From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752952AbbKBJvZ (ORCPT ); Mon, 2 Nov 2015 04:51:25 -0500 Received: from casper.infradead.org ([85.118.1.10]:47319 "EHLO casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751576AbbKBJvC (ORCPT ); Mon, 2 Nov 2015 04:51:02 -0500 Date: Mon, 2 Nov 2015 10:50:51 +0100 From: Peter Zijlstra To: Arnaldo Carvalho de Melo Cc: =?iso-8859-1?Q?Fr=E9d=E9ric?= Weisbecker , Jiri Olsa , David Ahern , Adrian Hunter , Wang Nan , Steven Rostedt , Linux Kernel Mailing List Subject: Re: tracepoint filter problems Message-ID: <20151102095051.GN17308@twins.programming.kicks-ass.net> References: <20151029152742.GB2923@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151029152742.GB2923@kernel.org> User-Agent: Mutt/1.5.21 (2012-12-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Oct 29, 2015 at 12:27:42PM -0300, Arnaldo Carvalho de Melo wrote: > Hi, > > In 'perf trace' we have an equivalent to strace's -e option, i.e. a way > to state which syscalls one wants to see, so, when we do: > > [root@felicio linux]# trace -e open > 0.348 ( 0.005 ms): ls/6887 open(filename: /etc/ld.so.cache, flags: CLOEXEC ) = 3 > 0.363 ( 0.005 ms): ls/6887 open(filename: /lib64/libselinux.so.1, flags: CLOEXEC ) = 3 > 0.400 ( 0.006 ms): ls/6887 open(filename: /lib64/libcap.so.2, flags: CLOEXEC ) = 3 > 0.427 ( 0.006 ms): ls/6887 open(filename: /lib64/libacl.so.1, flags: CLOEXEC ) = 3 > 0.454 ( 0.006 ms): ls/6887 open(filename: /lib64/libc.so.6, flags: CLOEXEC ) = 3 > 0.497 ( 0.006 ms): ls/6887 open(filename: /lib64/libpcre.so.1, flags: CLOEXEC ) = 3 > 0.533 ( 0.006 ms): ls/6887 open(filename: /lib64/liblzma.so.5, flags: CLOEXEC ) = 3 > 0.561 ( 0.006 ms): ls/6887 open(filename: /lib64/libdl.so.2, flags: CLOEXEC ) = 3 > 0.586 ( 0.006 ms): ls/6887 open(filename: /lib64/libattr.so.1, flags: CLOEXEC ) = 3 > 0.611 ( 0.006 ms): ls/6887 open(filename: /lib64/libpthread.so.0, flags: CLOEXEC ) = 3 > 0.859 ( 0.007 ms): ls/6887 open(filename: /usr/lib/locale/locale-archive, flags: CLOEXEC ) = 3 > ^C[root@felicio linux]# > > I.e. tracing system wide, looking for any program that calls the open syscall, it works, as it > used the PERF_EVENT_IOC_SET_FILTER to set the relevant 'id == 486' to filter it: > > [root@felicio linux]# head -2 /sys/kernel/debug/tracing/events/syscalls/sys_enter_open/format > name: sys_enter_open > ID: 486 > > Ok, this is how it should be, all works, but if I try instead calling a program > that in turn calls another, the filter will apply for the first in line, but > not for the calls made by another program called from it. > > In the example below 'perf trace' will ask to see just the 'open' syscall, and > it works for the started workload, namely 'perf record', but then it'll call > 'sleep 100000000000' and there the filter doesn't apply, bummer :-\ > > The inherit bit is set, sure, as we can see when adding -vv to the 'perf trace' > call, ideas? --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -6939,6 +6939,10 @@ static int perf_tp_filter_match(struct p { void *record = data->raw->data; + /* only top level events have filters set */ + if (event->parent) + event = event->parent; + if (likely(!event->filter) || filter_match_preds(event->filter, record)) return 1; return 0;