MINI SHELL

// Copyright (C) 2006 IBM Corp.
//
// This file is part of systemtap, and is free software.  You can
// redistribute it and/or modify it under the terms of the GNU General
// Public License (GPL); either version 2, or (at your option) any
// later version.

/*
 although addevent.syscall.* will trace all syscalls for you,
 but addevent.iosyscall* will log more detail about those
 io related syscalls instead of logging only the syscall name
*/
 
probe addevent.iosyscall
	= addevent.iosyscall.entry,
	addevent.iosyscall.return
{}

probe addevent.iosyscall.entry
	= 
	addevent.iosyscall.open.entry,
	addevent.iosyscall.close.entry,
	addevent.iosyscall.read.entry,
	addevent.iosyscall.write.entry,
	addevent.iosyscall.readv.entry,
	addevent.iosyscall.writev.entry,
	addevent.iosyscall.pread64.entry,
	addevent.iosyscall.pwrite64.entry,
	addevent.iosyscall.readahead.entry,
	addevent.iosyscall.sendfile.entry,
	addevent.iosyscall.lseek.entry,
	addevent.iosyscall.llseek.entry,
	addevent.iosyscall.sync.entry,
	addevent.iosyscall.fsync.entry,
	addevent.iosyscall.fdatasync.entry,
	addevent.iosyscall.flock.entry
{}

probe addevent.iosyscall.return
	= 
	addevent.iosyscall.open.return,
	addevent.iosyscall.close.return,
	addevent.iosyscall.read.return,
	addevent.iosyscall.write.return,
	addevent.iosyscall.readv.return,
	addevent.iosyscall.writev.return,
	addevent.iosyscall.pread64.return,
	addevent.iosyscall.pwrite64.return,
	addevent.iosyscall.readahead.return,
	addevent.iosyscall.sendfile.return,
	addevent.iosyscall.lseek.return,
	addevent.iosyscall.llseek.return,
	addevent.iosyscall.sync.return,
	addevent.iosyscall.fsync.return,
	addevent.iosyscall.fdatasync.return,
	addevent.iosyscall.flock.return
{}


/*
  addevent.iosyscall.open.{entry,return}
*/
probe addevent.iosyscall.open.entry
	+= _addevent.iosyscall.open.entry
{
	update_record()
}

probe _addevent.iosyscall.open.entry 
	= syscall.open
{
	log_iosyscall_open(HOOKID_IOSYSCALL_OPEN_ENTRY, filename, flags, mode)
}

probe addevent.iosyscall.open.return
	+= _addevent.iosyscall.open.return
{
	update_record()
}

probe _addevent.iosyscall.open.return 
	= syscall.open.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_OPEN_RETURN, $return)
}

function log_iosyscall_open(hookid:long, filename:string, flags:long, mode:long)
%{
	_lket_trace(_GROUP_IOSYSCALL, THIS->hookid, 
		"%0s%4b%4b", THIS->filename, THIS->flags, THIS->mode);
%}

function log_iosyscall_return(hookid:long, ret_val:long)
%{
	_lket_trace(_GROUP_IOSYSCALL, THIS->hookid, "%8b", (_FMT_)THIS->ret_val);
%}

/*
  addevent.iosyscall.close.{entry,return}
*/ 	
probe addevent.iosyscall.close.entry
	+= _addevent.iosyscall.close.entry
{
	update_record()
}

probe _addevent.iosyscall.close.entry 
	= syscall.close
{
	log_iosyscall_close(HOOKID_IOSYSCALL_CLOSE_ENTRY,fd)
}

probe addevent.iosyscall.close.return
	+= _addevent.iosyscall.close.return
{
	update_record()
}

probe _addevent.iosyscall.close.return 
	= syscall.close.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_CLOSE_RETURN, $return)
}

function log_iosyscall_close(hookid:long, fd:long)
%{
	_lket_trace(_GROUP_IOSYSCALL, THIS->hookid, "%8b", THIS->fd);
%}

/*
  addevent.iosyscall.read.{entry,return}
*/
probe addevent.iosyscall.read.entry
	+= _addevent.iosyscall.read.entry
{
	update_record()
}

probe _addevent.iosyscall.read.entry
	= syscall.read
{
	log_iosyscall_read_write(HOOKID_IOSYSCALL_READ_ENTRY, fd, buf_uaddr, count)
}

probe addevent.iosyscall.read.return
	+= _addevent.iosyscall.read.return
{
	update_record()
}

probe _addevent.iosyscall.read.return
	= syscall.read.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_READ_RETURN, $return)
}

/*
  addevent.iosyscall.write.{entry,return}
*/	
probe addevent.iosyscall.write.entry
	+= _addevent.iosyscall.write.entry
{
	update_record()
}

probe _addevent.iosyscall.write.entry
	= syscall.write
{
	log_iosyscall_read_write(HOOKID_IOSYSCALL_WRITE_ENTRY, fd, buf_uaddr, count)
}

probe addevent.iosyscall.write.return
	+= _addevent.iosyscall.write.return
{
	update_record()
}

probe _addevent.iosyscall.write.return
	= syscall.write.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_WRITE_RETURN, $return)
}
	
function log_iosyscall_read_write(hookid:long, fd:long, buf_uaddr:long,
		count:long)
%{
	_lket_trace(_GROUP_IOSYSCALL, THIS->hookid, "%8b%8b%8b",
		THIS->fd, THIS->buf_uaddr, THIS->count);
%}

/*
  addevent.iosyscall.readv.{entry,return}
*/
probe addevent.iosyscall.readv.entry
	+= _addevent.iosyscall.readv.entry
{
	update_record()
}

probe _addevent.iosyscall.readv.entry
	= syscall.readv
{
	log_iosyscall_readv_writev(HOOKID_IOSYSCALL_READV_ENTRY, fd, vector_uaddr, count)
}

probe addevent.iosyscall.readv.return
	+= _addevent.iosyscall.readv.return
{
	update_record()
}

probe _addevent.iosyscall.readv.return
	= syscall.readv.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_READV_RETURN, $return)
}
	
/*
  addevent.iosyscall.writev.{entry,return}
*/
probe addevent.iosyscall.writev.entry
	+= _addevent.iosyscall.writev.entry
{
	update_record()
}

probe _addevent.iosyscall.writev.entry
	= syscall.writev
{
	log_iosyscall_readv_writev(HOOKID_IOSYSCALL_WRITEV_ENTRY, fd, vector_uaddr, count)
}

probe addevent.iosyscall.writev.return
	+= _addevent.iosyscall.writev.return
{
	update_record()
}

probe _addevent.iosyscall.writev.return
	= syscall.writev.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_WRITEV_RETURN, $return)
}
	
function log_iosyscall_readv_writev(hookid:long, fd:long, 
		vector_uaddr:long, count:long)
%{
	_lket_trace(_GROUP_IOSYSCALL, THIS->hookid, "%8b%8b%8b",
		THIS->fd, THIS->vector_uaddr, THIS->count);
%}

/*
  addevent.iosyscall.pread64.{entry,return}
*/
probe addevent.iosyscall.pread64.entry
	+= _addevent.iosyscall.pread64.entry
{
	update_record()
}

probe _addevent.iosyscall.pread64.entry
	= syscall.pread64
{
	log_iosyscall_pread64_pwrite64(HOOKID_IOSYSCALL_PREAD64_ENTRY, 
		fd, buf_uaddr, count, offset)
}

probe addevent.iosyscall.pread64.return
	+= _addevent.iosyscall.pread64.return
{
	update_record()
}

probe _addevent.iosyscall.pread64.return
	= syscall.pread64.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_PREAD64_RETURN, $return)
}

/*
  addevent.iosyscall.pwrite64.{entry,return}
*/
probe addevent.iosyscall.pwrite64.entry
	+= _addevent.iosyscall.pwrite64.entry
{
	update_record()
}

probe _addevent.iosyscall.pwrite64.entry
	= syscall.pwrite64
{
	log_iosyscall_pread64_pwrite64(HOOKID_IOSYSCALL_PWRITE64_ENTRY,
		fd, buf_uaddr, count, offset);
}

probe addevent.iosyscall.pwrite64.return
	+= _addevent.iosyscall.pwrite64.return
{
	update_record()
}

probe _addevent.iosyscall.pwrite64.return
	= syscall.pwrite64.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_PWRITE64_RETURN, $return)
}

function log_iosyscall_pread64_pwrite64(hookid:long, fd:long, 
		buf_uaddr:long, count:long, offset:long)
%{
	_lket_trace(_GROUP_IOSYSCALL, THIS->hookid, "%8b%8b%8b%8b",
		THIS->fd, THIS->buf_uaddr, THIS->count, THIS->offset);
%}

/*
  addevent.iosyscall.readahead.{entry,return}
*/
probe addevent.iosyscall.readahead.entry
	+= _addevent.iosyscall.readahead.entry
{
	update_record()
}

probe _addevent.iosyscall.readahead.entry
	= syscall.readahead
{
	log_iosyscall_readahead(HOOKID_IOSYSCALL_READAHEAD_ENTRY, fd, offset, count)
}

probe addevent.iosyscall.readahead.return
	+= _addevent.iosyscall.readahead.return
{
	update_record()
}

probe _addevent.iosyscall.readahead.return
	= syscall.readahead.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_READAHEAD_RETURN, $return)
}


function log_iosyscall_readahead(hookid:long, fd:long, offset:long,count:long)
%{
	_lket_trace(_GROUP_IOSYSCALL, THIS->hookid,
		"%8b%8b%8b", THIS->fd, THIS->offset, THIS->count);
%}

/*
  addevent.iosyscall.sendfile.{entry,return}
*/
probe addevent.iosyscall.sendfile.entry
	+= _addevent.iosyscall.sendfile.entry
{
	update_record()
}

probe _addevent.iosyscall.sendfile.entry
	= syscall.sendfile
{
	log_iosyscall_sendfile(HOOKID_IOSYSCALL_SENDFILE_ENTRY,
		out_fd, in_fd, offset_uaddr, count)
}

probe addevent.iosyscall.sendfile.return
	+= _addevent.iosyscall.sendfile.return
{
	update_record()
}

probe _addevent.iosyscall.sendfile.return
	= syscall.sendfile.return
{
	 log_iosyscall_return(HOOKID_IOSYSCALL_SENDFILE_RETURN, $return)
}
	
function log_iosyscall_sendfile(hookid:long, out_fd:long, in_fd:long,
		offset_uaddr:long, count:long)
%{
	_lket_trace(_GROUP_IOSYSCALL, THIS->hookid, "%8b%8b%8b%8b",
		THIS->out_fd, THIS->in_fd, THIS->offset_uaddr,
		THIS->count);
%}

/*
  addevent.iosyscall.lseek.{entry,return}
*/

probe addevent.iosyscall.lseek.entry
	+= _addevent.iosyscall.lseek.entry
{
	update_record()
}

probe _addevent.iosyscall.lseek.entry
	= syscall.lseek
{
	log_iosyscall_lseek(HOOKID_IOSYSCALL_LSEEK_ENTRY, fildes, offset, whence)
}

probe addevent.iosyscall.lseek.return
	+= _addevent.iosyscall.lseek.return
{
	update_record()
}

probe _addevent.iosyscall.lseek.return
	= syscall.lseek.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_LSEEK_RETURN, $return)
}

function log_iosyscall_lseek(hookid:long, fd:long, offset:long, whence:long)
%{
	_lket_trace(_GROUP_IOSYSCALL, THIS->hookid,
		"%8b%8b%1b", THIS->fd, THIS->offset, THIS->whence);
%}

/*
  addevent.iosyscall.llseek.{entry,return}
*/
probe addevent.iosyscall.llseek.entry
	+= _addevent.iosyscall.llseek.entry
{
	update_record()
}

probe _addevent.iosyscall.llseek.entry
	= syscall.llseek
{
	log_iosyscall_llseek(HOOKID_IOSYSCALL_LLSEEK_ENTRY, 
		fd, offset_high, offset_low, result_uaddr, whence)
}

probe addevent.iosyscall.llseek.return
	+= _addevent.iosyscall.llseek.return
{
	update_record()
}

probe _addevent.iosyscall.llseek.return
	= syscall.llseek.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_LLSEEK_RETURN, $return)
}

function log_iosyscall_llseek(hookid:long, fd:long, offset_high:long, 
		offset_low:long, result_uaddr:long, whence:long)
%{
	_lket_trace(_GROUP_IOSYSCALL, THIS->hookid,
		"%8b%8b%8b%8b%1b", THIS->fd, THIS->offset_high,
		THIS->offset_low, THIS->result_uaddr, THIS->whence);
%}

/*
  addevent.iosyscall.sync.{entry,return}
*/

probe addevent.iosyscall.sync.entry
	+= _addevent.iosyscall.sync.entry
{
	update_record()
}

probe _addevent.iosyscall.sync.entry
	= syscall.sync
{
	log_iosyscall_sync(HOOKID_IOSYSCALL_SYNC_ENTRY)
}

probe addevent.iosyscall.sync.return
	+= _addevent.iosyscall.sync.return
{
	update_record()
}

probe _addevent.iosyscall.sync.return
	= syscall.sync.return
{
	 log_iosyscall_return(HOOKID_IOSYSCALL_SYNC_RETURN, $return)
}

function log_iosyscall_sync(hookid:long)
%{
	int GroupID = _GROUP_IOSYSCALL;
	int hookID = _HOOKID_IOSYSCALL_SYNC_ENTRY;
        struct timeval tv; 
        do_gettimeofday(&tv); 
#if defined(ASCII_TRACE)
	_stp_printf("%d%d%d%d%d%d%d%d", _GROUP_IOSYSCALL,
		THIS->hookid, tv.tv_sec, tv.tv_usec,
		current->tgid, current->parent->pid, current->pid,
                current->thread_info->cpu);

#else

        if(timing_method == TIMING_GETCYCLES) { 
                _stp_printf("%2b%2n%8b%8b", (_FMT_)0, 
                        (_FMT_)get_cycles(),
                        (_FMT_)((int64_t)current->pid << 32 |
                                (int32_t)GroupID << 24 | (int32_t)hookID << 16 |
                                (int16_t)current->thread_info->cpu << 8));
        } 
        else if(timing_method == TIMING_GETTIMEOFDAY) {
                struct timeval tv;
                do_gettimeofday (&tv);
                _stp_printf("%2b%2n%8b%8b", (_FMT_)0,
                        (_FMT_)(tv.tv_sec*1000000LL + tv.tv_usec),
                        (_FMT_)((int64_t)current->pid << 32 |
                                (int32_t)GroupID << 24 | (int32_t)hookID << 16 |
                                (int16_t)current->thread_info->cpu << 8));
        } 
        else {
                _stp_printf("%2b%2n%8b%8b", (_FMT_)0,
                        (_FMT_)pfn_schedclock(),
                        (_FMT_)((int64_t)current->pid << 32 |
                                (int32_t)GroupID << 24 | (int32_t)hookID << 16 |
                                (int16_t)current->thread_info->cpu << 8));
	}
#endif

%}

/*
  addevent.iosyscall.fsync.{entry,return}
*/

probe addevent.iosyscall.fsync.entry
	+= _addevent.iosyscall.fsync.entry
{
	update_record()
}

probe _addevent.iosyscall.fsync.entry
	= syscall.fsync
{
	log_iosyscall_fsync(HOOKID_IOSYSCALL_FSYNC_ENTRY, fd)
}

probe addevent.iosyscall.fsync.return
	+= _addevent.iosyscall.fsync.return
{
	update_record()
}

probe _addevent.iosyscall.fsync.return
	= syscall.fsync.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_FSYNC_RETURN, $return)
}
	
/*
  addevent.iosyscall.fdatasync.{entry,return}
*/

probe addevent.iosyscall.fdatasync.entry
	+= _addevent.iosyscall.fdatasync.entry
{
	update_record()
}

probe _addevent.iosyscall.fdatasync.entry
	= syscall.fdatasync
{
	log_iosyscall_fsync(HOOKID_IOSYSCALL_FDATASYNC_ENTRY, fd)
}

probe addevent.iosyscall.fdatasync.return
	+= _addevent.iosyscall.fdatasync.return
{
	update_record()
}

probe _addevent.iosyscall.fdatasync.return
	= syscall.fdatasync.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_FDATASYNC_RETURN, $return)
}

function log_iosyscall_fsync(hookid:long, fd:long)
%{
	_lket_trace(_GROUP_IOSYSCALL, THIS->hookid, "%8b", THIS->fd);
%}

/*
  addevent.iosyscall.flock.{entry,return}
*/

probe addevent.iosyscall.flock.entry
	+= _addevent.iosyscall.flock.entry
{
	update_record()
}

probe _addevent.iosyscall.flock.entry
	= syscall.flock
{
	log_iosyscall_flock(HOOKID_IOSYSCALL_FLOCK_ENTRY, fd, operation)
}

probe addevent.iosyscall.flock.return
	+= _addevent.iosyscall.flock.return
{
	update_record()
}

probe _addevent.iosyscall.flock.return
	= syscall.flock.return
{
	log_iosyscall_return(HOOKID_IOSYSCALL_FLOCK_RETURN, $return)
}

function log_iosyscall_flock(hookid:long, fd:long, operation:long)
%{
	_lket_trace(_GROUP_IOSYSCALL, THIS->hookid,
		"%8b%4b", THIS->fd, THIS->operation);
%}