• A
    perf trace: Reuse BPF augmenters from syscalls with similar args signature · ad4153f9
    Arnaldo Carvalho de Melo 提交于
    We have an augmenter for the "open" syscall, which has just one pointer,
    in the first argument, a "const char *", so any other syscall that has
    just one pointer and that is the first can reuse the "open" BPF
    augmenter program.
    
    Even more, syscalls that get two pointers with the first being a string
    can reuse "open"'s BPF augmenter till we have an augmenter that better
    matches that syscall with two pointers.
    
    With this the few augmenters we have, for open (first arg is a string),
    openat (2nd arg is a string), renameat (2nd and 4th are strings) can be
    reused by a lot of syscalls, ditto for "bind" reusing "connect" because
    both have the 2nd argument as a sockaddr and the 3rd as its len.
    
    Lets see how this makes the "bind" syscall reuse the "connect" BPF prog
    augmenter found in tools/perf/examples/bpf/augmented_raw_syscalls.c:
    
      # perf trace -e bind,connect systemctl restart sshd
      connect(3, { .family: PF_LOCAL, path: /run/systemd/private }, 23) = 0
      #
    
    Oh, it just connects to some daemon, so we better do it system wide and then
    stop/start sshd:
    
      # perf trace -e bind,connect
      systemctl/10124 connect(3, { .family: PF_LOCAL, path: /run/systemd/private }, 23) = 0
      sshd/10102 connect(7, { .family: PF_LOCAL, path: /dev/log }, 110) = 0
      systemctl/10126 connect(3, { .family: PF_LOCAL, path: /run/systemd/private }, 23) = 0
      systemd/10128  ... [continued]: connect())            = 0
      (sshd)/10128 connect(3, { .family: PF_LOCAL, path: /run/systemd/journal/stdout }, 30) ...
      sshd/10128 bind(3, { .family: PF_NETLINK }, 12)    = 0
      sshd/10128 connect(4, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
      sshd/10128 connect(3, { .family: PF_INET6, port: 22, addr: :: }, 28) = 0
      sshd/10128 connect(3, { .family: PF_UNSPEC }, 16)  = 0
      sshd/10128 connect(3, { .family: PF_INET, port: 22, addr: 0.0.0.0 }, 16) = 0
      sshd/10128 connect(3, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
      sshd/10128 connect(3, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
      sshd/10128 connect(5, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
      sshd/10128 connect(5, { .family: PF_LOCAL, path: /var/run/nscd/socket }, 110) = -1 ENOENT (No such file or directory)
      sshd/10128 bind(4, { .family: PF_INET, port: 22, addr: 0.0.0.0 }, 16) = 0
      sshd/10128 connect(6, { .family: PF_LOCAL, path: /dev/log }, 110) = 0
      sshd/10128 bind(6, { .family: PF_INET6, port: 22, addr: :: }, 28) = 0
      sshd/10128 connect(7, { .family: PF_LOCAL, path: /dev/log }, 110) = 0
      ^C#
    
    Cc: Adrian Hunter <adrian.hunter@intel.com>
    Cc: Jiri Olsa <jolsa@kernel.org>
    Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Link: https://lkml.kernel.org/n/tip-zfley2ghs4nim1uq4nu6ed3l@git.kernel.orgSigned-off-by: NArnaldo Carvalho de Melo <acme@redhat.com>
    ad4153f9
builtin-trace.c 126.0 KB