• Lai Jiangshan's avatar
    tracing: Separate raw syscall from syscall tracer · b8007ef7
    Lai Jiangshan authored
    The current syscall tracer mixes raw syscalls and real syscalls.
    
    echo 1 > events/syscalls/enable
    And we get these from the output:
    
    (XXXX insteads "            grep-20914 [001] 588211.446347" .. etc)
    
    XXXX: sys_read(fd: 3, buf: 80609a8, count: 7000)
    XXXX: sys_enter: NR 3 (3, 80609a8, 7000, a, 1000, bfce8ef8)
    XXXX: sys_read -> 0x138
    XXXX: sys_exit: NR 3 = 312
    XXXX: sys_read(fd: 3, buf: 8060ae0, count: 7000)
    XXXX: sys_enter: NR 3 (3, 8060ae0, 7000, a, 1000, bfce8ef8)
    XXXX: sys_read -> 0x138
    XXXX: sys_exit: NR 3 = 312
    
    There are 2 drawbacks here.
    A) two almost identical records are saved in ringbuffer
       when a syscall enters or exits. (4 records for every syscall)
       This wastes precious space in the ring buffer.
    B) the lines including "sys_enter/sys_exit" produces
       hardly any useful information for the output (no labels).
    
    The user can use this method to prevent these drawbacks:
    echo 1 > events/syscalls/enable
    echo 0 > events/syscalls/sys_enter/enable
    echo 0 > events/syscalls/sys_exit/enable
    
    But this is not user friendly. So we separate raw syscall
    from syscall tracer.
    
    After this fix applied:
    syscall tracer's output (echo 1 > events/syscalls/enable):
    
    XXXX: sys_read(fd: 3, buf: bfe87d88, count: 200)
    XXXX: sys_read -> 0x200
    XXXX: sys_fstat64(fd: 3, statbuf: bfe87c98)
    XXXX: sys_fstat64 -> 0x0
    XXXX: sys_close(fd: 3)
    
    raw syscall tracer's output (echo 1 > events/raw_syscalls/enable):
    
    XXXX: sys_enter: NR 175 (0, bf92bf18, bf92bf98, 8, b748cff4, bf92bef8)
    XXXX: sys_exit: NR 175 = 0
    XXXX: sys_enter: NR 175 (2, bf92bf98, 0, 8, b748cff4, bf92bef8)
    XXXX: sys_exit: NR 175 = 0
    XXXX: sys_enter: NR 3 (9, bf927f9c, 4000, b77e2518, b77dce60, bf92bff8)
    Signed-off-by: default avatarLai Jiangshan <laijs@cn.fujitsu.com>
    LKML-Reference: <4AEFC37C.5080609@cn.fujitsu.com>
    Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
    b8007ef7
syscalls.h 1.38 KB