linux-kernel - [PATCH tracing/kprobes 0/7] tracing/kprobes: kprobe-based event tracer update and perf support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 10 Sep 2009 19:52:58 -0400
From:	Masami Hiramatsu <mhiramat@...hat.com>
To:	Frederic Weisbecker <fweisbec@...il.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Ingo Molnar <mingo@...e.hu>,
	lkml <linux-kernel@...r.kernel.org>
Cc:	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	Andi Kleen <ak@...ux.intel.com>,
	Christoph Hellwig <hch@...radead.org>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>, Jason Baron <jbaron@...hat.com>,
	Jim Keniston <jkenisto@...ibm.com>,
	"K.Prasad" <prasad@...ux.vnet.ibm.com>,
	Lai Jiangshan <laijs@...fujitsu.com>,
	Li Zefan <lizf@...fujitsu.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>,
	Tom Zanussi <tzanussi@...il.com>,
	systemtap <systemtap@...rces.redhat.com>,
	DLE <dle-develop@...ts.sourceforge.net>
Subject: [PATCH tracing/kprobes 0/7] tracing/kprobes: kprobe-based event
	tracer update and perf support

Hi Frederic,

This series fixes bugs and upgrades kprobe-based event tracer
as a dynamic event tracer on ftrace/perf tools. This also enhances
tracer output format to show each argument name and event name on
each entry.

With this series, users can add trace events dynamically on ftrace
and use those events with perf tools as below.

(Step.1) Define new events under new group

$ echo p:mygroup/myprobe do_sys_open dfd=a0 filename=a1 flags=a2 mode=a3 \
 > /debug/tracing/kprobes_events
$ echo r:mygroup/myretprobe do_sys_open rv >> /debug/tracing/kprobes_events
$ cat /debug/tracing/kprobes_events
p:myprobe do_sys_open+0 dfd=a0 filename=a1 flags=a2 mode=a3
r:myretprobe do_sys_open+0 rv=rv

(You can see that each argument has its name.)


(Step.2) Perf shows new events

$ perf list
...
   mygroup:myretprobe                         [Tracepoint event]
   mygroup:myprobe                            [Tracepoint event]
...


(Step.3) Record events with perf

$ perf record -f -e mygroup:myprobe:record -F 1 -a ls
...
[ perf record: Captured and wrote 0.081 MB perf.data (~3544 samples) ]


(Step.4) Perf trace shows the result

$ perf trace
version = 0.5
            perf-1405  [000]     0.000000: myprobe: (c04b0a5c) dfd=ffffff9c filename=810d3f7 flags=98800 mode=1
            perf-1405  [000]     0.000000: myprobe: (c04b0a5c) dfd=ffffff9c filename=bff7650c flags=8000 mode=1b6
            perf-1405  [000]     0.000000: myprobe: (c04b0a5c) dfd=ffffff9c filename=bff7650c flags=98800 mode=bff7450c
            perf-1405  [000]     0.000000: myprobe: (c04b0a5c) dfd=ffffff9c filename=bff7650c flags=8000 mode=1b6


(Step.5) You can also use return probes.

$ perf record -f -e mygroup:myretprobe:record -F 1 -a ls
...
[ perf record: Captured and wrote 0.081 MB perf.data (~3544 samples) ]
$ perf trace
version = 0.5
            perf-1408  [000]     0.000000: myretprobe: (c04b0a5c <- c04b0b7d) rv=b
            perf-1408  [000]     0.000000: myretprobe: (c04b0a5c <- c04b0b7d) rv=c
            perf-1408  [000]     0.000000: myretprobe: (c04b0a5c <- c04b0b7d) rv=d
            perf-1408  [000]     0.000000: myretprobe: (c04b0a5c <- c04b0b7d) rv=c


TODO:
- Implement perf kprobe command to help defining new probes.


Thank you,

---

Masami Hiramatsu (7):
      tracing/kprobes: Support custom subsystem for each kprobe event
      tracing/kprobes: Show event name in trace output
      tracing/kprobes: Add argument name support
      tracing/kprobes: Add event profiling support
      tracing/kprobes: Cleanup kprobe tracer code.
      tracing/kprobes: Fix probe offset to be unsigned
      x86/ptrace: Fix regs_get_argument_nth() to add correct offset


 Documentation/trace/kprobetrace.txt |   65 +++---
 arch/x86/kernel/ptrace.c            |    2 
 kernel/trace/trace_kprobe.c         |  369 +++++++++++++++++++++++------------
 3 files changed, 274 insertions(+), 162 deletions(-)

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America), Inc.
Software Solutions Division

e-mail: mhiramat@...hat.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/