2009-08-24 15:43:14 -06:00
|
|
|
#undef TRACE_SYSTEM
|
tracing: Separate raw syscall from syscall tracer
The current syscall tracer mixes raw syscalls and real syscalls.
echo 1 > events/syscalls/enable
And we get these from the output:
(XXXX insteads " grep-20914 [001] 588211.446347" .. etc)
XXXX: sys_read(fd: 3, buf: 80609a8, count: 7000)
XXXX: sys_enter: NR 3 (3, 80609a8, 7000, a, 1000, bfce8ef8)
XXXX: sys_read -> 0x138
XXXX: sys_exit: NR 3 = 312
XXXX: sys_read(fd: 3, buf: 8060ae0, count: 7000)
XXXX: sys_enter: NR 3 (3, 8060ae0, 7000, a, 1000, bfce8ef8)
XXXX: sys_read -> 0x138
XXXX: sys_exit: NR 3 = 312
There are 2 drawbacks here.
A) two almost identical records are saved in ringbuffer
when a syscall enters or exits. (4 records for every syscall)
This wastes precious space in the ring buffer.
B) the lines including "sys_enter/sys_exit" produces
hardly any useful information for the output (no labels).
The user can use this method to prevent these drawbacks:
echo 1 > events/syscalls/enable
echo 0 > events/syscalls/sys_enter/enable
echo 0 > events/syscalls/sys_exit/enable
But this is not user friendly. So we separate raw syscall
from syscall tracer.
After this fix applied:
syscall tracer's output (echo 1 > events/syscalls/enable):
XXXX: sys_read(fd: 3, buf: bfe87d88, count: 200)
XXXX: sys_read -> 0x200
XXXX: sys_fstat64(fd: 3, statbuf: bfe87c98)
XXXX: sys_fstat64 -> 0x0
XXXX: sys_close(fd: 3)
raw syscall tracer's output (echo 1 > events/raw_syscalls/enable):
XXXX: sys_enter: NR 175 (0, bf92bf18, bf92bf98, 8, b748cff4, bf92bef8)
XXXX: sys_exit: NR 175 = 0
XXXX: sys_enter: NR 175 (2, bf92bf98, 0, 8, b748cff4, bf92bef8)
XXXX: sys_exit: NR 175 = 0
XXXX: sys_enter: NR 3 (9, bf927f9c, 4000, b77e2518, b77dce60, bf92bff8)
Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
LKML-Reference: <4AEFC37C.5080609@cn.fujitsu.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2009-11-02 22:45:32 -07:00
|
|
|
#define TRACE_SYSTEM raw_syscalls
|
|
|
|
#define TRACE_INCLUDE_FILE syscalls
|
2009-08-24 15:43:14 -06:00
|
|
|
|
|
|
|
#if !defined(_TRACE_EVENTS_SYSCALLS_H) || defined(TRACE_HEADER_MULTI_READ)
|
|
|
|
#define _TRACE_EVENTS_SYSCALLS_H
|
|
|
|
|
|
|
|
#include <linux/tracepoint.h>
|
|
|
|
|
|
|
|
#include <asm/ptrace.h>
|
|
|
|
#include <asm/syscall.h>
|
|
|
|
|
|
|
|
|
|
|
|
#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
|
|
|
|
|
|
|
|
extern void syscall_regfunc(void);
|
|
|
|
extern void syscall_unregfunc(void);
|
|
|
|
|
|
|
|
TRACE_EVENT_FN(sys_enter,
|
|
|
|
|
|
|
|
TP_PROTO(struct pt_regs *regs, long id),
|
|
|
|
|
|
|
|
TP_ARGS(regs, id),
|
|
|
|
|
|
|
|
TP_STRUCT__entry(
|
|
|
|
__field( long, id )
|
|
|
|
__array( unsigned long, args, 6 )
|
|
|
|
),
|
|
|
|
|
|
|
|
TP_fast_assign(
|
|
|
|
__entry->id = id;
|
|
|
|
syscall_get_arguments(current, regs, 0, 6, __entry->args);
|
|
|
|
),
|
|
|
|
|
|
|
|
TP_printk("NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)",
|
|
|
|
__entry->id,
|
|
|
|
__entry->args[0], __entry->args[1], __entry->args[2],
|
|
|
|
__entry->args[3], __entry->args[4], __entry->args[5]),
|
|
|
|
|
|
|
|
syscall_regfunc, syscall_unregfunc
|
|
|
|
);
|
|
|
|
|
2010-11-17 17:52:06 -07:00
|
|
|
TRACE_EVENT_FLAGS(sys_enter, TRACE_EVENT_FL_CAP_ANY)
|
|
|
|
|
2009-08-24 15:43:14 -06:00
|
|
|
TRACE_EVENT_FN(sys_exit,
|
|
|
|
|
|
|
|
TP_PROTO(struct pt_regs *regs, long ret),
|
|
|
|
|
|
|
|
TP_ARGS(regs, ret),
|
|
|
|
|
|
|
|
TP_STRUCT__entry(
|
|
|
|
__field( long, id )
|
|
|
|
__field( long, ret )
|
|
|
|
),
|
|
|
|
|
|
|
|
TP_fast_assign(
|
|
|
|
__entry->id = syscall_get_nr(current, regs);
|
|
|
|
__entry->ret = ret;
|
|
|
|
),
|
|
|
|
|
|
|
|
TP_printk("NR %ld = %ld",
|
|
|
|
__entry->id, __entry->ret),
|
|
|
|
|
|
|
|
syscall_regfunc, syscall_unregfunc
|
|
|
|
);
|
|
|
|
|
2010-11-17 17:52:06 -07:00
|
|
|
TRACE_EVENT_FLAGS(sys_exit, TRACE_EVENT_FL_CAP_ANY)
|
|
|
|
|
2009-08-24 15:43:14 -06:00
|
|
|
#endif /* CONFIG_HAVE_SYSCALL_TRACEPOINTS */
|
|
|
|
|
|
|
|
#endif /* _TRACE_EVENTS_SYSCALLS_H */
|
|
|
|
|
|
|
|
/* This part must be outside protection */
|
|
|
|
#include <trace/define_trace.h>
|
|
|
|
|