[PATCH 3/4] Add the syscall_any and syscall_any.return probe points

[William Cohen <wcohen at redhat dot com>]

The syscall.*{.return} and np_syscall.*.{.return} end up expanding to
large amount of code that takes a signficant amount of time to
compile.  The resulting kernel module also takes a fair amount of time
to install and remove the instrumentation when it starts and shuts
down.  For instrumentation don't really care about the details of the
syscall arguments it would be preferable to use the sys_enter and sys_exit
tracepoints to more efficiently probe the one or two places.

Using tp_syscall.*{.return} end up generating a lot of code to
determine which of the hundreds of syscall is being used and then runs
the same handler.  The syscall_any and syscall_any.return eliminate
that undesired overhead by just looking up the syscall name in a
table.
---
 doc/SystemTap_Tapset_Reference/tapsets.tmpl | 12 +++++
 tapset/linux/sysc_any.stp                   | 50 +++++++++++++++++++++
 2 files changed, 62 insertions(+)
 create mode 100644 tapset/linux/sysc_any.stp

diff --git a/doc/SystemTap_Tapset_Reference/tapsets.tmpl b/doc/SystemTap_Tapset_Reference/tapsets.tmpl
index c92e91b68..74e7f7762 100644
--- a/doc/SystemTap_Tapset_Reference/tapsets.tmpl
+++ b/doc/SystemTap_Tapset_Reference/tapsets.tmpl
@@ -463,6 +463,18 @@
 !Itapset/switchfile.stp
   </chapter>
 
+  <chapter id="syscall_any.stp">
+    <title>Syscall Any Tapset</title>
+    <para>
+      This family of probe points is designed to provide low cost
+      instrumentation for cases where only the syscall name (or number)
+      and return value are required and there is no need for the detailed
+      syscall argument values. They are restricted versions of
+      syscall.* and syscall.*.return.
+    </para>
+!Itapset/linux/sysc_any.stp
+  </chapter>
+
 !Syscalls
 
 </book>
diff --git a/tapset/linux/sysc_any.stp b/tapset/linux/sysc_any.stp
new file mode 100644
index 000000000..5ef1f794e
--- /dev/null
+++ b/tapset/linux/sysc_any.stp
@@ -0,0 +1,50 @@
+/**
+ * probe syscall_any - Record entry into a syscall
+ *
+ * @syscall_nr: number of the syscall
+ * @name: name of the syscall
+ *
+ * Context: The process performing the syscall
+ *
+ * The syscall_any probe point is designed to be a low overhead
+ * that monitors all the syscalls entered via a kernel tracepoint.
+ * Because of the breadth of syscalls it monitors it provides
+ * no information about the syscall arguments or argstr string
+ * representation of those arguments.
+ *
+ * This requires kernel 3.5+ and newer which have the
+ * kernel.trace("sys_enter") probe point.
+ */
+probe syscall_any = kernel.trace("sys_enter")
+{
+	__set_syscall_pt_regs($regs)
+	syscall_nr = $id
+	name = syscall_name($id)
+}
+
+/**
+ * probe syscall_any.return - Record exit from a syscall
+ *
+ * @syscall_nr: number of the syscall
+ * @name: name of the syscall
+ * @retval: return value of the syscall
+ *
+ * Context: The process performing the syscall
+ *
+ * The syscall_any.return probe point is designed to be a low overhead
+ * that monitors all the syscalls returns via a kernel tracepoint.
+ * Because of the breadth of syscalls it monitors it provides
+ * no information about the syscall arguments, argstr string
+ * representation of those arguments, or a string interpretation
+ * of the return value (retval).
+ *
+ * This requires kernel 3.5+ and newer which have the
+ * kernel.trace("sys_exit") probe point.
+ */
+probe syscall_any.return = kernel.trace("sys_exit")
+{
+	__set_syscall_pt_regs($regs)
+	syscall_nr = _stp_syscall_nr()
+	name = syscall_name(_stp_syscall_nr())
+	retval = $ret
+}
-- 
2.17.1