/*
   * builtin-trace.c
   *
   * Builtin 'trace' command:
   *
   * Display a continuously updated trace of any workload, CPU, specific PID,
   * system wide, etc.  Default format is loosely strace like, but any other
   * event may be specified using --event.
   *
   * Copyright (C) 2012, 2013, 2014, 2015 Red Hat Inc, Arnaldo Carvalho de Melo <acme@redhat.com>
   *
   * Initially based on the 'trace' prototype by Thomas Gleixner:
   *
   * http://lwn.net/Articles/415728/ ("Announcing a new utility: 'trace'")
   *
   * Released under the GPL v2. (and only v2, not any later version)
   */

  #include <traceevent/event-parse.h>

  #include <api/fs/tracing_path.h>

  #include "builtin.h"

  #include "util/color.h"

  #include "util/debug.h"

  #include "util/evlist.h"

  #include <subcmd/exec-cmd.h>

  #include "util/machine.h"

  #include "util/session.h"

  #include "util/thread.h"

  #include <subcmd/parse-options.h>

  #include "util/strlist.h"

  #include "util/intlist.h"

  #include "util/thread_map.h"

  #include "util/stat.h"

  #include "trace-event.h"

  #include "util/parse-events.h"

  #include "util/bpf-loader.h"

  #include "callchain.h"

  #include "syscalltbl.h"

  #include "rb_resort.h"

  #include <libaudit.h> /* FIXME: Still needed for audit_errno_to_name */

  #include <stdlib.h>

  #include <linux/err.h>

  #include <linux/filter.h>
  #include <linux/audit.h>

  #include <linux/random.h>

  #include <linux/stringify.h>

  #include <linux/time64.h>

  #ifndef O_CLOEXEC
  # define O_CLOEXEC		02000000
  #endif

  struct trace {
  	struct perf_tool	tool;

  	struct syscalltbl	*sctbl;

  	struct {
  		int		max;
  		struct syscall  *table;
  		struct {
  			struct perf_evsel *sys_enter,
  					  *sys_exit;
  		}		events;
  	} syscalls;
  	struct record_opts	opts;
  	struct perf_evlist	*evlist;
  	struct machine		*host;
  	struct thread		*current;
  	u64			base_time;
  	FILE			*output;
  	unsigned long		nr_events;
  	struct strlist		*ev_qualifier;
  	struct {
  		size_t		nr;
  		int		*entries;
  	}			ev_qualifier_ids;
  	struct intlist		*tid_list;
  	struct intlist		*pid_list;
  	struct {
  		size_t		nr;
  		pid_t		*entries;
  	}			filter_pids;
  	double			duration_filter;
  	double			runtime_ms;
  	struct {
  		u64		vfs_getname,
  				proc_getname;
  	} stats;

  	unsigned int		max_stack;

  	unsigned int		min_stack;

  	bool			not_ev_qualifier;
  	bool			live;
  	bool			full_time;
  	bool			sched;
  	bool			multiple_threads;
  	bool			summary;
  	bool			summary_only;
  	bool			show_comm;
  	bool			show_tool_stats;
  	bool			trace_syscalls;

  	bool			kernel_syscallchains;

  	bool			force;
  	bool			vfs_getname;
  	int			trace_pgfaults;

  	int			open_id;

  };

  struct tp_field {
  	int offset;
  	union {
  		u64 (*integer)(struct tp_field *field, struct perf_sample *sample);
  		void *(*pointer)(struct tp_field *field, struct perf_sample *sample);
  	};
  };
  
  #define TP_UINT_FIELD(bits) \
  static u64 tp_field__u##bits(struct tp_field *field, struct perf_sample *sample) \
  { \

  	u##bits value; \
  	memcpy(&value, sample->raw_data + field->offset, sizeof(value)); \
  	return value;  \

  }
  
  TP_UINT_FIELD(8);
  TP_UINT_FIELD(16);
  TP_UINT_FIELD(32);
  TP_UINT_FIELD(64);
  
  #define TP_UINT_FIELD__SWAPPED(bits) \
  static u64 tp_field__swapped_u##bits(struct tp_field *field, struct perf_sample *sample) \
  { \

  	u##bits value; \
  	memcpy(&value, sample->raw_data + field->offset, sizeof(value)); \

  	return bswap_##bits(value);\
  }
  
  TP_UINT_FIELD__SWAPPED(16);
  TP_UINT_FIELD__SWAPPED(32);
  TP_UINT_FIELD__SWAPPED(64);
  
  static int tp_field__init_uint(struct tp_field *field,
  			       struct format_field *format_field,
  			       bool needs_swap)
  {
  	field->offset = format_field->offset;
  
  	switch (format_field->size) {
  	case 1:
  		field->integer = tp_field__u8;
  		break;
  	case 2:
  		field->integer = needs_swap ? tp_field__swapped_u16 : tp_field__u16;
  		break;
  	case 4:
  		field->integer = needs_swap ? tp_field__swapped_u32 : tp_field__u32;
  		break;
  	case 8:
  		field->integer = needs_swap ? tp_field__swapped_u64 : tp_field__u64;
  		break;
  	default:
  		return -1;
  	}
  
  	return 0;
  }
  
  static void *tp_field__ptr(struct tp_field *field, struct perf_sample *sample)
  {
  	return sample->raw_data + field->offset;
  }
  
  static int tp_field__init_ptr(struct tp_field *field, struct format_field *format_field)
  {
  	field->offset = format_field->offset;
  	field->pointer = tp_field__ptr;
  	return 0;
  }
  
  struct syscall_tp {
  	struct tp_field id;
  	union {
  		struct tp_field args, ret;
  	};
  };
  
  static int perf_evsel__init_tp_uint_field(struct perf_evsel *evsel,
  					  struct tp_field *field,
  					  const char *name)
  {
  	struct format_field *format_field = perf_evsel__field(evsel, name);
  
  	if (format_field == NULL)
  		return -1;
  
  	return tp_field__init_uint(field, format_field, evsel->needs_swap);
  }
  
  #define perf_evsel__init_sc_tp_uint_field(evsel, name) \
  	({ struct syscall_tp *sc = evsel->priv;\
  	   perf_evsel__init_tp_uint_field(evsel, &sc->name, #name); })
  
  static int perf_evsel__init_tp_ptr_field(struct perf_evsel *evsel,
  					 struct tp_field *field,
  					 const char *name)
  {
  	struct format_field *format_field = perf_evsel__field(evsel, name);
  
  	if (format_field == NULL)
  		return -1;
  
  	return tp_field__init_ptr(field, format_field);
  }
  
  #define perf_evsel__init_sc_tp_ptr_field(evsel, name) \
  	({ struct syscall_tp *sc = evsel->priv;\
  	   perf_evsel__init_tp_ptr_field(evsel, &sc->name, #name); })
  
  static void perf_evsel__delete_priv(struct perf_evsel *evsel)
  {

  	zfree(&evsel->priv);

  	perf_evsel__delete(evsel);
  }

  static int perf_evsel__init_syscall_tp(struct perf_evsel *evsel, void *handler)
  {
  	evsel->priv = malloc(sizeof(struct syscall_tp));
  	if (evsel->priv != NULL) {
  		if (perf_evsel__init_sc_tp_uint_field(evsel, id))
  			goto out_delete;
  
  		evsel->handler = handler;
  		return 0;
  	}
  
  	return -ENOMEM;
  
  out_delete:

  	zfree(&evsel->priv);

  	return -ENOENT;
  }

  static struct perf_evsel *perf_evsel__syscall_newtp(const char *direction, void *handler)

  {

  	struct perf_evsel *evsel = perf_evsel__newtp("raw_syscalls", direction);

  	/* older kernel (e.g., RHEL6) use syscalls:{enter,exit} */

  	if (IS_ERR(evsel))

  		evsel = perf_evsel__newtp("syscalls", direction);

  	if (IS_ERR(evsel))
  		return NULL;
  
  	if (perf_evsel__init_syscall_tp(evsel, handler))
  		goto out_delete;

  
  	return evsel;
  
  out_delete:
  	perf_evsel__delete_priv(evsel);
  	return NULL;
  }
  
  #define perf_evsel__sc_tp_uint(evsel, name, sample) \
  	({ struct syscall_tp *fields = evsel->priv; \
  	   fields->name.integer(&fields->name, sample); })
  
  #define perf_evsel__sc_tp_ptr(evsel, name, sample) \
  	({ struct syscall_tp *fields = evsel->priv; \
  	   fields->name.pointer(&fields->name, sample); })

  struct syscall_arg {
  	unsigned long val;

  	struct thread *thread;
  	struct trace  *trace;

  	void	      *parm;

  	u8	      idx;
  	u8	      mask;
  };

  struct strarray {

  	int	    offset;

  	int	    nr_entries;
  	const char **entries;
  };
  
  #define DEFINE_STRARRAY(array) struct strarray strarray__##array = { \
  	.nr_entries = ARRAY_SIZE(array), \
  	.entries = array, \
  }

  #define DEFINE_STRARRAY_OFFSET(array, off) struct strarray strarray__##array = { \
  	.offset	    = off, \
  	.nr_entries = ARRAY_SIZE(array), \
  	.entries = array, \
  }

  static size_t __syscall_arg__scnprintf_strarray(char *bf, size_t size,
  						const char *intfmt,
  					        struct syscall_arg *arg)

  {

  	struct strarray *sa = arg->parm;

  	int idx = arg->val - sa->offset;

  
  	if (idx < 0 || idx >= sa->nr_entries)

  		return scnprintf(bf, size, intfmt, arg->val);

  
  	return scnprintf(bf, size, "%s", sa->entries[idx]);
  }

  static size_t syscall_arg__scnprintf_strarray(char *bf, size_t size,
  					      struct syscall_arg *arg)
  {
  	return __syscall_arg__scnprintf_strarray(bf, size, "%d", arg);
  }

  #define SCA_STRARRAY syscall_arg__scnprintf_strarray

  #if defined(__i386__) || defined(__x86_64__)
  /*
   * FIXME: Make this available to all arches as soon as the ioctl beautifier
   * 	  gets rewritten to support all arches.
   */

  static size_t syscall_arg__scnprintf_strhexarray(char *bf, size_t size,
  						 struct syscall_arg *arg)
  {
  	return __syscall_arg__scnprintf_strarray(bf, size, "%#x", arg);
  }
  
  #define SCA_STRHEXARRAY syscall_arg__scnprintf_strhexarray

  #endif /* defined(__i386__) || defined(__x86_64__) */

  static size_t syscall_arg__scnprintf_fd(char *bf, size_t size,
  					struct syscall_arg *arg);
  
  #define SCA_FD syscall_arg__scnprintf_fd

  #ifndef AT_FDCWD
  #define AT_FDCWD	-100
  #endif

  static size_t syscall_arg__scnprintf_fd_at(char *bf, size_t size,
  					   struct syscall_arg *arg)
  {
  	int fd = arg->val;
  
  	if (fd == AT_FDCWD)
  		return scnprintf(bf, size, "CWD");
  
  	return syscall_arg__scnprintf_fd(bf, size, arg);
  }
  
  #define SCA_FDAT syscall_arg__scnprintf_fd_at
  
  static size_t syscall_arg__scnprintf_close_fd(char *bf, size_t size,
  					      struct syscall_arg *arg);
  
  #define SCA_CLOSE_FD syscall_arg__scnprintf_close_fd

  static size_t syscall_arg__scnprintf_hex(char *bf, size_t size,

  					 struct syscall_arg *arg)

  {

  	return scnprintf(bf, size, "%#lx", arg->val);

  }

  #define SCA_HEX syscall_arg__scnprintf_hex

  static size_t syscall_arg__scnprintf_int(char *bf, size_t size,
  					 struct syscall_arg *arg)
  {
  	return scnprintf(bf, size, "%d", arg->val);
  }
  
  #define SCA_INT syscall_arg__scnprintf_int

  static const char *bpf_cmd[] = {
  	"MAP_CREATE", "MAP_LOOKUP_ELEM", "MAP_UPDATE_ELEM", "MAP_DELETE_ELEM",
  	"MAP_GET_NEXT_KEY", "PROG_LOAD",
  };
  static DEFINE_STRARRAY(bpf_cmd);

  static const char *epoll_ctl_ops[] = { "ADD", "DEL", "MOD", };
  static DEFINE_STRARRAY_OFFSET(epoll_ctl_ops, 1);

  static const char *itimers[] = { "REAL", "VIRTUAL", "PROF", };
  static DEFINE_STRARRAY(itimers);

  static const char *keyctl_options[] = {
  	"GET_KEYRING_ID", "JOIN_SESSION_KEYRING", "UPDATE", "REVOKE", "CHOWN",
  	"SETPERM", "DESCRIBE", "CLEAR", "LINK", "UNLINK", "SEARCH", "READ",
  	"INSTANTIATE", "NEGATE", "SET_REQKEY_KEYRING", "SET_TIMEOUT",
  	"ASSUME_AUTHORITY", "GET_SECURITY", "SESSION_TO_PARENT", "REJECT",
  	"INSTANTIATE_IOV", "INVALIDATE", "GET_PERSISTENT",
  };
  static DEFINE_STRARRAY(keyctl_options);

  static const char *whences[] = { "SET", "CUR", "END",
  #ifdef SEEK_DATA
  "DATA",
  #endif
  #ifdef SEEK_HOLE
  "HOLE",
  #endif
  };
  static DEFINE_STRARRAY(whences);

  static const char *fcntl_cmds[] = {
  	"DUPFD", "GETFD", "SETFD", "GETFL", "SETFL", "GETLK", "SETLK",
  	"SETLKW", "SETOWN", "GETOWN", "SETSIG", "GETSIG", "F_GETLK64",
  	"F_SETLK64", "F_SETLKW64", "F_SETOWN_EX", "F_GETOWN_EX",
  	"F_GETOWNER_UIDS",
  };
  static DEFINE_STRARRAY(fcntl_cmds);

  static const char *rlimit_resources[] = {
  	"CPU", "FSIZE", "DATA", "STACK", "CORE", "RSS", "NPROC", "NOFILE",
  	"MEMLOCK", "AS", "LOCKS", "SIGPENDING", "MSGQUEUE", "NICE", "RTPRIO",
  	"RTTIME",
  };
  static DEFINE_STRARRAY(rlimit_resources);

  static const char *sighow[] = { "BLOCK", "UNBLOCK", "SETMASK", };
  static DEFINE_STRARRAY(sighow);

  static const char *clockid[] = {
  	"REALTIME", "MONOTONIC", "PROCESS_CPUTIME_ID", "THREAD_CPUTIME_ID",

  	"MONOTONIC_RAW", "REALTIME_COARSE", "MONOTONIC_COARSE", "BOOTTIME",
  	"REALTIME_ALARM", "BOOTTIME_ALARM", "SGI_CYCLE", "TAI"

  };
  static DEFINE_STRARRAY(clockid);

  static const char *socket_families[] = {
  	"UNSPEC", "LOCAL", "INET", "AX25", "IPX", "APPLETALK", "NETROM",
  	"BRIDGE", "ATMPVC", "X25", "INET6", "ROSE", "DECnet", "NETBEUI",
  	"SECURITY", "KEY", "NETLINK", "PACKET", "ASH", "ECONET", "ATMSVC",
  	"RDS", "SNA", "IRDA", "PPPOX", "WANPIPE", "LLC", "IB", "CAN", "TIPC",
  	"BLUETOOTH", "IUCV", "RXRPC", "ISDN", "PHONET", "IEEE802154", "CAIF",
  	"ALG", "NFC", "VSOCK",
  };
  static DEFINE_STRARRAY(socket_families);

  static size_t syscall_arg__scnprintf_access_mode(char *bf, size_t size,
  						 struct syscall_arg *arg)
  {
  	size_t printed = 0;
  	int mode = arg->val;
  
  	if (mode == F_OK) /* 0 */
  		return scnprintf(bf, size, "F");
  #define	P_MODE(n) \
  	if (mode & n##_OK) { \
  		printed += scnprintf(bf + printed, size - printed, "%s", #n); \
  		mode &= ~n##_OK; \
  	}
  
  	P_MODE(R);
  	P_MODE(W);
  	P_MODE(X);
  #undef P_MODE
  
  	if (mode)
  		printed += scnprintf(bf + printed, size - printed, "|%#x", mode);
  
  	return printed;
  }
  
  #define SCA_ACCMODE syscall_arg__scnprintf_access_mode

  static size_t syscall_arg__scnprintf_filename(char *bf, size_t size,
  					      struct syscall_arg *arg);
  
  #define SCA_FILENAME syscall_arg__scnprintf_filename

  static size_t syscall_arg__scnprintf_pipe_flags(char *bf, size_t size,
  						struct syscall_arg *arg)
  {
  	int printed = 0, flags = arg->val;
  
  #define	P_FLAG(n) \
  	if (flags & O_##n) { \
  		printed += scnprintf(bf + printed, size - printed, "%s%s", printed ? "|" : "", #n); \
  		flags &= ~O_##n; \
  	}
  
  	P_FLAG(CLOEXEC);
  	P_FLAG(NONBLOCK);
  #undef P_FLAG
  
  	if (flags)
  		printed += scnprintf(bf + printed, size - printed, "%s%#x", printed ? "|" : "", flags);
  
  	return printed;
  }
  
  #define SCA_PIPE_FLAGS syscall_arg__scnprintf_pipe_flags

  #if defined(__i386__) || defined(__x86_64__)
  /*
   * FIXME: Make this available to all arches.
   */

  #define TCGETS		0x5401
  
  static const char *tioctls[] = {
  	"TCGETS", "TCSETS", "TCSETSW", "TCSETSF", "TCGETA", "TCSETA", "TCSETAW",
  	"TCSETAF", "TCSBRK", "TCXONC", "TCFLSH", "TIOCEXCL", "TIOCNXCL",
  	"TIOCSCTTY", "TIOCGPGRP", "TIOCSPGRP", "TIOCOUTQ", "TIOCSTI",
  	"TIOCGWINSZ", "TIOCSWINSZ", "TIOCMGET", "TIOCMBIS", "TIOCMBIC",
  	"TIOCMSET", "TIOCGSOFTCAR", "TIOCSSOFTCAR", "FIONREAD", "TIOCLINUX",
  	"TIOCCONS", "TIOCGSERIAL", "TIOCSSERIAL", "TIOCPKT", "FIONBIO",
  	"TIOCNOTTY", "TIOCSETD", "TIOCGETD", "TCSBRKP", [0x27] = "TIOCSBRK",
  	"TIOCCBRK", "TIOCGSID", "TCGETS2", "TCSETS2", "TCSETSW2", "TCSETSF2",
  	"TIOCGRS485", "TIOCSRS485", "TIOCGPTN", "TIOCSPTLCK",
  	"TIOCGDEV||TCGETX", "TCSETX", "TCSETXF", "TCSETXW", "TIOCSIG",
  	"TIOCVHANGUP", "TIOCGPKT", "TIOCGPTLCK", "TIOCGEXCL",
  	[0x50] = "FIONCLEX", "FIOCLEX", "FIOASYNC", "TIOCSERCONFIG",
  	"TIOCSERGWILD", "TIOCSERSWILD", "TIOCGLCKTRMIOS", "TIOCSLCKTRMIOS",
  	"TIOCSERGSTRUCT", "TIOCSERGETLSR", "TIOCSERGETMULTI", "TIOCSERSETMULTI",
  	"TIOCMIWAIT", "TIOCGICOUNT", [0x60] = "FIOQSIZE",
  };
  
  static DEFINE_STRARRAY_OFFSET(tioctls, 0x5401);

  #endif /* defined(__i386__) || defined(__x86_64__) */

  #ifndef GRND_NONBLOCK
  #define GRND_NONBLOCK	0x0001
  #endif
  #ifndef GRND_RANDOM
  #define GRND_RANDOM	0x0002
  #endif

  static size_t syscall_arg__scnprintf_getrandom_flags(char *bf, size_t size,
  						   struct syscall_arg *arg)
  {
  	int printed = 0, flags = arg->val;
  
  #define	P_FLAG(n) \
  	if (flags & GRND_##n) { \
  		printed += scnprintf(bf + printed, size - printed, "%s%s", printed ? "|" : "", #n); \
  		flags &= ~GRND_##n; \
  	}
  
  	P_FLAG(RANDOM);
  	P_FLAG(NONBLOCK);
  #undef P_FLAG
  
  	if (flags)
  		printed += scnprintf(bf + printed, size - printed, "%s%#x", printed ? "|" : "", flags);
  
  	return printed;
  }
  
  #define SCA_GETRANDOM_FLAGS syscall_arg__scnprintf_getrandom_flags

  #define STRARRAY(arg, name, array) \
  	  .arg_scnprintf = { [arg] = SCA_STRARRAY, }, \
  	  .arg_parm	 = { [arg] = &strarray__##array, }

  #include "trace/beauty/eventfd.c"

  #include "trace/beauty/flock.c"

  #include "trace/beauty/futex_op.c"

  #include "trace/beauty/mmap.c"

  #include "trace/beauty/mode_t.c"

  #include "trace/beauty/msg_flags.c"

  #include "trace/beauty/open_flags.c"

  #include "trace/beauty/perf_event_open.c"

  #include "trace/beauty/pid.c"

  #include "trace/beauty/sched_policy.c"

  #include "trace/beauty/seccomp.c"

  #include "trace/beauty/signum.c"

  #include "trace/beauty/socket_type.c"

  #include "trace/beauty/waitid_options.c"

  static struct syscall_fmt {
  	const char *name;

  	const char *alias;

  	size_t	   (*arg_scnprintf[6])(char *bf, size_t size, struct syscall_arg *arg);

  	void	   *arg_parm[6];

  	bool	   errmsg;

  	bool	   errpid;

  	bool	   timeout;

  	bool	   hexret;

  } syscall_fmts[] = {

  	{ .name	    = "access",	    .errmsg = true,

  	  .arg_scnprintf = { [1] = SCA_ACCMODE,  /* mode */ }, },

  	{ .name	    = "arch_prctl", .errmsg = true, .alias = "prctl", },

  	{ .name	    = "bpf",	    .errmsg = true, STRARRAY(0, cmd, bpf_cmd), },

  	{ .name	    = "brk",	    .hexret = true,
  	  .arg_scnprintf = { [0] = SCA_HEX, /* brk */ }, },

  	{ .name	    = "chdir",	    .errmsg = true, },
  	{ .name	    = "chmod",	    .errmsg = true, },
  	{ .name	    = "chroot",	    .errmsg = true, },

  	{ .name     = "clock_gettime",  .errmsg = true, STRARRAY(0, clk_id, clockid), },

  	{ .name	    = "clone",	    .errpid = true, },

  	{ .name	    = "close",	    .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_CLOSE_FD, /* fd */ }, },

  	{ .name	    = "connect",    .errmsg = true, },

  	{ .name	    = "creat",	    .errmsg = true, },

  	{ .name	    = "dup",	    .errmsg = true, },
  	{ .name	    = "dup2",	    .errmsg = true, },
  	{ .name	    = "dup3",	    .errmsg = true, },

  	{ .name	    = "epoll_ctl",  .errmsg = true, STRARRAY(1, op, epoll_ctl_ops), },

  	{ .name	    = "eventfd2",   .errmsg = true,
  	  .arg_scnprintf = { [1] = SCA_EFD_FLAGS, /* flags */ }, },

  	{ .name	    = "faccessat",  .errmsg = true, },

  	{ .name	    = "fadvise64",  .errmsg = true, },
  	{ .name	    = "fallocate",  .errmsg = true, },
  	{ .name	    = "fchdir",	    .errmsg = true, },
  	{ .name	    = "fchmod",	    .errmsg = true, },

  	{ .name	    = "fchmodat",   .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, },

  	{ .name	    = "fchown",	    .errmsg = true, },

  	{ .name	    = "fchownat",   .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, },

  	{ .name	    = "fcntl",	    .errmsg = true,

  	  .arg_scnprintf = { [1] = SCA_STRARRAY, /* cmd */ },

  	  .arg_parm	 = { [1] = &strarray__fcntl_cmds, /* cmd */ }, },

  	{ .name	    = "fdatasync",  .errmsg = true, },

  	{ .name	    = "flock",	    .errmsg = true,

  	  .arg_scnprintf = { [1] = SCA_FLOCK, /* cmd */ }, },
  	{ .name	    = "fsetxattr",  .errmsg = true, },
  	{ .name	    = "fstat",	    .errmsg = true, .alias = "newfstat", },

  	{ .name	    = "fstatat",    .errmsg = true, .alias = "newfstatat", },

  	{ .name	    = "fstatfs",    .errmsg = true, },
  	{ .name	    = "fsync",    .errmsg = true, },
  	{ .name	    = "ftruncate", .errmsg = true, },

  	{ .name	    = "futex",	    .errmsg = true,
  	  .arg_scnprintf = { [1] = SCA_FUTEX_OP, /* op */ }, },

  	{ .name	    = "futimesat", .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, },

  	{ .name	    = "getdents",   .errmsg = true, },
  	{ .name	    = "getdents64", .errmsg = true, },

  	{ .name	    = "getitimer",  .errmsg = true, STRARRAY(0, which, itimers), },

  	{ .name	    = "getpid",	    .errpid = true, },

  	{ .name	    = "getpgid",    .errpid = true, },

  	{ .name	    = "getppid",    .errpid = true, },

  	{ .name	    = "getrandom",  .errmsg = true,
  	  .arg_scnprintf = { [2] = SCA_GETRANDOM_FLAGS, /* flags */ }, },

  	{ .name	    = "getrlimit",  .errmsg = true, STRARRAY(0, resource, rlimit_resources), },

  	{ .name	    = "getxattr",   .errmsg = true, },
  	{ .name	    = "inotify_add_watch",	    .errmsg = true, },

  	{ .name	    = "ioctl",	    .errmsg = true,

  	  .arg_scnprintf = {

  #if defined(__i386__) || defined(__x86_64__)
  /*
   * FIXME: Make this available to all arches.
   */

  			     [1] = SCA_STRHEXARRAY, /* cmd */
  			     [2] = SCA_HEX, /* arg */ },
  	  .arg_parm	 = { [1] = &strarray__tioctls, /* cmd */ }, },

  #else
  			     [2] = SCA_HEX, /* arg */ }, },
  #endif

  	{ .name	    = "keyctl",	    .errmsg = true, STRARRAY(0, option, keyctl_options), },

  	{ .name	    = "kill",	    .errmsg = true,
  	  .arg_scnprintf = { [1] = SCA_SIGNUM, /* sig */ }, },

  	{ .name	    = "lchown",    .errmsg = true, },
  	{ .name	    = "lgetxattr",  .errmsg = true, },

  	{ .name	    = "linkat",	    .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, },

  	{ .name	    = "listxattr",  .errmsg = true, },
  	{ .name	    = "llistxattr", .errmsg = true, },
  	{ .name	    = "lremovexattr",  .errmsg = true, },

  	{ .name	    = "lseek",	    .errmsg = true,

  	  .arg_scnprintf = { [2] = SCA_STRARRAY, /* whence */ },

  	  .arg_parm	 = { [2] = &strarray__whences, /* whence */ }, },

  	{ .name	    = "lsetxattr",  .errmsg = true, },
  	{ .name	    = "lstat",	    .errmsg = true, .alias = "newlstat", },
  	{ .name	    = "lsxattr",    .errmsg = true, },

  	{ .name     = "madvise",    .errmsg = true,
  	  .arg_scnprintf = { [0] = SCA_HEX,	 /* start */
  			     [2] = SCA_MADV_BHV, /* behavior */ }, },

  	{ .name	    = "mkdir",    .errmsg = true, },

  	{ .name	    = "mkdirat",    .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, },
  	{ .name	    = "mknod",      .errmsg = true, },

  	{ .name	    = "mknodat",    .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* fd */ }, },

  	{ .name	    = "mlock",	    .errmsg = true,
  	  .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, },
  	{ .name	    = "mlockall",   .errmsg = true,
  	  .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, },

  	{ .name	    = "mmap",	    .hexret = true,

  	  .arg_scnprintf = { [0] = SCA_HEX,	  /* addr */

  			     [2] = SCA_MMAP_PROT, /* prot */

  			     [3] = SCA_MMAP_FLAGS, /* flags */ }, },

  	{ .name	    = "mprotect",   .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_HEX, /* start */
  			     [2] = SCA_MMAP_PROT, /* prot */ }, },

  	{ .name	    = "mq_unlink", .errmsg = true,
  	  .arg_scnprintf = { [0] = SCA_FILENAME, /* u_name */ }, },

  	{ .name	    = "mremap",	    .hexret = true,
  	  .arg_scnprintf = { [0] = SCA_HEX, /* addr */

  			     [3] = SCA_MREMAP_FLAGS, /* flags */

  			     [4] = SCA_HEX, /* new_addr */ }, },

  	{ .name	    = "munlock",    .errmsg = true,
  	  .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, },

  	{ .name	    = "munmap",	    .errmsg = true,
  	  .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, },

  	{ .name	    = "name_to_handle_at", .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },

  	{ .name	    = "newfstatat", .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },

  	{ .name	    = "open",	    .errmsg = true,

  	  .arg_scnprintf = { [1] = SCA_OPEN_FLAGS, /* flags */ }, },

  	{ .name	    = "open_by_handle_at", .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */
  			     [2] = SCA_OPEN_FLAGS, /* flags */ }, },

  	{ .name	    = "openat",	    .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */
  			     [2] = SCA_OPEN_FLAGS, /* flags */ }, },

  	{ .name	    = "perf_event_open", .errmsg = true,

  	  .arg_scnprintf = { [2] = SCA_INT, /* cpu */

  			     [3] = SCA_FD,  /* group_fd */
  			     [4] = SCA_PERF_FLAGS,  /* flags */ }, },

  	{ .name	    = "pipe2",	    .errmsg = true,
  	  .arg_scnprintf = { [1] = SCA_PIPE_FLAGS, /* flags */ }, },

  	{ .name	    = "poll",	    .errmsg = true, .timeout = true, },
  	{ .name	    = "ppoll",	    .errmsg = true, .timeout = true, },

  	{ .name	    = "pread",	    .errmsg = true, .alias = "pread64", },
  	{ .name	    = "preadv",	    .errmsg = true, .alias = "pread", },

  	{ .name	    = "prlimit64",  .errmsg = true, STRARRAY(1, resource, rlimit_resources), },

  	{ .name	    = "pwrite",	    .errmsg = true, .alias = "pwrite64", },
  	{ .name	    = "pwritev",    .errmsg = true, },
  	{ .name	    = "read",	    .errmsg = true, },

  	{ .name	    = "readlink",   .errmsg = true, },

  	{ .name	    = "readlinkat", .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },

  	{ .name	    = "readv",	    .errmsg = true, },

  	{ .name	    = "recvfrom",   .errmsg = true,

  	  .arg_scnprintf = { [3] = SCA_MSG_FLAGS, /* flags */ }, },

  	{ .name	    = "recvmmsg",   .errmsg = true,

  	  .arg_scnprintf = { [3] = SCA_MSG_FLAGS, /* flags */ }, },

  	{ .name	    = "recvmsg",    .errmsg = true,

  	  .arg_scnprintf = { [2] = SCA_MSG_FLAGS, /* flags */ }, },

  	{ .name	    = "removexattr", .errmsg = true, },

  	{ .name	    = "renameat",   .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },

  	{ .name	    = "rmdir",    .errmsg = true, },

  	{ .name	    = "rt_sigaction", .errmsg = true,
  	  .arg_scnprintf = { [0] = SCA_SIGNUM, /* sig */ }, },

  	{ .name	    = "rt_sigprocmask",  .errmsg = true, STRARRAY(0, how, sighow), },

  	{ .name	    = "rt_sigqueueinfo", .errmsg = true,
  	  .arg_scnprintf = { [1] = SCA_SIGNUM, /* sig */ }, },
  	{ .name	    = "rt_tgsigqueueinfo", .errmsg = true,
  	  .arg_scnprintf = { [2] = SCA_SIGNUM, /* sig */ }, },

  	{ .name	    = "sched_getattr",	      .errmsg = true, },
  	{ .name	    = "sched_setattr",	      .errmsg = true, },

  	{ .name	    = "sched_setscheduler",   .errmsg = true,
  	  .arg_scnprintf = { [1] = SCA_SCHED_POLICY, /* policy */ }, },

  	{ .name	    = "seccomp", .errmsg = true,
  	  .arg_scnprintf = { [0] = SCA_SECCOMP_OP, /* op */
  			     [1] = SCA_SECCOMP_FLAGS, /* flags */ }, },

  	{ .name	    = "select",	    .errmsg = true, .timeout = true, },

  	{ .name	    = "sendmmsg",    .errmsg = true,

  	  .arg_scnprintf = { [3] = SCA_MSG_FLAGS, /* flags */ }, },

  	{ .name	    = "sendmsg",    .errmsg = true,

  	  .arg_scnprintf = { [2] = SCA_MSG_FLAGS, /* flags */ }, },

  	{ .name	    = "sendto",	    .errmsg = true,

  	  .arg_scnprintf = { [3] = SCA_MSG_FLAGS, /* flags */ }, },

  	{ .name	    = "set_tid_address", .errpid = true, },

  	{ .name	    = "setitimer",  .errmsg = true, STRARRAY(0, which, itimers), },

  	{ .name	    = "setpgid",    .errmsg = true, },

  	{ .name	    = "setrlimit",  .errmsg = true, STRARRAY(0, resource, rlimit_resources), },

  	{ .name	    = "setxattr",   .errmsg = true, },

  	{ .name	    = "shutdown",   .errmsg = true, },

  	{ .name	    = "socket",	    .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_STRARRAY, /* family */
  			     [1] = SCA_SK_TYPE, /* type */ },

  	  .arg_parm	 = { [0] = &strarray__socket_families, /* family */ }, },
  	{ .name	    = "socketpair", .errmsg = true,
  	  .arg_scnprintf = { [0] = SCA_STRARRAY, /* family */
  			     [1] = SCA_SK_TYPE, /* type */ },

  	  .arg_parm	 = { [0] = &strarray__socket_families, /* family */ }, },

  	{ .name	    = "stat",	    .errmsg = true, .alias = "newstat", },
  	{ .name	    = "statfs",	    .errmsg = true, },

  	{ .name	    = "swapoff",    .errmsg = true,
  	  .arg_scnprintf = { [0] = SCA_FILENAME, /* specialfile */ }, },
  	{ .name	    = "swapon",	    .errmsg = true,
  	  .arg_scnprintf = { [0] = SCA_FILENAME, /* specialfile */ }, },

  	{ .name	    = "symlinkat",  .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },

  	{ .name	    = "tgkill",	    .errmsg = true,
  	  .arg_scnprintf = { [2] = SCA_SIGNUM, /* sig */ }, },
  	{ .name	    = "tkill",	    .errmsg = true,
  	  .arg_scnprintf = { [1] = SCA_SIGNUM, /* sig */ }, },

  	{ .name	    = "truncate",   .errmsg = true, },

  	{ .name	    = "uname",	    .errmsg = true, .alias = "newuname", },

  	{ .name	    = "unlinkat",   .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* dfd */ }, },
  	{ .name	    = "utime",  .errmsg = true, },

  	{ .name	    = "utimensat",  .errmsg = true,

  	  .arg_scnprintf = { [0] = SCA_FDAT, /* dirfd */ }, },
  	{ .name	    = "utimes",  .errmsg = true, },

  	{ .name	    = "vmsplice",  .errmsg = true, },

  	{ .name	    = "wait4",	    .errpid = true,

  	  .arg_scnprintf = { [2] = SCA_WAITID_OPTIONS, /* options */ }, },

  	{ .name	    = "waitid",	    .errpid = true,

  	  .arg_scnprintf = { [3] = SCA_WAITID_OPTIONS, /* options */ }, },

  	{ .name	    = "write",	    .errmsg = true, },
  	{ .name	    = "writev",	    .errmsg = true, },

  };
  
  static int syscall_fmt__cmp(const void *name, const void *fmtp)
  {
  	const struct syscall_fmt *fmt = fmtp;
  	return strcmp(name, fmt->name);
  }
  
  static struct syscall_fmt *syscall_fmt__find(const char *name)
  {
  	const int nmemb = ARRAY_SIZE(syscall_fmts);
  	return bsearch(name, syscall_fmts, nmemb, sizeof(struct syscall_fmt), syscall_fmt__cmp);
  }
  
  struct syscall {
  	struct event_format *tp_format;

  	int		    nr_args;
  	struct format_field *args;

  	const char	    *name;

  	bool		    is_exit;

  	struct syscall_fmt  *fmt;

  	size_t		    (**arg_scnprintf)(char *bf, size_t size, struct syscall_arg *arg);

  	void		    **arg_parm;

  };

  static size_t fprintf_duration(unsigned long t, FILE *fp)
  {
  	double duration = (double)t / NSEC_PER_MSEC;
  	size_t printed = fprintf(fp, "(");
  
  	if (duration >= 1.0)
  		printed += color_fprintf(fp, PERF_COLOR_RED, "%6.3f ms", duration);
  	else if (duration >= 0.01)
  		printed += color_fprintf(fp, PERF_COLOR_YELLOW, "%6.3f ms", duration);
  	else
  		printed += color_fprintf(fp, PERF_COLOR_NORMAL, "%6.3f ms", duration);

  	return printed + fprintf(fp, "): ");

  }

  /**
   * filename.ptr: The filename char pointer that will be vfs_getname'd
   * filename.entry_str_pos: Where to insert the string translated from
   *                         filename.ptr by the vfs_getname tracepoint/kprobe.
   */

  struct thread_trace {
  	u64		  entry_time;
  	u64		  exit_time;
  	bool		  entry_pending;

  	unsigned long	  nr_events;

  	unsigned long	  pfmaj, pfmin;

  	char		  *entry_str;

  	double		  runtime_ms;

          struct {
  		unsigned long ptr;

  		short int     entry_str_pos;
  		bool	      pending_open;
  		unsigned int  namelen;
  		char	      *name;

  	} filename;

  	struct {
  		int	  max;
  		char	  **table;
  	} paths;

  
  	struct intlist *syscall_stats;

  };
  
  static struct thread_trace *thread_trace__new(void)
  {

  	struct thread_trace *ttrace =  zalloc(sizeof(struct thread_trace));
  
  	if (ttrace)
  		ttrace->paths.max = -1;

  	ttrace->syscall_stats = intlist__new(NULL);

  	return ttrace;

  }

  static struct thread_trace *thread__trace(struct thread *thread, FILE *fp)

  {

  	struct thread_trace *ttrace;

  	if (thread == NULL)
  		goto fail;

  	if (thread__priv(thread) == NULL)
  		thread__set_priv(thread, thread_trace__new());

  	if (thread__priv(thread) == NULL)

  		goto fail;

  	ttrace = thread__priv(thread);

  	++ttrace->nr_events;
  
  	return ttrace;

  fail:

  	color_fprintf(fp, PERF_COLOR_RED,

  		      "WARNING: not enough memory, dropping samples!
  ");
  	return NULL;
  }

  #define TRACE_PFMAJ		(1 << 0)
  #define TRACE_PFMIN		(1 << 1)

  static const size_t trace__entry_str_size = 2048;

  static int trace__set_fd_pathname(struct thread *thread, int fd, const char *pathname)

  {

  	struct thread_trace *ttrace = thread__priv(thread);

  
  	if (fd > ttrace->paths.max) {
  		char **npath = realloc(ttrace->paths.table, (fd + 1) * sizeof(char *));
  
  		if (npath == NULL)
  			return -1;
  
  		if (ttrace->paths.max != -1) {
  			memset(npath + ttrace->paths.max + 1, 0,
  			       (fd - ttrace->paths.max) * sizeof(char *));
  		} else {
  			memset(npath, 0, (fd + 1) * sizeof(char *));
  		}
  
  		ttrace->paths.table = npath;
  		ttrace->paths.max   = fd;
  	}
  
  	ttrace->paths.table[fd] = strdup(pathname);
  
  	return ttrace->paths.table[fd] != NULL ? 0 : -1;
  }

  static int thread__read_fd_path(struct thread *thread, int fd)
  {
  	char linkname[PATH_MAX], pathname[PATH_MAX];
  	struct stat st;
  	int ret;
  
  	if (thread->pid_ == thread->tid) {
  		scnprintf(linkname, sizeof(linkname),
  			  "/proc/%d/fd/%d", thread->pid_, fd);
  	} else {
  		scnprintf(linkname, sizeof(linkname),
  			  "/proc/%d/task/%d/fd/%d", thread->pid_, thread->tid, fd);
  	}
  
  	if (lstat(linkname, &st) < 0 || st.st_size + 1 > (off_t)sizeof(pathname))
  		return -1;
  
  	ret = readlink(linkname, pathname, sizeof(pathname));
  
  	if (ret < 0 || ret > st.st_size)
  		return -1;
  
  	pathname[ret] = '\0';
  	return trace__set_fd_pathname(thread, fd, pathname);
  }

  static const char *thread__fd_path(struct thread *thread, int fd,
  				   struct trace *trace)

  {

  	struct thread_trace *ttrace = thread__priv(thread);

  
  	if (ttrace == NULL)
  		return NULL;
  
  	if (fd < 0)
  		return NULL;

  	if ((fd > ttrace->paths.max || ttrace->paths.table[fd] == NULL)) {

  		if (!trace->live)
  			return NULL;
  		++trace->stats.proc_getname;

  		if (thread__read_fd_path(thread, fd))

  			return NULL;
  	}

  
  	return ttrace->paths.table[fd];
  }
  
  static size_t syscall_arg__scnprintf_fd(char *bf, size_t size,
  					struct syscall_arg *arg)
  {
  	int fd = arg->val;
  	size_t printed = scnprintf(bf, size, "%d", fd);

  	const char *path = thread__fd_path(arg->thread, fd, arg->trace);

  
  	if (path)
  		printed += scnprintf(bf + printed, size - printed, "<%s>", path);
  
  	return printed;
  }
  
  static size_t syscall_arg__scnprintf_close_fd(char *bf, size_t size,
  					      struct syscall_arg *arg)
  {
  	int fd = arg->val;
  	size_t printed = syscall_arg__scnprintf_fd(bf, size, arg);

  	struct thread_trace *ttrace = thread__priv(arg->thread);

  	if (ttrace && fd >= 0 && fd <= ttrace->paths.max)
  		zfree(&ttrace->paths.table[fd]);

  
  	return printed;
  }

  static void thread__set_filename_pos(struct thread *thread, const char *bf,
  				     unsigned long ptr)
  {
  	struct thread_trace *ttrace = thread__priv(thread);
  
  	ttrace->filename.ptr = ptr;
  	ttrace->filename.entry_str_pos = bf - ttrace->entry_str;
  }
  
  static size_t syscall_arg__scnprintf_filename(char *bf, size_t size,
  					      struct syscall_arg *arg)
  {
  	unsigned long ptr = arg->val;
  
  	if (!arg->trace->vfs_getname)
  		return scnprintf(bf, size, "%#x", ptr);
  
  	thread__set_filename_pos(arg->thread, bf, ptr);
  	return 0;
  }

  static bool trace__filter_duration(struct trace *trace, double t)
  {
  	return t < (trace->duration_filter * NSEC_PER_MSEC);
  }

  static size_t trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp)
  {
  	double ts = (double)(tstamp - trace->base_time) / NSEC_PER_MSEC;

  	return fprintf(fp, "%10.3f ", ts);

  }

  static bool done = false;

  static bool interrupted = false;

  static void sig_handler(int sig)

  {
  	done = true;

  	interrupted = sig == SIGINT;

  }

  static size_t trace__fprintf_entry_head(struct trace *trace, struct thread *thread,

  					u64 duration, u64 tstamp, FILE *fp)

  {
  	size_t printed = trace__fprintf_tstamp(trace, tstamp, fp);

  	printed += fprintf_duration(duration, fp);

  	if (trace->multiple_threads) {
  		if (trace->show_comm)

  			printed += fprintf(fp, "%.14s/", thread__comm_str(thread));

  		printed += fprintf(fp, "%d ", thread->tid);

  	}

  
  	return printed;
  }

  static int trace__process_event(struct trace *trace, struct machine *machine,

  				union perf_event *event, struct perf_sample *sample)

  {
  	int ret = 0;
  
  	switch (event->header.type) {
  	case PERF_RECORD_LOST:

  		color_fprintf(trace->output, PERF_COLOR_RED,

  			      "LOST %" PRIu64 " events!
  ", event->lost.lost);

  		ret = machine__process_lost_event(machine, event, sample);

  		break;

  	default:

  		ret = machine__process_event(machine, event, sample);

  		break;
  	}
  
  	return ret;
  }

  static int trace__tool_process(struct perf_tool *tool,

  			       union perf_event *event,

  			       struct perf_sample *sample,

  			       struct machine *machine)
  {

  	struct trace *trace = container_of(tool, struct trace, tool);

  	return trace__process_event(trace, machine, event, sample);

  }

  static char *trace__machine__resolve_kernel_addr(void *vmachine, unsigned long long *addrp, char **modp)
  {
  	struct machine *machine = vmachine;
  
  	if (machine->kptr_restrict_warned)
  		return NULL;
  
  	if (symbol_conf.kptr_restrict) {
  		pr_warning("Kernel address maps (/proc/{kallsyms,modules}) are restricted.
  
  "
  			   "Check /proc/sys/kernel/kptr_restrict.
  
  "
  			   "Kernel samples will not be resolved.
  ");
  		machine->kptr_restrict_warned = true;
  		return NULL;
  	}
  
  	return machine__resolve_kernel_addr(vmachine, addrp, modp);
  }

  static int trace__symbols_init(struct trace *trace, struct perf_evlist *evlist)
  {

  	int err = symbol__init(NULL);

  
  	if (err)
  		return err;

  	trace->host = machine__new_host();
  	if (trace->host == NULL)
  		return -ENOMEM;

  	if (trace_event__register_resolver(trace->host, trace__machine__resolve_kernel_addr) < 0)

  		return -errno;

  	err = __machine__synthesize_threads(trace->host, &trace->tool, &trace->opts.target,

  					    evlist->threads, trace__tool_process, false,
  					    trace->opts.proc_map_timeout);

  	if (err)
  		symbol__exit();
  
  	return err;
  }

  static int syscall__set_arg_fmts(struct syscall *sc)
  {
  	struct format_field *field;

  	int idx = 0, len;

  	sc->arg_scnprintf = calloc(sc->nr_args, sizeof(void *));

  	if (sc->arg_scnprintf == NULL)
  		return -1;

  	if (sc->fmt)
  		sc->arg_parm = sc->fmt->arg_parm;

  	for (field = sc->args; field; field = field->next) {

  		if (sc->fmt && sc->fmt->arg_scnprintf[idx])
  			sc->arg_scnprintf[idx] = sc->fmt->arg_scnprintf[idx];

  		else if (strcmp(field->type, "const char *") == 0 &&
  			 (strcmp(field->name, "filename") == 0 ||
  			  strcmp(field->name, "path") == 0 ||
  			  strcmp(field->name, "pathname") == 0))
  			sc->arg_scnprintf[idx] = SCA_FILENAME;

  		else if (field->flags & FIELD_IS_POINTER)

  			sc->arg_scnprintf[idx] = syscall_arg__scnprintf_hex;

  		else if (strcmp(field->type, "pid_t") == 0)
  			sc->arg_scnprintf[idx] = SCA_PID;

  		else if (strcmp(field->type, "umode_t") == 0)
  			sc->arg_scnprintf[idx] = SCA_MODE_T;

  		else if ((strcmp(field->type, "int") == 0 ||
  			  strcmp(field->type, "unsigned int") == 0 ||
  			  strcmp(field->type, "long") == 0) &&
  			 (len = strlen(field->name)) >= 2 &&
  			 strcmp(field->name + len - 2, "fd") == 0) {
  			/*
  			 * /sys/kernel/tracing/events/syscalls/sys_enter*
  			 * egrep 'field:.*fd;' .../format|sed -r 's/.*field:([a-z ]+) [a-z_]*fd.+/\1/g'|sort|uniq -c
  			 * 65 int
  			 * 23 unsigned int
  			 * 7 unsigned long
  			 */
  			sc->arg_scnprintf[idx] = SCA_FD;
  		}

  		++idx;
  	}
  
  	return 0;
  }

  static int trace__read_syscall_info(struct trace *trace, int id)
  {
  	char tp_name[128];
  	struct syscall *sc;

  	const char *name = syscalltbl__name(trace->sctbl, id);

  
  	if (name == NULL)
  		return -1;

  
  	if (id > trace->syscalls.max) {
  		struct syscall *nsyscalls = realloc(trace->syscalls.table, (id + 1) * sizeof(*sc));
  
  		if (nsyscalls == NULL)
  			return -1;
  
  		if (trace->syscalls.max != -1) {
  			memset(nsyscalls + trace->syscalls.max + 1, 0,
  			       (id - trace->syscalls.max) * sizeof(*sc));
  		} else {
  			memset(nsyscalls, 0, (id + 1) * sizeof(*sc));
  		}
  
  		trace->syscalls.table = nsyscalls;
  		trace->syscalls.max   = id;
  	}
  
  	sc = trace->syscalls.table + id;

  	sc->name = name;

  	sc->fmt  = syscall_fmt__find(sc->name);

  	snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->name);

  	sc->tp_format = trace_event__tp_format("syscalls", tp_name);

  	if (IS_ERR(sc->tp_format) && sc->fmt && sc->fmt->alias) {

  		snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->fmt->alias);

  		sc->tp_format = trace_event__tp_format("syscalls", tp_name);

  	}

  	if (IS_ERR(sc->tp_format))

  		return -1;

  	sc->args = sc->tp_format->format.fields;
  	sc->nr_args = sc->tp_format->format.nr_fields;

  	/*
  	 * We need to check and discard the first variable '__syscall_nr'
  	 * or 'nr' that mean the syscall number. It is needless here.
  	 * So drop '__syscall_nr' or 'nr' field but does not exist on older kernels.
  	 */
  	if (sc->args && (!strcmp(sc->args->name, "__syscall_nr") || !strcmp(sc->args->name, "nr"))) {

  		sc->args = sc->args->next;
  		--sc->nr_args;
  	}

  	sc->is_exit = !strcmp(name, "exit_group") || !strcmp(name, "exit");

  	return syscall__set_arg_fmts(sc);

  }

  static int trace__validate_ev_qualifier(struct trace *trace)
  {

  	int err = 0, i;

  	struct str_node *pos;

  	trace->ev_qualifier_ids.nr = strlist__nr_entries(trace->ev_qualifier);
  	trace->ev_qualifier_ids.entries = malloc(trace->ev_qualifier_ids.nr *
  						 sizeof(trace->ev_qualifier_ids.entries[0]));
  
  	if (trace->ev_qualifier_ids.entries == NULL) {
  		fputs("Error:\tNot enough memory for allocating events qualifier ids
  ",
  		       trace->output);
  		err = -EINVAL;
  		goto out;
  	}
  
  	i = 0;

  	strlist__for_each_entry(pos, trace->ev_qualifier) {

  		const char *sc = pos->s;

  		int id = syscalltbl__id(trace->sctbl, sc);

  		if (id < 0) {

  			if (err == 0) {
  				fputs("Error:\tInvalid syscall ", trace->output);
  				err = -EINVAL;
  			} else {
  				fputs(", ", trace->output);
  			}
  
  			fputs(sc, trace->output);
  		}

  
  		trace->ev_qualifier_ids.entries[i++] = id;

  	}
  
  	if (err < 0) {
  		fputs("
  Hint:\ttry 'perf list syscalls:sys_enter_*'"
  		      "
  Hint:\tand: 'man syscalls'
  ", trace->output);

  		zfree(&trace->ev_qualifier_ids.entries);
  		trace->ev_qualifier_ids.nr = 0;

  	}

  out:

  	return err;
  }

  /*
   * args is to be interpreted as a series of longs but we need to handle
   * 8-byte unaligned accesses. args points to raw_data within the event
   * and raw_data is guaranteed to be 8-byte unaligned because it is
   * preceded by raw_size which is a u32. So we need to copy args to a temp
   * variable to read it. Most notably this avoids extended load instructions
   * on unaligned addresses
   */

  static size_t syscall__scnprintf_args(struct syscall *sc, char *bf, size_t size,

  				      unsigned char *args, struct trace *trace,

  				      struct thread *thread)

  {

  	size_t printed = 0;

  	unsigned char *p;
  	unsigned long val;

  	if (sc->args != NULL) {

  		struct format_field *field;

  		u8 bit = 1;
  		struct syscall_arg arg = {

  			.idx	= 0,
  			.mask	= 0,
  			.trace  = trace,
  			.thread = thread,

  		};

  		for (field = sc->args; field;

  		     field = field->next, ++arg.idx, bit <<= 1) {
  			if (arg.mask & bit)

  				continue;

  
  			/* special care for unaligned accesses */
  			p = args + sizeof(unsigned long) * arg.idx;
  			memcpy(&val, p, sizeof(val));

  			/*
   			 * Suppress this argument if its value is zero and
   			 * and we don't have a string associated in an
   			 * strarray for it.
   			 */

  			if (val == 0 &&

  			    !(sc->arg_scnprintf &&
  			      sc->arg_scnprintf[arg.idx] == SCA_STRARRAY &&
  			      sc->arg_parm[arg.idx]))

  				continue;

  			printed += scnprintf(bf + printed, size - printed,

  					     "%s%s: ", printed ? ", " : "", field->name);

  			if (sc->arg_scnprintf && sc->arg_scnprintf[arg.idx]) {

  				arg.val = val;

  				if (sc->arg_parm)
  					arg.parm = sc->arg_parm[arg.idx];

  				printed += sc->arg_scnprintf[arg.idx](bf + printed,
  								      size - printed, &arg);

  			} else {

  				printed += scnprintf(bf + printed, size - printed,

  						     "%ld", val);

  			}

  		}

  	} else if (IS_ERR(sc->tp_format)) {
  		/*
  		 * If we managed to read the tracepoint /format file, then we
  		 * may end up not having any args, like with gettid(), so only
  		 * print the raw args when we didn't manage to read it.
  		 */

  		int i = 0;

  		while (i < 6) {

  			/* special care for unaligned accesses */
  			p = args + sizeof(unsigned long) * i;
  			memcpy(&val, p, sizeof(val));

  			printed += scnprintf(bf + printed, size - printed,
  					     "%sarg%d: %ld",

  					     printed ? ", " : "", i, val);

  			++i;
  		}
  	}
  
  	return printed;
  }

  typedef int (*tracepoint_handler)(struct trace *trace, struct perf_evsel *evsel,

  				  union perf_event *event,

  				  struct perf_sample *sample);
  
  static struct syscall *trace__syscall_info(struct trace *trace,

  					   struct perf_evsel *evsel, int id)

  {

  
  	if (id < 0) {

  
  		/*
  		 * XXX: Noticed on x86_64, reproduced as far back as 3.0.36, haven't tried
  		 * before that, leaving at a higher verbosity level till that is
  		 * explained. Reproduced with plain ftrace with:
  		 *
  		 * echo 1 > /t/events/raw_syscalls/sys_exit/enable
  		 * grep "NR -1 " /t/trace_pipe
  		 *
  		 * After generating some load on the machine.
   		 */
  		if (verbose > 1) {
  			static u64 n;
  			fprintf(trace->output, "Invalid syscall %d id, skipping (%s, %" PRIu64 ") ...
  ",
  				id, perf_evsel__name(evsel), ++n);
  		}

  		return NULL;
  	}
  
  	if ((id > trace->syscalls.max || trace->syscalls.table[id].name == NULL) &&
  	    trace__read_syscall_info(trace, id))
  		goto out_cant_read;
  
  	if ((id > trace->syscalls.max || trace->syscalls.table[id].name == NULL))
  		goto out_cant_read;
  
  	return &trace->syscalls.table[id];
  
  out_cant_read:

  	if (verbose) {
  		fprintf(trace->output, "Problems reading syscall %d", id);
  		if (id <= trace->syscalls.max && trace->syscalls.table[id].name != NULL)
  			fprintf(trace->output, "(%s)", trace->syscalls.table[id].name);
  		fputs(" information
  ", trace->output);
  	}

  	return NULL;
  }

  static void thread__update_stats(struct thread_trace *ttrace,
  				 int id, struct perf_sample *sample)
  {
  	struct int_node *inode;
  	struct stats *stats;
  	u64 duration = 0;
  
  	inode = intlist__findnew(ttrace->syscall_stats, id);
  	if (inode == NULL)
  		return;
  
  	stats = inode->priv;
  	if (stats == NULL) {
  		stats = malloc(sizeof(struct stats));
  		if (stats == NULL)
  			return;
  		init_stats(stats);
  		inode->priv = stats;
  	}
  
  	if (ttrace->entry_time && sample->time > ttrace->entry_time)
  		duration = sample->time - ttrace->entry_time;
  
  	update_stats(stats, duration);
  }

  static int trace__printf_interrupted_entry(struct trace *trace, struct perf_sample *sample)
  {
  	struct thread_trace *ttrace;
  	u64 duration;
  	size_t printed;
  
  	if (trace->current == NULL)
  		return 0;
  
  	ttrace = thread__priv(trace->current);
  
  	if (!ttrace->entry_pending)
  		return 0;
  
  	duration = sample->time - ttrace->entry_time;

  	printed  = trace__fprintf_entry_head(trace, trace->current, duration, ttrace->entry_time, trace->output);

  	printed += fprintf(trace->output, "%-70s) ...
  ", ttrace->entry_str);
  	ttrace->entry_pending = false;
  
  	return printed;
  }

  static int trace__sys_enter(struct trace *trace, struct perf_evsel *evsel,

  			    union perf_event *event __maybe_unused,

  			    struct perf_sample *sample)
  {

  	char *msg;

  	void *args;

  	size_t printed = 0;

  	struct thread *thread;

  	int id = perf_evsel__sc_tp_uint(evsel, id, sample), err = -1;

  	struct syscall *sc = trace__syscall_info(trace, evsel, id);

  	struct thread_trace *ttrace;
  
  	if (sc == NULL)
  		return -1;

  	thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);

  	ttrace = thread__trace(thread, trace->output);

  	if (ttrace == NULL)

  		goto out_put;

  	args = perf_evsel__sc_tp_ptr(evsel, args, sample);

  
  	if (ttrace->entry_str == NULL) {

  		ttrace->entry_str = malloc(trace__entry_str_size);

  		if (!ttrace->entry_str)

  			goto out_put;

  	}

  	if (!(trace->duration_filter || trace->summary_only || trace->min_stack))

  		trace__printf_interrupted_entry(trace, sample);

  	ttrace->entry_time = sample->time;
  	msg = ttrace->entry_str;

  	printed += scnprintf(msg + printed, trace__entry_str_size - printed, "%s(", sc->name);

  	printed += syscall__scnprintf_args(sc, msg + printed, trace__entry_str_size - printed,

  					   args, trace, thread);

  	if (sc->is_exit) {

  		if (!(trace->duration_filter || trace->summary_only || trace->min_stack)) {

  			trace__fprintf_entry_head(trace, thread, 1, ttrace->entry_time, trace->output);

  			fprintf(trace->output, "%-70s)
  ", ttrace->entry_str);

  		}

  	} else {

  		ttrace->entry_pending = true;

  		/* See trace__vfs_getname & trace__sys_exit */
  		ttrace->filename.pending_open = false;
  	}

  	if (trace->current != thread) {
  		thread__put(trace->current);
  		trace->current = thread__get(thread);
  	}

  	err = 0;
  out_put:
  	thread__put(thread);
  	return err;

  }

  static int trace__resolve_callchain(struct trace *trace, struct perf_evsel *evsel,
  				    struct perf_sample *sample,
  				    struct callchain_cursor *cursor)

  {
  	struct addr_location al;

  
  	if (machine__resolve(trace->host, &al, sample) < 0 ||
  	    thread__resolve_callchain(al.thread, cursor, evsel, sample, NULL, NULL, trace->max_stack))
  		return -1;
  
  	return 0;
  }
  
  static int trace__fprintf_callchain(struct trace *trace, struct perf_sample *sample)
  {

  	/* TODO: user-configurable print_opts */

  	const unsigned int print_opts = EVSEL__PRINT_SYM |
  				        EVSEL__PRINT_DSO |
  				        EVSEL__PRINT_UNKNOWN_AS_ADDR;

  	return sample__fprintf_callchain(sample, 38, print_opts, &callchain_cursor, trace->output);

  }

  static int trace__sys_exit(struct trace *trace, struct perf_evsel *evsel,

  			   union perf_event *event __maybe_unused,

  			   struct perf_sample *sample)
  {

  	long ret;

  	u64 duration = 0;

  	struct thread *thread;

  	int id = perf_evsel__sc_tp_uint(evsel, id, sample), err = -1, callchain_ret = 0;

  	struct syscall *sc = trace__syscall_info(trace, evsel, id);

  	struct thread_trace *ttrace;
  
  	if (sc == NULL)
  		return -1;

  	thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);

  	ttrace = thread__trace(thread, trace->output);

  	if (ttrace == NULL)

  		goto out_put;

  	if (trace->summary)
  		thread__update_stats(ttrace, id, sample);

  	ret = perf_evsel__sc_tp_uint(evsel, ret, sample);

  	if (id == trace->open_id && ret >= 0 && ttrace->filename.pending_open) {

  		trace__set_fd_pathname(thread, ret, ttrace->filename.name);
  		ttrace->filename.pending_open = false;

  		++trace->stats.vfs_getname;
  	}

  	ttrace->exit_time = sample->time;

  	if (ttrace->entry_time) {

  		duration = sample->time - ttrace->entry_time;

  		if (trace__filter_duration(trace, duration))
  			goto out;
  	} else if (trace->duration_filter)
  		goto out;

  	if (sample->callchain) {
  		callchain_ret = trace__resolve_callchain(trace, evsel, sample, &callchain_cursor);
  		if (callchain_ret == 0) {
  			if (callchain_cursor.nr < trace->min_stack)
  				goto out;
  			callchain_ret = 1;
  		}
  	}

  	if (trace->summary_only)
  		goto out;

  	trace__fprintf_entry_head(trace, thread, duration, ttrace->entry_time, trace->output);

  
  	if (ttrace->entry_pending) {

  		fprintf(trace->output, "%-70s", ttrace->entry_str);

  	} else {

  		fprintf(trace->output, " ... [");
  		color_fprintf(trace->output, PERF_COLOR_YELLOW, "continued");
  		fprintf(trace->output, "]: %s()", sc->name);

  	}

  	if (sc->fmt == NULL) {
  signed_print:

  		fprintf(trace->output, ") = %ld", ret);

  	} else if (ret < 0 && (sc->fmt->errmsg || sc->fmt->errpid)) {

  		char bf[STRERR_BUFSIZE];

  		const char *emsg = str_error_r(-ret, bf, sizeof(bf)),

  			   *e = audit_errno_to_name(-ret);

  		fprintf(trace->output, ") = -1 %s %s", e, emsg);

  	} else if (ret == 0 && sc->fmt->timeout)

  		fprintf(trace->output, ") = 0 Timeout");

  	else if (sc->fmt->hexret)

  		fprintf(trace->output, ") = %#lx", ret);

  	else if (sc->fmt->errpid) {
  		struct thread *child = machine__find_thread(trace->host, ret, ret);
  
  		if (child != NULL) {
  			fprintf(trace->output, ") = %ld", ret);
  			if (child->comm_set)
  				fprintf(trace->output, " (%s)", thread__comm_str(child));
  			thread__put(child);
  		}
  	} else

  		goto signed_print;

  	fputc('
  ', trace->output);

  	if (callchain_ret > 0)
  		trace__fprintf_callchain(trace, sample);
  	else if (callchain_ret < 0)
  		pr_err("Problem processing %s callchain, skipping...
  ", perf_evsel__name(evsel));

  out:

  	ttrace->entry_pending = false;

  	err = 0;
  out_put:
  	thread__put(thread);
  	return err;

  }

  static int trace__vfs_getname(struct trace *trace, struct perf_evsel *evsel,

  			      union perf_event *event __maybe_unused,

  			      struct perf_sample *sample)
  {

  	struct thread *thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);
  	struct thread_trace *ttrace;
  	size_t filename_len, entry_str_len, to_move;
  	ssize_t remaining_space;
  	char *pos;

  	const char *filename = perf_evsel__rawptr(evsel, sample, "pathname");

  
  	if (!thread)
  		goto out;
  
  	ttrace = thread__priv(thread);
  	if (!ttrace)
  		goto out;

  	filename_len = strlen(filename);
  
  	if (ttrace->filename.namelen < filename_len) {
  		char *f = realloc(ttrace->filename.name, filename_len + 1);
  
  		if (f == NULL)
  				goto out;
  
  		ttrace->filename.namelen = filename_len;
  		ttrace->filename.name = f;
  	}
  
  	strcpy(ttrace->filename.name, filename);
  	ttrace->filename.pending_open = true;

  	if (!ttrace->filename.ptr)
  		goto out;
  
  	entry_str_len = strlen(ttrace->entry_str);
  	remaining_space = trace__entry_str_size - entry_str_len - 1; /* \0 */
  	if (remaining_space <= 0)
  		goto out;

  	if (filename_len > (size_t)remaining_space) {
  		filename += filename_len - remaining_space;
  		filename_len = remaining_space;
  	}
  
  	to_move = entry_str_len - ttrace->filename.entry_str_pos + 1; /* \0 */
  	pos = ttrace->entry_str + ttrace->filename.entry_str_pos;
  	memmove(pos + filename_len, pos, to_move);
  	memcpy(pos, filename, filename_len);
  
  	ttrace->filename.ptr = 0;
  	ttrace->filename.entry_str_pos = 0;
  out:

  	return 0;
  }

  static int trace__sched_stat_runtime(struct trace *trace, struct perf_evsel *evsel,

  				     union perf_event *event __maybe_unused,

  				     struct perf_sample *sample)
  {
          u64 runtime = perf_evsel__intval(evsel, sample, "runtime");
  	double runtime_ms = (double)runtime / NSEC_PER_MSEC;

  	struct thread *thread = machine__findnew_thread(trace->host,

  							sample->pid,
  							sample->tid);

  	struct thread_trace *ttrace = thread__trace(thread, trace->output);

  
  	if (ttrace == NULL)
  		goto out_dump;
  
  	ttrace->runtime_ms += runtime_ms;
  	trace->runtime_ms += runtime_ms;

  	thread__put(thread);

  	return 0;
  
  out_dump:

  	fprintf(trace->output, "%s: comm=%s,pid=%u,runtime=%" PRIu64 ",vruntime=%" PRIu64 ")
  ",

  	       evsel->name,
  	       perf_evsel__strval(evsel, sample, "comm"),
  	       (pid_t)perf_evsel__intval(evsel, sample, "pid"),
  	       runtime,
  	       perf_evsel__intval(evsel, sample, "vruntime"));

  	thread__put(thread);

  	return 0;
  }

  static void bpf_output__printer(enum binary_printer_ops op,
  				unsigned int val, void *extra)
  {
  	FILE *output = extra;
  	unsigned char ch = (unsigned char)val;
  
  	switch (op) {
  	case BINARY_PRINT_CHAR_DATA:
  		fprintf(output, "%c", isprint(ch) ? ch : '.');
  		break;
  	case BINARY_PRINT_DATA_BEGIN:
  	case BINARY_PRINT_LINE_BEGIN:
  	case BINARY_PRINT_ADDR:
  	case BINARY_PRINT_NUM_DATA:
  	case BINARY_PRINT_NUM_PAD:
  	case BINARY_PRINT_SEP:
  	case BINARY_PRINT_CHAR_PAD:
  	case BINARY_PRINT_LINE_END:
  	case BINARY_PRINT_DATA_END:
  	default:
  		break;
  	}
  }
  
  static void bpf_output__fprintf(struct trace *trace,
  				struct perf_sample *sample)
  {
  	print_binary(sample->raw_data, sample->raw_size, 8,
  		     bpf_output__printer, trace->output);
  }

  static int trace__event_handler(struct trace *trace, struct perf_evsel *evsel,
  				union perf_event *event __maybe_unused,
  				struct perf_sample *sample)
  {

  	int callchain_ret = 0;
  
  	if (sample->callchain) {
  		callchain_ret = trace__resolve_callchain(trace, evsel, sample, &callchain_cursor);
  		if (callchain_ret == 0) {
  			if (callchain_cursor.nr < trace->min_stack)
  				goto out;
  			callchain_ret = 1;
  		}
  	}

  	trace__printf_interrupted_entry(trace, sample);
  	trace__fprintf_tstamp(trace, sample->time, trace->output);

  
  	if (trace->trace_syscalls)
  		fprintf(trace->output, "(         ): ");
  
  	fprintf(trace->output, "%s:", evsel->name);

  	if (perf_evsel__is_bpf_output(evsel)) {
  		bpf_output__fprintf(trace, sample);
  	} else if (evsel->tp_format) {

  		event_format__fprintf(evsel->tp_format, sample->cpu,
  				      sample->raw_data, sample->raw_size,
  				      trace->output);
  	}
  
  	fprintf(trace->output, ")
  ");

  	if (callchain_ret > 0)
  		trace__fprintf_callchain(trace, sample);
  	else if (callchain_ret < 0)
  		pr_err("Problem processing %s callchain, skipping...
  ", perf_evsel__name(evsel));
  out:

  	return 0;
  }

  static void print_location(FILE *f, struct perf_sample *sample,
  			   struct addr_location *al,
  			   bool print_dso, bool print_sym)
  {
  
  	if ((verbose || print_dso) && al->map)
  		fprintf(f, "%s@", al->map->dso->long_name);
  
  	if ((verbose || print_sym) && al->sym)

  		fprintf(f, "%s+0x%" PRIx64, al->sym->name,

  			al->addr - al->sym->start);
  	else if (al->map)

  		fprintf(f, "0x%" PRIx64, al->addr);

  	else

  		fprintf(f, "0x%" PRIx64, sample->addr);

  }
  
  static int trace__pgfault(struct trace *trace,
  			  struct perf_evsel *evsel,

  			  union perf_event *event __maybe_unused,

  			  struct perf_sample *sample)
  {
  	struct thread *thread;

  	struct addr_location al;
  	char map_type = 'd';

  	struct thread_trace *ttrace;

  	int err = -1;

  	int callchain_ret = 0;

  
  	thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);