1  // SPDX-License-Identifier: GPL-2.0
2  /*
3      Description:
4  
5      . Disable strace like syscall tracing (--no-syscalls), or try tracing
6        just some (-e *sleep).
7  
8      . Attach a filter function to a kernel function, returning when it should
9        be considered, i.e. appear on the output.
10  
11      . Run it system wide, so that any sleep of >= 5 seconds and < than 6
12        seconds gets caught.
13  
14      . Ask for callgraphs using DWARF info, so that userspace can be unwound
15  
16      . While this is running, run something like "sleep 5s".
17  
18      . If we decide to add tv_nsec as well, then it becomes:
19  
20        int probe(hrtimer_nanosleep, rqtp->tv_sec rqtp->tv_nsec)(void *ctx, int err, long sec, long nsec)
21  
22        I.e. add where it comes from (rqtp->tv_nsec) and where it will be
23        accessible in the function body (nsec)
24  
25      # perf trace --no-syscalls -e tools/perf/examples/bpf/5sec.c/call-graph=dwarf/
26           0.000 perf_bpf_probe:func:(ffffffff9811b5f0) tv_sec=5
27                                             hrtimer_nanosleep ([kernel.kallsyms])
28                                             __x64_sys_nanosleep ([kernel.kallsyms])
29                                             do_syscall_64 ([kernel.kallsyms])
30                                             entry_SYSCALL_64 ([kernel.kallsyms])
31                                             __GI___nanosleep (/usr/lib64/libc-2.26.so)
32                                             rpl_nanosleep (/usr/bin/sleep)
33                                             xnanosleep (/usr/bin/sleep)
34                                             main (/usr/bin/sleep)
35                                             __libc_start_main (/usr/lib64/libc-2.26.so)
36                                             _start (/usr/bin/sleep)
37      ^C#
38  
39     Copyright (C) 2018 Red Hat, Inc., Arnaldo Carvalho de Melo <acme@redhat.com>
40  */
41  
42  #include <linux/bpf.h>
43  #include <bpf/bpf_helpers.h>
44  
45  #define NSEC_PER_SEC	1000000000L
46  
47  SEC("hrtimer_nanosleep=hrtimer_nanosleep rqtp")
hrtimer_nanosleep(void * ctx,int err,long long sec)48  int hrtimer_nanosleep(void *ctx, int err, long long sec)
49  {
50  	return sec / NSEC_PER_SEC == 5ULL;
51  }
52  
53  char _license[] SEC("license") = "GPL";
54