1. 29 Jul, 2019 40 commits
    • Jiri Olsa's avatar
      perf stat: Move loaded out of struct perf_counts_values · df1d6856
      Jiri Olsa authored
      Because we will make struct perf_counts_values public in following
      patches and 'loaded' is implementation related.
      
      No functional change is expected.
      Signed-off-by: default avatarJiri Olsa <jolsa@kernel.org>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
      Cc: Andi Kleen <ak@linux.intel.com>
      Cc: Michael Petlan <mpetlan@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Link: http://lkml.kernel.org/r/20190721112506.12306-2-jolsa@kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      df1d6856
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Add "sendfile64" alias to the "sendfile" syscall · e4b00e93
      Arnaldo Carvalho de Melo authored
      We were looking in tracefs for:
      
        /sys/kernel/debug/tracing/events/syscalls/sys_enter_sendfile/format when
      
      what is there is just
      
        /sys/kernel/debug/tracing/events/syscalls/sys_enter_sendfile/format
      
      Its the same id, 40 in x86_64, so just add an alias and let the existing
      logic take care of that.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-km2hmg7hru6u4pawi5fi903q@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      e4b00e93
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Reuse BPF augmenters from syscalls with similar args signature · ad4153f9
      Arnaldo Carvalho de Melo authored
      We have an augmenter for the "open" syscall, which has just one pointer,
      in the first argument, a "const char *", so any other syscall that has
      just one pointer and that is the first can reuse the "open" BPF
      augmenter program.
      
      Even more, syscalls that get two pointers with the first being a string
      can reuse "open"'s BPF augmenter till we have an augmenter that better
      matches that syscall with two pointers.
      
      With this the few augmenters we have, for open (first arg is a string),
      openat (2nd arg is a string), renameat (2nd and 4th are strings) can be
      reused by a lot of syscalls, ditto for "bind" reusing "connect" because
      both have the 2nd argument as a sockaddr and the 3rd as its len.
      
      Lets see how this makes the "bind" syscall reuse the "connect" BPF prog
      augmenter found in tools/perf/examples/bpf/augmented_raw_syscalls.c:
      
        # perf trace -e bind,connect systemctl restart sshd
        connect(3, { .family: PF_LOCAL, path: /run/systemd/private }, 23) = 0
        #
      
      Oh, it just connects to some daemon, so we better do it system wide and then
      stop/start sshd:
      
        # perf trace -e bind,connect
        systemctl/10124 connect(3, { .family: PF_LOCAL, path: /run/systemd/private }, 23) = 0
        sshd/10102 connect(7, { .family: PF_LOCAL, path: /dev/log }, 110) = 0
        systemctl/10126 connect(3, { .family: PF_LOCAL, path: /run/systemd/private }, 23) = 0
        systemd/10128  ... [continued]: connect())            = 0
        (sshd)/10128 connect(3, { .family: PF_LOCAL, path: /run/systemd/journal/stdout }, 30) ...
        sshd/10128 bind(3, { .family: PF_NETLINK }, 12)    = 0
        sshd/10128 connect(4, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        sshd/10128 connect(3, { .family: PF_INET6, port: 22, addr: :: }, 28) = 0
        sshd/10128 connect(3, { .family: PF_UNSPEC }, 16)  = 0
        sshd/10128 connect(3, { .family: PF_INET, port: 22, addr: 0.0.0.0 }, 16) = 0
        sshd/10128 connect(3, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        sshd/10128 connect(3, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        sshd/10128 connect(5, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        sshd/10128 connect(5, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        sshd/10128 bind(4, { .family: PF_INET, port: 22, addr: 0.0.0.0 }, 16) = 0
        sshd/10128 connect(6, { .family: PF_LOCAL, path: /dev/log }, 110) = 0
        sshd/10128 bind(6, { .family: PF_INET6, port: 22, addr: :: }, 28) = 0
        sshd/10128 connect(7, { .family: PF_LOCAL, path: /dev/log }, 110) = 0
        ^C#
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-zfley2ghs4nim1uq4nu6ed3l@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      ad4153f9
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Preallocate the syscall table · 30a910d7
      Arnaldo Carvalho de Melo authored
      We'll continue reading its details from tracefs as we need it, but
      preallocate the whole thing otherwise we may realloc and end up with
      pointers to the previous buffer.
      
      I.e. in an upcoming algorithm we'll look for syscalls that have function
      signatures that are similar to a given syscall to see if we can reuse
      its BPF augmenter, so we may be at syscall 42, having a 'struct syscall'
      pointing to that slot in trace->syscalls.table[] and try to read the
      slot for an yet unread syscall, which would realloc that table to read
      the info for syscall 43, say, which would trigger a realoc of
      trace->syscalls.table[], and then the pointer we had for syscall 42
      would be pointing to the previous block of memory. b00m.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Brendan Gregg <brendan.d.gregg@gmail.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-m3cjzzifibs13imafhkk77a0@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      30a910d7
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Mark syscall ids that are not allocated to avoid unnecessary error messages · b8b1033f
      Arnaldo Carvalho de Melo authored
      There are holes in syscall tables with IDs not associated with any
      syscall, mark those when trying to read information for syscalls, which
      could happen when iterating thru all syscalls from 0 to the highest
      numbered syscall id.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-cku9mpcrcsqaiq0jepu86r68@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      b8b1033f
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Forward error codes when trying to read syscall info · 5d2bd889
      Arnaldo Carvalho de Melo authored
      We iterate thru the syscall table produced from the kernel syscall
      tables reading info, propagate the error and add to the debug message.
      
      This helps in fixing further bugs, such as failing to read the
      "sendfile" syscall info when it really should try the aliasm
      "sendfile64".
      
        Problems reading syscall 40: 2 (No such file or directory)(sendfile) information
      
        # grep sendfile /tmp/build/perf/arch/x86/include/generated/asm/syscalls_64.c
      	[40] = "sendfile",
        #
      
      I.e. in the tracefs format file for the syscall tracepoints we have it
      as sendfile64:
      
        # find /sys -type f -name format | grep sendfile
        /sys/kernel/debug/tracing/events/syscalls/sys_enter_sendfile64/format
        /sys/kernel/debug/tracing/events/syscalls/sys_exit_sendfile64/format
        #
      
      But as "sendfile" in the file used to build the syscall table used in
      perf:
      
        $ grep sendfile arch/x86/entry/syscalls/syscall_64.tbl
        40	common	sendfile		__x64_sys_sendfile64
        $
      
      So we need to add, in followup patches, aliases in 'perf trace' syscall
      data structures to cope with thie.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-w3eluap63x9je0bb8o3t79tz@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      5d2bd889
    • Arnaldo Carvalho de Melo's avatar
      perf trace beauty: Add BPF augmenter for the 'rename' syscall · cfa9ac73
      Arnaldo Carvalho de Melo authored
      I.e. two strings:
      
        # perf trace -e rename
        systemd/1 rename("/run/systemd/units/.#invocation:dnf-makecache.service970761b7f2840dcc", "/run/systemd/units/invocation:dnf-makecache.service") = 0
        systemd-journa/715 rename("/run/systemd/journal/streams/.#9:17539785BJDblc", "/run/systemd/journal/streams/9:17539785") = 0
        mv/1936 rename("/tmp/build/perf/fd/.array.o.tmp", "/tmp/build/perf/fd/.array.o.cmd") = 0
        sh/1949 rename("/tmp/build/perf/.cpu.o.tmp", "/tmp/build/perf/.cpu.o.cmd") = 0
        mv/1954 rename("/tmp/build/perf/fs/.tracing_path.o.tmp", "/tmp/build/perf/fs/.tracing_path.o.cmd") = 0
        mv/1963 rename("/tmp/build/perf/common-cmds.h+", "/tmp/build/perf/common-cmds.h") = 0
        :1975/1975 rename("/tmp/build/perf/.exec-cmd.o.tmp", "/tmp/build/perf/.exec-cmd.o.cmd") = 0
        mv/1979 rename("/tmp/build/perf/fs/.fs.o.tmp", "/tmp/build/perf/fs/.fs.o.cmd") = 0
        mv/2005 rename("/tmp/build/perf/.debug.o.tmp", "/tmp/build/perf/.debug.o.cmd") = 0
        mv/2012 rename("/tmp/build/perf/.str_error_r.o.tmp", "/tmp/build/perf/.str_error_r.o.cmd") = 0
        mv/2019 rename("/tmp/build/perf/.help.o.tmp", "/tmp/build/perf/.help.o.cmd") = 0
        mv/2031 rename("/tmp/build/perf/.trace-seq.o.tmp", "/tmp/build/perf/.trace-seq.o.cmd") = 0
        make/2038  ... [continued]: rename())             = 0
        :2038/2038 rename("/tmp/build/perf/.event-plugin.o.tmp", "/tmp/build/perf/.event-plugin.o.cmd") ...
        ar/2035 rename("/tmp/build/perf/stzwBX3a", "/tmp/build/perf/libapi.a") = 0
        mv/2051 rename("/tmp/build/perf/.parse-utils.o.tmp", "/tmp/build/perf/.parse-utils.o.cmd") = 0
        mv/2069 rename("/tmp/build/perf/.subcmd-config.o.tmp", "/tmp/build/perf/.subcmd-config.o.cmd") = 0
        make/2080 rename("/tmp/build/perf/.parse-filter.o.tmp", "/tmp/build/perf/.parse-filter.o.cmd") = 0
        mv/2099 rename("/tmp/build/perf/.pager.o.tmp", "/tmp/build/perf/.pager.o.cmd") = 0
        :2124/2124 rename("/tmp/build/perf/.sigchain.o.tmp", "/tmp/build/perf/.sigchain.o.cmd") = 0
        make/2140 rename("/tmp/build/perf/.event-parse.o.tmp", "/tmp/build/perf/.event-parse.o.cmd") = 0
        mv/2164 rename("/tmp/build/perf/.kbuffer-parse.o.tmp", "/tmp/build/perf/.kbuffer-parse.o.cmd") = 0
        sh/2174 rename("/tmp/build/perf/.run-command.o.tmp", "/tmp/build/perf/.run-command.o.cmd") = 0
        mv/2190 rename("/tmp/build/perf/.tep_strerror.o.tmp", "/tmp/build/perf/.tep_strerror.o.cmd") = 0
        :2261/2261 rename("/tmp/build/perf/.event-parse-api.o.tmp", "/tmp/build/perf/.event-parse-api.o.cmd") = 0
        :2480/2480 rename("/tmp/build/perf/stLv3kG2", "/tmp/build/perf/libtraceevent.a") = 0
        ^C#
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-6hh2rl27uri6gsxhmk6q3hx5@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      cfa9ac73
    • Arnaldo Carvalho de Melo's avatar
      perf trace beauty: Beautify bind's sockaddr arg · 247dd65b
      Arnaldo Carvalho de Melo authored
      By reusing the "connect" BPF collector.
      
      Testing it system wide and stopping/starting sshd:
      
        # perf trace -e bind
        LLVM: dumping /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o
        DNS Res~er #18/15132 bind(243, { .family: PF_NETLINK }, 12)  = 0
        DNS Res~er #19/4833 bind(247, { .family: PF_NETLINK }, 12)  = 0
        DNS Res~er #19/4833 bind(238, { .family: PF_NETLINK }, 12)  = 0
        DNS Res~er #18/15132 bind(243, { .family: PF_NETLINK }, 12)  = 0
        DNS Res~er #18/10327 bind(258, { .family: PF_NETLINK }, 12)  = 0
        :6507/6507 bind(24, { .family: PF_NETLINK }, 12)   = 0
        DNS Res~er #19/4833 bind(238, { .family: PF_NETLINK }, 12)  = 0
        DNS Res~er #18/15132 bind(242, { .family: PF_NETLINK }, 12)  = 0
        sshd/6514 bind(3, { .family: PF_NETLINK }, 12)    = 0
        sshd/6514 bind(5, { .family: PF_INET, port: 22, addr: 0.0.0.0 }, 16) = 0
        sshd/6514 bind(7, { .family: PF_INET6, port: 22, addr: :: }, 28) = 0
        DNS Res~er #18/10327 bind(229, { .family: PF_NETLINK }, 12)  = 0
        DNS Res~er #18/15132 bind(231, { .family: PF_NETLINK }, 12)  = 0
        DNS Res~er #19/4833 bind(229, { .family: PF_NETLINK }, 12)  = 0
        ^C#
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-m2hmxqrckxxw2ciki0tu889u@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      247dd65b
    • Arnaldo Carvalho de Melo's avatar
      perf trace beauty: Beautify 'sendto's sockaddr arg · 3c475bc0
      Arnaldo Carvalho de Melo authored
      By just writing the collector in the augmented_raw_syscalls.c BPF
      program:
      
        # perf trace -e sendto
        <SNIP>
        ping/23492 sendto(3, 0x56253bbef700, 64, NONE, { .family: PF_INET, port: 0, addr: 10.10.161.32 }, 0x10) = 64
        ping/23492 sendto(3, 0x56253bbef700, 64, NONE, { .family: PF_INET, port: 0, addr: 10.10.161.32 }, 0x10) = 64
        ping/23492 sendto(3, 0x56253bbef700, 64, NONE, { .family: PF_INET, port: 0, addr: 10.10.161.32 }, 0x10) = 64
        ping/23492 sendto(3, 0x56253bbef700, 64, NONE, { .family: PF_INET, port: 0, addr: 10.10.161.32 }, 0x10) = 64
        Socket Thread/3573 sendto(247, 0x7fb32d49c000, 120, NONE, { .family: PF_UNSPEC }, NULL) = 120
        DNS Res~er #18/11374 sendto(242, 0x7fb342cfe420, 20, NONE, { .family: PF_NETLINK }, 0xc) = 20
        DNS Res~er #18/11374 sendto(242, 0x7fb342cfcca0, 42, MSG_NOSIGNAL, { .family: PF_UNSPEC }, NULL) = 42
        DNS Res~er #18/11374 sendto(242, 0x7fb342cfcccc, 42, MSG_NOSIGNAL, { .family: PF_UNSPEC }, NULL) = 42
        ping/23492 sendto(3, 0x56253bbef700, 64, NONE, { .family: PF_INET, port: 0, addr: 10.10.161.32 }, 0x10) = 64
        Socket Thread/3573 sendto(242, 0x7fb308bb1c08, 296, NONE, { .family: PF_UNSPEC }, NULL) = 296
        ping/23492 sendto(3, 0x56253bbef700, 64, NONE, { .family: PF_INET, port: 0, addr: 10.10.161.32 }, 0x10) = 64
        ping/23492 sendto(3, 0x56253bbef700, 64, NONE, { .family: PF_INET, port: 0, addr: 10.10.161.32 }, 0x10) = 64
        ping/23492 sendto(3, 0x56253bbef700, 64, NONE, { .family: PF_INET, port: 0, addr: 10.10.161.32 }, 0x10) = 64
        ping/23492 sendto(3, 0x56253bbef700, 64, NONE, { .family: PF_INET, port: 0, addr: 10.10.161.32 }, 0x10) = 64
        ^C
        #
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-p0l0rlvq19v5zf8qc2x2itow@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      3c475bc0
    • Arnaldo Carvalho de Melo's avatar
      perf trace beauty: Do not try to use the fd->pathname beautifier for bind/connect fd arg · ef969ca6
      Arnaldo Carvalho de Melo authored
      Doesn't make sense and also we now beautify the sockaddr, which provides
      enough info:
      
        # trace -e close,socket,connec* ssh www.bla.com
        <SNIP>
        close(5)                                = 0
        socket(PF_INET, SOCK_DGRAM|CLOEXEC|NONBLOCK, IPPROTO_IP) = 5
        connect(5, { .family: PF_INET, port: 53, addr: 192.168.44.1 }, 16) = 0
        close(5)                                = 0
        socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 5
        ^C#
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-h9drpb7ail808d2mh4n7tla4@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      ef969ca6
    • Arnaldo Carvalho de Melo's avatar
      perf trace beauty: Disable fd->pathname when close() not enabled · 79d725cd
      Arnaldo Carvalho de Melo authored
      As we invalidate the fd->pathname table in the SCA_CLOSE_FD beautifier,
      if we don't have it we may end up keeping an fd->pathname association
      that then gets misprinted.
      
      The previous behaviour continues when the close() syscall is enabled,
      which may still be a a problem if we lose records (i.e. we may lose a
      'close' record and then get that fd reused by socket()) but then the
      tool will notify that records are being lost and the user will be warned
      that some of the heuristics will fall apart.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-b7t6h8sq9lebemvfy2zh3qq1@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      79d725cd
    • Arnaldo Carvalho de Melo's avatar
      perf trace beauty: Make connect's addrlen be printed as an int, not hex · 1d862752
      Arnaldo Carvalho de Melo authored
        # perf trace -e connec* ssh www.bla.com
        connect(3</var/lib/sss/mc/passwd>, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        connect(3</var/lib/sss/mc/passwd>, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        connect(4<socket:[16610959]>, { .family: PF_LOCAL, path: /var/lib/sss/pipes/nss }, 110) = 0
        connect(7, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        connect(7, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        connect(5, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        connect(5</usr/lib64/libnss_mdns4_minimal.so.2>, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        connect(5</usr/lib64/libnss_mdns4_minimal.so.2>, { .family: PF_INET, port: 53, addr: 192.168.44.1 }, 16) = 0
        connect(5</usr/lib64/libnss_mdns4_minimal.so.2>, { .family: PF_INET, port: 22, addr: 146.112.61.108 }, 16) = 0
        connect(5</usr/lib64/libnss_mdns4_minimal.so.2>, { .family: PF_INET6, port: 22, addr: ::ffff:146.112.61.108 }, 28) = 0
        ^Cconnect(5</usr/lib64/libnss_mdns4_minimal.so.2>, { .family: PF_INET, port: 22, addr: 146.112.61.108 }, 16) = -1 (unknown) (INTERNAL ERROR: strerror_r(512, [buf], 128)=22)
        #
      
      Argh, the SCA_FD needs to invalidate its cache when close is done...
      
      It works if the 'close' syscall is not filtered out ;-\
      
        # perf trace -e close,connec* ssh www.bla.com
        close(3)                                = 0
        close(3</usr/lib64/libpcre2-8.so.0.8.0>) = 0
        close(3)                                = 0
        close(3</usr/lib64/libkrb5.so.3.3>)     = 0
        close(3</usr/lib64/libkrb5.so.3.3>)     = 0
        close(3)                                = 0
        close(3</usr/lib64/libk5crypto.so.3.1>) = 0
        close(3</usr/lib64/libk5crypto.so.3.1>) = 0
        close(3</usr/lib64/libcom_err.so.2.1>)  = 0
        close(3</usr/lib64/libcom_err.so.2.1>)  = 0
        close(3)                                = 0
        close(3</usr/lib64/libkrb5support.so.0.1>) = 0
        close(3</usr/lib64/libkrb5support.so.0.1>) = 0
        close(3</usr/lib64/libkeyutils.so.1.8>) = 0
        close(3</usr/lib64/libkeyutils.so.1.8>) = 0
        close(3)                                = 0
        close(3)                                = 0
        close(3)                                = 0
        close(3)                                = 0
        close(4)                                = 0
        close(3)                                = 0
        close(3)                                = 0
        connect(3</etc/nsswitch.conf>, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        close(3</etc/nsswitch.conf>)            = 0
        connect(3</usr/lib64/libnss_sss.so.2>, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
        close(3</usr/lib64/libnss_sss.so.2>)    = 0
        close(3</usr/lib64/libnss_sss.so.2>)    = 0
        close(3)                                = 0
        close(3)                                = 0
        connect(4<socket:[16616519]>, { .family: PF_LOCAL, path: /var/lib/sss/pipes/nss }, 110) = 0
        ^C
        #
      
      Will disable this beautifier when 'close' is filtered out...
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-ekuiciyx4znchvy95c8p1yyi@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      1d862752
    • Arnaldo Carvalho de Melo's avatar
      perf augmented_raw_syscalls: Augment sockaddr arg in 'connect' · 212b9ab6
      Arnaldo Carvalho de Melo authored
      We already had a beautifier for an augmented sockaddr payload, but that
      was when we were hooking on each syscalls:sys_enter_foo tracepoints,
      since now we're almost doing that by doing a tail call from
      raw_syscalls:sys_enter, its almost the same, we can reuse it straight
      away.
      
        # perf trace -e connec* ssh www.bla.com
        connect(3</var/lib/sss/mc/passwd>, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 0x6e) = -1 ENOENT (No such file or directory)
        connect(3</var/lib/sss/mc/passwd>, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 0x6e) = -1 ENOENT (No such file or directory)
        connect(4<socket:[16604782]>, { .family: PF_LOCAL, path: /var/lib/sss/pipes/nss }, 0x6e) = 0
        connect(7, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 0x6e) = -1 ENOENT (No such file or directory)
        connect(7, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 0x6e) = -1 ENOENT (No such file or directory)
        connect(5</etc/hosts>, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 0x6e) = -1 ENOENT (No such file or directory)
        connect(5</etc/hosts>, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 0x6e) = -1 ENOENT (No such file or directory)
        connect(5</etc/hosts>, { .family: PF_INET, port: 53, addr: 192.168.44.1 }, 0x10) = 0
        connect(5</etc/hosts>, { .family: PF_INET, port: 22, addr: 146.112.61.108 }, 0x10) = 0
        connect(5</etc/hosts>, { .family: PF_INET6, port: 22, addr: ::ffff:146.112.61.108 }, 0x1c) = 0
        ^C#
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-5xkrbcpjsgnr3zt1aqdd7nvc@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      212b9ab6
    • Arnaldo Carvalho de Melo's avatar
      perf augmented_raw_syscalls: Rename augmented_args_filename to augmented_args_payload · 6f563674
      Arnaldo Carvalho de Melo authored
      It'll get other stuff in there than just filenames, starting with
      sockaddr for 'connect' and 'bind'.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-bsexidtsn91ehdpzcd6n5fm9@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      6f563674
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Look for default name for entries in the syscalls prog array · 8b8044e5
      Arnaldo Carvalho de Melo authored
      I.e. just look for "!syscalls:sys_enter_" or "exit_" plus the syscall
      name, that way we need just to add entries to the
      augmented_raw_syscalls.c BPF source to add handlers.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-6xavwddruokp6ohs7tf4qilb@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      8b8044e5
    • Arnaldo Carvalho de Melo's avatar
      perf augmented_raw_syscalls: Support copying two string syscall args · 8d5da264
      Arnaldo Carvalho de Melo authored
      Starting with the renameat and renameat2 syscall, that both receive as
      second and fourth parameters a pathname:
      
        # perf trace -e rename* mv one ANOTHER
        LLVM: dumping /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o
        mv: cannot stat 'one': No such file or directory
        renameat2(AT_FDCWD, "one", AT_FDCWD, "ANOTHER", RENAME_NOREPLACE) = -1 ENOENT (No such file or directory)
        #
      
      Since the per CPU scratch buffer map has space for two maximum sized
      pathnames, the verifier is satisfied that there will be no overrun.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-x2uboyg5kx2wqeru288209b6@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      8d5da264
    • Arnaldo Carvalho de Melo's avatar
      perf augmented_raw_syscalls: Switch to using BPF_MAP_TYPE_PROG_ARRAY · bf134ca6
      Arnaldo Carvalho de Melo authored
      Trying to control what arguments to copy, which ones were strings, etc
      all from userspace via maps went nowhere, lots of difficulties to get
      the verifier satisfied, so use what the fine BPF guys designed for such
      a syscall handling mechanism: bpf_tail_call + BPF_MAP_TYPE_PROG_ARRAY.
      
      The series leading to this should have explained it thoroughly, but the
      end result, explained via gdb should help understand this:
      
        Breakpoint 1, syscall_arg__scnprintf_filename (bf=0xc002b1 "", size=2031, arg=0x7fffffff7970) at builtin-trace.c:1268
        1268	{
        (gdb) n
        1269		unsigned long ptr = arg->val;
        (gdb) n
        1271		if (arg->augmented.args)
        (gdb) n
        1272			return syscall_arg__scnprintf_augmented_string(arg, bf, size);
        (gdb) s
        syscall_arg__scnprintf_augmented_string (arg=0x7fffffff7970, bf=0xc002b1 "", size=2031) at builtin-trace.c:1251
        1251	{
        (gdb) n
        1252		struct augmented_arg *augmented_arg = arg->augmented.args;
        (gdb) n
        1253		size_t printed = scnprintf(bf, size, "\"%.*s\"", augmented_arg->size, augmented_arg->value);
        (gdb) n
        1258		int consumed = sizeof(*augmented_arg) + augmented_arg->size;
        (gdb) p bf
        $1 = 0xc002b1 "\"/etc/ld.so.cache\""
        (gdb) bt
        #0  syscall_arg__scnprintf_augmented_string (arg=0x7fffffff7970, bf=0xc002b1 "\"/etc/ld.so.cache\"", size=2031) at builtin-trace.c:1258
        #1  0x0000000000492634 in syscall_arg__scnprintf_filename (bf=0xc002b1 "\"/etc/ld.so.cache\"", size=2031, arg=0x7fffffff7970) at builtin-trace.c:1272
        #2  0x0000000000493cd7 in syscall__scnprintf_val (sc=0xc0de68, bf=0xc002b1 "\"/etc/ld.so.cache\"", size=2031, arg=0x7fffffff7970, val=140737354091036) at builtin-trace.c:1689
        #3  0x000000000049404f in syscall__scnprintf_args (sc=0xc0de68, bf=0xc002a7 "AT_FDCWD, \"/etc/ld.so.cache\"", size=2041, args=0x7ffff6cbf1ec "\234\377\377\377", augmented_args=0x7ffff6cbf21c, augmented_args_size=28, trace=0x7fffffffa170,
            thread=0xbff940) at builtin-trace.c:1756
        #4  0x0000000000494a97 in trace__sys_enter (trace=0x7fffffffa170, evsel=0xbe1900, event=0x7ffff6cbf1a0, sample=0x7fffffff7b00) at builtin-trace.c:1975
        #5  0x0000000000496ff1 in trace__handle_event (trace=0x7fffffffa170, event=0x7ffff6cbf1a0, sample=0x7fffffff7b00) at builtin-trace.c:2685
        #6  0x0000000000497edb in __trace__deliver_event (trace=0x7fffffffa170, event=0x7ffff6cbf1a0) at builtin-trace.c:3029
        #7  0x000000000049801e in trace__deliver_event (trace=0x7fffffffa170, event=0x7ffff6cbf1a0) at builtin-trace.c:3056
        #8  0x00000000004988de in trace__run (trace=0x7fffffffa170, argc=2, argv=0x7fffffffd660) at builtin-trace.c:3258
        #9  0x000000000049c2d3 in cmd_trace (argc=2, argv=0x7fffffffd660) at builtin-trace.c:4220
        #10 0x00000000004dcb6c in run_builtin (p=0xa18e00 <commands+576>, argc=5, argv=0x7fffffffd660) at perf.c:304
        #11 0x00000000004dcdd9 in handle_internal_command (argc=5, argv=0x7fffffffd660) at perf.c:356
        #12 0x00000000004dcf20 in run_argv (argcp=0x7fffffffd4bc, argv=0x7fffffffd4b0) at perf.c:400
        #13 0x00000000004dd28c in main (argc=5, argv=0x7fffffffd660) at perf.c:522
        (gdb)
        (gdb) continue
        Continuing.
        openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
      
      Now its a matter of automagically assigning the BPF programs copying
      syscall arg pointers to functions that are "open"-like (i.e. that need
      only the first syscall arg copied as a string), or "openat"-like (2nd
      arg, etc).
      
      End result in tool output:
      
        # perf trace -e open* ls /tmp/notthere
        LLVM: dumping /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o
        openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
        openat(AT_FDCWD, "/lib64/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
        openat(AT_FDCWD, "/lib64/libcap.so.2", O_RDONLY|O_CLOEXEC) = 3
        openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
        openat(AT_FDCWD, "/lib64/libpcre2-8.so.0", O_RDONLY|O_CLOEXEC) = 3
        openat(AT_FDCWD, "/lib64/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
        openat(AT_FDCWD, "/lib64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
        openat(AT_FDCWD, "", O_RDONLY|O_CLOEXEC) = 3
        openat(AT_FDCWD, "/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 3
        openat(AT_FDCWD, "/usr/share/locale/en_US.UTF-8/LC_MESSAGES/coreutils.mo", O_RDONLY) = ls: cannot access '/tmp/notthere'-1 ENOENT (No such file or directory)
        openat(AT_FDCWD, "/usr/share/locale/en_US.utf8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
        openat(AT_FDCWD, "/usr/share/locale/en_US/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
        openat(AT_FDCWD, "/usr/share/locale/en.UTF-8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
        openat(AT_FDCWD, "/usr/share/locale/en.utf8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
        openat(AT_FDCWD, "/usr/share/locale/en/LC_MESSAGES/coreutils.mo", O_RDONLY: No such file or directory) =
        -1 ENOENT (No such file or directory)
        openat(AT_FDCWD, "/usr/share/locale/en_US.UTF-8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
        openat(AT_FDCWD, "/usr/share/locale/en_US.utf8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
        openat(AT_FDCWD, "/usr/share/locale/en_US/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
        openat(AT_FDCWD, "/usr/share/locale/en.UTF-8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
        openat(AT_FDCWD, "/usr/share/locale/en.utf8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
        openat(AT_FDCWD, "/usr/share/locale/en/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
        #
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-snc7ry99cl6r0pqaspjim98x@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      bf134ca6
    • Arnaldo Carvalho de Melo's avatar
      perf augmented_raw_syscalls: Add handler for "openat" · 236dd583
      Arnaldo Carvalho de Melo authored
      I.e. for a syscall that has its second argument being a string, its
      difficult these days to find 'open' being used in the wild :-)
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-yf3kbzirqrukd3fb2sp5qx4p@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      236dd583
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Handle raw_syscalls:sys_enter just like the BPF_OUTPUT augmented event · b119970a
      Arnaldo Carvalho de Melo authored
      So, we use a PERF_COUNT_SW_BPF_OUTPUT to output the augmented sys_enter
      payload, i.e. to output more than just the raw syscall args, and if
      something goes wrong when handling an unfiltered syscall, we bail out
      and just return 1 in the bpf program associated with
      raw_syscalls:sys_enter, meaning, don't filter that tracepoint, in which
      case what will appear in the perf ring buffer isn't the BPF_OUTPUT
      event, but the original raw_syscalls:sys_enter event with its normal
      payload.
      
      Now that we're switching to using a bpf_tail_call +
      BPF_MAP_TYPE_PROG_ARRAY we're going to use this in the common case, so a
      bug where raw_syscalls:sys_enter wasn't being handled by
      trace__sys_enter() surfaced and for  that case, instead of using the
      strace-like augmenter (trace__sys_enter()), we continued to use the
      normal generic tracepoint handler:
      
        (gdb) p evsel
        $2 = (struct perf_evsel *) 0xc03e40
        (gdb) p evsel->name
        $3 = 0xbc56c0 "raw_syscalls:sys_enter"
        (gdb) p ((struct perf_evsel *) 0xc03e40)->name
        $4 = 0xbc56c0 "raw_syscalls:sys_enter"
        (gdb) p ((struct perf_evsel *) 0xc03e40)->handler
        $5 = (void *) 0x495eb3 <trace__event_handler>
      
      This resulted in this:
      
           0.027 raw_syscalls:sys_enter:NR 12 (0, 7fcfcac64c9b, 4d, 7fcfcac64c9b, 7fcfcac6ce00, 19)
           ... [continued]: brk())                = 0x563b88677000
      
      I.e. only the sys_exit tracepoint was being properly handled, but since
      the sys_enter went to the generic trace__event_handler() we printed it
      using libtraceevent's formatter instead of 'perf trace's strace-like
      one.
      
      Fix it by setting trace__sys_enter() as the handler for
      raw_syscalls:sys_enter and setup the tp_field tracepoint field
      accessors.
      
      Now, to test it we just make raw_syscalls:sys_enter return 1 right after
      checking if the pid is filtered, making it not use
      bpf_perf_output_event() but rather ask for the tracepoint not to be
      filtered and the result is the expected one:
      
        brk(NULL)                               = 0x556f42d6e000
      
      I.e. raw_syscalls:sys_enter returns 1, gets handled by
      trace__sys_enter() and gets it combined with the raw_syscalls:sys_exit
      in a strace-like way.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-0mkocgk31nmy0odknegcby4z@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      b119970a
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Put the per-syscall entry/exit prog_array BPF map infrastructure in place · 3803a229
      Arnaldo Carvalho de Melo authored
      I.e. look for "syscalls_sys_enter" and "syscalls_sys_exit" BPF maps of
      type PROG_ARRAY and populate it with the handlers as specified per
      syscall, for now only 'open' is wiring it to something, in time all
      syscalls that need to copy arguments entering a syscall or returning
      from one will set these to the right handlers, reusing when possible
      pre-existing ones.
      
      Next step is to use bpf_tail_call() into that.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-t0p4u43i9vbpzs1xtowna3gb@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      3803a229
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Allow specifying the bpf prog to augment specific syscalls · 6ff8fff4
      Arnaldo Carvalho de Melo authored
      This is a step in the direction of being able to use a
      BPF_MAP_TYPE_PROG_ARRAY to handle syscalls that need to copy pointer
      payloads in addition to the raw tracepoint syscall args.
      
      There is a first example in
      tools/perf/examples/bpf/augmented_raw_syscalls.c for the 'open' syscall.
      
      Next step is to introduce the prog array map and use this 'open'
      augmenter, then use that augmenter in other syscalls that also only copy
      the first arg as a string, and then show how to use with a syscall that
      reads more than one filename, like 'rename', etc.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-pys4v57x5qqrybb4cery2mc8@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      6ff8fff4
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Add BPF handler for unaugmented syscalls · 5834da7f
      Arnaldo Carvalho de Melo authored
      Will be used to assign to syscalls that don't need augmentation, i.e.
      those with just integer args.
      
      All syscalls will be in a BPF_MAP_TYPE_PROG_ARRAY, and the
      bpf_tail_call() keyed by the syscall id will either find nothing in
      place, which means the syscall is being filtered, or a function that
      will either add things like filenames to the ring buffer, right after
      the raw syscall args, or be this unaugmented handler that will just
      return 1, meaning don't filter the original
      raw_syscalls:sys_{enter,exit} tracepoint.
      
      For now it is not really being used, this is just leg work to break the
      patch into smaller pieces.
      
      It introduces a trace__find_bpf_program_by_title() helper that in turn
      uses libbpf's bpf_object__find_program_by_title() on the BPF object with
      the __augmented_syscalls__ map. "title" is how libbpf calls the SEC()
      argument for functions, i.e. the ELF section that follows a convention
      to specify what BPF program (a function with this SEC() marking) should
      be connected to which tracepoint, kprobes, etc.
      
      In perf anything that is of the form SEC("sys:event_name") will be
      connected to that tracepoint by perf's BPF loader.
      
      In this case its something that will be bpf_tail_call()ed from either
      the "raw_syscalls:sys_enter" or "raw_syscall:sys_exit" tracepoints, so
      its named "!raw_syscalls:unaugmented" to convey that idea, i.e. its not
      going to be directly attached to a tracepoint, thus it starts with a
      "!".
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-meucpjx2u0slpkayx56lxqq6@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      5834da7f
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Order -e syscalls table · 83e69b92
      Arnaldo Carvalho de Melo authored
      The ev_qualifier is an array with the syscall ids passed via -e on the
      command line, sort it as we'll search it when setting up the
      BPF_MAP_TYPE_PROG_ARRAY.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-c8hprylp3ai6e0z9burn2r3s@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      83e69b92
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Look up maps just on the __augmented_syscalls__ BPF object · 5ca0b7f5
      Arnaldo Carvalho de Melo authored
      We can conceivably have multiple BPF object files for other purposes, so
      better look just on the BPF object containing the __augmented_syscalls__
      map for all things augmented_syscalls related.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Brendan Gregg <brendan.d.gregg@gmail.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-3jt8knkuae9lt705r1lns202@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      5ca0b7f5
    • Arnaldo Carvalho de Melo's avatar
      perf trace: Add pointer to BPF object containing __augmented_syscalls__ · c8c80570
      Arnaldo Carvalho de Melo authored
      So that we can use it when looking for other components of that object
      file, such as other programs to add to the BPF_MAP_TYPE_PROG_ARRAY and
      use with bpf_tail_call().
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-1ibmz7ouv6llqxajy7m8igtd@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      c8c80570
    • Arnaldo Carvalho de Melo's avatar
      perf evsel: Store backpointer to attached bpf_object · af4a0991
      Arnaldo Carvalho de Melo authored
      We may want to get to this bpf_object, to search for other BPF programs,
      etc.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-3y8hrb6lszjfi23vjlic3cib@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      af4a0991
    • Arnaldo Carvalho de Melo's avatar
      perf bpf: Do not attach a BPF prog to a tracepoint if its name starts with ! · 2620b7e3
      Arnaldo Carvalho de Melo authored
      With BPF_MAP_TYPE_PROG_ARRAY + bpf_tail_call() we want to have BPF
      programs, i.e. functions in a object file that perf's BPF loader
      shouldn't try to attach to anything, i.e. "!syscalls:sys_enter_open"
      should just stay there, not be attached to a tracepoint with that name,
      it'll be used by, for instance, 'perf trace' to associate with syscalls
      that copy, in addition to the syscall raw args, a filename pointed by
      the first arg, i.e. multiple syscalls that need copying the same pointer
      arg in the same way, as a filename, for instance, will share the same
      BPF program/function.
      
      Right now when perf's BPF loader sees a function with a name
      "sys:name" it'll look for a tracepoint and will associate that BPF
      program with it, say:
      
        SEC("raw_syscalls:sys_enter")
        int sys_enter(struct syscall_enter_args *args)
        {
           //SNIP
        }
      
      Will crate a perf_evsel tracepoint event and then associate with it that
      BPF program.
      
      This convention at some point will switch to the one used by the BPF
      loader in libbpf, but to experiment with BPF_MAP_TYPE_PROG_ARRAY in
      'perf trace' lets do this, that will not require changing too much
      stuff.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-lk6dasjr1yf9rtvl292b2hpc@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      2620b7e3
    • Arnaldo Carvalho de Melo's avatar
      perf include bpf: Add bpf_tail_call() prototype · 941a7658
      Arnaldo Carvalho de Melo authored
      Will be used together with BPF_MAP_TYPE_PROG_ARRAY in
      tools/perf/examples/bpf/augmented_raw_syscalls.c.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-pd1bpy8i31nta6jqwdex871g@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      941a7658
    • Ingo Molnar's avatar
      Merge tag 'perf-urgent-for-mingo-5.3-20190729' of... · b3c303be
      Ingo Molnar authored
      Merge tag 'perf-urgent-for-mingo-5.3-20190729' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent
      
      Pull perf/urgent fixes from Arnaldo Carvalho de Melo:
      
      perf header:
      
        Vince Weaver:
      
        - Fix divide by zero error if f_header.attr_size==0, found using a perf tool fuzzer.
      
        Numfor Mbiziwo-Tiapo:
      
        - Silence use of uninitialized value warning pointed out by clang's MSAN tool.
      
      libbpf:
      
        Andrii Nakryiko:
      
        - Fix missing __WORDSIZE definition in some systems, such as musl libc (Alpine Linux).
      
      tools header UAPI:
      
        Arnaldo Carvalho de Melo:
      
        - Sync headers to address perf build warnings:
      
          - syscalls_64.tbl and generic unistd.h to pick up clone3 and pidfd_open.
      
          - With new ioctls: kvm.h, drm.h and usbdevice_fs.h.
      
          - No tooling change: mman.h, sched.h and if_link.h.
      
      Documentation:
      
        Vince Weaver:
      
        - Fix perf.data documentation units for memory size, its kB, not bytes.
      Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      b3c303be
    • Linus Torvalds's avatar
      Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost · 2a11c76e
      Linus Torvalds authored
      Pull virtio/vhost fixes from Michael Tsirkin:
      
       - Fixes in the iommu and balloon devices.
      
       - Disable the meta-data optimization for now - I hope we can get it
         fixed shortly, but there's no point in making users suffer crashes
         while we are working on that.
      
      * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
        vhost: disable metadata prefetch optimization
        iommu/virtio: Update to most recent specification
        balloon: fix up comments
        mm/balloon_compaction: avoid duplicate page removal
      2a11c76e
    • Linus Torvalds's avatar
      Merge tag 'platform-drivers-x86-v5.3-3' of git://git.infradead.org/linux-platform-drivers-x86 · 45aee68e
      Linus Torvalds authored
      Pull x86 platform driver fixes from Andy Shevchenko:
       "Business as usual, a few fixes and new IDs:
      
         - PC Engines APU got one fix for software dependencies to
           automatically load them and another fix for mapping of key button
           in the front to issue restart event.
      
         - OLPC driver is now probed automatically based on module device
           table.
      
         - Intel PMC core driver supports Intel Ice Lake NNPI processor.
      
         - WMI driver missed description of a new field in the structure that
           has been added"
      
      * tag 'platform-drivers-x86-v5.3-3' of git://git.infradead.org/linux-platform-drivers-x86:
        platform/x86: pcengines-apuv2: use KEY_RESTART for front button
        platform/x86: intel_pmc_core: Add ICL-NNPI support to PMC Core
        Platform: OLPC: add SPI MODULE_DEVICE_TABLE
        platform/x86: wmi: add missing struct parameter description
        platform/x86: pcengines-apuv2: Fix softdep statement
      45aee68e
    • Enrico Weigelt's avatar
      platform/x86: pcengines-apuv2: use KEY_RESTART for front button · f14312a9
      Enrico Weigelt authored
      The keycode KEY_RESTART is more appropriate for the front button,
      as most people use it for things like restart or factory reset.
      Signed-off-by: default avatarEnrico Weigelt <info@metux.net>
      Fixes: f8eb0235 ("x86: pcengines apuv2 gpio/leds/keys platform driver")
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      f14312a9
    • Andrii Nakryiko's avatar
      libbpf: fix missing __WORDSIZE definition · 8aa259b1
      Andrii Nakryiko authored
      hashmap.h depends on __WORDSIZE being defined. It is defined by
      glibc/musl in different headers. It's an explicit goal for musl to be
      "non-detectable" at compilation time, so instead include glibc header if
      glibc is explicitly detected and fall back to musl header otherwise.
      Reported-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarAndrii Nakryiko <andriin@fb.com>
      Tested-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Alexei Starovoitov <ast@fb.com>
      Cc: Andrii Nakryiko <andrii.nakryiko@gmail.com>
      Cc: Daniel Borkmann <daniel@iogearbox.net>
      Fixes: e3b92422 ("libbpf: add resizable non-thread safe internal hashmap")
      Link: https://lkml.kernel.org/r/20190718173021.2418606-1-andriin@fb.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      8aa259b1
    • Vince Weaver's avatar
      perf tools: Fix perf.data documentation units for memory size · 2e9a06dd
      Vince Weaver authored
      The perf.data-file-format documentation incorrectly says the
      HEADER_TOTAL_MEM results are in bytes.  The results are in kilobytes
      (perf reads the value from /proc/meminfo)
      Signed-off-by: default avatarVince Weaver <vincent.weaver@maine.edu>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1907251155500.22624@macbook-airSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      2e9a06dd
    • Numfor Mbiziwo-Tiapo's avatar
      perf header: Fix use of unitialized value warning · 20f9781f
      Numfor Mbiziwo-Tiapo authored
      When building our local version of perf with MSAN (Memory Sanitizer) and
      running the perf record command, MSAN throws a use of uninitialized
      value warning in "tools/perf/util/util.c:333:6".
      
      This warning stems from the "buf" variable being passed into "write".
      It originated as the variable "ev" with the type union perf_event*
      defined in the "perf_event__synthesize_attr" function in
      "tools/perf/util/header.c".
      
      In the "perf_event__synthesize_attr" function they allocate space with a malloc
      call using ev, then go on to only assign some of the member variables before
      passing "ev" on as a parameter to the "process" function therefore "ev"
      contains uninitialized memory. Changing the malloc call to zalloc to initialize
      all the members of "ev" which gets rid of the warning.
      
      To reproduce this warning, build perf by running:
      make -C tools/perf CLANG=1 CC=clang EXTRA_CFLAGS="-fsanitize=memory\
       -fsanitize-memory-track-origins"
      
      (Additionally, llvm might have to be installed and clang might have to
      be specified as the compiler - export CC=/usr/bin/clang)
      
      then running:
      tools/perf/perf record -o - ls / | tools/perf/perf --no-pager annotate\
       -i - --stdio
      
      Please see the cover letter for why false positive warnings may be
      generated.
      Signed-off-by: default avatarNumfor Mbiziwo-Tiapo <nums@google.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Ian Rogers <irogers@google.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Mark Drayton <mbd@fb.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Song Liu <songliubraving@fb.com>
      Cc: Stephane Eranian <eranian@google.com>
      Link: http://lkml.kernel.org/r/20190724234500.253358-2-nums@google.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      20f9781f
    • Vince Weaver's avatar
      perf header: Fix divide by zero error if f_header.attr_size==0 · 7622236c
      Vince Weaver authored
      So I have been having lots of trouble with hand-crafted perf.data files
      causing segfaults and the like, so I have started fuzzing the perf tool.
      
      First issue found:
      
      If f_header.attr_size is 0 in the perf.data file, then perf will crash
      with a divide-by-zero error.
      
      Committer note:
      
      Added a pr_err() to tell the user why the command failed.
      Signed-off-by: default avatarVince Weaver <vincent.weaver@maine.edu>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1907231100440.14532@macbook-airSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      7622236c
    • Arnaldo Carvalho de Melo's avatar
      tools headers UAPI: Sync if_link.h with the kernel · e54599c9
      Arnaldo Carvalho de Melo authored
      To pick the changes in:
      
        07a4ddec ("bonding: add an option to specify a delay between peer notifications")
      
      And silence this build warning:
      
        Kernel ABI header at 'tools/include/uapi/linux/if_link.h' differs from latest version at 'include/uapi/linux/if_link.h'
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Vincent Bernat <vincent@bernat.ch>
      Link: https://lkml.kernel.org/n/tip-3liw4exxh8goc0rq9xryl2kv@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      e54599c9
    • Arnaldo Carvalho de Melo's avatar
      tools headers UAPI: Sync sched.h with the kernel · c093de6b
      Arnaldo Carvalho de Melo authored
      To get the changes in:
      
        a509a7cd ("sched/uclamp: Extend sched_setattr() to support utilization clamping")
        1d6362fa ("sched/core: Allow sched_setattr() to use the current policy")
        7f192e3c ("fork: add clone3")
      
      And silence this perf build warning:
      
        Warning: Kernel ABI header at 'tools/include/uapi/linux/sched.h' differs from latest version at 'include/uapi/linux/sched.h'
        diff -u tools/include/uapi/linux/sched.h include/uapi/linux/sched.h
      
      No changes in tools/ due to the above.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Christian Brauner <christian@brauner.io>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Patrick Bellasi <patrick.bellasi@arm.com>
      Link: https://lkml.kernel.org/n/tip-mtrpsjrux5hgyr5uf8l1aa46@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      c093de6b
    • Arnaldo Carvalho de Melo's avatar
      tools headers UAPI: Sync usbdevice_fs.h with the kernels to get new ioctl · 0f58163c
      Arnaldo Carvalho de Melo authored
      To get the changes in:
      
        6d101f24 ("USB: add usbfs ioctl to retrieve the connection parameters")
      
      And address this perf build warning:
      
        Warning: Kernel ABI header at 'tools/include/uapi/linux/usbdevice_fs.h' differs from latest version at 'include/uapi/linux/usbdevice_fs.h'
        diff -u tools/include/uapi/linux/usbdevice_fs.h include/uapi/linux/usbdevice_fs.h
      
      Which ends up autogenerating a ioctl_cmd->string table used by 'perf
      trace':
      
        $ tools/perf/trace/beauty/usbdevfs_ioctl.sh > before
        $ cp include/uapi/linux/usbdevice_fs.h tools/include/uapi/linux/usbdevice_fs.h
        $ tools/perf/trace/beauty/usbdevfs_ioctl.sh > after
        $ diff -u before after
        --- before 2019-07-26 15:26:55.513636844 -0300
        +++ after 2019-07-26 15:29:11.650518677 -0300
        @@ -23,6 +23,7 @@
                [2] = "BULK",
                [30] = "DROP_PRIVILEGES",
                [31] = "GET_SPEED",
        +       [32] = "CONNINFO_EX",
                [3] = "RESETEP",
                [4] = "SETINTERFACE",
                [5] = "SETCONFIGURATION",
        $
      
      Now 'perf trace' ioctl beautifier will translate this new ioctl to a
      string and at some point will allow filtering the 'ioctl' syscall with
      something like this in a system wide strace-like sessin:
      
        # perf trace -e ioctl/cmd=USBDEVFS_CONNINFO_EX/
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-tkdfbgzqypwco96b309c0ovd@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      0f58163c
    • Arnaldo Carvalho de Melo's avatar
      tools perf beauty: Fix usbdevfs_ioctl table generator to handle _IOC() · 7ee52615
      Arnaldo Carvalho de Melo authored
      In addition to _IOW() and _IOR(), to handle this case:
      
        #define USBDEVFS_CONNINFO_EX(len)  _IOC(_IOC_READ, 'U', 32, len)
      
      That will happen in the next sync of this header file.
      
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Link: https://lkml.kernel.org/n/tip-3br5e4t64e4lp0goo84che3s@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      7ee52615