// Copyright (C) 2006 IBM Corp. // // This file is part of systemtap, and is free software. You can // redistribute it and/or modify it under the terms of the GNU General // Public License (GPL); either version 2, or (at your option) any // later version. /* although addevent.syscall.* will trace all syscalls for you, but addevent.iosyscall* will log more detail about those io related syscalls instead of logging only the syscall name */ probe addevent.iosyscall = addevent.iosyscall.entry, addevent.iosyscall.return {} probe addevent.iosyscall.entry = addevent.iosyscall.open.entry, addevent.iosyscall.close.entry, addevent.iosyscall.read.entry, addevent.iosyscall.write.entry, addevent.iosyscall.readv.entry, addevent.iosyscall.writev.entry, addevent.iosyscall.pread64.entry, addevent.iosyscall.pwrite64.entry, addevent.iosyscall.readahead.entry, addevent.iosyscall.sendfile.entry, addevent.iosyscall.lseek.entry, addevent.iosyscall.llseek.entry, addevent.iosyscall.sync.entry, addevent.iosyscall.fsync.entry, addevent.iosyscall.fdatasync.entry, addevent.iosyscall.flock.entry {} probe addevent.iosyscall.return = addevent.iosyscall.open.return, addevent.iosyscall.close.return, addevent.iosyscall.read.return, addevent.iosyscall.write.return, addevent.iosyscall.readv.return, addevent.iosyscall.writev.return, addevent.iosyscall.pread64.return, addevent.iosyscall.pwrite64.return, addevent.iosyscall.readahead.return, addevent.iosyscall.sendfile.return, addevent.iosyscall.lseek.return, addevent.iosyscall.llseek.return, addevent.iosyscall.sync.return, addevent.iosyscall.fsync.return, addevent.iosyscall.fdatasync.return, addevent.iosyscall.flock.return {} /* addevent.iosyscall.open.{entry,return} */ probe addevent.iosyscall.open = addevent.iosyscall.open.entry, addevent.iosyscall.open.return {} probe addevent.iosyscall.open.entry += _addevent.iosyscall.open.entry { update_record() } probe _addevent.iosyscall.open.entry = syscall.open { log_iosyscall_open(filename, flags, mode) } probe addevent.iosyscall.open.return += _addevent.iosyscall.open.return { update_record() } probe _addevent.iosyscall.open.return = syscall.open.return { log_iosyscall_return(HOOKID_IOSYSCALL_OPEN_RETURN, $return) } function log_iosyscall_open(filename:string, flags:long, mode:long) %{ _lket_trace(_GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_OPEN_ENTRY, "%0s%4b%4b", THIS->filename, THIS->flags, THIS->mode); %} function log_iosyscall_return(hookid:long, ret_val:long) %{ _lket_trace(_GROUP_IOSYSCALL, THIS->hookid, "%8b", THIS->ret_val); %} /* addevent.iosyscall.close.{entry,return} */ probe addevent.iosyscall.close = addevent.iosyscall.close.entry, addevent.iosyscall.close.return {} probe addevent.iosyscall.close.entry += _addevent.iosyscall.close.entry { update_record() } probe _addevent.iosyscall.close.entry = syscall.close { log_iosyscall_close(fd) } probe addevent.iosyscall.close.return += _addevent.iosyscall.close.return { update_record() } probe _addevent.iosyscall.close.return = syscall.close.return { log_iosyscall_return(HOOKID_IOSYSCALL_CLOSE_RETURN, $return) } function log_iosyscall_close(fd:long) %{ _lket_trace(_GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_CLOSE_ENTRY, "%8b", THIS->fd); %} /* addevent.iosyscall.read.{entry,return} */ probe addevent.iosyscall.read = addevent.iosyscall.read.entry, addevent.iosyscall.read.return {} probe addevent.iosyscall.read.entry += _addevent.iosyscall.read.entry { update_record() } probe _addevent.iosyscall.read.entry = syscall.read { log_iosyscall_read(fd, buf_uaddr, count) } probe addevent.iosyscall.read.return += _addevent.iosyscall.read.return { update_record() } probe _addevent.iosyscall.read.return = syscall.read.return { log_iosyscall_return(HOOKID_IOSYSCALL_READ_RETURN, $return) } /* addevent.iosyscall.write.{entry,return} */ probe addevent.iosyscall.write = addevent.iosyscall.write.entry, addevent.iosyscall.write.return {} probe addevent.iosyscall.write.entry += _addevent.iosyscall.write.entry { update_record() } probe _addevent.iosyscall.write.entry = syscall.write { log_iosyscall_write(fd, buf_uaddr, count) } probe addevent.iosyscall.write.return += _addevent.iosyscall.write.return { update_record() } probe _addevent.iosyscall.write.return = syscall.write.return { log_iosyscall_return(HOOKID_IOSYSCALL_WRITE_RETURN, $return) } function log_iosyscall_read(fd:long, buf_uaddr:long, count:long) %{ _lket_trace(_GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_READ_ENTRY, "%8b%8b%8b", THIS->fd, THIS->buf_uaddr, THIS->count); %} function log_iosyscall_write(fd:long, buf_uaddr:long, count:long) %{ _lket_trace(_GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_WRITE_ENTRY, "%8b%8b%8b", THIS->fd, THIS->buf_uaddr, THIS->count); %} /* addevent.iosyscall.readv.{entry,return} */ probe addevent.iosyscall.readv = addevent.iosyscall.readv.entry, addevent.iosyscall.readv.return {} probe addevent.iosyscall.readv.entry += _addevent.iosyscall.readv.entry { update_record() } probe _addevent.iosyscall.readv.entry = syscall.readv { log_iosyscall_readv_writev(HOOKID_IOSYSCALL_READV_ENTRY, fd, vector_uaddr, count) } probe addevent.iosyscall.readv.return += _addevent.iosyscall.readv.return { update_record() } probe _addevent.iosyscall.readv.return = syscall.readv.return { log_iosyscall_return(HOOKID_IOSYSCALL_READV_RETURN, $return) } /* addevent.iosyscall.writev.{entry,return} */ probe addevent.iosyscall.writev = addevent.iosyscall.writev.entry, addevent.iosyscall.writev.return {} probe addevent.iosyscall.writev.entry += _addevent.iosyscall.writev.entry { update_record() } probe _addevent.iosyscall.writev.entry = syscall.writev { log_iosyscall_readv_writev(HOOKID_IOSYSCALL_WRITEV_ENTRY, fd, vector_uaddr, count) } probe addevent.iosyscall.writev.return += _addevent.iosyscall.writev.return { update_record() } probe _addevent.iosyscall.writev.return = syscall.writev.return { log_iosyscall_return(HOOKID_IOSYSCALL_WRITEV_RETURN, $return) } function log_iosyscall_readv_writev(hookid:long, fd:long, vector_uaddr:long, count:long) %{ _lket_trace(_GROUP_IOSYSCALL, THIS->hookid, "%8b%8b%8b", THIS->fd, THIS->vector_uaddr, THIS->count); %} /* addevent.iosyscall.pread64.{entry,return} */ probe addevent.iosyscall.pread64 = addevent.iosyscall.pread64.entry, addevent.iosyscall.pread64.return {} probe addevent.iosyscall.pread64.entry += _addevent.iosyscall.pread64.entry { update_record() } probe _addevent.iosyscall.pread64.entry = syscall.pread64 { log_iosyscall_pread64_pwrite64(HOOKID_IOSYSCALL_PREAD64_ENTRY, fd, buf_uaddr, count, offset) } probe addevent.iosyscall.pread64.return += _addevent.iosyscall.pread64.return { update_record() } probe _addevent.iosyscall.pread64.return = syscall.pread64.return { log_iosyscall_return(HOOKID_IOSYSCALL_PREAD64_RETURN, $return) } /* addevent.iosyscall.pwrite64.{entry,return} */ probe addevent.iosyscall.pwrite64 = addevent.iosyscall.pwrite64.entry, addevent.iosyscall.pwrite64.return {} probe addevent.iosyscall.pwrite64.entry += _addevent.iosyscall.pwrite64.entry { update_record() } probe _addevent.iosyscall.pwrite64.entry = syscall.pwrite64 { log_iosyscall_pread64_pwrite64(HOOKID_IOSYSCALL_PWRITE64_ENTRY, fd, buf_uaddr, count, offset); } probe addevent.iosyscall.pwrite64.return += _addevent.iosyscall.pwrite64.return { update_record() } probe _addevent.iosyscall.pwrite64.return = syscall.pwrite64.return { log_iosyscall_return(HOOKID_IOSYSCALL_PWRITE64_RETURN, $return) } function log_iosyscall_pread64_pwrite64(hookid:long, fd:long, buf_uaddr:long, count:long, offset:long) %{ _lket_trace(_GROUP_IOSYSCALL, THIS->hookid, "%8b%8b%8b%8b", THIS->fd, THIS->buf_uaddr, THIS->count, THIS->offset); %} /* addevent.iosyscall.readahead.{entry,return} */ probe addevent.iosyscall.readahead = addevent.iosyscall.readahead.entry, addevent.iosyscall.readahead.return {} probe addevent.iosyscall.readahead.entry += _addevent.iosyscall.readahead.entry { update_record() } probe _addevent.iosyscall.readahead.entry = syscall.readahead { log_iosyscall_readahead(fd, offset, count) } probe addevent.iosyscall.readahead.return += _addevent.iosyscall.readahead.return { update_record() } probe _addevent.iosyscall.readahead.return = syscall.readahead.return { log_iosyscall_return(HOOKID_IOSYSCALL_READAHEAD_RETURN, $return) } function log_iosyscall_readahead(fd:long, offset:long,count:long) %{ _lket_trace(_GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_READAHEAD_ENTRY, "%8b%8b%8b", THIS->fd, THIS->offset, THIS->count); %} /* addevent.iosyscall.sendfile.{entry,return} */ probe addevent.iosyscall.sendfile = addevent.iosyscall.sendfile.entry, addevent.iosyscall.sendfile.return {} probe addevent.iosyscall.sendfile.entry += _addevent.iosyscall.sendfile.entry { update_record() } probe _addevent.iosyscall.sendfile.entry = syscall.sendfile { log_iosyscall_sendfile(out_fd, in_fd, offset_uaddr, count) } probe addevent.iosyscall.sendfile.return += _addevent.iosyscall.sendfile.return { update_record() } probe _addevent.iosyscall.sendfile.return = syscall.sendfile.return { log_iosyscall_return(HOOKID_IOSYSCALL_SENDFILE_RETURN, $return) } function log_iosyscall_sendfile(out_fd:long, in_fd:long, offset_uaddr:long, count:long) %{ _lket_trace(_GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_SENDFILE_ENTRY, "%8b%8b%8b%8b", THIS->out_fd, THIS->in_fd, THIS->offset_uaddr, THIS->count); %} /* addevent.iosyscall.lseek.{entry,return} */ probe addevent.iosyscall.lseek = addevent.iosyscall.lseek.entry, addevent.iosyscall.lseek.return {} probe addevent.iosyscall.lseek.entry += _addevent.iosyscall.lseek.entry { update_record() } probe _addevent.iosyscall.lseek.entry = syscall.lseek { log_iosyscall_lseek(fildes, offset, whence) } probe addevent.iosyscall.lseek.return += _addevent.iosyscall.lseek.return { update_record() } probe _addevent.iosyscall.lseek.return = syscall.lseek.return { log_iosyscall_return(HOOKID_IOSYSCALL_LSEEK_RETURN, $return) } function log_iosyscall_lseek(fd:long, offset:long, whence:long) %{ _lket_trace(_GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_LSEEK_ENTRY, "%8b%8b%1b", THIS->fd, THIS->offset, THIS->whence); %} /* addevent.iosyscall.llseek.{entry,return} */ probe addevent.iosyscall.llseek = addevent.iosyscall.llseek.entry, addevent.iosyscall.llseek.return {} probe addevent.iosyscall.llseek.entry += _addevent.iosyscall.llseek.entry { update_record() } probe _addevent.iosyscall.llseek.entry = syscall.llseek { log_iosyscall_llseek(fd, offset_high, offset_low, result_uaddr, whence) } probe addevent.iosyscall.llseek.return += _addevent.iosyscall.llseek.return { update_record() } probe _addevent.iosyscall.llseek.return = syscall.llseek.return { log_iosyscall_return(HOOKID_IOSYSCALL_LLSEEK_RETURN, $return) } function log_iosyscall_llseek(fd:long, offset_high:long, offset_low:long, result_uaddr:long, whence:long) %{ _lket_trace(_GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_LLSEEK_ENTRY, "%8b%8b%8b%8b%1b", THIS->fd, THIS->offset_high, THIS->offset_low, THIS->result_uaddr, THIS->whence); %} /* addevent.iosyscall.sync.{entry,return} */ probe addevent.iosyscall.sync = addevent.iosyscall.sync.entry, addevent.iosyscall.sync.return {} probe addevent.iosyscall.sync.entry += _addevent.iosyscall.sync.entry { update_record() } probe _addevent.iosyscall.sync.entry = syscall.sync { log_iosyscall_sync() } probe addevent.iosyscall.sync.return += _addevent.iosyscall.sync.return { update_record() } probe _addevent.iosyscall.sync.return = syscall.sync.return { log_iosyscall_return(HOOKID_IOSYSCALL_SYNC_RETURN, $return) } function log_iosyscall_sync() %{ int GroupID = _GROUP_IOSYSCALL; int hookID = _HOOKID_IOSYSCALL_SYNC_ENTRY; struct timeval tv; do_gettimeofday(&tv); #if defined(ASCII_TRACE) _stp_printf("%d%d%d%d%d%d%d%d", _GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_SYNC_ENTRY, tv.tv_sec, tv.tv_usec, current->tgid, current->parent->pid, current->pid, current->thread_info->cpu); #else if(timing_method == TIMING_GETCYCLES) { _stp_printf("%2b%2n%8b%8b", (_FMT_)0, (_FMT_)get_cycles(), (_FMT_)((int64_t)current->pid << 32 | (int32_t)GroupID << 24 | (int32_t)hookID << 16 | (int16_t)current->thread_info->cpu << 8)); } else if(timing_method == TIMING_GETTIMEOFDAY) { struct timeval tv; do_gettimeofday (&tv); _stp_printf("%2b%2n%8b%8b", (_FMT_)0, (_FMT_)(tv.tv_sec*1000000LL + tv.tv_usec), (_FMT_)((int64_t)current->pid << 32 | (int32_t)GroupID << 24 | (int32_t)hookID << 16 | (int16_t)current->thread_info->cpu << 8)); } else { _stp_printf("%2b%2n%8b%8b", (_FMT_)0, (_FMT_)pfn_schedclock(), (_FMT_)((int64_t)current->pid << 32 | (int32_t)GroupID << 24 | (int32_t)hookID << 16 | (int16_t)current->thread_info->cpu << 8)); } #endif %} /* addevent.iosyscall.fsync.{entry,return} */ probe addevent.iosyscall.fsync = addevent.iosyscall.fsync.entry, addevent.iosyscall.fsync.return {} probe addevent.iosyscall.fsync.entry += _addevent.iosyscall.fsync.entry { update_record() } probe _addevent.iosyscall.fsync.entry = syscall.fsync { log_iosyscall_fsync(HOOKID_IOSYSCALL_FSYNC_ENTRY, fd) } probe addevent.iosyscall.fsync.return += _addevent.iosyscall.fsync.return { update_record() } probe _addevent.iosyscall.fsync.return = syscall.fsync.return { log_iosyscall_return(HOOKID_IOSYSCALL_FSYNC_RETURN, $return) } /* addevent.iosyscall.fdatasync.{entry,return} */ probe addevent.iosyscall.fdatasync = addevent.iosyscall.fdatasync.entry, addevent.iosyscall.fdatasync.return {} probe addevent.iosyscall.fdatasync.entry += _addevent.iosyscall.fdatasync.entry { update_record() } probe _addevent.iosyscall.fdatasync.entry = syscall.fdatasync { log_iosyscall_fsync(HOOKID_IOSYSCALL_FDATASYNC_ENTRY, fd) } probe addevent.iosyscall.fdatasync.return += _addevent.iosyscall.fdatasync.return { update_record() } probe _addevent.iosyscall.fdatasync.return = syscall.fdatasync.return { log_iosyscall_return(HOOKID_IOSYSCALL_FDATASYNC_RETURN, $return) } function log_iosyscall_fsync(hookid:long, fd:long) %{ _lket_trace(_GROUP_IOSYSCALL, THIS->hookid, "%8b", THIS->fd); %} /* addevent.iosyscall.flock.{entry,return} */ probe addevent.iosyscall.flock = addevent.iosyscall.flock.entry, addevent.iosyscall.flock.return {} probe addevent.iosyscall.flock.entry += _addevent.iosyscall.flock.entry { update_record() } probe _addevent.iosyscall.flock.entry = syscall.flock { log_iosyscall_flock(fd, operation) } probe addevent.iosyscall.flock.return += _addevent.iosyscall.flock.return { update_record() } probe _addevent.iosyscall.flock.return = syscall.flock.return { log_iosyscall_return(HOOKID_IOSYSCALL_FLOCK_RETURN, $return) } function log_iosyscall_flock(fd:long, operation:long) %{ _lket_trace(_GROUP_IOSYSCALL, _HOOKID_IOSYSCALL_FLOCK_ENTRY, "%8b%4b", THIS->fd, THIS->operation); %}