1 files changed, 498 insertions, 139 deletions

diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 4f0bbffee05f..0f633f0d6be8 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: GPL-2.0-only
 /*
  * builtin-trace.c
  *
@@ -15,6 +14,7 @@
  * http://lwn.net/Articles/415728/ ("Announcing a new utility: 'trace'")
  */
 
+#include "util/record.h"
 #include <traceevent/event-parse.h>
 #include <api/fs/tracing_path.h>
 #include <bpf/bpf.h>
@@ -25,9 +25,12 @@
 #include "util/color.h"
 #include "util/config.h"
 #include "util/debug.h"
+#include "util/dso.h"
 #include "util/env.h"
 #include "util/event.h"
 #include "util/evlist.h"
+#include "util/evswitch.h"
+#include <subcmd/pager.h>
 #include <subcmd/exec-cmd.h>
 #include "util/machine.h"
 #include "util/map.h"
@@ -40,6 +43,8 @@
 #include "util/intlist.h"
 #include "util/thread_map.h"
 #include "util/stat.h"
+#include "util/tool.h"
+#include "util/util.h"
 #include "trace/beauty/beauty.h"
 #include "trace-event.h"
 #include "util/parse-events.h"
@@ -49,6 +54,7 @@
 #include "string2.h"
 #include "syscalltbl.h"
 #include "rb_resort.h"
+#include "../perf.h"
 
 #include <errno.h>
 #include <inttypes.h>
@@ -80,28 +86,34 @@ struct trace {
         struct perf_tool        tool;
         struct syscalltbl       *sctbl;
         struct {
-                int             max;
                 struct syscall  *table;
                 struct bpf_map  *map;
+                struct { // per syscall BPF_MAP_TYPE_PROG_ARRAY
+                        struct bpf_map  *sys_enter,
+                                        *sys_exit;
+                }               prog_array;
                 struct {
-                        struct perf_evsel *sys_enter,
+                        struct evsel *sys_enter,
                                           *sys_exit,
                                           *augmented;
                 }               events;
+                struct bpf_program *unaugmented_prog;
         } syscalls;
         struct {
                 struct bpf_map *map;
         } dump;
         struct record_opts      opts;
-        struct perf_evlist      *evlist;
+        struct evlist   *evlist;
         struct machine          *host;
         struct thread           *current;
+        struct bpf_object       *bpf_obj;
         struct cgroup           *cgroup;
         u64                     base_time;
         FILE                    *output;
         unsigned long           nr_events;
         unsigned long           nr_events_printed;
         unsigned long           max_events;
+        struct evswitch         evswitch;
         struct strlist          *ev_qualifier;
         struct {
                 size_t          nr;
@@ -122,6 +134,7 @@ struct trace {
         unsigned int            min_stack;
         int                     raw_augmented_syscalls_args_size;
         bool                    raw_augmented_syscalls;
+        bool                    fd_path_disabled;
         bool                    sort_events;
         bool                    not_ev_qualifier;
         bool                    live;
@@ -237,7 +250,7 @@ struct syscall_tp {
         };
 };
 
-static int perf_evsel__init_tp_uint_field(struct perf_evsel *evsel,
+static int perf_evsel__init_tp_uint_field(struct evsel *evsel,
                                           struct tp_field *field,
                                           const char *name)
 {
@@ -253,7 +266,7 @@ static int perf_evsel__init_tp_uint_field(struct perf_evsel *evsel,
         ({ struct syscall_tp *sc = evsel->priv;\
            perf_evsel__init_tp_uint_field(evsel, &sc->name, #name); })
 
-static int perf_evsel__init_tp_ptr_field(struct perf_evsel *evsel,
+static int perf_evsel__init_tp_ptr_field(struct evsel *evsel,
                                          struct tp_field *field,
                                          const char *name)
 {
@@ -269,13 +282,13 @@ static int perf_evsel__init_tp_ptr_field(struct perf_evsel *evsel,
         ({ struct syscall_tp *sc = evsel->priv;\
            perf_evsel__init_tp_ptr_field(evsel, &sc->name, #name); })
 
-static void perf_evsel__delete_priv(struct perf_evsel *evsel)
+static void evsel__delete_priv(struct evsel *evsel)
 {
         zfree(&evsel->priv);
-        perf_evsel__delete(evsel);
+        evsel__delete(evsel);
 }
 
-static int perf_evsel__init_syscall_tp(struct perf_evsel *evsel)
+static int perf_evsel__init_syscall_tp(struct evsel *evsel)
 {
         struct syscall_tp *sc = evsel->priv = malloc(sizeof(struct syscall_tp));
 
@@ -292,7 +305,7 @@ out_delete:
         return -ENOENT;
 }
 
-static int perf_evsel__init_augmented_syscall_tp(struct perf_evsel *evsel, struct perf_evsel *tp)
+static int perf_evsel__init_augmented_syscall_tp(struct evsel *evsel, struct evsel *tp)
 {
         struct syscall_tp *sc = evsel->priv = malloc(sizeof(struct syscall_tp));
 
@@ -314,21 +327,21 @@ out_delete:
         return -EINVAL;
 }
 
-static int perf_evsel__init_augmented_syscall_tp_args(struct perf_evsel *evsel)
+static int perf_evsel__init_augmented_syscall_tp_args(struct evsel *evsel)
 {
         struct syscall_tp *sc = evsel->priv;
 
         return __tp_field__init_ptr(&sc->args, sc->id.offset + sizeof(u64));
 }
 
-static int perf_evsel__init_augmented_syscall_tp_ret(struct perf_evsel *evsel)
+static int perf_evsel__init_augmented_syscall_tp_ret(struct evsel *evsel)
 {
         struct syscall_tp *sc = evsel->priv;
 
         return __tp_field__init_uint(&sc->ret, sizeof(u64), sc->id.offset + sizeof(u64), evsel->needs_swap);
 }
 
-static int perf_evsel__init_raw_syscall_tp(struct perf_evsel *evsel, void *handler)
+static int perf_evsel__init_raw_syscall_tp(struct evsel *evsel, void *handler)
 {
         evsel->priv = malloc(sizeof(struct syscall_tp));
         if (evsel->priv != NULL) {
@@ -346,9 +359,9 @@ out_delete:
         return -ENOENT;
 }
 
-static struct perf_evsel *perf_evsel__raw_syscall_newtp(const char *direction, void *handler)
+static struct evsel *perf_evsel__raw_syscall_newtp(const char *direction, void *handler)
 {
-        struct perf_evsel *evsel = perf_evsel__newtp("raw_syscalls", direction);
+        struct evsel *evsel = perf_evsel__newtp("raw_syscalls", direction);
 
         /* older kernel (e.g., RHEL6) use syscalls:{enter,exit} */
         if (IS_ERR(evsel))
@@ -363,7 +376,7 @@ static struct perf_evsel *perf_evsel__raw_syscall_newtp(const char *direction, v
         return evsel;
 
 out_delete:
-        perf_evsel__delete_priv(evsel);
+        evsel__delete_priv(evsel);
         return NULL;
 }
 
@@ -688,6 +701,10 @@ struct syscall_arg_fmt {
 static struct syscall_fmt {
         const char *name;
         const char *alias;
+        struct {
+                const char *sys_enter,
+                           *sys_exit;
+        }          bpf_prog_name;
         struct syscall_arg_fmt arg[6];
         u8         nr_args;
         bool       errpid;
@@ -700,7 +717,9 @@ static struct syscall_fmt {
           .arg = { [0] = { .scnprintf = SCA_X86_ARCH_PRCTL_CODE, /* code */ },
                    [1] = { .scnprintf = SCA_PTR, /* arg2 */ }, }, },
         { .name     = "bind",
-          .arg = { [1] = { .scnprintf = SCA_SOCKADDR, /* umyaddr */ }, }, },
+          .arg = { [0] = { .scnprintf = SCA_INT, /* fd */ },
+                   [1] = { .scnprintf = SCA_SOCKADDR, /* umyaddr */ },
+                   [2] = { .scnprintf = SCA_INT, /* addrlen */ }, }, },
         { .name     = "bpf",
           .arg = { [0] = STRARRAY(cmd, bpf_cmd), }, },
         { .name     = "brk",        .hexret = true,
@@ -716,7 +735,9 @@ static struct syscall_fmt {
         { .name     = "close",
           .arg = { [0] = { .scnprintf = SCA_CLOSE_FD, /* fd */ }, }, },
         { .name     = "connect",
-          .arg = { [1] = { .scnprintf = SCA_SOCKADDR, /* servaddr */ }, }, },
+          .arg = { [0] = { .scnprintf = SCA_INT, /* fd */ },
+                   [1] = { .scnprintf = SCA_SOCKADDR, /* servaddr */ },
+                   [2] = { .scnprintf = SCA_INT, /* addrlen */ }, }, },
         { .name     = "epoll_ctl",
           .arg = { [1] = STRARRAY(op, epoll_ctl_ops), }, },
         { .name     = "eventfd2",
@@ -882,6 +903,7 @@ static struct syscall_fmt {
           .arg = { [0] = { .scnprintf = SCA_SECCOMP_OP,    /* op */ },
                    [1] = { .scnprintf = SCA_SECCOMP_FLAGS, /* flags */ }, }, },
         { .name     = "select", .timeout = true, },
+        { .name     = "sendfile", .alias = "sendfile64", },
         { .name     = "sendmmsg",
           .arg = { [3] = { .scnprintf = SCA_MSG_FLAGS, /* flags */ }, }, },
         { .name     = "sendmsg",
@@ -960,13 +982,19 @@ static struct syscall_fmt *syscall_fmt__find_by_alias(const char *alias)
  * is_exit: is this "exit" or "exit_group"?
  * is_open: is this "open" or "openat"? To associate the fd returned in sys_exit with the pathname in sys_enter.
  * args_size: sum of the sizes of the syscall arguments, anything after that is augmented stuff: pathname for openat, etc.
+ * nonexistent: Just a hole in the syscall table, syscall id not allocated
  */
 struct syscall {
         struct tep_event    *tp_format;
         int                 nr_args;
         int                 args_size;
+        struct {
+                struct bpf_program *sys_enter,
+                                   *sys_exit;
+        }                   bpf_prog;
         bool                is_exit;
         bool                is_open;
+        bool                nonexistent;
         struct tep_format_field *args;
         const char          *name;
         struct syscall_fmt  *fmt;
@@ -1163,7 +1191,7 @@ static const char *thread__fd_path(struct thread *thread, int fd,
 {
         struct thread_trace *ttrace = thread__priv(thread);
 
-        if (ttrace == NULL)
+        if (ttrace == NULL || trace->fd_path_disabled)
                 return NULL;
 
         if (fd < 0)
@@ -1359,7 +1387,7 @@ static char *trace__machine__resolve_kernel_addr(void *vmachine, unsigned long l
 
         if (symbol_conf.kptr_restrict) {
                 pr_warning("Kernel address maps (/proc/{kallsyms,modules}) are restricted.\n\n"
-                           "Check /proc/sys/kernel/kptr_restrict.\n\n"
+                           "Check /proc/sys/kernel/kptr_restrict and /proc/sys/kernel/perf_event_paranoid.\n\n"
                            "Kernel samples will not be resolved.\n");
                 machine->kptr_restrict_warned = true;
                 return NULL;
@@ -1368,7 +1396,7 @@ static char *trace__machine__resolve_kernel_addr(void *vmachine, unsigned long l
         return machine__resolve_kernel_addr(vmachine, addrp, modp);
 }
 
-static int trace__symbols_init(struct trace *trace, struct perf_evlist *evlist)
+static int trace__symbols_init(struct trace *trace, struct evlist *evlist)
 {
         int err = symbol__init(NULL);
 
@@ -1384,7 +1412,7 @@ static int trace__symbols_init(struct trace *trace, struct perf_evlist *evlist)
                 goto out;
 
         err = __machine__synthesize_threads(trace->host, &trace->tool, &trace->opts.target,
-                                            evlist->threads, trace__tool_process, false,
+                                            evlist->core.threads, trace__tool_process, false,
                                             1);
 out:
         if (err)
@@ -1471,29 +1499,22 @@ static int trace__read_syscall_info(struct trace *trace, int id)
         struct syscall *sc;
         const char *name = syscalltbl__name(trace->sctbl, id);
 
-        if (name == NULL)
-                return -1;
-
-        if (id > trace->syscalls.max) {
-                struct syscall *nsyscalls = realloc(trace->syscalls.table, (id + 1) * sizeof(*sc));
-
-                if (nsyscalls == NULL)
-                        return -1;
+        if (trace->syscalls.table == NULL) {
+                trace->syscalls.table = calloc(trace->sctbl->syscalls.max_id + 1, sizeof(*sc));
+                if (trace->syscalls.table == NULL)
+                        return -ENOMEM;
+        }
 
-                if (trace->syscalls.max != -1) {
-                        memset(nsyscalls + trace->syscalls.max + 1, 0,
-                               (id - trace->syscalls.max) * sizeof(*sc));
-                } else {
-                        memset(nsyscalls, 0, (id + 1) * sizeof(*sc));
-                }
+        sc = trace->syscalls.table + id;
+        if (sc->nonexistent)
+                return 0;
 
-                trace->syscalls.table = nsyscalls;
-                trace->syscalls.max   = id;
+        if (name == NULL) {
+                sc->nonexistent = true;
+                return 0;
         }
 
-        sc = trace->syscalls.table + id;
         sc->name = name;
-
         sc->fmt  = syscall_fmt__find(sc->name);
 
         snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->name);
@@ -1505,10 +1526,10 @@ static int trace__read_syscall_info(struct trace *trace, int id)
         }
 
         if (syscall__alloc_arg_fmts(sc, IS_ERR(sc->tp_format) ? 6 : sc->tp_format->format.nr_fields))
-                return -1;
+                return -ENOMEM;
 
         if (IS_ERR(sc->tp_format))
-                return -1;
+                return PTR_ERR(sc->tp_format);
 
         sc->args = sc->tp_format->format.fields;
         /*
@@ -1527,6 +1548,13 @@ static int trace__read_syscall_info(struct trace *trace, int id)
         return syscall__set_arg_fmts(sc);
 }
 
+static int intcmp(const void *a, const void *b)
+{
+        const int *one = a, *another = b;
+
+        return *one - *another;
+}
+
 static int trace__validate_ev_qualifier(struct trace *trace)
 {
         int err = 0;
@@ -1590,6 +1618,7 @@ matches:
         }
 
         trace->ev_qualifier_ids.nr = nr_used;
+        qsort(trace->ev_qualifier_ids.entries, nr_used, sizeof(int), intcmp);
 out:
         if (printed_invalid_prefix)
                 pr_debug("\n");
@@ -1600,6 +1629,22 @@ out_free:
         goto out;
 }
 
+static __maybe_unused bool trace__syscall_enabled(struct trace *trace, int id)
+{
+        bool in_ev_qualifier;
+
+        if (trace->ev_qualifier_ids.nr == 0)
+                return true;
+
+        in_ev_qualifier = bsearch(&id, trace->ev_qualifier_ids.entries,
+                                  trace->ev_qualifier_ids.nr, sizeof(int), intcmp) != NULL;
+
+        if (in_ev_qualifier)
+               return !trace->not_ev_qualifier;
+
+        return trace->not_ev_qualifier;
+}
+
 /*
  * args is to be interpreted as a series of longs but we need to handle
  * 8-byte unaligned accesses. args points to raw_data within the event
@@ -1738,13 +1783,14 @@ next_arg:
         return printed;
 }
 
-typedef int (*tracepoint_handler)(struct trace *trace, struct perf_evsel *evsel,
+typedef int (*tracepoint_handler)(struct trace *trace, struct evsel *evsel,
                                   union perf_event *event,
                                   struct perf_sample *sample);
 
 static struct syscall *trace__syscall_info(struct trace *trace,
-                                           struct perf_evsel *evsel, int id)
+                                           struct evsel *evsel, int id)
 {
+        int err = 0;
 
         if (id < 0) {
 
@@ -1766,19 +1812,28 @@ static struct syscall *trace__syscall_info(struct trace *trace,
                 return NULL;
         }
 
-        if ((id > trace->syscalls.max || trace->syscalls.table[id].name == NULL) &&
-            trace__read_syscall_info(trace, id))
+        err = -EINVAL;
+
+        if (id > trace->sctbl->syscalls.max_id)
+                goto out_cant_read;
+
+        if ((trace->syscalls.table == NULL || trace->syscalls.table[id].name == NULL) &&
+            (err = trace__read_syscall_info(trace, id)) != 0)
                 goto out_cant_read;
 
-        if ((id > trace->syscalls.max || trace->syscalls.table[id].name == NULL))
+        if (trace->syscalls.table[id].name == NULL) {
+                if (trace->syscalls.table[id].nonexistent)
+                        return NULL;
                 goto out_cant_read;
+        }
 
         return &trace->syscalls.table[id];
 
 out_cant_read:
         if (verbose > 0) {
-                fprintf(trace->output, "Problems reading syscall %d", id);
-                if (id <= trace->syscalls.max && trace->syscalls.table[id].name != NULL)
+                char sbuf[STRERR_BUFSIZE];
+                fprintf(trace->output, "Problems reading syscall %d: %d (%s)", id, -err, str_error_r(-err, sbuf, sizeof(sbuf)));
+                if (id <= trace->sctbl->syscalls.max_id && trace->syscalls.table[id].name != NULL)
                         fprintf(trace->output, "(%s)", trace->syscalls.table[id].name);
                 fputs(" information\n", trace->output);
         }
@@ -1839,7 +1894,7 @@ static int trace__printf_interrupted_entry(struct trace *trace)
         return printed;
 }
 
-static int trace__fprintf_sample(struct trace *trace, struct perf_evsel *evsel,
+static int trace__fprintf_sample(struct trace *trace, struct evsel *evsel,
                                  struct perf_sample *sample, struct thread *thread)
 {
         int printed = 0;
@@ -1882,7 +1937,7 @@ static void *syscall__augmented_args(struct syscall *sc, struct perf_sample *sam
         return augmented_args;
 }
 
-static int trace__sys_enter(struct trace *trace, struct perf_evsel *evsel,
+static int trace__sys_enter(struct trace *trace, struct evsel *evsel,
                             union perf_event *event __maybe_unused,
                             struct perf_sample *sample)
 {
@@ -1961,7 +2016,7 @@ out_put:
         return err;
 }
 
-static int trace__fprintf_sys_enter(struct trace *trace, struct perf_evsel *evsel,
+static int trace__fprintf_sys_enter(struct trace *trace, struct evsel *evsel,
                                     struct perf_sample *sample)
 {
         struct thread_trace *ttrace;
@@ -1994,13 +2049,13 @@ out_put:
         return err;
 }
 
-static int trace__resolve_callchain(struct trace *trace, struct perf_evsel *evsel,
+static int trace__resolve_callchain(struct trace *trace, struct evsel *evsel,
                                     struct perf_sample *sample,
                                     struct callchain_cursor *cursor)
 {
         struct addr_location al;
-        int max_stack = evsel->attr.sample_max_stack ?
-                        evsel->attr.sample_max_stack :
+        int max_stack = evsel->core.attr.sample_max_stack ?
+                        evsel->core.attr.sample_max_stack :
                         trace->max_stack;
         int err;
 
@@ -2022,7 +2077,7 @@ static int trace__fprintf_callchain(struct trace *trace, struct perf_sample *sam
         return sample__fprintf_callchain(sample, 38, print_opts, &callchain_cursor, trace->output);
 }
 
-static const char *errno_to_name(struct perf_evsel *evsel, int err)
+static const char *errno_to_name(struct evsel *evsel, int err)
 {
         struct perf_env *env = perf_evsel__env(evsel);
         const char *arch_name = perf_env__arch(env);
@@ -2030,7 +2085,7 @@ static const char *errno_to_name(struct perf_evsel *evsel, int err)
         return arch_syscalls__strerrno(arch_name, err);
 }
 
-static int trace__sys_exit(struct trace *trace, struct perf_evsel *evsel,
+static int trace__sys_exit(struct trace *trace, struct evsel *evsel,
                            union perf_event *event __maybe_unused,
                            struct perf_sample *sample)
 {
@@ -2058,7 +2113,7 @@ static int trace__sys_exit(struct trace *trace, struct perf_evsel *evsel,
 
         ret = perf_evsel__sc_tp_uint(evsel, ret, sample);
 
-        if (sc->is_open && ret >= 0 && ttrace->filename.pending_open) {
+        if (!trace->fd_path_disabled && sc->is_open && ret >= 0 && ttrace->filename.pending_open) {
                 trace__set_fd_pathname(thread, ret, ttrace->filename.name);
                 ttrace->filename.pending_open = false;
                 ++trace->stats.vfs_getname;
@@ -2164,7 +2219,7 @@ out_put:
         return err;
 }
 
-static int trace__vfs_getname(struct trace *trace, struct perf_evsel *evsel,
+static int trace__vfs_getname(struct trace *trace, struct evsel *evsel,
                               union perf_event *event __maybe_unused,
                               struct perf_sample *sample)
 {
@@ -2225,7 +2280,7 @@ out:
         return 0;
 }
 
-static int trace__sched_stat_runtime(struct trace *trace, struct perf_evsel *evsel,
+static int trace__sched_stat_runtime(struct trace *trace, struct evsel *evsel,
                                      union perf_event *event __maybe_unused,
                                      struct perf_sample *sample)
 {
@@ -2287,7 +2342,7 @@ static void bpf_output__fprintf(struct trace *trace,
         ++trace->nr_events_printed;
 }
 
-static int trace__event_handler(struct trace *trace, struct perf_evsel *evsel,
+static int trace__event_handler(struct trace *trace, struct evsel *evsel,
                                 union perf_event *event __maybe_unused,
                                 struct perf_sample *sample)
 {
@@ -2353,8 +2408,8 @@ static int trace__event_handler(struct trace *trace, struct perf_evsel *evsel,
                         ++trace->nr_events_printed;
 
                         if (evsel->max_events != ULONG_MAX && ++evsel->nr_events_printed == evsel->max_events) {
-                                perf_evsel__disable(evsel);
-                                perf_evsel__close(evsel);
+                                evsel__disable(evsel);
+                                evsel__close(evsel);
                         }
                 }
         }
@@ -2389,7 +2444,7 @@ static void print_location(FILE *f, struct perf_sample *sample,
 }
 
 static int trace__pgfault(struct trace *trace,
-                          struct perf_evsel *evsel,
+                          struct evsel *evsel,
                           union perf_event *event __maybe_unused,
                           struct perf_sample *sample)
 {
@@ -2415,7 +2470,7 @@ static int trace__pgfault(struct trace *trace,
         if (ttrace == NULL)
                 goto out_put;
 
-        if (evsel->attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ)
+        if (evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ)
                 ttrace->pfmaj++;
         else
                 ttrace->pfmin++;
@@ -2428,7 +2483,7 @@ static int trace__pgfault(struct trace *trace,
         trace__fprintf_entry_head(trace, thread, 0, true, sample->time, trace->output);
 
         fprintf(trace->output, "%sfault [",
-                evsel->attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ?
+                evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ?
                 "maj" : "min");
 
         print_location(trace->output, sample, &al, false, true);
@@ -2464,7 +2519,7 @@ out_put:
 }
 
 static void trace__set_base_time(struct trace *trace,
-                                 struct perf_evsel *evsel,
+                                 struct evsel *evsel,
                                  struct perf_sample *sample)
 {
         /*
@@ -2476,14 +2531,14 @@ static void trace__set_base_time(struct trace *trace,
          * appears in our event stream (vfs_getname comes to mind).
          */
         if (trace->base_time == 0 && !trace->full_time &&
-            (evsel->attr.sample_type & PERF_SAMPLE_TIME))
+            (evsel->core.attr.sample_type & PERF_SAMPLE_TIME))
                 trace->base_time = sample->time;
 }
 
 static int trace__process_sample(struct perf_tool *tool,
                                  union perf_event *event,
                                  struct perf_sample *sample,
-                                 struct perf_evsel *evsel,
+                                 struct evsel *evsel,
                                  struct machine *machine __maybe_unused)
 {
         struct trace *trace = container_of(tool, struct trace, tool);
@@ -2569,10 +2624,10 @@ static int trace__record(struct trace *trace, int argc, const char **argv)
 
 static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp);
 
-static bool perf_evlist__add_vfs_getname(struct perf_evlist *evlist)
+static bool evlist__add_vfs_getname(struct evlist *evlist)
 {
         bool found = false;
-        struct perf_evsel *evsel, *tmp;
+        struct evsel *evsel, *tmp;
         struct parse_events_error err = { .idx = 0, };
         int ret = parse_events(evlist, "probe:vfs_getname*", &err);
 
@@ -2589,17 +2644,17 @@ static bool perf_evlist__add_vfs_getname(struct perf_evlist *evlist)
                         continue;
                 }
 
-                list_del_init(&evsel->node);
+                list_del_init(&evsel->core.node);
                 evsel->evlist = NULL;
-                perf_evsel__delete(evsel);
+                evsel__delete(evsel);
         }
 
         return found;
 }
 
-static struct perf_evsel *perf_evsel__new_pgfault(u64 config)
+static struct evsel *perf_evsel__new_pgfault(u64 config)
 {
-        struct perf_evsel *evsel;
+        struct evsel *evsel;
         struct perf_event_attr attr = {
                 .type = PERF_TYPE_SOFTWARE,
                 .mmap_data = 1,
@@ -2610,7 +2665,7 @@ static struct perf_evsel *perf_evsel__new_pgfault(u64 config)
 
         event_attr_init(&attr);
 
-        evsel = perf_evsel__new(&attr);
+        evsel = evsel__new(&attr);
         if (evsel)
                 evsel->handler = trace__pgfault;
 
@@ -2620,7 +2675,7 @@ static struct perf_evsel *perf_evsel__new_pgfault(u64 config)
 static void trace__handle_event(struct trace *trace, union perf_event *event, struct perf_sample *sample)
 {
         const u32 type = event->header.type;
-        struct perf_evsel *evsel;
+        struct evsel *evsel;
 
         if (type != PERF_RECORD_SAMPLE) {
                 trace__process_event(trace, trace->host, event, sample);
@@ -2633,9 +2688,12 @@ static void trace__handle_event(struct trace *trace, union perf_event *event, st
                 return;
         }
 
+        if (evswitch__discard(&trace->evswitch, evsel))
+                return;
+
         trace__set_base_time(trace, evsel, sample);
 
-        if (evsel->attr.type == PERF_TYPE_TRACEPOINT &&
+        if (evsel->core.attr.type == PERF_TYPE_TRACEPOINT &&
             sample->raw_data == NULL) {
                 fprintf(trace->output, "%s sample with no payload for tid: %d, cpu %d, raw_size=%d, skipping...\n",
                        perf_evsel__name(evsel), sample->tid,
@@ -2652,8 +2710,8 @@ static void trace__handle_event(struct trace *trace, union perf_event *event, st
 static int trace__add_syscall_newtp(struct trace *trace)
 {
         int ret = -1;
-        struct perf_evlist *evlist = trace->evlist;
-        struct perf_evsel *sys_enter, *sys_exit;
+        struct evlist *evlist = trace->evlist;
+        struct evsel *sys_enter, *sys_exit;
 
         sys_enter = perf_evsel__raw_syscall_newtp("sys_enter", trace__sys_enter);
         if (sys_enter == NULL)
@@ -2672,8 +2730,8 @@ static int trace__add_syscall_newtp(struct trace *trace)
         perf_evsel__config_callchain(sys_enter, &trace->opts, &callchain_param);
         perf_evsel__config_callchain(sys_exit, &trace->opts, &callchain_param);
 
-        perf_evlist__add(evlist, sys_enter);
-        perf_evlist__add(evlist, sys_exit);
+        evlist__add(evlist, sys_enter);
+        evlist__add(evlist, sys_exit);
 
         if (callchain_param.enabled && !trace->kernel_syscallchains) {
                 /*
@@ -2681,7 +2739,7 @@ static int trace__add_syscall_newtp(struct trace *trace)
                  * leading to the syscall, allow overriding that for
                  * debugging reasons using --kernel_syscall_callchains
                  */
-                sys_exit->attr.exclude_callchain_kernel = 1;
+                sys_exit->core.attr.exclude_callchain_kernel = 1;
         }
 
         trace->syscalls.events.sys_enter = sys_enter;
@@ -2692,16 +2750,16 @@ out:
         return ret;
 
 out_delete_sys_exit:
-        perf_evsel__delete_priv(sys_exit);
+        evsel__delete_priv(sys_exit);
 out_delete_sys_enter:
-        perf_evsel__delete_priv(sys_enter);
+        evsel__delete_priv(sys_enter);
         goto out;
 }
 
 static int trace__set_ev_qualifier_tp_filter(struct trace *trace)
 {
         int err = -1;
-        struct perf_evsel *sys_exit;
+        struct evsel *sys_exit;
         char *filter = asprintf_expr_inout_ints("id", !trace->not_ev_qualifier,
                                                 trace->ev_qualifier_ids.nr,
                                                 trace->ev_qualifier_ids.entries);
@@ -2724,6 +2782,70 @@ out_enomem:
 }
 
 #ifdef HAVE_LIBBPF_SUPPORT
+static struct bpf_program *trace__find_bpf_program_by_title(struct trace *trace, const char *name)
+{
+        if (trace->bpf_obj == NULL)
+                return NULL;
+
+        return bpf_object__find_program_by_title(trace->bpf_obj, name);
+}
+
+static struct bpf_program *trace__find_syscall_bpf_prog(struct trace *trace, struct syscall *sc,
+                                                        const char *prog_name, const char *type)
+{
+        struct bpf_program *prog;
+
+        if (prog_name == NULL) {
+                char default_prog_name[256];
+                scnprintf(default_prog_name, sizeof(default_prog_name), "!syscalls:sys_%s_%s", type, sc->name);
+                prog = trace__find_bpf_program_by_title(trace, default_prog_name);
+                if (prog != NULL)
+                        goto out_found;
+                if (sc->fmt && sc->fmt->alias) {
+                        scnprintf(default_prog_name, sizeof(default_prog_name), "!syscalls:sys_%s_%s", type, sc->fmt->alias);
+                        prog = trace__find_bpf_program_by_title(trace, default_prog_name);
+                        if (prog != NULL)
+                                goto out_found;
+                }
+                goto out_unaugmented;
+        }
+
+        prog = trace__find_bpf_program_by_title(trace, prog_name);
+
+        if (prog != NULL) {
+out_found:
+                return prog;
+        }
+
+        pr_debug("Couldn't find BPF prog \"%s\" to associate with syscalls:sys_%s_%s, not augmenting it\n",
+                 prog_name, type, sc->name);
+out_unaugmented:
+        return trace->syscalls.unaugmented_prog;
+}
+
+static void trace__init_syscall_bpf_progs(struct trace *trace, int id)
+{
+        struct syscall *sc = trace__syscall_info(trace, NULL, id);
+
+        if (sc == NULL)
+                return;
+
+        sc->bpf_prog.sys_enter = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_enter : NULL, "enter");
+        sc->bpf_prog.sys_exit  = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_exit  : NULL,  "exit");
+}
+
+static int trace__bpf_prog_sys_enter_fd(struct trace *trace, int id)
+{
+        struct syscall *sc = trace__syscall_info(trace, NULL, id);
+        return sc ? bpf_program__fd(sc->bpf_prog.sys_enter) : bpf_program__fd(trace->syscalls.unaugmented_prog);
+}
+
+static int trace__bpf_prog_sys_exit_fd(struct trace *trace, int id)
+{
+        struct syscall *sc = trace__syscall_info(trace, NULL, id);
+        return sc ? bpf_program__fd(sc->bpf_prog.sys_exit) : bpf_program__fd(trace->syscalls.unaugmented_prog);
+}
+
 static void trace__init_bpf_map_syscall_args(struct trace *trace, int id, struct bpf_map_syscall_entry *entry)
 {
         struct syscall *sc = trace__syscall_info(trace, NULL, id);
@@ -2755,8 +2877,10 @@ static int trace__set_ev_qualifier_bpf_filter(struct trace *trace)
         for (i = 0; i < trace->ev_qualifier_ids.nr; ++i) {
                 int key = trace->ev_qualifier_ids.entries[i];
 
-                if (value.enabled)
+                if (value.enabled) {
                         trace__init_bpf_map_syscall_args(trace, key, &value);
+                        trace__init_syscall_bpf_progs(trace, key);
+                }
 
                 err = bpf_map_update_elem(fd, &key, &value, BPF_EXIST);
                 if (err)
@@ -2795,6 +2919,186 @@ static int trace__init_syscalls_bpf_map(struct trace *trace)
 
         return __trace__init_syscalls_bpf_map(trace, enabled);
 }
+
+static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace, struct syscall *sc)
+{
+        struct tep_format_field *field, *candidate_field;
+        int id;
+
+        /*
+         * We're only interested in syscalls that have a pointer:
+         */
+        for (field = sc->args; field; field = field->next) {
+                if (field->flags & TEP_FIELD_IS_POINTER)
+                        goto try_to_find_pair;
+        }
+
+        return NULL;
+
+try_to_find_pair:
+        for (id = 0; id < trace->sctbl->syscalls.nr_entries; ++id) {
+                struct syscall *pair = trace__syscall_info(trace, NULL, id);
+                struct bpf_program *pair_prog;
+                bool is_candidate = false;
+
+                if (pair == NULL || pair == sc ||
+                    pair->bpf_prog.sys_enter == trace->syscalls.unaugmented_prog)
+                        continue;
+
+                for (field = sc->args, candidate_field = pair->args;
+                     field && candidate_field; field = field->next, candidate_field = candidate_field->next) {
+                        bool is_pointer = field->flags & TEP_FIELD_IS_POINTER,
+                             candidate_is_pointer = candidate_field->flags & TEP_FIELD_IS_POINTER;
+
+                        if (is_pointer) {
+                               if (!candidate_is_pointer) {
+                                        // The candidate just doesn't copies our pointer arg, might copy other pointers we want.
+                                        continue;
+                               }
+                        } else {
+                                if (candidate_is_pointer) {
+                                        // The candidate might copy a pointer we don't have, skip it.
+                                        goto next_candidate;
+                                }
+                                continue;
+                        }
+
+                        if (strcmp(field->type, candidate_field->type))
+                                goto next_candidate;
+
+                        is_candidate = true;
+                }
+
+                if (!is_candidate)
+                        goto next_candidate;
+
+                /*
+                 * Check if the tentative pair syscall augmenter has more pointers, if it has,
+                 * then it may be collecting that and we then can't use it, as it would collect
+                 * more than what is common to the two syscalls.
+                 */
+                if (candidate_field) {
+                        for (candidate_field = candidate_field->next; candidate_field; candidate_field = candidate_field->next)
+                                if (candidate_field->flags & TEP_FIELD_IS_POINTER)
+                                        goto next_candidate;
+                }
+
+                pair_prog = pair->bpf_prog.sys_enter;
+                /*
+                 * If the pair isn't enabled, then its bpf_prog.sys_enter will not
+                 * have been searched for, so search it here and if it returns the
+                 * unaugmented one, then ignore it, otherwise we'll reuse that BPF
+                 * program for a filtered syscall on a non-filtered one.
+                 *
+                 * For instance, we have "!syscalls:sys_enter_renameat" and that is
+                 * useful for "renameat2".
+                 */
+                if (pair_prog == NULL) {
+                        pair_prog = trace__find_syscall_bpf_prog(trace, pair, pair->fmt ? pair->fmt->bpf_prog_name.sys_enter : NULL, "enter");
+                        if (pair_prog == trace->syscalls.unaugmented_prog)
+                                goto next_candidate;
+                }
+
+                pr_debug("Reusing \"%s\" BPF sys_enter augmenter for \"%s\"\n", pair->name, sc->name);
+                return pair_prog;
+        next_candidate:
+                continue;
+        }
+
+        return NULL;
+}
+
+static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace)
+{
+        int map_enter_fd = bpf_map__fd(trace->syscalls.prog_array.sys_enter),
+            map_exit_fd  = bpf_map__fd(trace->syscalls.prog_array.sys_exit);
+        int err = 0, key;
+
+        for (key = 0; key < trace->sctbl->syscalls.nr_entries; ++key) {
+                int prog_fd;
+
+                if (!trace__syscall_enabled(trace, key))
+                        continue;
+
+                trace__init_syscall_bpf_progs(trace, key);
+
+                // It'll get at least the "!raw_syscalls:unaugmented"
+                prog_fd = trace__bpf_prog_sys_enter_fd(trace, key);
+                err = bpf_map_update_elem(map_enter_fd, &key, &prog_fd, BPF_ANY);
+                if (err)
+                        break;
+                prog_fd = trace__bpf_prog_sys_exit_fd(trace, key);
+                err = bpf_map_update_elem(map_exit_fd, &key, &prog_fd, BPF_ANY);
+                if (err)
+                        break;
+        }
+
+        /*
+         * Now lets do a second pass looking for enabled syscalls without
+         * an augmenter that have a signature that is a superset of another
+         * syscall with an augmenter so that we can auto-reuse it.
+         *
+         * I.e. if we have an augmenter for the "open" syscall that has
+         * this signature:
+         *
+         *   int open(const char *pathname, int flags, mode_t mode);
+         *
+         * I.e. that will collect just the first string argument, then we
+         * can reuse it for the 'creat' syscall, that has this signature:
+         *
+         *   int creat(const char *pathname, mode_t mode);
+         *
+         * and for:
+         *
+         *   int stat(const char *pathname, struct stat *statbuf);
+         *   int lstat(const char *pathname, struct stat *statbuf);
+         *
+         * Because the 'open' augmenter will collect the first arg as a string,
+         * and leave alone all the other args, which already helps with
+         * beautifying 'stat' and 'lstat''s pathname arg.
+         *
+         * Then, in time, when 'stat' gets an augmenter that collects both
+         * first and second arg (this one on the raw_syscalls:sys_exit prog
+         * array tail call, then that one will be used.
+         */
+        for (key = 0; key < trace->sctbl->syscalls.nr_entries; ++key) {
+                struct syscall *sc = trace__syscall_info(trace, NULL, key);
+                struct bpf_program *pair_prog;
+                int prog_fd;
+
+                if (sc == NULL || sc->bpf_prog.sys_enter == NULL)
+                        continue;
+
+                /*
+                 * For now we're just reusing the sys_enter prog, and if it
+                 * already has an augmenter, we don't need to find one.
+                 */
+                if (sc->bpf_prog.sys_enter != trace->syscalls.unaugmented_prog)
+                        continue;
+
+                /*
+                 * Look at all the other syscalls for one that has a signature
+                 * that is close enough that we can share:
+                 */
+                pair_prog = trace__find_usable_bpf_prog_entry(trace, sc);
+                if (pair_prog == NULL)
+                        continue;
+
+                sc->bpf_prog.sys_enter = pair_prog;
+
+                /*
+                 * Update the BPF_MAP_TYPE_PROG_SHARED for raw_syscalls:sys_enter
+                 * with the fd for the program we're reusing:
+                 */
+                prog_fd = bpf_program__fd(sc->bpf_prog.sys_enter);
+                err = bpf_map_update_elem(map_enter_fd, &key, &prog_fd, BPF_ANY);
+                if (err)
+                        break;
+        }
+
+
+        return err;
+}
 #else
 static int trace__set_ev_qualifier_bpf_filter(struct trace *trace __maybe_unused)
 {
@@ -2805,6 +3109,17 @@ static int trace__init_syscalls_bpf_map(struct trace *trace __maybe_unused)
 {
         return 0;
 }
+
+static struct bpf_program *trace__find_bpf_program_by_title(struct trace *trace __maybe_unused,
+                                                            const char *name __maybe_unused)
+{
+        return NULL;
+}
+
+static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace __maybe_unused)
+{
+        return 0;
+}
 #endif // HAVE_LIBBPF_SUPPORT
 
 static int trace__set_ev_qualifier_filter(struct trace *trace)
@@ -2879,7 +3194,7 @@ static int trace__set_filter_pids(struct trace *trace)
                         err = bpf_map__set_filter_pids(trace->filter_pids.map, trace->filter_pids.nr,
                                                        trace->filter_pids.entries);
                 }
-        } else if (thread_map__pid(trace->evlist->threads, 0) == -1) {
+        } else if (perf_thread_map__pid(trace->evlist->core.threads, 0) == -1) {
                 err = trace__set_filter_loop_pids(trace);
         }
 
@@ -2888,7 +3203,7 @@ static int trace__set_filter_pids(struct trace *trace)
 
 static int __trace__deliver_event(struct trace *trace, union perf_event *event)
 {
-        struct perf_evlist *evlist = trace->evlist;
+        struct evlist *evlist = trace->evlist;
         struct perf_sample sample;
         int err;
 
@@ -2946,8 +3261,8 @@ static int ordered_events__deliver_event(struct ordered_events *oe,
 
 static int trace__run(struct trace *trace, int argc, const char **argv)
 {
-        struct perf_evlist *evlist = trace->evlist;
-        struct perf_evsel *evsel, *pgfault_maj = NULL, *pgfault_min = NULL;
+        struct evlist *evlist = trace->evlist;
+        struct evsel *evsel, *pgfault_maj = NULL, *pgfault_min = NULL;
         int err = -1, i;
         unsigned long before;
         const bool forks = argc > 0;
@@ -2960,7 +3275,7 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
                         goto out_error_raw_syscalls;
 
                 if (trace->trace_syscalls)
-                        trace->vfs_getname = perf_evlist__add_vfs_getname(evlist);
+                        trace->vfs_getname = evlist__add_vfs_getname(evlist);
         }
 
         if ((trace->trace_pgfaults & TRACE_PFMAJ)) {
@@ -2968,7 +3283,7 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
                 if (pgfault_maj == NULL)
                         goto out_error_mem;
                 perf_evsel__config_callchain(pgfault_maj, &trace->opts, &callchain_param);
-                perf_evlist__add(evlist, pgfault_maj);
+                evlist__add(evlist, pgfault_maj);
         }
 
         if ((trace->trace_pgfaults & TRACE_PFMIN)) {
@@ -2976,7 +3291,7 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
                 if (pgfault_min == NULL)
                         goto out_error_mem;
                 perf_evsel__config_callchain(pgfault_min, &trace->opts, &callchain_param);
-                perf_evlist__add(evlist, pgfault_min);
+                evlist__add(evlist, pgfault_min);
         }
 
         if (trace->sched &&
@@ -3038,7 +3353,7 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
                 }
         }
 
-        err = perf_evlist__open(evlist);
+        err = evlist__open(evlist);
         if (err < 0)
                 goto out_error_open;
 
@@ -3059,6 +3374,9 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
         if (trace->syscalls.map)
                 trace__init_syscalls_bpf_map(trace);
 
+        if (trace->syscalls.prog_array.sys_enter)
+                trace__init_syscalls_bpf_prog_array_maps(trace);
+
         if (trace->ev_qualifier_ids.nr > 0) {
                 err = trace__set_ev_qualifier_filter(trace);
                 if (err < 0)
@@ -3070,6 +3388,19 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
                 }
         }
 
+        /*
+         * If the "close" syscall is not traced, then we will not have the
+         * opportunity to, in syscall_arg__scnprintf_close_fd() invalidate the
+         * fd->pathname table and were ending up showing the last value set by
+         * syscalls opening a pathname and associating it with a descriptor or
+         * reading it from /proc/pid/fd/ in cases where that doesn't make
+         * sense.
+         *
+         *  So just disable this beautifier (SCA_FD, SCA_FDAT) when 'close' is
+         *  not in use.
+         */
+        trace->fd_path_disabled = !trace__syscall_enabled(trace, syscalltbl__id(trace->sctbl, "close"));
+
         err = perf_evlist__apply_filters(evlist, &evsel);
         if (err < 0)
                 goto out_error_apply_filters;
@@ -3082,30 +3413,30 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
                 goto out_error_mmap;
 
         if (!target__none(&trace->opts.target) && !trace->opts.initial_delay)
-                perf_evlist__enable(evlist);
+                evlist__enable(evlist);
 
         if (forks)
                 perf_evlist__start_workload(evlist);
 
         if (trace->opts.initial_delay) {
                 usleep(trace->opts.initial_delay * 1000);
-                perf_evlist__enable(evlist);
+                evlist__enable(evlist);
         }
 
-        trace->multiple_threads = thread_map__pid(evlist->threads, 0) == -1 ||
-                                  evlist->threads->nr > 1 ||
-                                  perf_evlist__first(evlist)->attr.inherit;
+        trace->multiple_threads = perf_thread_map__pid(evlist->core.threads, 0) == -1 ||
+                                  evlist->core.threads->nr > 1 ||
+                                  perf_evlist__first(evlist)->core.attr.inherit;
 
         /*
-         * Now that we already used evsel->attr to ask the kernel to setup the
-         * events, lets reuse evsel->attr.sample_max_stack as the limit in
+         * Now that we already used evsel->core.attr to ask the kernel to setup the
+         * events, lets reuse evsel->core.attr.sample_max_stack as the limit in
          * trace__resolve_callchain(), allowing per-event max-stack settings
          * to override an explicitly set --max-stack global setting.
          */
         evlist__for_each_entry(evlist, evsel) {
                 if (evsel__has_callchain(evsel) &&
-                    evsel->attr.sample_max_stack == 0)
-                        evsel->attr.sample_max_stack = trace->max_stack;
+                    evsel->core.attr.sample_max_stack == 0)
+                        evsel->core.attr.sample_max_stack = trace->max_stack;
         }
 again:
         before = trace->nr_events;
@@ -3131,7 +3462,7 @@ again:
                                 goto out_disable;
 
                         if (done && !draining) {
-                                perf_evlist__disable(evlist);
+                                evlist__disable(evlist);
                                 draining = true;
                         }
                 }
@@ -3157,7 +3488,7 @@ again:
 out_disable:
         thread__zput(trace->current);
 
-        perf_evlist__disable(evlist);
+        evlist__disable(evlist);
 
         if (trace->sort_events)
                 ordered_events__flush(&trace->oe.data, OE_FLUSH__FINAL);
@@ -3178,7 +3509,7 @@ out_disable:
 out_delete_evlist:
         trace__symbols__exit(trace);
 
-        perf_evlist__delete(evlist);
+        evlist__delete(evlist);
         cgroup__put(trace->cgroup);
         trace->evlist = NULL;
         trace->live = false;
@@ -3223,7 +3554,7 @@ out_errno:
 
 static int trace__replay(struct trace *trace)
 {
-        const struct perf_evsel_str_handler handlers[] = {
+        const struct evsel_str_handler handlers[] = {
                 { "probe:vfs_getname",       trace__vfs_getname, },
         };
         struct perf_data data = {
@@ -3232,7 +3563,7 @@ static int trace__replay(struct trace *trace)
                 .force = trace->force,
         };
         struct perf_session *session;
-        struct perf_evsel *evsel;
+        struct evsel *evsel;
         int err = -1;
 
         trace->tool.sample        = trace__process_sample;
@@ -3298,10 +3629,10 @@ static int trace__replay(struct trace *trace)
         }
 
         evlist__for_each_entry(session->evlist, evsel) {
-                if (evsel->attr.type == PERF_TYPE_SOFTWARE &&
-                    (evsel->attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ||
-                     evsel->attr.config == PERF_COUNT_SW_PAGE_FAULTS_MIN ||
-                     evsel->attr.config == PERF_COUNT_SW_PAGE_FAULTS))
+                if (evsel->core.attr.type == PERF_TYPE_SOFTWARE &&
+                    (evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ||
+                     evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS_MIN ||
+                     evsel->core.attr.config == PERF_COUNT_SW_PAGE_FAULTS))
                         evsel->handler = trace__pgfault;
         }
 
@@ -3523,17 +3854,17 @@ static int parse_pagefaults(const struct option *opt, const char *str,
         return 0;
 }
 
-static void evlist__set_evsel_handler(struct perf_evlist *evlist, void *handler)
+static void evlist__set_evsel_handler(struct evlist *evlist, void *handler)
 {
-        struct perf_evsel *evsel;
+        struct evsel *evsel;
 
         evlist__for_each_entry(evlist, evsel)
                 evsel->handler = handler;
 }
 
-static int evlist__set_syscall_tp_fields(struct perf_evlist *evlist)
+static int evlist__set_syscall_tp_fields(struct evlist *evlist)
 {
-        struct perf_evsel *evsel;
+        struct evsel *evsel;
 
         evlist__for_each_entry(evlist, evsel) {
                 if (evsel->priv || !evsel->tp_format)
@@ -3660,7 +3991,7 @@ static int trace__parse_cgroups(const struct option *opt, const char *str, int u
 {
         struct trace *trace = opt->value;
 
-        if (!list_empty(&trace->evlist->entries))
+        if (!list_empty(&trace->evlist->core.entries))
                 return parse_cgroups(opt, str, unset);
 
         trace->cgroup = evlist__findnew_cgroup(trace->evlist, str);
@@ -3668,28 +3999,24 @@ static int trace__parse_cgroups(const struct option *opt, const char *str, int u
         return 0;
 }
 
-static struct bpf_map *bpf__find_map_by_name(const char *name)
+static struct bpf_map *trace__find_bpf_map_by_name(struct trace *trace, const char *name)
 {
-        struct bpf_object *obj, *tmp;
-
-        bpf_object__for_each_safe(obj, tmp) {
-                struct bpf_map *map = bpf_object__find_map_by_name(obj, name);
-                if (map)
-                        return map;
-
-        }
+        if (trace->bpf_obj == NULL)
+                return NULL;
 
-        return NULL;
+        return bpf_object__find_map_by_name(trace->bpf_obj, name);
 }
 
 static void trace__set_bpf_map_filtered_pids(struct trace *trace)
 {
-        trace->filter_pids.map = bpf__find_map_by_name("pids_filtered");
+        trace->filter_pids.map = trace__find_bpf_map_by_name(trace, "pids_filtered");
 }
 
 static void trace__set_bpf_map_syscalls(struct trace *trace)
 {
-        trace->syscalls.map = bpf__find_map_by_name("syscalls");
+        trace->syscalls.map = trace__find_bpf_map_by_name(trace, "syscalls");
+        trace->syscalls.prog_array.sys_enter = trace__find_bpf_map_by_name(trace, "syscalls_sys_enter");
+        trace->syscalls.prog_array.sys_exit  = trace__find_bpf_map_by_name(trace, "syscalls_sys_exit");
 }
 
 static int trace__config(const char *var, const char *value, void *arg)
@@ -3745,9 +4072,6 @@ int cmd_trace(int argc, const char **argv)
                 NULL
         };
         struct trace trace = {
-                .syscalls = {
-                        . max = -1,
-                },
                 .opts = {
                         .target = {
                                 .uid       = UINT_MAX,
@@ -3844,11 +4168,12 @@ int cmd_trace(int argc, const char **argv)
         OPT_UINTEGER('D', "delay", &trace.opts.initial_delay,
                      "ms to wait before starting measurement after program "
                      "start"),
+        OPTS_EVSWITCH(&trace.evswitch),
         OPT_END()
         };
         bool __maybe_unused max_stack_user_set = true;
         bool mmap_pages_user_set = true;
-        struct perf_evsel *evsel;
+        struct evsel *evsel;
         const char * const trace_subcommands[] = { "record", NULL };
         int err = -1;
         char bf[BUFSIZ];
@@ -3856,7 +4181,7 @@ int cmd_trace(int argc, const char **argv)
         signal(SIGSEGV, sighandler_dump_stack);
         signal(SIGFPE, sighandler_dump_stack);
 
-        trace.evlist = perf_evlist__new();
+        trace.evlist = evlist__new();
         trace.sctbl = syscalltbl__new();
 
         if (trace.evlist == NULL || trace.sctbl == NULL) {
@@ -3895,8 +4220,23 @@ int cmd_trace(int argc, const char **argv)
 
         if (evsel) {
                 trace.syscalls.events.augmented = evsel;
+
+                evsel = perf_evlist__find_tracepoint_by_name(trace.evlist, "raw_syscalls:sys_enter");
+                if (evsel == NULL) {
+                        pr_err("ERROR: raw_syscalls:sys_enter not found in the augmented BPF object\n");
+                        goto out;
+                }
+
+                if (evsel->bpf_obj == NULL) {
+                        pr_err("ERROR: raw_syscalls:sys_enter not associated to a BPF object\n");
+                        goto out;
+                }
+
+                trace.bpf_obj = evsel->bpf_obj;
+
                 trace__set_bpf_map_filtered_pids(&trace);
                 trace__set_bpf_map_syscalls(&trace);
+                trace.syscalls.unaugmented_prog = trace__find_bpf_program_by_title(&trace, "!raw_syscalls:unaugmented");
         }
 
         err = bpf__setup_stdout(trace.evlist);
@@ -3909,7 +4249,7 @@ int cmd_trace(int argc, const char **argv)
         err = -1;
 
         if (map_dump_str) {
-                trace.dump.map = bpf__find_map_by_name(map_dump_str);
+                trace.dump.map = trace__find_bpf_map_by_name(&trace, map_dump_str);
                 if (trace.dump.map == NULL) {
                         pr_err("ERROR: BPF map \"%s\" not found\n", map_dump_str);
                         goto out;
@@ -3942,7 +4282,7 @@ int cmd_trace(int argc, const char **argv)
                 symbol_conf.use_callchain = true;
         }
 
-        if (trace.evlist->nr_entries > 0) {
+        if (trace.evlist->core.nr_entries > 0) {
                 evlist__set_evsel_handler(trace.evlist, trace__event_handler);
                 if (evlist__set_syscall_tp_fields(trace.evlist)) {
                         perror("failed to set syscalls:* tracepoint fields");
@@ -3977,11 +4317,26 @@ int cmd_trace(int argc, const char **argv)
 
                         if (trace.syscalls.events.augmented->priv == NULL &&
                             strstr(perf_evsel__name(evsel), "syscalls:sys_enter")) {
-                                struct perf_evsel *augmented = trace.syscalls.events.augmented;
+                                struct evsel *augmented = trace.syscalls.events.augmented;
                                 if (perf_evsel__init_augmented_syscall_tp(augmented, evsel) ||
                                     perf_evsel__init_augmented_syscall_tp_args(augmented))
                                         goto out;
+                                /*
+                                 * Augmented is __augmented_syscalls__ BPF_OUTPUT event
+                                 * Above we made sure we can get from the payload the tp fields
+                                 * that we get from syscalls:sys_enter tracefs format file.
+                                 */
                                 augmented->handler = trace__sys_enter;
+                                /*
+                                 * Now we do the same for the *syscalls:sys_enter event so that
+                                 * if we handle it directly, i.e. if the BPF prog returns 0 so
+                                 * as not to filter it, then we'll handle it just like we would
+                                 * for the BPF_OUTPUT one:
+                                 */
+                                if (perf_evsel__init_augmented_syscall_tp(evsel, evsel) ||
+                                    perf_evsel__init_augmented_syscall_tp_args(evsel))
+                                        goto out;
+                                evsel->handler = trace__sys_enter;
                         }
 
                         if (strstarts(perf_evsel__name(evsel), "syscalls:sys_exit_")) {
@@ -4025,7 +4380,7 @@ init_augmented_syscall_tp:
                 trace.summary = trace.summary_only;
 
         if (!trace.trace_syscalls && !trace.trace_pgfaults &&
-            trace.evlist->nr_entries == 0 /* Was --events used? */) {
+            trace.evlist->core.nr_entries == 0 /* Was --events used? */) {
                 trace.trace_syscalls = true;
         }
 
@@ -4037,6 +4392,10 @@ init_augmented_syscall_tp:
                 }
         }
 
+        err = evswitch__init(&trace.evswitch, trace.evlist, stderr);
+        if (err)
+                goto out_close;
+
         err = target__validate(&trace.opts.target);
         if (err) {
                 target__strerror(&trace.opts.target, err, bf, sizeof(bf));