raw_data + offset);
2718
+		} else
2719
+			val = format_field__intval(field, sample, evsel->needs_swap);
2720
+		/*
2721
+		 * Some syscall args need some mask, most don't and
2722
+		 * return val untouched.
2723
+		 */
2724
+		val = syscall_arg_fmt__mask_val(arg, &syscall_arg, val);
2725
+
2726
+		/*
2727
+		 * Suppress this argument if its value is zero and
2728
+		 * and we don't have a string associated in an
2729
+		 * strarray for it.
2730
+		 */
2731
+		if (val == 0 &&
2732
+		    !trace->show_zeros &&
2733
+		    !((arg->show_zero ||
2734
+		       arg->scnprintf == SCA_STRARRAY ||
2735
+		       arg->scnprintf == SCA_STRARRAYS) &&
2736
+		      arg->parm))
2737
+			continue;
2738
+
2739
+		printed += scnprintf(bf + printed, size - printed, "%s", printed ? ", " : "");
2740
+
2741
+		/*
2742
+		 * XXX Perhaps we should have a show_tp_arg_names,
2743
+		 * leaving show_arg_names just for syscalls?
2744
+		 */
2745
+		if (1 || trace->show_arg_names)
2746
+			printed += scnprintf(bf + printed, size - printed, "%s: ", field->name);
2747
+
2748
+		printed += syscall_arg_fmt__scnprintf_val(arg, bf + printed, size - printed, &syscall_arg, val);
2749
+	}
2750
+
2751
+	return printed + fprintf(trace->output, "%s", bf);
2752
+}
2753
+
2754
+static int trace__event_handler(struct trace *trace, struct evsel *evsel,
2022
2755
 				union perf_event *event __maybe_unused,
2023
2756
 				struct perf_sample *sample)
2024
2757
 {
2758
+	struct thread *thread;
2025
2759
 	int callchain_ret = 0;
2760
+	/*
2761
+	 * Check if we called perf_evsel__disable(evsel) due to, for instance,
2762
+	 * this event's max_events having been hit and this is an entry coming
2763
+	 * from the ring buffer that we should discard, since the max events
2764
+	 * have already been considered/printed.
2765
+	 */
2766
+	if (evsel->disabled)
2767
+		return 0;
2768
+
2769
+	thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);
2026
2770
 
2027
2771
 	if (sample->callchain) {
2028
2772
 		callchain_ret = trace__resolve_callchain(trace, evsel, sample, &callchain_cursor);
..
..
@@ -2036,32 +2780,63 @@
2036
2780
 	trace__printf_interrupted_entry(trace);
2037
2781
 	trace__fprintf_tstamp(trace, sample->time, trace->output);
2038
2782
 
2039
-	if (trace->trace_syscalls)
2783
+	if (trace->trace_syscalls && trace->show_duration)
2040
2784
 		fprintf(trace->output, "(         ): ");
2041
2785
 
2042
-	fprintf(trace->output, "%s:", evsel->name);
2786
+	if (thread)
2787
+		trace__fprintf_comm_tid(trace, thread, trace->output);
2043
2788
 
2044
-	if (perf_evsel__is_bpf_output(evsel)) {
2045
-		if (evsel == trace->syscalls.events.augmented)
2789
+	if (evsel == trace->syscalls.events.augmented) {
2790
+		int id = perf_evsel__sc_tp_uint(evsel, id, sample);
2791
+		struct syscall *sc = trace__syscall_info(trace, evsel, id);
2792
+
2793
+		if (sc) {
2794
+			fprintf(trace->output, "%s(", sc->name);
2046
2795
 			trace__fprintf_sys_enter(trace, evsel, sample);
2047
-		else
2048
-			bpf_output__fprintf(trace, sample);
2796
+			fputc(')', trace->output);
2797
+			goto newline;
2798
+		}
2799
+
2800
+		/*
2801
+		 * XXX: Not having the associated syscall info or not finding/adding
2802
+		 * 	the thread should never happen, but if it does...
2803
+		 * 	fall thru and print it as a bpf_output event.
2804
+		 */
2805
+	}
2806
+
2807
+	fprintf(trace->output, "%s(", evsel->name);
2808
+
2809
+	if (evsel__is_bpf_output(evsel)) {
2810
+		bpf_output__fprintf(trace, sample);
2049
2811
 	} else if (evsel->tp_format) {
2050
2812
 		if (strncmp(evsel->tp_format->name, "sys_enter_", 10) ||
2051
2813
 		    trace__fprintf_sys_enter(trace, evsel, sample)) {
2052
-			event_format__fprintf(evsel->tp_format, sample->cpu,
2053
-					      sample->raw_data, sample->raw_size,
2054
-					      trace->output);
2814
+			if (trace->libtraceevent_print) {
2815
+				event_format__fprintf(evsel->tp_format, sample->cpu,
2816
+						      sample->raw_data, sample->raw_size,
2817
+						      trace->output);
2818
+			} else {
2819
+				trace__fprintf_tp_fields(trace, evsel, sample, thread, NULL, 0);
2820
+			}
2055
2821
 		}
2056
2822
 	}
2057
2823
 
2058
-	fprintf(trace->output, "\n");
2824
+newline:
2825
+	fprintf(trace->output, ")\n");
2059
2826
 
2060
2827
 	if (callchain_ret > 0)
2061
2828
 		trace__fprintf_callchain(trace, sample);
2062
2829
 	else if (callchain_ret < 0)
2063
-		pr_err("Problem processing %s callchain, skipping...\n", perf_evsel__name(evsel));
2830
+		pr_err("Problem processing %s callchain, skipping...\n", evsel__name(evsel));
2831
+
2832
+	++trace->nr_events_printed;
2833
+
2834
+	if (evsel->max_events != ULONG_MAX && ++evsel->nr_events_printed == evsel->max_events) {
2835
+		evsel__disable(evsel);
2836
+		evsel__close(evsel);
2837
+	}
2064
2838
 out:
2839
+	thread__put(thread);
2065
2840
 	return 0;
2066
2841
 }
2067
2842
 
..
..
@@ -2083,7 +2858,7 @@
2083
2858
 }
2084
2859
 
2085
2860
 static int trace__pgfault(struct trace *trace,
2086
-			  struct perf_evsel *evsel,
2861
+			  struct evsel *evsel,
2087
2862
 			  union perf_event *event __maybe_unused,
2088
2863
 			  struct perf_sample *sample)
2089
2864
 {
..
..
@@ -2109,7 +2884,7 @@
2109
2884
 	if (ttrace == NULL)
2110
2885
 		goto out_put;
2111
2886
 
2112
-	if (evsel->attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ)
2887
+	if (evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ)
2113
2888
 		ttrace->pfmaj++;
2114
2889
 	else
2115
2890
 		ttrace->pfmin++;
..
..
@@ -2122,7 +2897,7 @@
2122
2897
 	trace__fprintf_entry_head(trace, thread, 0, true, sample->time, trace->output);
2123
2898
 
2124
2899
 	fprintf(trace->output, "%sfault [",
2125
-		evsel->attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ?
2900
+		evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ?
2126
2901
 		"maj" : "min");
2127
2902
 
2128
2903
 	print_location(trace->output, sample, &al, false, true);
..
..
@@ -2147,7 +2922,9 @@
2147
2922
 	if (callchain_ret > 0)
2148
2923
 		trace__fprintf_callchain(trace, sample);
2149
2924
 	else if (callchain_ret < 0)
2150
-		pr_err("Problem processing %s callchain, skipping...\n", perf_evsel__name(evsel));
2925
+		pr_err("Problem processing %s callchain, skipping...\n", evsel__name(evsel));
2926
+
2927
+	++trace->nr_events_printed;
2151
2928
 out:
2152
2929
 	err = 0;
2153
2930
 out_put:
..
..
@@ -2156,7 +2933,7 @@
2156
2933
 }
2157
2934
 
2158
2935
 static void trace__set_base_time(struct trace *trace,
2159
-				 struct perf_evsel *evsel,
2936
+				 struct evsel *evsel,
2160
2937
 				 struct perf_sample *sample)
2161
2938
 {
2162
2939
 	/*
..
..
@@ -2168,14 +2945,14 @@
2168
2945
 	 * appears in our event stream (vfs_getname comes to mind).
2169
2946
 	 */
2170
2947
 	if (trace->base_time == 0 && !trace->full_time &&
2171
-	    (evsel->attr.sample_type & PERF_SAMPLE_TIME))
2948
+	    (evsel->core.attr.sample_type & PERF_SAMPLE_TIME))
2172
2949
 		trace->base_time = sample->time;
2173
2950
 }
2174
2951
 
2175
2952
 static int trace__process_sample(struct perf_tool *tool,
2176
2953
 				 union perf_event *event,
2177
2954
 				 struct perf_sample *sample,
2178
-				 struct perf_evsel *evsel,
2955
+				 struct evsel *evsel,
2179
2956
 				 struct machine *machine __maybe_unused)
2180
2957
 {
2181
2958
 	struct trace *trace = container_of(tool, struct trace, tool);
..
..
@@ -2209,21 +2986,23 @@
2209
2986
 		"-m", "1024",
2210
2987
 		"-c", "1",
2211
2988
 	};
2212
-
2989
+	pid_t pid = getpid();
2990
+	char *filter = asprintf__tp_filter_pids(1, &pid);
2213
2991
 	const char * const sc_args[] = { "-e", };
2214
2992
 	unsigned int sc_args_nr = ARRAY_SIZE(sc_args);
2215
2993
 	const char * const majpf_args[] = { "-e", "major-faults" };
2216
2994
 	unsigned int majpf_args_nr = ARRAY_SIZE(majpf_args);
2217
2995
 	const char * const minpf_args[] = { "-e", "minor-faults" };
2218
2996
 	unsigned int minpf_args_nr = ARRAY_SIZE(minpf_args);
2997
+	int err = -1;
2219
2998
 
2220
-	/* +1 is for the event string below */
2221
-	rec_argc = ARRAY_SIZE(record_args) + sc_args_nr + 1 +
2999
+	/* +3 is for the event string below and the pid filter */
3000
+	rec_argc = ARRAY_SIZE(record_args) + sc_args_nr + 3 +
2222
3001
 		majpf_args_nr + minpf_args_nr + argc;
2223
3002
 	rec_argv = calloc(rec_argc + 1, sizeof(char *));
2224
3003
 
2225
-	if (rec_argv == NULL)
2226
-		return -ENOMEM;
3004
+	if (rec_argv == NULL || filter == NULL)
3005
+		goto out_free;
2227
3006
 
2228
3007
 	j = 0;
2229
3008
 	for (i = 0; i < ARRAY_SIZE(record_args); i++)
..
..
@@ -2240,10 +3019,12 @@
2240
3019
 			rec_argv[j++] = "syscalls:sys_enter,syscalls:sys_exit";
2241
3020
 		else {
2242
3021
 			pr_err("Neither raw_syscalls nor syscalls events exist.\n");
2243
-			free(rec_argv);
2244
-			return -1;
3022
+			goto out_free;
2245
3023
 		}
2246
3024
 	}
3025
+
3026
+	rec_argv[j++] = "--filter";
3027
+	rec_argv[j++] = filter;
2247
3028
 
2248
3029
 	if (trace->trace_pgfaults & TRACE_PFMAJ)
2249
3030
 		for (i = 0; i < majpf_args_nr; i++)
..
..
@@ -2256,42 +3037,53 @@
2256
3037
 	for (i = 0; i < (unsigned int)argc; i++)
2257
3038
 		rec_argv[j++] = argv[i];
2258
3039
 
2259
-	return cmd_record(j, rec_argv);
3040
+	err = cmd_record(j, rec_argv);
3041
+out_free:
3042
+	free(filter);
3043
+	free(rec_argv);
3044
+	return err;
2260
3045
 }
2261
3046
 
2262
3047
 static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp);
2263
3048
 
2264
-static bool perf_evlist__add_vfs_getname(struct perf_evlist *evlist)
3049
+static bool evlist__add_vfs_getname(struct evlist *evlist)
2265
3050
 {
2266
3051
 	bool found = false;
2267
-	struct perf_evsel *evsel, *tmp;
2268
-	struct parse_events_error err = { .idx = 0, };
2269
-	int ret = parse_events(evlist, "probe:vfs_getname*", &err);
3052
+	struct evsel *evsel, *tmp;
3053
+	struct parse_events_error err;
3054
+	int ret;
2270
3055
 
2271
-	if (ret)
3056
+	bzero(&err, sizeof(err));
3057
+	ret = parse_events(evlist, "probe:vfs_getname*", &err);
3058
+	if (ret) {
3059
+		free(err.str);
3060
+		free(err.help);
3061
+		free(err.first_str);
3062
+		free(err.first_help);
2272
3063
 		return false;
3064
+	}
2273
3065
 
2274
3066
 	evlist__for_each_entry_safe(evlist, evsel, tmp) {
2275
-		if (!strstarts(perf_evsel__name(evsel), "probe:vfs_getname"))
3067
+		if (!strstarts(evsel__name(evsel), "probe:vfs_getname"))
2276
3068
 			continue;
2277
3069
 
2278
-		if (perf_evsel__field(evsel, "pathname")) {
3070
+		if (evsel__field(evsel, "pathname")) {
2279
3071
 			evsel->handler = trace__vfs_getname;
2280
3072
 			found = true;
2281
3073
 			continue;
2282
3074
 		}
2283
3075
 
2284
-		list_del_init(&evsel->node);
3076
+		list_del_init(&evsel->core.node);
2285
3077
 		evsel->evlist = NULL;
2286
-		perf_evsel__delete(evsel);
3078
+		evsel__delete(evsel);
2287
3079
 	}
2288
3080
 
2289
3081
 	return found;
2290
3082
 }
2291
3083
 
2292
-static struct perf_evsel *perf_evsel__new_pgfault(u64 config)
3084
+static struct evsel *evsel__new_pgfault(u64 config)
2293
3085
 {
2294
-	struct perf_evsel *evsel;
3086
+	struct evsel *evsel;
2295
3087
 	struct perf_event_attr attr = {
2296
3088
 		.type = PERF_TYPE_SOFTWARE,
2297
3089
 		.mmap_data = 1,
..
..
@@ -2302,7 +3094,7 @@
2302
3094
 
2303
3095
 	event_attr_init(&attr);
2304
3096
 
2305
-	evsel = perf_evsel__new(&attr);
3097
+	evsel = evsel__new(&attr);
2306
3098
 	if (evsel)
2307
3099
 		evsel->handler = trace__pgfault;
2308
3100
 
..
..
@@ -2312,7 +3104,7 @@
2312
3104
 static void trace__handle_event(struct trace *trace, union perf_event *event, struct perf_sample *sample)
2313
3105
 {
2314
3106
 	const u32 type = event->header.type;
2315
-	struct perf_evsel *evsel;
3107
+	struct evsel *evsel;
2316
3108
 
2317
3109
 	if (type != PERF_RECORD_SAMPLE) {
2318
3110
 		trace__process_event(trace, trace->host, event, sample);
..
..
@@ -2325,24 +3117,30 @@
2325
3117
 		return;
2326
3118
 	}
2327
3119
 
3120
+	if (evswitch__discard(&trace->evswitch, evsel))
3121
+		return;
3122
+
2328
3123
 	trace__set_base_time(trace, evsel, sample);
2329
3124
 
2330
-	if (evsel->attr.type == PERF_TYPE_TRACEPOINT &&
3125
+	if (evsel->core.attr.type == PERF_TYPE_TRACEPOINT &&
2331
3126
 	    sample->raw_data == NULL) {
2332
3127
 		fprintf(trace->output, "%s sample with no payload for tid: %d, cpu %d, raw_size=%d, skipping...\n",
2333
-		       perf_evsel__name(evsel), sample->tid,
3128
+		       evsel__name(evsel), sample->tid,
2334
3129
 		       sample->cpu, sample->raw_size);
2335
3130
 	} else {
2336
3131
 		tracepoint_handler handler = evsel->handler;
2337
3132
 		handler(trace, evsel, event, sample);
2338
3133
 	}
3134
+
3135
+	if (trace->nr_events_printed >= trace->max_events && trace->max_events != ULONG_MAX)
3136
+		interrupted = true;
2339
3137
 }
2340
3138
 
2341
3139
 static int trace__add_syscall_newtp(struct trace *trace)
2342
3140
 {
2343
3141
 	int ret = -1;
2344
-	struct perf_evlist *evlist = trace->evlist;
2345
-	struct perf_evsel *sys_enter, *sys_exit;
3142
+	struct evlist *evlist = trace->evlist;
3143
+	struct evsel *sys_enter, *sys_exit;
2346
3144
 
2347
3145
 	sys_enter = perf_evsel__raw_syscall_newtp("sys_enter", trace__sys_enter);
2348
3146
 	if (sys_enter == NULL)
..
..
@@ -2358,11 +3156,11 @@
2358
3156
 	if (perf_evsel__init_sc_tp_uint_field(sys_exit, ret))
2359
3157
 		goto out_delete_sys_exit;
2360
3158
 
2361
-	perf_evsel__config_callchain(sys_enter, &trace->opts, &callchain_param);
2362
-	perf_evsel__config_callchain(sys_exit, &trace->opts, &callchain_param);
3159
+	evsel__config_callchain(sys_enter, &trace->opts, &callchain_param);
3160
+	evsel__config_callchain(sys_exit, &trace->opts, &callchain_param);
2363
3161
 
2364
-	perf_evlist__add(evlist, sys_enter);
2365
-	perf_evlist__add(evlist, sys_exit);
3162
+	evlist__add(evlist, sys_enter);
3163
+	evlist__add(evlist, sys_exit);
2366
3164
 
2367
3165
 	if (callchain_param.enabled && !trace->kernel_syscallchains) {
2368
3166
 		/*
..
..
@@ -2370,7 +3168,7 @@
2370
3168
 		 * leading to the syscall, allow overriding that for
2371
3169
 		 * debugging reasons using --kernel_syscall_callchains
2372
3170
 		 */
2373
-		sys_exit->attr.exclude_callchain_kernel = 1;
3171
+		sys_exit->core.attr.exclude_callchain_kernel = 1;
2374
3172
 	}
2375
3173
 
2376
3174
 	trace->syscalls.events.sys_enter = sys_enter;
..
..
@@ -2381,16 +3179,16 @@
2381
3179
 	return ret;
2382
3180
 
2383
3181
 out_delete_sys_exit:
2384
-	perf_evsel__delete_priv(sys_exit);
3182
+	evsel__delete_priv(sys_exit);
2385
3183
 out_delete_sys_enter:
2386
-	perf_evsel__delete_priv(sys_enter);
3184
+	evsel__delete_priv(sys_enter);
2387
3185
 	goto out;
2388
3186
 }
2389
3187
 
2390
-static int trace__set_ev_qualifier_filter(struct trace *trace)
3188
+static int trace__set_ev_qualifier_tp_filter(struct trace *trace)
2391
3189
 {
2392
3190
 	int err = -1;
2393
-	struct perf_evsel *sys_exit;
3191
+	struct evsel *sys_exit;
2394
3192
 	char *filter = asprintf_expr_inout_ints("id", !trace->not_ev_qualifier,
2395
3193
 						trace->ev_qualifier_ids.nr,
2396
3194
 						trace->ev_qualifier_ids.entries);
..
..
@@ -2398,10 +3196,9 @@
2398
3196
 	if (filter == NULL)
2399
3197
 		goto out_enomem;
2400
3198
 
2401
-	if (!perf_evsel__append_tp_filter(trace->syscalls.events.sys_enter,
2402
-					  filter)) {
3199
+	if (!evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter)) {
2403
3200
 		sys_exit = trace->syscalls.events.sys_exit;
2404
-		err = perf_evsel__append_tp_filter(sys_exit, filter);
3201
+		err = evsel__append_tp_filter(sys_exit, filter);
2405
3202
 	}
2406
3203
 
2407
3204
 	free(filter);
..
..
@@ -2412,9 +3209,450 @@
2412
3209
 	goto out;
2413
3210
 }
2414
3211
 
3212
+#ifdef HAVE_LIBBPF_SUPPORT
3213
+static struct bpf_map *trace__find_bpf_map_by_name(struct trace *trace, const char *name)
3214
+{
3215
+	if (trace->bpf_obj == NULL)
3216
+		return NULL;
3217
+
3218
+	return bpf_object__find_map_by_name(trace->bpf_obj, name);
3219
+}
3220
+
3221
+static void trace__set_bpf_map_filtered_pids(struct trace *trace)
3222
+{
3223
+	trace->filter_pids.map = trace__find_bpf_map_by_name(trace, "pids_filtered");
3224
+}
3225
+
3226
+static void trace__set_bpf_map_syscalls(struct trace *trace)
3227
+{
3228
+	trace->syscalls.map = trace__find_bpf_map_by_name(trace, "syscalls");
3229
+	trace->syscalls.prog_array.sys_enter = trace__find_bpf_map_by_name(trace, "syscalls_sys_enter");
3230
+	trace->syscalls.prog_array.sys_exit  = trace__find_bpf_map_by_name(trace, "syscalls_sys_exit");
3231
+}
3232
+
3233
+static struct bpf_program *trace__find_bpf_program_by_title(struct trace *trace, const char *name)
3234
+{
3235
+	if (trace->bpf_obj == NULL)
3236
+		return NULL;
3237
+
3238
+	return bpf_object__find_program_by_title(trace->bpf_obj, name);
3239
+}
3240
+
3241
+static struct bpf_program *trace__find_syscall_bpf_prog(struct trace *trace, struct syscall *sc,
3242
+							const char *prog_name, const char *type)
3243
+{
3244
+	struct bpf_program *prog;
3245
+
3246
+	if (prog_name == NULL) {
3247
+		char default_prog_name[256];
3248
+		scnprintf(default_prog_name, sizeof(default_prog_name), "!syscalls:sys_%s_%s", type, sc->name);
3249
+		prog = trace__find_bpf_program_by_title(trace, default_prog_name);
3250
+		if (prog != NULL)
3251
+			goto out_found;
3252
+		if (sc->fmt && sc->fmt->alias) {
3253
+			scnprintf(default_prog_name, sizeof(default_prog_name), "!syscalls:sys_%s_%s", type, sc->fmt->alias);
3254
+			prog = trace__find_bpf_program_by_title(trace, default_prog_name);
3255
+			if (prog != NULL)
3256
+				goto out_found;
3257
+		}
3258
+		goto out_unaugmented;
3259
+	}
3260
+
3261
+	prog = trace__find_bpf_program_by_title(trace, prog_name);
3262
+
3263
+	if (prog != NULL) {
3264
+out_found:
3265
+		return prog;
3266
+	}
3267
+
3268
+	pr_debug("Couldn't find BPF prog \"%s\" to associate with syscalls:sys_%s_%s, not augmenting it\n",
3269
+		 prog_name, type, sc->name);
3270
+out_unaugmented:
3271
+	return trace->syscalls.unaugmented_prog;
3272
+}
3273
+
3274
+static void trace__init_syscall_bpf_progs(struct trace *trace, int id)
3275
+{
3276
+	struct syscall *sc = trace__syscall_info(trace, NULL, id);
3277
+
3278
+	if (sc == NULL)
3279
+		return;
3280
+
3281
+	sc->bpf_prog.sys_enter = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_enter : NULL, "enter");
3282
+	sc->bpf_prog.sys_exit  = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_exit  : NULL,  "exit");
3283
+}
3284
+
3285
+static int trace__bpf_prog_sys_enter_fd(struct trace *trace, int id)
3286
+{
3287
+	struct syscall *sc = trace__syscall_info(trace, NULL, id);
3288
+	return sc ? bpf_program__fd(sc->bpf_prog.sys_enter) : bpf_program__fd(trace->syscalls.unaugmented_prog);
3289
+}
3290
+
3291
+static int trace__bpf_prog_sys_exit_fd(struct trace *trace, int id)
3292
+{
3293
+	struct syscall *sc = trace__syscall_info(trace, NULL, id);
3294
+	return sc ? bpf_program__fd(sc->bpf_prog.sys_exit) : bpf_program__fd(trace->syscalls.unaugmented_prog);
3295
+}
3296
+
3297
+static void trace__init_bpf_map_syscall_args(struct trace *trace, int id, struct bpf_map_syscall_entry *entry)
3298
+{
3299
+	struct syscall *sc = trace__syscall_info(trace, NULL, id);
3300
+	int arg = 0;
3301
+
3302
+	if (sc == NULL)
3303
+		goto out;
3304
+
3305
+	for (; arg < sc->nr_args; ++arg) {
3306
+		entry->string_args_len[arg] = 0;
3307
+		if (sc->arg_fmt[arg].scnprintf == SCA_FILENAME) {
3308
+			/* Should be set like strace -s strsize */
3309
+			entry->string_args_len[arg] = PATH_MAX;
3310
+		}
3311
+	}
3312
+out:
3313
+	for (; arg < 6; ++arg)
3314
+		entry->string_args_len[arg] = 0;
3315
+}
3316
+static int trace__set_ev_qualifier_bpf_filter(struct trace *trace)
3317
+{
3318
+	int fd = bpf_map__fd(trace->syscalls.map);
3319
+	struct bpf_map_syscall_entry value = {
3320
+		.enabled = !trace->not_ev_qualifier,
3321
+	};
3322
+	int err = 0;
3323
+	size_t i;
3324
+
3325
+	for (i = 0; i < trace->ev_qualifier_ids.nr; ++i) {
3326
+		int key = trace->ev_qualifier_ids.entries[i];
3327
+
3328
+		if (value.enabled) {
3329
+			trace__init_bpf_map_syscall_args(trace, key, &value);
3330
+			trace__init_syscall_bpf_progs(trace, key);
3331
+		}
3332
+
3333
+		err = bpf_map_update_elem(fd, &key, &value, BPF_EXIST);
3334
+		if (err)
3335
+			break;
3336
+	}
3337
+
3338
+	return err;
3339
+}
3340
+
3341
+static int __trace__init_syscalls_bpf_map(struct trace *trace, bool enabled)
3342
+{
3343
+	int fd = bpf_map__fd(trace->syscalls.map);
3344
+	struct bpf_map_syscall_entry value = {
3345
+		.enabled = enabled,
3346
+	};
3347
+	int err = 0, key;
3348
+
3349
+	for (key = 0; key < trace->sctbl->syscalls.nr_entries; ++key) {
3350
+		if (enabled)
3351
+			trace__init_bpf_map_syscall_args(trace, key, &value);
3352
+
3353
+		err = bpf_map_update_elem(fd, &key, &value, BPF_ANY);
3354
+		if (err)
3355
+			break;
3356
+	}
3357
+
3358
+	return err;
3359
+}
3360
+
3361
+static int trace__init_syscalls_bpf_map(struct trace *trace)
3362
+{
3363
+	bool enabled = true;
3364
+
3365
+	if (trace->ev_qualifier_ids.nr)
3366
+		enabled = trace->not_ev_qualifier;
3367
+
3368
+	return __trace__init_syscalls_bpf_map(trace, enabled);
3369
+}
3370
+
3371
+static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace, struct syscall *sc)
3372
+{
3373
+	struct tep_format_field *field, *candidate_field;
3374
+	int id;
3375
+
3376
+	/*
3377
+	 * We're only interested in syscalls that have a pointer:
3378
+	 */
3379
+	for (field = sc->args; field; field = field->next) {
3380
+		if (field->flags & TEP_FIELD_IS_POINTER)
3381
+			goto try_to_find_pair;
3382
+	}
3383
+
3384
+	return NULL;
3385
+
3386
+try_to_find_pair:
3387
+	for (id = 0; id < trace->sctbl->syscalls.nr_entries; ++id) {
3388
+		struct syscall *pair = trace__syscall_info(trace, NULL, id);
3389
+		struct bpf_program *pair_prog;
3390
+		bool is_candidate = false;
3391
+
3392
+		if (pair == NULL || pair == sc ||
3393
+		    pair->bpf_prog.sys_enter == trace->syscalls.unaugmented_prog)
3394
+			continue;
3395
+
3396
+		for (field = sc->args, candidate_field = pair->args;
3397
+		     field && candidate_field; field = field->next, candidate_field = candidate_field->next) {
3398
+			bool is_pointer = field->flags & TEP_FIELD_IS_POINTER,
3399
+			     candidate_is_pointer = candidate_field->flags & TEP_FIELD_IS_POINTER;
3400
+
3401
+			if (is_pointer) {
3402
+			       if (!candidate_is_pointer) {
3403
+					// The candidate just doesn't copies our pointer arg, might copy other pointers we want.
3404
+					continue;
3405
+			       }
3406
+			} else {
3407
+				if (candidate_is_pointer) {
3408
+					// The candidate might copy a pointer we don't have, skip it.
3409
+					goto next_candidate;
3410
+				}
3411
+				continue;
3412
+			}
3413
+
3414
+			if (strcmp(field->type, candidate_field->type))
3415
+				goto next_candidate;
3416
+
3417
+			is_candidate = true;
3418
+		}
3419
+
3420
+		if (!is_candidate)
3421
+			goto next_candidate;
3422
+
3423
+		/*
3424
+		 * Check if the tentative pair syscall augmenter has more pointers, if it has,
3425
+		 * then it may be collecting that and we then can't use it, as it would collect
3426
+		 * more than what is common to the two syscalls.
3427
+		 */
3428
+		if (candidate_field) {
3429
+			for (candidate_field = candidate_field->next; candidate_field; candidate_field = candidate_field->next)
3430
+				if (candidate_field->flags & TEP_FIELD_IS_POINTER)
3431
+					goto next_candidate;
3432
+		}
3433
+
3434
+		pair_prog = pair->bpf_prog.sys_enter;
3435
+		/*
3436
+		 * If the pair isn't enabled, then its bpf_prog.sys_enter will not
3437
+		 * have been searched for, so search it here and if it returns the
3438
+		 * unaugmented one, then ignore it, otherwise we'll reuse that BPF
3439
+		 * program for a filtered syscall on a non-filtered one.
3440
+		 *
3441
+		 * For instance, we have "!syscalls:sys_enter_renameat" and that is
3442
+		 * useful for "renameat2".
3443
+		 */
3444
+		if (pair_prog == NULL) {
3445
+			pair_prog = trace__find_syscall_bpf_prog(trace, pair, pair->fmt ? pair->fmt->bpf_prog_name.sys_enter : NULL, "enter");
3446
+			if (pair_prog == trace->syscalls.unaugmented_prog)
3447
+				goto next_candidate;
3448
+		}
3449
+
3450
+		pr_debug("Reusing \"%s\" BPF sys_enter augmenter for \"%s\"\n", pair->name, sc->name);
3451
+		return pair_prog;
3452
+	next_candidate:
3453
+		continue;
3454
+	}
3455
+
3456
+	return NULL;
3457
+}
3458
+
3459
+static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace)
3460
+{
3461
+	int map_enter_fd = bpf_map__fd(trace->syscalls.prog_array.sys_enter),
3462
+	    map_exit_fd  = bpf_map__fd(trace->syscalls.prog_array.sys_exit);
3463
+	int err = 0, key;
3464
+
3465
+	for (key = 0; key < trace->sctbl->syscalls.nr_entries; ++key) {
3466
+		int prog_fd;
3467
+
3468
+		if (!trace__syscall_enabled(trace, key))
3469
+			continue;
3470
+
3471
+		trace__init_syscall_bpf_progs(trace, key);
3472
+
3473
+		// It'll get at least the "!raw_syscalls:unaugmented"
3474
+		prog_fd = trace__bpf_prog_sys_enter_fd(trace, key);
3475
+		err = bpf_map_update_elem(map_enter_fd, &key, &prog_fd, BPF_ANY);
3476
+		if (err)
3477
+			break;
3478
+		prog_fd = trace__bpf_prog_sys_exit_fd(trace, key);
3479
+		err = bpf_map_update_elem(map_exit_fd, &key, &prog_fd, BPF_ANY);
3480
+		if (err)
3481
+			break;
3482
+	}
3483
+
3484
+	/*
3485
+	 * Now lets do a second pass looking for enabled syscalls without
3486
+	 * an augmenter that have a signature that is a superset of another
3487
+	 * syscall with an augmenter so that we can auto-reuse it.
3488
+	 *
3489
+	 * I.e. if we have an augmenter for the "open" syscall that has
3490
+	 * this signature:
3491
+	 *
3492
+	 *   int open(const char *pathname, int flags, mode_t mode);
3493
+	 *
3494
+	 * I.e. that will collect just the first string argument, then we
3495
+	 * can reuse it for the 'creat' syscall, that has this signature:
3496
+	 *
3497
+	 *   int creat(const char *pathname, mode_t mode);
3498
+	 *
3499
+	 * and for:
3500
+	 *
3501
+	 *   int stat(const char *pathname, struct stat *statbuf);
3502
+	 *   int lstat(const char *pathname, struct stat *statbuf);
3503
+	 *
3504
+	 * Because the 'open' augmenter will collect the first arg as a string,
3505
+	 * and leave alone all the other args, which already helps with
3506
+	 * beautifying 'stat' and 'lstat''s pathname arg.
3507
+	 *
3508
+	 * Then, in time, when 'stat' gets an augmenter that collects both
3509
+	 * first and second arg (this one on the raw_syscalls:sys_exit prog
3510
+	 * array tail call, then that one will be used.
3511
+	 */
3512
+	for (key = 0; key < trace->sctbl->syscalls.nr_entries; ++key) {
3513
+		struct syscall *sc = trace__syscall_info(trace, NULL, key);
3514
+		struct bpf_program *pair_prog;
3515
+		int prog_fd;
3516
+
3517
+		if (sc == NULL || sc->bpf_prog.sys_enter == NULL)
3518
+			continue;
3519
+
3520
+		/*
3521
+		 * For now we're just reusing the sys_enter prog, and if it
3522
+		 * already has an augmenter, we don't need to find one.
3523
+		 */
3524
+		if (sc->bpf_prog.sys_enter != trace->syscalls.unaugmented_prog)
3525
+			continue;
3526
+
3527
+		/*
3528
+		 * Look at all the other syscalls for one that has a signature
3529
+		 * that is close enough that we can share:
3530
+		 */
3531
+		pair_prog = trace__find_usable_bpf_prog_entry(trace, sc);
3532
+		if (pair_prog == NULL)
3533
+			continue;
3534
+
3535
+		sc->bpf_prog.sys_enter = pair_prog;
3536
+
3537
+		/*
3538
+		 * Update the BPF_MAP_TYPE_PROG_SHARED for raw_syscalls:sys_enter
3539
+		 * with the fd for the program we're reusing:
3540
+		 */
3541
+		prog_fd = bpf_program__fd(sc->bpf_prog.sys_enter);
3542
+		err = bpf_map_update_elem(map_enter_fd, &key, &prog_fd, BPF_ANY);
3543
+		if (err)
3544
+			break;
3545
+	}
3546
+
3547
+
3548
+	return err;
3549
+}
3550
+
3551
+static void trace__delete_augmented_syscalls(struct trace *trace)
3552
+{
3553
+	struct evsel *evsel, *tmp;
3554
+
3555
+	evlist__remove(trace->evlist, trace->syscalls.events.augmented);
3556
+	evsel__delete(trace->syscalls.events.augmented);
3557
+	trace->syscalls.events.augmented = NULL;
3558
+
3559
+	evlist__for_each_entry_safe(trace->evlist, tmp, evsel) {
3560
+		if (evsel->bpf_obj == trace->bpf_obj) {
3561
+			evlist__remove(trace->evlist, evsel);
3562
+			evsel__delete(evsel);
3563
+		}
3564
+
3565
+	}
3566
+
3567
+	bpf_object__close(trace->bpf_obj);
3568
+	trace->bpf_obj = NULL;
3569
+}
3570
+#else // HAVE_LIBBPF_SUPPORT
3571
+static struct bpf_map *trace__find_bpf_map_by_name(struct trace *trace __maybe_unused,
3572
+						   const char *name __maybe_unused)
3573
+{
3574
+	return NULL;
3575
+}
3576
+
3577
+static void trace__set_bpf_map_filtered_pids(struct trace *trace __maybe_unused)
3578
+{
3579
+}
3580
+
3581
+static void trace__set_bpf_map_syscalls(struct trace *trace __maybe_unused)
3582
+{
3583
+}
3584
+
3585
+static int trace__set_ev_qualifier_bpf_filter(struct trace *trace __maybe_unused)
3586
+{
3587
+	return 0;
3588
+}
3589
+
3590
+static int trace__init_syscalls_bpf_map(struct trace *trace __maybe_unused)
3591
+{
3592
+	return 0;
3593
+}
3594
+
3595
+static struct bpf_program *trace__find_bpf_program_by_title(struct trace *trace __maybe_unused,
3596
+							    const char *name __maybe_unused)
3597
+{
3598
+	return NULL;
3599
+}
3600
+
3601
+static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace __maybe_unused)
3602
+{
3603
+	return 0;
3604
+}
3605
+
3606
+static void trace__delete_augmented_syscalls(struct trace *trace __maybe_unused)
3607
+{
3608
+}
3609
+#endif // HAVE_LIBBPF_SUPPORT
3610
+
3611
+static bool trace__only_augmented_syscalls_evsels(struct trace *trace)
3612
+{
3613
+	struct evsel *evsel;
3614
+
3615
+	evlist__for_each_entry(trace->evlist, evsel) {
3616
+		if (evsel == trace->syscalls.events.augmented ||
3617
+		    evsel->bpf_obj == trace->bpf_obj)
3618
+			continue;
3619
+
3620
+		return false;
3621
+	}
3622
+
3623
+	return true;
3624
+}
3625
+
3626
+static int trace__set_ev_qualifier_filter(struct trace *trace)
3627
+{
3628
+	if (trace->syscalls.map)
3629
+		return trace__set_ev_qualifier_bpf_filter(trace);
3630
+	if (trace->syscalls.events.sys_enter)
3631
+		return trace__set_ev_qualifier_tp_filter(trace);
3632
+	return 0;
3633
+}
3634
+
3635
+static int bpf_map__set_filter_pids(struct bpf_map *map __maybe_unused,
3636
+				    size_t npids __maybe_unused, pid_t *pids __maybe_unused)
3637
+{
3638
+	int err = 0;
3639
+#ifdef HAVE_LIBBPF_SUPPORT
3640
+	bool value = true;
3641
+	int map_fd = bpf_map__fd(map);
3642
+	size_t i;
3643
+
3644
+	for (i = 0; i < npids; ++i) {
3645
+		err = bpf_map_update_elem(map_fd, &pids[i], &value, BPF_ANY);
3646
+		if (err)
3647
+			break;
3648
+	}
3649
+#endif
3650
+	return err;
3651
+}
3652
+
2415
3653
 static int trace__set_filter_loop_pids(struct trace *trace)
2416
3654
 {
2417
-	unsigned int nr = 1;
3655
+	unsigned int nr = 1, err;
2418
3656
 	pid_t pids[32] = {
2419
3657
 		getpid(),
2420
3658
 	};
..
..
@@ -2426,20 +3664,237 @@
2426
3664
 		if (parent == NULL)
2427
3665
 			break;
2428
3666
 
2429
-		if (!strcmp(thread__comm_str(parent), "sshd")) {
3667
+		if (!strcmp(thread__comm_str(parent), "sshd") ||
3668
+		    strstarts(thread__comm_str(parent), "gnome-terminal")) {
2430
3669
 			pids[nr++] = parent->tid;
2431
3670
 			break;
2432
3671
 		}
2433
3672
 		thread = parent;
2434
3673
 	}
2435
3674
 
2436
-	return perf_evlist__set_filter_pids(trace->evlist, nr, pids);
3675
+	err = perf_evlist__append_tp_filter_pids(trace->evlist, nr, pids);
3676
+	if (!err && trace->filter_pids.map)
3677
+		err = bpf_map__set_filter_pids(trace->filter_pids.map, nr, pids);
3678
+
3679
+	return err;
3680
+}
3681
+
3682
+static int trace__set_filter_pids(struct trace *trace)
3683
+{
3684
+	int err = 0;
3685
+	/*
3686
+	 * Better not use !target__has_task() here because we need to cover the
3687
+	 * case where no threads were specified in the command line, but a
3688
+	 * workload was, and in that case we will fill in the thread_map when
3689
+	 * we fork the workload in perf_evlist__prepare_workload.
3690
+	 */
3691
+	if (trace->filter_pids.nr > 0) {
3692
+		err = perf_evlist__append_tp_filter_pids(trace->evlist, trace->filter_pids.nr,
3693
+							 trace->filter_pids.entries);
3694
+		if (!err && trace->filter_pids.map) {
3695
+			err = bpf_map__set_filter_pids(trace->filter_pids.map, trace->filter_pids.nr,
3696
+						       trace->filter_pids.entries);
3697
+		}
3698
+	} else if (perf_thread_map__pid(trace->evlist->core.threads, 0) == -1) {
3699
+		err = trace__set_filter_loop_pids(trace);
3700
+	}
3701
+
3702
+	return err;
3703
+}
3704
+
3705
+static int __trace__deliver_event(struct trace *trace, union perf_event *event)
3706
+{
3707
+	struct evlist *evlist = trace->evlist;
3708
+	struct perf_sample sample;
3709
+	int err;
3710
+
3711
+	err = perf_evlist__parse_sample(evlist, event, &sample);
3712
+	if (err)
3713
+		fprintf(trace->output, "Can't parse sample, err = %d, skipping...\n", err);
3714
+	else
3715
+		trace__handle_event(trace, event, &sample);
3716
+
3717
+	return 0;
3718
+}
3719
+
3720
+static int __trace__flush_events(struct trace *trace)
3721
+{
3722
+	u64 first = ordered_events__first_time(&trace->oe.data);
3723
+	u64 flush = trace->oe.last - NSEC_PER_SEC;
3724
+
3725
+	/* Is there some thing to flush.. */
3726
+	if (first && first < flush)
3727
+		return ordered_events__flush_time(&trace->oe.data, flush);
3728
+
3729
+	return 0;
3730
+}
3731
+
3732
+static int trace__flush_events(struct trace *trace)
3733
+{
3734
+	return !trace->sort_events ? 0 : __trace__flush_events(trace);
3735
+}
3736
+
3737
+static int trace__deliver_event(struct trace *trace, union perf_event *event)
3738
+{
3739
+	int err;
3740
+
3741
+	if (!trace->sort_events)
3742
+		return __trace__deliver_event(trace, event);
3743
+
3744
+	err = perf_evlist__parse_sample_timestamp(trace->evlist, event, &trace->oe.last);
3745
+	if (err && err != -1)
3746
+		return err;
3747
+
3748
+	err = ordered_events__queue(&trace->oe.data, event, trace->oe.last, 0);
3749
+	if (err)
3750
+		return err;
3751
+
3752
+	return trace__flush_events(trace);
3753
+}
3754
+
3755
+static int ordered_events__deliver_event(struct ordered_events *oe,
3756
+					 struct ordered_event *event)
3757
+{
3758
+	struct trace *trace = container_of(oe, struct trace, oe.data);
3759
+
3760
+	return __trace__deliver_event(trace, event->event);
3761
+}
3762
+
3763
+static struct syscall_arg_fmt *evsel__find_syscall_arg_fmt_by_name(struct evsel *evsel, char *arg)
3764
+{
3765
+	struct tep_format_field *field;
3766
+	struct syscall_arg_fmt *fmt = __evsel__syscall_arg_fmt(evsel);
3767
+
3768
+	if (evsel->tp_format == NULL || fmt == NULL)
3769
+		return NULL;
3770
+
3771
+	for (field = evsel->tp_format->format.fields; field; field = field->next, ++fmt)
3772
+		if (strcmp(field->name, arg) == 0)
3773
+			return fmt;
3774
+
3775
+	return NULL;
3776
+}
3777
+
3778
+static int trace__expand_filter(struct trace *trace __maybe_unused, struct evsel *evsel)
3779
+{
3780
+	char *tok, *left = evsel->filter, *new_filter = evsel->filter;
3781
+
3782
+	while ((tok = strpbrk(left, "=<>!")) != NULL) {
3783
+		char *right = tok + 1, *right_end;
3784
+
3785
+		if (*right == '=')
3786
+			++right;
3787
+
3788
+		while (isspace(*right))
3789
+			++right;
3790
+
3791
+		if (*right == '\0')
3792
+			break;
3793
+
3794
+		while (!isalpha(*left))
3795
+			if (++left == tok) {
3796
+				/*
3797
+				 * Bail out, can't find the name of the argument that is being
3798
+				 * used in the filter, let it try to set this filter, will fail later.
3799
+				 */
3800
+				return 0;
3801
+			}
3802
+
3803
+		right_end = right + 1;
3804
+		while (isalnum(*right_end) || *right_end == '_' || *right_end == '|')
3805
+			++right_end;
3806
+
3807
+		if (isalpha(*right)) {
3808
+			struct syscall_arg_fmt *fmt;
3809
+			int left_size = tok - left,
3810
+			    right_size = right_end - right;
3811
+			char arg[128];
3812
+
3813
+			while (isspace(left[left_size - 1]))
3814
+				--left_size;
3815
+
3816
+			scnprintf(arg, sizeof(arg), "%.*s", left_size, left);
3817
+
3818
+			fmt = evsel__find_syscall_arg_fmt_by_name(evsel, arg);
3819
+			if (fmt == NULL) {
3820
+				pr_err("\"%s\" not found in \"%s\", can't set filter \"%s\"\n",
3821
+				       arg, evsel->name, evsel->filter);
3822
+				return -1;
3823
+			}
3824
+
3825
+			pr_debug2("trying to expand \"%s\" \"%.*s\" \"%.*s\" -> ",
3826
+				 arg, (int)(right - tok), tok, right_size, right);
3827
+
3828
+			if (fmt->strtoul) {
3829
+				u64 val;
3830
+				struct syscall_arg syscall_arg = {
3831
+					.parm = fmt->parm,
3832
+				};
3833
+
3834
+				if (fmt->strtoul(right, right_size, &syscall_arg, &val)) {
3835
+					char *n, expansion[19];
3836
+					int expansion_lenght = scnprintf(expansion, sizeof(expansion), "%#" PRIx64, val);
3837
+					int expansion_offset = right - new_filter;
3838
+
3839
+					pr_debug("%s", expansion);
3840
+
3841
+					if (asprintf(&n, "%.*s%s%s", expansion_offset, new_filter, expansion, right_end) < 0) {
3842
+						pr_debug(" out of memory!\n");
3843
+						free(new_filter);
3844
+						return -1;
3845
+					}
3846
+					if (new_filter != evsel->filter)
3847
+						free(new_filter);
3848
+					left = n + expansion_offset + expansion_lenght;
3849
+					new_filter = n;
3850
+				} else {
3851
+					pr_err("\"%.*s\" not found for \"%s\" in \"%s\", can't set filter \"%s\"\n",
3852
+					       right_size, right, arg, evsel->name, evsel->filter);
3853
+					return -1;
3854
+				}
3855
+			} else {
3856
+				pr_err("No resolver (strtoul) for \"%s\" in \"%s\", can't set filter \"%s\"\n",
3857
+				       arg, evsel->name, evsel->filter);
3858
+				return -1;
3859
+			}
3860
+
3861
+			pr_debug("\n");
3862
+		} else {
3863
+			left = right_end;
3864
+		}
3865
+	}
3866
+
3867
+	if (new_filter != evsel->filter) {
3868
+		pr_debug("New filter for %s: %s\n", evsel->name, new_filter);
3869
+		evsel__set_filter(evsel, new_filter);
3870
+		free(new_filter);
3871
+	}
3872
+
3873
+	return 0;
3874
+}
3875
+
3876
+static int trace__expand_filters(struct trace *trace, struct evsel **err_evsel)
3877
+{
3878
+	struct evlist *evlist = trace->evlist;
3879
+	struct evsel *evsel;
3880
+
3881
+	evlist__for_each_entry(evlist, evsel) {
3882
+		if (evsel->filter == NULL)
3883
+			continue;
3884
+
3885
+		if (trace__expand_filter(trace, evsel)) {
3886
+			*err_evsel = evsel;
3887
+			return -1;
3888
+		}
3889
+	}
3890
+
3891
+	return 0;
2437
3892
 }
2438
3893
 
2439
3894
 static int trace__run(struct trace *trace, int argc, const char **argv)
2440
3895
 {
2441
-	struct perf_evlist *evlist = trace->evlist;
2442
-	struct perf_evsel *evsel, *pgfault_maj = NULL, *pgfault_min = NULL;
3896
+	struct evlist *evlist = trace->evlist;
3897
+	struct evsel *evsel, *pgfault_maj = NULL, *pgfault_min = NULL;
2443
3898
 	int err = -1, i;
2444
3899
 	unsigned long before;
2445
3900
 	const bool forks = argc > 0;
..
..
@@ -2447,33 +3902,33 @@
2447
3902
 
2448
3903
 	trace->live = true;
2449
3904
 
2450
-	if (trace->trace_syscalls && trace__add_syscall_newtp(trace))
2451
-		goto out_error_raw_syscalls;
3905
+	if (!trace->raw_augmented_syscalls) {
3906
+		if (trace->trace_syscalls && trace__add_syscall_newtp(trace))
3907
+			goto out_error_raw_syscalls;
2452
3908
 
2453
-	if (trace->trace_syscalls)
2454
-		trace->vfs_getname = perf_evlist__add_vfs_getname(evlist);
3909
+		if (trace->trace_syscalls)
3910
+			trace->vfs_getname = evlist__add_vfs_getname(evlist);
3911
+	}
2455
3912
 
2456
3913
 	if ((trace->trace_pgfaults & TRACE_PFMAJ)) {
2457
-		pgfault_maj = perf_evsel__new_pgfault(PERF_COUNT_SW_PAGE_FAULTS_MAJ);
3914
+		pgfault_maj = evsel__new_pgfault(PERF_COUNT_SW_PAGE_FAULTS_MAJ);
2458
3915
 		if (pgfault_maj == NULL)
2459
3916
 			goto out_error_mem;
2460
-		perf_evsel__config_callchain(pgfault_maj, &trace->opts, &callchain_param);
2461
-		perf_evlist__add(evlist, pgfault_maj);
3917
+		evsel__config_callchain(pgfault_maj, &trace->opts, &callchain_param);
3918
+		evlist__add(evlist, pgfault_maj);
2462
3919
 	}
2463
3920
 
2464
3921
 	if ((trace->trace_pgfaults & TRACE_PFMIN)) {
2465
-		pgfault_min = perf_evsel__new_pgfault(PERF_COUNT_SW_PAGE_FAULTS_MIN);
3922
+		pgfault_min = evsel__new_pgfault(PERF_COUNT_SW_PAGE_FAULTS_MIN);
2466
3923
 		if (pgfault_min == NULL)
2467
3924
 			goto out_error_mem;
2468
-		perf_evsel__config_callchain(pgfault_min, &trace->opts, &callchain_param);
2469
-		perf_evlist__add(evlist, pgfault_min);
3925
+		evsel__config_callchain(pgfault_min, &trace->opts, &callchain_param);
3926
+		evlist__add(evlist, pgfault_min);
2470
3927
 	}
2471
3928
 
2472
3929
 	if (trace->sched &&
2473
-	    perf_evlist__add_newtp(evlist, "sched", "sched_stat_runtime",
2474
-				   trace__sched_stat_runtime))
3930
+	    evlist__add_newtp(evlist, "sched", "sched_stat_runtime", trace__sched_stat_runtime))
2475
3931
 		goto out_error_sched_stat_runtime;
2476
-
2477
3932
 	/*
2478
3933
 	 * If a global cgroup was set, apply it to all the events without an
2479
3934
 	 * explicit cgroup. I.e.:
..
..
@@ -2528,7 +3983,7 @@
2528
3983
 		}
2529
3984
 	}
2530
3985
 
2531
-	err = perf_evlist__open(evlist);
3986
+	err = evlist__open(evlist);
2532
3987
 	if (err < 0)
2533
3988
 		goto out_error_open;
2534
3989
 
..
..
@@ -2542,108 +3997,122 @@
2542
3997
 		goto out_error_open;
2543
3998
 	}
2544
3999
 
2545
-	/*
2546
-	 * Better not use !target__has_task() here because we need to cover the
2547
-	 * case where no threads were specified in the command line, but a
2548
-	 * workload was, and in that case we will fill in the thread_map when
2549
-	 * we fork the workload in perf_evlist__prepare_workload.
2550
-	 */
2551
-	if (trace->filter_pids.nr > 0)
2552
-		err = perf_evlist__set_filter_pids(evlist, trace->filter_pids.nr, trace->filter_pids.entries);
2553
-	else if (thread_map__pid(evlist->threads, 0) == -1)
2554
-		err = trace__set_filter_loop_pids(trace);
2555
-
4000
+	err = trace__set_filter_pids(trace);
2556
4001
 	if (err < 0)
2557
4002
 		goto out_error_mem;
4003
+
4004
+	if (trace->syscalls.map)
4005
+		trace__init_syscalls_bpf_map(trace);
4006
+
4007
+	if (trace->syscalls.prog_array.sys_enter)
4008
+		trace__init_syscalls_bpf_prog_array_maps(trace);
2558
4009
 
2559
4010
 	if (trace->ev_qualifier_ids.nr > 0) {
2560
4011
 		err = trace__set_ev_qualifier_filter(trace);
2561
4012
 		if (err < 0)
2562
4013
 			goto out_errno;
2563
4014
 
2564
-		pr_debug("event qualifier tracepoint filter: %s\n",
2565
-			 trace->syscalls.events.sys_exit->filter);
4015
+		if (trace->syscalls.events.sys_exit) {
4016
+			pr_debug("event qualifier tracepoint filter: %s\n",
4017
+				 trace->syscalls.events.sys_exit->filter);
4018
+		}
2566
4019
 	}
2567
4020
 
4021
+	/*
4022
+	 * If the "close" syscall is not traced, then we will not have the
4023
+	 * opportunity to, in syscall_arg__scnprintf_close_fd() invalidate the
4024
+	 * fd->pathname table and were ending up showing the last value set by
4025
+	 * syscalls opening a pathname and associating it with a descriptor or
4026
+	 * reading it from /proc/pid/fd/ in cases where that doesn't make
4027
+	 * sense.
4028
+	 *
4029
+	 *  So just disable this beautifier (SCA_FD, SCA_FDAT) when 'close' is
4030
+	 *  not in use.
4031
+	 */
4032
+	trace->fd_path_disabled = !trace__syscall_enabled(trace, syscalltbl__id(trace->sctbl, "close"));
4033
+
4034
+	err = trace__expand_filters(trace, &evsel);
4035
+	if (err)
4036
+		goto out_delete_evlist;
2568
4037
 	err = perf_evlist__apply_filters(evlist, &evsel);
2569
4038
 	if (err < 0)
2570
4039
 		goto out_error_apply_filters;
2571
4040
 
2572
-	err = perf_evlist__mmap(evlist, trace->opts.mmap_pages);
4041
+	if (trace->dump.map)
4042
+		bpf_map__fprintf(trace->dump.map, trace->output);
4043
+
4044
+	err = evlist__mmap(evlist, trace->opts.mmap_pages);
2573
4045
 	if (err < 0)
2574
4046
 		goto out_error_mmap;
2575
4047
 
2576
4048
 	if (!target__none(&trace->opts.target) && !trace->opts.initial_delay)
2577
-		perf_evlist__enable(evlist);
4049
+		evlist__enable(evlist);
2578
4050
 
2579
4051
 	if (forks)
2580
4052
 		perf_evlist__start_workload(evlist);
2581
4053
 
2582
4054
 	if (trace->opts.initial_delay) {
2583
4055
 		usleep(trace->opts.initial_delay * 1000);
2584
-		perf_evlist__enable(evlist);
4056
+		evlist__enable(evlist);
2585
4057
 	}
2586
4058
 
2587
-	trace->multiple_threads = thread_map__pid(evlist->threads, 0) == -1 ||
2588
-				  evlist->threads->nr > 1 ||
2589
-				  perf_evlist__first(evlist)->attr.inherit;
4059
+	trace->multiple_threads = perf_thread_map__pid(evlist->core.threads, 0) == -1 ||
4060
+				  evlist->core.threads->nr > 1 ||
4061
+				  evlist__first(evlist)->core.attr.inherit;
2590
4062
 
2591
4063
 	/*
2592
-	 * Now that we already used evsel->attr to ask the kernel to setup the
2593
-	 * events, lets reuse evsel->attr.sample_max_stack as the limit in
4064
+	 * Now that we already used evsel->core.attr to ask the kernel to setup the
4065
+	 * events, lets reuse evsel->core.attr.sample_max_stack as the limit in
2594
4066
 	 * trace__resolve_callchain(), allowing per-event max-stack settings
2595
-	 * to override an explicitely set --max-stack global setting.
4067
+	 * to override an explicitly set --max-stack global setting.
2596
4068
 	 */
2597
4069
 	evlist__for_each_entry(evlist, evsel) {
2598
4070
 		if (evsel__has_callchain(evsel) &&
2599
-		    evsel->attr.sample_max_stack == 0)
2600
-			evsel->attr.sample_max_stack = trace->max_stack;
4071
+		    evsel->core.attr.sample_max_stack == 0)
4072
+			evsel->core.attr.sample_max_stack = trace->max_stack;
2601
4073
 	}
2602
4074
 again:
2603
4075
 	before = trace->nr_events;
2604
4076
 
2605
-	for (i = 0; i < evlist->nr_mmaps; i++) {
4077
+	for (i = 0; i < evlist->core.nr_mmaps; i++) {
2606
4078
 		union perf_event *event;
2607
-		struct perf_mmap *md;
4079
+		struct mmap *md;
2608
4080
 
2609
4081
 		md = &evlist->mmap[i];
2610
-		if (perf_mmap__read_init(md) < 0)
4082
+		if (perf_mmap__read_init(&md->core) < 0)
2611
4083
 			continue;
2612
4084
 
2613
-		while ((event = perf_mmap__read_event(md)) != NULL) {
2614
-			struct perf_sample sample;
2615
-
4085
+		while ((event = perf_mmap__read_event(&md->core)) != NULL) {
2616
4086
 			++trace->nr_events;
2617
4087
 
2618
-			err = perf_evlist__parse_sample(evlist, event, &sample);
2619
-			if (err) {
2620
-				fprintf(trace->output, "Can't parse sample, err = %d, skipping...\n", err);
2621
-				goto next_event;
2622
-			}
4088
+			err = trace__deliver_event(trace, event);
4089
+			if (err)
4090
+				goto out_disable;
2623
4091
 
2624
-			trace__handle_event(trace, event, &sample);
2625
-next_event:
2626
-			perf_mmap__consume(md);
4092
+			perf_mmap__consume(&md->core);
2627
4093
 
2628
4094
 			if (interrupted)
2629
4095
 				goto out_disable;
2630
4096
 
2631
4097
 			if (done && !draining) {
2632
-				perf_evlist__disable(evlist);
4098
+				evlist__disable(evlist);
2633
4099
 				draining = true;
2634
4100
 			}
2635
4101
 		}
2636
-		perf_mmap__read_done(md);
4102
+		perf_mmap__read_done(&md->core);
2637
4103
 	}
2638
4104
 
2639
4105
 	if (trace->nr_events == before) {
2640
4106
 		int timeout = done ? 100 : -1;
2641
4107
 
2642
-		if (!draining && perf_evlist__poll(evlist, timeout) > 0) {
2643
-			if (perf_evlist__filter_pollfd(evlist, POLLERR | POLLHUP) == 0)
4108
+		if (!draining && evlist__poll(evlist, timeout) > 0) {
4109
+			if (evlist__filter_pollfd(evlist, POLLERR | POLLHUP | POLLNVAL) == 0)
2644
4110
 				draining = true;
2645
4111
 
2646
4112
 			goto again;
4113
+		} else {
4114
+			if (trace__flush_events(trace))
4115
+				goto out_disable;
2647
4116
 		}
2648
4117
 	} else {
2649
4118
 		goto again;
..
..
@@ -2652,7 +4121,10 @@
2652
4121
 out_disable:
2653
4122
 	thread__zput(trace->current);
2654
4123
 
2655
-	perf_evlist__disable(evlist);
4124
+	evlist__disable(evlist);
4125
+
4126
+	if (trace->sort_events)
4127
+		ordered_events__flush(&trace->oe.data, OE_FLUSH__FINAL);
2656
4128
 
2657
4129
 	if (!err) {
2658
4130
 		if (trace->summary)
..
..
@@ -2670,7 +4142,7 @@
2670
4142
 out_delete_evlist:
2671
4143
 	trace__symbols__exit(trace);
2672
4144
 
2673
-	perf_evlist__delete(evlist);
4145
+	evlist__delete(evlist);
2674
4146
 	cgroup__put(trace->cgroup);
2675
4147
 	trace->evlist = NULL;
2676
4148
 	trace->live = false;
..
..
@@ -2687,11 +4159,11 @@
2687
4159
 	goto out_error;
2688
4160
 
2689
4161
 out_error_mmap:
2690
-	perf_evlist__strerror_mmap(evlist, errno, errbuf, sizeof(errbuf));
4162
+	evlist__strerror_mmap(evlist, errno, errbuf, sizeof(errbuf));
2691
4163
 	goto out_error;
2692
4164
 
2693
4165
 out_error_open:
2694
-	perf_evlist__strerror_open(evlist, errno, errbuf, sizeof(errbuf));
4166
+	evlist__strerror_open(evlist, errno, errbuf, sizeof(errbuf));
2695
4167
 
2696
4168
 out_error:
2697
4169
 	fprintf(trace->output, "%s\n", errbuf);
..
..
@@ -2700,7 +4172,7 @@
2700
4172
 out_error_apply_filters:
2701
4173
 	fprintf(trace->output,
2702
4174
 		"Failed to set filter \"%s\" on event %s with %d (%s)\n",
2703
-		evsel->filter, perf_evsel__name(evsel), errno,
4175
+		evsel->filter, evsel__name(evsel), errno,
2704
4176
 		str_error_r(errno, errbuf, sizeof(errbuf)));
2705
4177
 	goto out_delete_evlist;
2706
4178
 }
..
..
@@ -2715,18 +4187,16 @@
2715
4187
 
2716
4188
 static int trace__replay(struct trace *trace)
2717
4189
 {
2718
-	const struct perf_evsel_str_handler handlers[] = {
4190
+	const struct evsel_str_handler handlers[] = {
2719
4191
 		{ "probe:vfs_getname",	     trace__vfs_getname, },
2720
4192
 	};
2721
4193
 	struct perf_data data = {
2722
-		.file      = {
2723
-			.path = input_name,
2724
-		},
2725
-		.mode      = PERF_DATA_MODE_READ,
2726
-		.force     = trace->force,
4194
+		.path  = input_name,
4195
+		.mode  = PERF_DATA_MODE_READ,
4196
+		.force = trace->force,
2727
4197
 	};
2728
4198
 	struct perf_session *session;
2729
-	struct perf_evsel *evsel;
4199
+	struct evsel *evsel;
2730
4200
 	int err = -1;
2731
4201
 
2732
4202
 	trace->tool.sample	  = trace__process_sample;
..
..
@@ -2747,8 +4217,8 @@
2747
4217
 	trace->multiple_threads = true;
2748
4218
 
2749
4219
 	session = perf_session__new(&data, false, &trace->tool);
2750
-	if (session == NULL)
2751
-		return -1;
4220
+	if (IS_ERR(session))
4221
+		return PTR_ERR(session);
2752
4222
 
2753
4223
 	if (trace->opts.target.pid)
2754
4224
 		symbol_conf.pid_list_str = strdup(trace->opts.target.pid);
..
..
@@ -2773,7 +4243,7 @@
2773
4243
 							     "syscalls:sys_enter");
2774
4244
 
2775
4245
 	if (evsel &&
2776
-	    (perf_evsel__init_raw_syscall_tp(evsel, trace__sys_enter) < 0 ||
4246
+	    (evsel__init_raw_syscall_tp(evsel, trace__sys_enter) < 0 ||
2777
4247
 	    perf_evsel__init_sc_tp_ptr_field(evsel, args))) {
2778
4248
 		pr_err("Error during initialize raw_syscalls:sys_enter event\n");
2779
4249
 		goto out;
..
..
@@ -2785,17 +4255,17 @@
2785
4255
 		evsel = perf_evlist__find_tracepoint_by_name(session->evlist,
2786
4256
 							     "syscalls:sys_exit");
2787
4257
 	if (evsel &&
2788
-	    (perf_evsel__init_raw_syscall_tp(evsel, trace__sys_exit) < 0 ||
4258
+	    (evsel__init_raw_syscall_tp(evsel, trace__sys_exit) < 0 ||
2789
4259
 	    perf_evsel__init_sc_tp_uint_field(evsel, ret))) {
2790
4260
 		pr_err("Error during initialize raw_syscalls:sys_exit event\n");
2791
4261
 		goto out;
2792
4262
 	}
2793
4263
 
2794
4264
 	evlist__for_each_entry(session->evlist, evsel) {
2795
-		if (evsel->attr.type == PERF_TYPE_SOFTWARE &&
2796
-		    (evsel->attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ||
2797
-		     evsel->attr.config == PERF_COUNT_SW_PAGE_FAULTS_MIN ||
2798
-		     evsel->attr.config == PERF_COUNT_SW_PAGE_FAULTS))
4265
+		if (evsel->core.attr.type == PERF_TYPE_SOFTWARE &&
4266
+		    (evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ||
4267
+		     evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MIN ||
4268
+		     evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS))
2799
4269
 			evsel->handler = trace__pgfault;
2800
4270
 	}
2801
4271
 
..
..
@@ -2824,17 +4294,17 @@
2824
4294
 }
2825
4295
 
2826
4296
 DEFINE_RESORT_RB(syscall_stats, a->msecs > b->msecs,
2827
-	struct stats 	*stats;
2828
-	double		msecs;
2829
-	int		syscall;
4297
+	struct syscall_stats *stats;
4298
+	double		     msecs;
4299
+	int		     syscall;
2830
4300
 )
2831
4301
 {
2832
4302
 	struct int_node *source = rb_entry(nd, struct int_node, rb_node);
2833
-	struct stats *stats = source->priv;
4303
+	struct syscall_stats *stats = source->priv;
2834
4304
 
2835
4305
 	entry->syscall = source->i;
2836
4306
 	entry->stats   = stats;
2837
-	entry->msecs   = stats ? (u64)stats->n * (avg_stats(stats) / NSEC_PER_MSEC) : 0;
4307
+	entry->msecs   = stats ? (u64)stats->stats.n * (avg_stats(&stats->stats) / NSEC_PER_MSEC) : 0;
2838
4308
 }
2839
4309
 
2840
4310
 static size_t thread__dump_stats(struct thread_trace *ttrace,
..
..
@@ -2850,27 +4320,37 @@
2850
4320
 
2851
4321
 	printed += fprintf(fp, "\n");
2852
4322
 
2853
-	printed += fprintf(fp, "   syscall            calls    total       min       avg       max      stddev\n");
2854
-	printed += fprintf(fp, "                               (msec)    (msec)    (msec)    (msec)        (%%)\n");
2855
-	printed += fprintf(fp, "   --------------- -------- --------- --------- --------- ---------     ------\n");
4323
+	printed += fprintf(fp, "   syscall            calls  errors  total       min       avg       max       stddev\n");
4324
+	printed += fprintf(fp, "                                     (msec)    (msec)    (msec)    (msec)        (%%)\n");
4325
+	printed += fprintf(fp, "   --------------- --------  ------ -------- --------- --------- ---------     ------\n");
2856
4326
 
2857
4327
 	resort_rb__for_each_entry(nd, syscall_stats) {
2858
-		struct stats *stats = syscall_stats_entry->stats;
4328
+		struct syscall_stats *stats = syscall_stats_entry->stats;
2859
4329
 		if (stats) {
2860
-			double min = (double)(stats->min) / NSEC_PER_MSEC;
2861
-			double max = (double)(stats->max) / NSEC_PER_MSEC;
2862
-			double avg = avg_stats(stats);
4330
+			double min = (double)(stats->stats.min) / NSEC_PER_MSEC;
4331
+			double max = (double)(stats->stats.max) / NSEC_PER_MSEC;
4332
+			double avg = avg_stats(&stats->stats);
2863
4333
 			double pct;
2864
-			u64 n = (u64) stats->n;
4334
+			u64 n = (u64)stats->stats.n;
2865
4335
 
2866
-			pct = avg ? 100.0 * stddev_stats(stats)/avg : 0.0;
4336
+			pct = avg ? 100.0 * stddev_stats(&stats->stats) / avg : 0.0;
2867
4337
 			avg /= NSEC_PER_MSEC;
2868
4338
 
2869
4339
 			sc = &trace->syscalls.table[syscall_stats_entry->syscall];
2870
4340
 			printed += fprintf(fp, "   %-15s", sc->name);
2871
-			printed += fprintf(fp, " %8" PRIu64 " %9.3f %9.3f %9.3f",
2872
-					   n, syscall_stats_entry->msecs, min, avg);
4341
+			printed += fprintf(fp, " %8" PRIu64 " %6" PRIu64 " %9.3f %9.3f %9.3f",
4342
+					   n, stats->nr_failures, syscall_stats_entry->msecs, min, avg);
2873
4343
 			printed += fprintf(fp, " %9.3f %9.2f%%\n", max, pct);
4344
+
4345
+			if (trace->errno_summary && stats->nr_failures) {
4346
+				const char *arch_name = perf_env__arch(trace->host->env);
4347
+				int e;
4348
+
4349
+				for (e = 0; e < stats->max_errno; ++e) {
4350
+					if (stats->errnos[e] != 0)
4351
+						fprintf(fp, "\t\t\t\t%s: %d\n", arch_syscalls__strerrno(arch_name, e + 1), stats->errnos[e]);
4352
+				}
4353
+			}
2874
4354
 		}
2875
4355
 	}
2876
4356
 
..
..
@@ -2951,8 +4431,8 @@
2951
4431
 	return 0;
2952
4432
 }
2953
4433
 
2954
-static int trace__set_filter_pids(const struct option *opt, const char *str,
2955
-				  int unset __maybe_unused)
4434
+static int trace__set_filter_pids_from_option(const struct option *opt, const char *str,
4435
+					      int unset __maybe_unused)
2956
4436
 {
2957
4437
 	int ret = -1;
2958
4438
 	size_t i;
..
..
@@ -3017,38 +4497,65 @@
3017
4497
 	return 0;
3018
4498
 }
3019
4499
 
3020
-static void evlist__set_evsel_handler(struct perf_evlist *evlist, void *handler)
4500
+static void evlist__set_default_evsel_handler(struct evlist *evlist, void *handler)
3021
4501
 {
3022
-	struct perf_evsel *evsel;
4502
+	struct evsel *evsel;
3023
4503
 
3024
-	evlist__for_each_entry(evlist, evsel)
3025
-		evsel->handler = handler;
4504
+	evlist__for_each_entry(evlist, evsel) {
4505
+		if (evsel->handler == NULL)
4506
+			evsel->handler = handler;
4507
+	}
3026
4508
 }
3027
4509
 
3028
-static int evlist__set_syscall_tp_fields(struct perf_evlist *evlist)
4510
+static void evsel__set_syscall_arg_fmt(struct evsel *evsel, const char *name)
3029
4511
 {
3030
-	struct perf_evsel *evsel;
4512
+	struct syscall_arg_fmt *fmt = evsel__syscall_arg_fmt(evsel);
4513
+
4514
+	if (fmt) {
4515
+		struct syscall_fmt *scfmt = syscall_fmt__find(name);
4516
+
4517
+		if (scfmt) {
4518
+			int skip = 0;
4519
+
4520
+			if (strcmp(evsel->tp_format->format.fields->name, "__syscall_nr") == 0 ||
4521
+			    strcmp(evsel->tp_format->format.fields->name, "nr") == 0)
4522
+				++skip;
4523
+
4524
+			memcpy(fmt + skip, scfmt->arg, (evsel->tp_format->format.nr_fields - skip) * sizeof(*fmt));
4525
+		}
4526
+	}
4527
+}
4528
+
4529
+static int evlist__set_syscall_tp_fields(struct evlist *evlist)
4530
+{
4531
+	struct evsel *evsel;
3031
4532
 
3032
4533
 	evlist__for_each_entry(evlist, evsel) {
3033
4534
 		if (evsel->priv || !evsel->tp_format)
3034
4535
 			continue;
3035
4536
 
3036
-		if (strcmp(evsel->tp_format->system, "syscalls"))
4537
+		if (strcmp(evsel->tp_format->system, "syscalls")) {
4538
+			evsel__init_tp_arg_scnprintf(evsel);
3037
4539
 			continue;
4540
+		}
3038
4541
 
3039
-		if (perf_evsel__init_syscall_tp(evsel))
4542
+		if (evsel__init_syscall_tp(evsel))
3040
4543
 			return -1;
3041
4544
 
3042
4545
 		if (!strncmp(evsel->tp_format->name, "sys_enter_", 10)) {
3043
-			struct syscall_tp *sc = evsel->priv;
4546
+			struct syscall_tp *sc = __evsel__syscall_tp(evsel);
3044
4547
 
3045
4548
 			if (__tp_field__init_ptr(&sc->args, sc->id.offset + sizeof(u64)))
3046
4549
 				return -1;
4550
+
4551
+			evsel__set_syscall_arg_fmt(evsel, evsel->tp_format->name + sizeof("sys_enter_") - 1);
3047
4552
 		} else if (!strncmp(evsel->tp_format->name, "sys_exit_", 9)) {
3048
-			struct syscall_tp *sc = evsel->priv;
4553
+			struct syscall_tp *sc = __evsel__syscall_tp(evsel);
3049
4554
 
3050
4555
 			if (__tp_field__init_uint(&sc->ret, sizeof(u64), sc->id.offset + sizeof(u64), evsel->needs_swap))
3051
4556
 				return -1;
4557
+
4558
+			evsel__set_syscall_arg_fmt(evsel, evsel->tp_format->name + sizeof("sys_exit_") - 1);
3052
4559
 		}
3053
4560
 	}
3054
4561
 
..
..
@@ -3072,6 +4579,7 @@
3072
4579
 	int len = strlen(str) + 1, err = -1, list, idx;
3073
4580
 	char *strace_groups_dir = system_path(STRACE_GROUPS_DIR);
3074
4581
 	char group_name[PATH_MAX];
4582
+	struct syscall_fmt *fmt;
3075
4583
 
3076
4584
 	if (strace_groups_dir == NULL)
3077
4585
 		return -1;
..
..
@@ -3089,12 +4597,19 @@
3089
4597
 		if (syscalltbl__id(trace->sctbl, s) >= 0 ||
3090
4598
 		    syscalltbl__strglobmatch_first(trace->sctbl, s, &idx) >= 0) {
3091
4599
 			list = 1;
4600
+			goto do_concat;
4601
+		}
4602
+
4603
+		fmt = syscall_fmt__find_by_alias(s);
4604
+		if (fmt != NULL) {
4605
+			list = 1;
4606
+			s = fmt->name;
3092
4607
 		} else {
3093
4608
 			path__join(group_name, sizeof(group_name), strace_groups_dir, s);
3094
4609
 			if (access(group_name, R_OK) == 0)
3095
4610
 				list = 1;
3096
4611
 		}
3097
-
4612
+do_concat:
3098
4613
 		if (lists[list]) {
3099
4614
 			sprintf(lists[list] + strlen(lists[list]), ",%s", s);
3100
4615
 		} else {
..
..
@@ -3130,9 +4645,9 @@
3130
4645
 	err = 0;
3131
4646
 
3132
4647
 	if (lists[0]) {
3133
-		struct option o = OPT_CALLBACK('e', "event", &trace->evlist, "event",
3134
-					       "event selector. use 'perf list' to list available events",
3135
-					       parse_events_option);
4648
+		struct option o = {
4649
+			.value = &trace->evlist,
4650
+		};
3136
4651
 		err = parse_events_option(&o, lists[0], 0);
3137
4652
 	}
3138
4653
 out:
..
..
@@ -3146,12 +4661,59 @@
3146
4661
 {
3147
4662
 	struct trace *trace = opt->value;
3148
4663
 
3149
-	if (!list_empty(&trace->evlist->entries))
3150
-		return parse_cgroups(opt, str, unset);
3151
-
4664
+	if (!list_empty(&trace->evlist->core.entries)) {
4665
+		struct option o = {
4666
+			.value = &trace->evlist,
4667
+		};
4668
+		return parse_cgroups(&o, str, unset);
4669
+	}
3152
4670
 	trace->cgroup = evlist__findnew_cgroup(trace->evlist, str);
3153
4671
 
3154
4672
 	return 0;
4673
+}
4674
+
4675
+static int trace__config(const char *var, const char *value, void *arg)
4676
+{
4677
+	struct trace *trace = arg;
4678
+	int err = 0;
4679
+
4680
+	if (!strcmp(var, "trace.add_events")) {
4681
+		trace->perfconfig_events = strdup(value);
4682
+		if (trace->perfconfig_events == NULL) {
4683
+			pr_err("Not enough memory for %s\n", "trace.add_events");
4684
+			return -1;
4685
+		}
4686
+	} else if (!strcmp(var, "trace.show_timestamp")) {
4687
+		trace->show_tstamp = perf_config_bool(var, value);
4688
+	} else if (!strcmp(var, "trace.show_duration")) {
4689
+		trace->show_duration = perf_config_bool(var, value);
4690
+	} else if (!strcmp(var, "trace.show_arg_names")) {
4691
+		trace->show_arg_names = perf_config_bool(var, value);
4692
+		if (!trace->show_arg_names)
4693
+			trace->show_zeros = true;
4694
+	} else if (!strcmp(var, "trace.show_zeros")) {
4695
+		bool new_show_zeros = perf_config_bool(var, value);
4696
+		if (!trace->show_arg_names && !new_show_zeros) {
4697
+			pr_warning("trace.show_zeros has to be set when trace.show_arg_names=no\n");
4698
+			goto out;
4699
+		}
4700
+		trace->show_zeros = new_show_zeros;
4701
+	} else if (!strcmp(var, "trace.show_prefix")) {
4702
+		trace->show_string_prefix = perf_config_bool(var, value);
4703
+	} else if (!strcmp(var, "trace.no_inherit")) {
4704
+		trace->opts.no_inherit = perf_config_bool(var, value);
4705
+	} else if (!strcmp(var, "trace.args_alignment")) {
4706
+		int args_alignment = 0;
4707
+		if (perf_config_int(&args_alignment, var, value) == 0)
4708
+			trace->args_alignment = args_alignment;
4709
+	} else if (!strcmp(var, "trace.tracepoint_beautifiers")) {
4710
+		if (strcasecmp(value, "libtraceevent") == 0)
4711
+			trace->libtraceevent_print = true;
4712
+		else if (strcasecmp(value, "libbeauty") == 0)
4713
+			trace->libtraceevent_print = false;
4714
+	}
4715
+out:
4716
+	return err;
3155
4717
 }
3156
4718
 
3157
4719
 int cmd_trace(int argc, const char **argv)
..
..
@@ -3164,9 +4726,6 @@
3164
4726
 		NULL
3165
4727
 	};
3166
4728
 	struct trace trace = {
3167
-		.syscalls = {
3168
-			. max = -1,
3169
-		},
3170
4729
 		.opts = {
3171
4730
 			.target = {
3172
4731
 				.uid	   = UINT_MAX,
..
..
@@ -3176,19 +4735,26 @@
3176
4735
 			.user_interval = ULLONG_MAX,
3177
4736
 			.no_buffering  = true,
3178
4737
 			.mmap_pages    = UINT_MAX,
3179
-			.proc_map_timeout  = 500,
3180
4738
 		},
3181
4739
 		.output = stderr,
3182
4740
 		.show_comm = true,
4741
+		.show_tstamp = true,
4742
+		.show_duration = true,
4743
+		.show_arg_names = true,
4744
+		.args_alignment = 70,
3183
4745
 		.trace_syscalls = false,
3184
4746
 		.kernel_syscallchains = false,
3185
4747
 		.max_stack = UINT_MAX,
4748
+		.max_events = ULONG_MAX,
3186
4749
 	};
4750
+	const char *map_dump_str = NULL;
3187
4751
 	const char *output_name = NULL;
3188
4752
 	const struct option trace_options[] = {
3189
4753
 	OPT_CALLBACK('e', "event", &trace, "event",
3190
4754
 		     "event/syscall selector. use 'perf list' to list available events",
3191
4755
 		     trace__parse_events_option),
4756
+	OPT_CALLBACK(0, "filter", &trace.evlist, "filter",
4757
+		     "event filter", parse_filter),
3192
4758
 	OPT_BOOLEAN(0, "comm", &trace.show_comm,
3193
4759
 		    "show the thread COMM next to its id"),
3194
4760
 	OPT_BOOLEAN(0, "tool_stats", &trace.show_tool_stats, "show tool stats"),
..
..
@@ -3201,7 +4767,7 @@
3201
4767
 	OPT_STRING('t', "tid", &trace.opts.target.tid, "tid",
3202
4768
 		    "trace events on existing thread id"),
3203
4769
 	OPT_CALLBACK(0, "filter-pids", &trace, "CSV list of pids",
3204
-		     "pids to filter (by the kernel)", trace__set_filter_pids),
4770
+		     "pids to filter (by the kernel)", trace__set_filter_pids_from_option),
3205
4771
 	OPT_BOOLEAN('a', "all-cpus", &trace.opts.target.system_wide,
3206
4772
 		    "system-wide collection from all CPUs"),
3207
4773
 	OPT_STRING('C', "cpu", &trace.opts.target.cpu_list, "cpu",
..
..
@@ -3216,6 +4782,9 @@
3216
4782
 	OPT_CALLBACK(0, "duration", &trace, "float",
3217
4783
 		     "show only events with duration > N.M ms",
3218
4784
 		     trace__set_duration),
4785
+#ifdef HAVE_LIBBPF_SUPPORT
4786
+	OPT_STRING(0, "map-dump", &map_dump_str, "BPF map", "BPF map to periodically dump"),
4787
+#endif
3219
4788
 	OPT_BOOLEAN(0, "sched", &trace.sched, "show blocking scheduler events"),
3220
4789
 	OPT_INCR('v', "verbose", &verbose, "be more verbose"),
3221
4790
 	OPT_BOOLEAN('T', "time", &trace.full_time,
..
..
@@ -3226,6 +4795,8 @@
3226
4795
 		    "Show only syscall summary with statistics"),
3227
4796
 	OPT_BOOLEAN('S', "with-summary", &trace.summary,
3228
4797
 		    "Show all syscalls and summary with statistics"),
4798
+	OPT_BOOLEAN(0, "errno-summary", &trace.errno_summary,
4799
+		    "Show errno stats per syscall, use with -s or -S"),
3229
4800
 	OPT_CALLBACK_DEFAULT('F', "pf", &trace.trace_pgfaults, "all|maj|min",
3230
4801
 		     "Trace pagefaults", parse_pagefaults, "maj"),
3231
4802
 	OPT_BOOLEAN(0, "syscalls", &trace.trace_syscalls, "Trace syscalls"),
..
..
@@ -3233,8 +4804,12 @@
3233
4804
 	OPT_CALLBACK(0, "call-graph", &trace.opts,
3234
4805
 		     "record_mode[,record_size]", record_callchain_help,
3235
4806
 		     &record_parse_callchain_opt),
4807
+	OPT_BOOLEAN(0, "libtraceevent_print", &trace.libtraceevent_print,
4808
+		    "Use libtraceevent to print the tracepoint arguments."),
3236
4809
 	OPT_BOOLEAN(0, "kernel-syscall-graph", &trace.kernel_syscallchains,
3237
4810
 		    "Show the kernel callchains on the syscall exit path"),
4811
+	OPT_ULONG(0, "max-events", &trace.max_events,
4812
+		"Set the maximum number of events to print, exit after that is reached. "),
3238
4813
 	OPT_UINTEGER(0, "min-stack", &trace.min_stack,
3239
4814
 		     "Set the minimum stack depth when parsing the callchain, "
3240
4815
 		     "anything below the specified depth will be ignored."),
..
..
@@ -3242,20 +4817,23 @@
3242
4817
 		     "Set the maximum stack depth when parsing the callchain, "
3243
4818
 		     "anything beyond the specified depth will be ignored. "
3244
4819
 		     "Default: kernel.perf_event_max_stack or " __stringify(PERF_MAX_STACK_DEPTH)),
4820
+	OPT_BOOLEAN(0, "sort-events", &trace.sort_events,
4821
+			"Sort batch of events before processing, use if getting out of order events"),
3245
4822
 	OPT_BOOLEAN(0, "print-sample", &trace.print_sample,
3246
4823
 			"print the PERF_RECORD_SAMPLE PERF_SAMPLE_ info, for debugging"),
3247
-	OPT_UINTEGER(0, "proc-map-timeout", &trace.opts.proc_map_timeout,
4824
+	OPT_UINTEGER(0, "proc-map-timeout", &proc_map_timeout,
3248
4825
 			"per thread proc mmap processing timeout in ms"),
3249
4826
 	OPT_CALLBACK('G', "cgroup", &trace, "name", "monitor event in cgroup name only",
3250
4827
 		     trace__parse_cgroups),
3251
-	OPT_UINTEGER('D', "delay", &trace.opts.initial_delay,
4828
+	OPT_INTEGER('D', "delay", &trace.opts.initial_delay,
3252
4829
 		     "ms to wait before starting measurement after program "
3253
4830
 		     "start"),
4831
+	OPTS_EVSWITCH(&trace.evswitch),
3254
4832
 	OPT_END()
3255
4833
 	};
3256
4834
 	bool __maybe_unused max_stack_user_set = true;
3257
4835
 	bool mmap_pages_user_set = true;
3258
-	struct perf_evsel *evsel;
4836
+	struct evsel *evsel;
3259
4837
 	const char * const trace_subcommands[] = { "record", NULL };
3260
4838
 	int err = -1;
3261
4839
 	char bf[BUFSIZ];
..
..
@@ -3263,7 +4841,7 @@
3263
4841
 	signal(SIGSEGV, sighandler_dump_stack);
3264
4842
 	signal(SIGFPE, sighandler_dump_stack);
3265
4843
 
3266
-	trace.evlist = perf_evlist__new();
4844
+	trace.evlist = evlist__new();
3267
4845
 	trace.sctbl = syscalltbl__new();
3268
4846
 
3269
4847
 	if (trace.evlist == NULL || trace.sctbl == NULL) {
..
..
@@ -3272,8 +4850,53 @@
3272
4850
 		goto out;
3273
4851
 	}
3274
4852
 
4853
+	/*
4854
+	 * Parsing .perfconfig may entail creating a BPF event, that may need
4855
+	 * to create BPF maps, so bump RLIM_MEMLOCK as the default 64K setting
4856
+	 * is too small. This affects just this process, not touching the
4857
+	 * global setting. If it fails we'll get something in 'perf trace -v'
4858
+	 * to help diagnose the problem.
4859
+	 */
4860
+	rlimit__bump_memlock();
4861
+
4862
+	err = perf_config(trace__config, &trace);
4863
+	if (err)
4864
+		goto out;
4865
+
3275
4866
 	argc = parse_options_subcommand(argc, argv, trace_options, trace_subcommands,
3276
4867
 				 trace_usage, PARSE_OPT_STOP_AT_NON_OPTION);
4868
+
4869
+	/*
4870
+	 * Here we already passed thru trace__parse_events_option() and it has
4871
+	 * already figured out if -e syscall_name, if not but if --event
4872
+	 * foo:bar was used, the user is interested _just_ in those, say,
4873
+	 * tracepoint events, not in the strace-like syscall-name-based mode.
4874
+	 *
4875
+	 * This is important because we need to check if strace-like mode is
4876
+	 * needed to decided if we should filter out the eBPF
4877
+	 * __augmented_syscalls__ code, if it is in the mix, say, via
4878
+	 * .perfconfig trace.add_events, and filter those out.
4879
+	 */
4880
+	if (!trace.trace_syscalls && !trace.trace_pgfaults &&
4881
+	    trace.evlist->core.nr_entries == 0 /* Was --events used? */) {
4882
+		trace.trace_syscalls = true;
4883
+	}
4884
+	/*
4885
+	 * Now that we have --verbose figured out, lets see if we need to parse
4886
+	 * events from .perfconfig, so that if those events fail parsing, say some
4887
+	 * BPF program fails, then we'll be able to use --verbose to see what went
4888
+	 * wrong in more detail.
4889
+	 */
4890
+	if (trace.perfconfig_events != NULL) {
4891
+		struct parse_events_error parse_err;
4892
+
4893
+		bzero(&parse_err, sizeof(parse_err));
4894
+		err = parse_events(trace.evlist, trace.perfconfig_events, &parse_err);
4895
+		if (err) {
4896
+			parse_events_print_error(&parse_err, trace.perfconfig_events);
4897
+			goto out;
4898
+		}
4899
+	}
3277
4900
 
3278
4901
 	if ((nr_cgroups || trace.cgroup) && !trace.opts.target.system_wide) {
3279
4902
 		usage_with_options_msg(trace_usage, trace_options,
..
..
@@ -3288,10 +4911,60 @@
3288
4911
 	}
3289
4912
 
3290
4913
 	if (evsel) {
3291
-		if (perf_evsel__init_augmented_syscall_tp(evsel) ||
3292
-		    perf_evsel__init_augmented_syscall_tp_args(evsel))
3293
-			goto out;
3294
4914
 		trace.syscalls.events.augmented = evsel;
4915
+
4916
+		evsel = perf_evlist__find_tracepoint_by_name(trace.evlist, "raw_syscalls:sys_enter");
4917
+		if (evsel == NULL) {
4918
+			pr_err("ERROR: raw_syscalls:sys_enter not found in the augmented BPF object\n");
4919
+			goto out;
4920
+		}
4921
+
4922
+		if (evsel->bpf_obj == NULL) {
4923
+			pr_err("ERROR: raw_syscalls:sys_enter not associated to a BPF object\n");
4924
+			goto out;
4925
+		}
4926
+
4927
+		trace.bpf_obj = evsel->bpf_obj;
4928
+
4929
+		/*
4930
+		 * If we have _just_ the augmenter event but don't have a
4931
+		 * explicit --syscalls, then assume we want all strace-like
4932
+		 * syscalls:
4933
+		 */
4934
+		if (!trace.trace_syscalls && trace__only_augmented_syscalls_evsels(&trace))
4935
+			trace.trace_syscalls = true;
4936
+		/*
4937
+		 * So, if we have a syscall augmenter, but trace_syscalls, aka
4938
+		 * strace-like syscall tracing is not set, then we need to trow
4939
+		 * away the augmenter, i.e. all the events that were created
4940
+		 * from that BPF object file.
4941
+		 *
4942
+		 * This is more to fix the current .perfconfig trace.add_events
4943
+		 * style of setting up the strace-like eBPF based syscall point
4944
+		 * payload augmenter.
4945
+		 *
4946
+		 * All this complexity will be avoided by adding an alternative
4947
+		 * to trace.add_events in the form of
4948
+		 * trace.bpf_augmented_syscalls, that will be only parsed if we
4949
+		 * need it.
4950
+		 *
4951
+		 * .perfconfig trace.add_events is still useful if we want, for
4952
+		 * instance, have msr_write.msr in some .perfconfig profile based
4953
+		 * 'perf trace --config determinism.profile' mode, where for some
4954
+		 * particular goal/workload type we want a set of events and
4955
+		 * output mode (with timings, etc) instead of having to add
4956
+		 * all via the command line.
4957
+		 *
4958
+		 * Also --config to specify an alternate .perfconfig file needs
4959
+		 * to be implemented.
4960
+		 */
4961
+		if (!trace.trace_syscalls) {
4962
+			trace__delete_augmented_syscalls(&trace);
4963
+		} else {
4964
+			trace__set_bpf_map_filtered_pids(&trace);
4965
+			trace__set_bpf_map_syscalls(&trace);
4966
+			trace.syscalls.unaugmented_prog = trace__find_bpf_program_by_title(&trace, "!raw_syscalls:unaugmented");
4967
+		}
3295
4968
 	}
3296
4969
 
3297
4970
 	err = bpf__setup_stdout(trace.evlist);
..
..
@@ -3302,6 +4975,14 @@
3302
4975
 	}
3303
4976
 
3304
4977
 	err = -1;
4978
+
4979
+	if (map_dump_str) {
4980
+		trace.dump.map = trace__find_bpf_map_by_name(&trace, map_dump_str);
4981
+		if (trace.dump.map == NULL) {
4982
+			pr_err("ERROR: BPF map \"%s\" not found\n", map_dump_str);
4983
+			goto out;
4984
+		}
4985
+	}
3305
4986
 
3306
4987
 	if (trace.trace_pgfaults) {
3307
4988
 		trace.opts.sample_address = true;
..
..
@@ -3329,25 +5010,106 @@
3329
5010
 		symbol_conf.use_callchain = true;
3330
5011
 	}
3331
5012
 
3332
-	if (trace.evlist->nr_entries > 0) {
3333
-		evlist__set_evsel_handler(trace.evlist, trace__event_handler);
5013
+	if (trace.evlist->core.nr_entries > 0) {
5014
+		evlist__set_default_evsel_handler(trace.evlist, trace__event_handler);
3334
5015
 		if (evlist__set_syscall_tp_fields(trace.evlist)) {
3335
5016
 			perror("failed to set syscalls:* tracepoint fields");
3336
5017
 			goto out;
3337
5018
 		}
3338
5019
 	}
3339
5020
 
5021
+	if (trace.sort_events) {
5022
+		ordered_events__init(&trace.oe.data, ordered_events__deliver_event, &trace);
5023
+		ordered_events__set_copy_on_queue(&trace.oe.data, true);
5024
+	}
5025
+
5026
+	/*
5027
+	 * If we are augmenting syscalls, then combine what we put in the
5028
+	 * __augmented_syscalls__ BPF map with what is in the
5029
+	 * syscalls:sys_exit_FOO tracepoints, i.e. just like we do without BPF,
5030
+	 * combining raw_syscalls:sys_enter with raw_syscalls:sys_exit.
5031
+	 *
5032
+	 * We'll switch to look at two BPF maps, one for sys_enter and the
5033
+	 * other for sys_exit when we start augmenting the sys_exit paths with
5034
+	 * buffers that are being copied from kernel to userspace, think 'read'
5035
+	 * syscall.
5036
+	 */
5037
+	if (trace.syscalls.events.augmented) {
5038
+		evlist__for_each_entry(trace.evlist, evsel) {
5039
+			bool raw_syscalls_sys_exit = strcmp(evsel__name(evsel), "raw_syscalls:sys_exit") == 0;
5040
+
5041
+			if (raw_syscalls_sys_exit) {
5042
+				trace.raw_augmented_syscalls = true;
5043
+				goto init_augmented_syscall_tp;
5044
+			}
5045
+
5046
+			if (trace.syscalls.events.augmented->priv == NULL &&
5047
+			    strstr(evsel__name(evsel), "syscalls:sys_enter")) {
5048
+				struct evsel *augmented = trace.syscalls.events.augmented;
5049
+				if (evsel__init_augmented_syscall_tp(augmented, evsel) ||
5050
+				    evsel__init_augmented_syscall_tp_args(augmented))
5051
+					goto out;
5052
+				/*
5053
+				 * Augmented is __augmented_syscalls__ BPF_OUTPUT event
5054
+				 * Above we made sure we can get from the payload the tp fields
5055
+				 * that we get from syscalls:sys_enter tracefs format file.
5056
+				 */
5057
+				augmented->handler = trace__sys_enter;
5058
+				/*
5059
+				 * Now we do the same for the *syscalls:sys_enter event so that
5060
+				 * if we handle it directly, i.e. if the BPF prog returns 0 so
5061
+				 * as not to filter it, then we'll handle it just like we would
5062
+				 * for the BPF_OUTPUT one:
5063
+				 */
5064
+				if (evsel__init_augmented_syscall_tp(evsel, evsel) ||
5065
+				    evsel__init_augmented_syscall_tp_args(evsel))
5066
+					goto out;
5067
+				evsel->handler = trace__sys_enter;
5068
+			}
5069
+
5070
+			if (strstarts(evsel__name(evsel), "syscalls:sys_exit_")) {
5071
+				struct syscall_tp *sc;
5072
+init_augmented_syscall_tp:
5073
+				if (evsel__init_augmented_syscall_tp(evsel, evsel))
5074
+					goto out;
5075
+				sc = __evsel__syscall_tp(evsel);
5076
+				/*
5077
+				 * For now with BPF raw_augmented we hook into
5078
+				 * raw_syscalls:sys_enter and there we get all
5079
+				 * 6 syscall args plus the tracepoint common
5080
+				 * fields and the syscall_nr (another long).
5081
+				 * So we check if that is the case and if so
5082
+				 * don't look after the sc->args_size but
5083
+				 * always after the full raw_syscalls:sys_enter
5084
+				 * payload, which is fixed.
5085
+				 *
5086
+				 * We'll revisit this later to pass
5087
+				 * s->args_size to the BPF augmenter (now
5088
+				 * tools/perf/examples/bpf/augmented_raw_syscalls.c,
5089
+				 * so that it copies only what we need for each
5090
+				 * syscall, like what happens when we use
5091
+				 * syscalls:sys_enter_NAME, so that we reduce
5092
+				 * the kernel/userspace traffic to just what is
5093
+				 * needed for each syscall.
5094
+				 */
5095
+				if (trace.raw_augmented_syscalls)
5096
+					trace.raw_augmented_syscalls_args_size = (6 + 1) * sizeof(long) + sc->id.offset;
5097
+				evsel__init_augmented_syscall_tp_ret(evsel);
5098
+				evsel->handler = trace__sys_exit;
5099
+			}
5100
+		}
5101
+	}
5102
+
3340
5103
 	if ((argc >= 1) && (strcmp(argv[0], "record") == 0))
3341
5104
 		return trace__record(&trace, argc-1, &argv[1]);
5105
+
5106
+	/* Using just --errno-summary will trigger --summary */
5107
+	if (trace.errno_summary && !trace.summary && !trace.summary_only)
5108
+		trace.summary_only = true;
3342
5109
 
3343
5110
 	/* summary_only implies summary option, but don't overwrite summary if set */
3344
5111
 	if (trace.summary_only)
3345
5112
 		trace.summary = trace.summary_only;
3346
-
3347
-	if (!trace.trace_syscalls && !trace.trace_pgfaults &&
3348
-	    trace.evlist->nr_entries == 0 /* Was --events used? */) {
3349
-		trace.trace_syscalls = true;
3350
-	}
3351
5113
 
3352
5114
 	if (output_name != NULL) {
3353
5115
 		err = trace__open_output(&trace, output_name);
..
..
@@ -3356,6 +5118,10 @@
3356
5118
 			goto out;
3357
5119
 		}
3358
5120
 	}
5121
+
5122
+	err = evswitch__init(&trace.evswitch, trace.evlist, stderr);
5123
+	if (err)
5124
+		goto out_close;
3359
5125
 
3360
5126
 	err = target__validate(&trace.opts.target);
3361
5127
 	if (err) {
..
..
@@ -3383,5 +5149,6 @@
3383
5149
 	if (output_name != NULL)
3384
5150
 		fclose(trace.output);
3385
5151
 out:
5152
+	zfree(&trace.perfconfig_events);
3386
5153
 	return err;
3387
5154
 }