linux-kernel - [RFC PATCH tracing/kprobes 0/5] tracing/kprobes, perf: perf kprobe support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090925191424.12939.91503.stgit@omoto>
Date:	Fri, 25 Sep 2009 12:14:30 -0700
From:	Masami Hiramatsu <mhiramat@...hat.com>
To:	Frederic Weisbecker <fweisbec@...il.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Ingo Molnar <mingo@...e.hu>,
	lkml <linux-kernel@...r.kernel.org>
Cc:	Frederic Weisbecker <fweisbec@...il.com>,
	Ingo Molnar <mingo@...e.hu>,
	Thomas Gleixner <tglx@...utronix.de>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Mike Galbraith <efault@....de>,
	Paul Mackerras <paulus@...ba.org>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Christoph Hellwig <hch@...radead.org>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	Jim Keniston <jkenisto@...ibm.com>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	systemtap <systemtap@...rces.redhat.com>,
	DLE <dle-develop@...ts.sourceforge.net>
Subject: [RFC PATCH tracing/kprobes 0/5] tracing/kprobes,
	perf: perf kprobe support


Hi,

These patches introduce perf kprobe command and update kprobe-tracer.
perf kprobe command allows you to add new probe points by C line number
and local variable names.

Usage
-----
 perf kprobe [<options>] -P PROBEDEF [-P PROBEDEF ...]

    -k, --vmlinux <file>  vmlinux/module pathname
    -r, --release <rel>   kernel release
    -P, --probe <p|r:[GRP/]NAME,FUNC[+OFFS][@SRC]|@SRC:LINE,ARG[,ARG,...]>
                          probe point definition, where
		p:	kprobe probe
		r:	kretprobe probe
		GRP:	Group name (optional)
		NAME:	Event name
		FUNC:	Function name
		OFFS:	Offset from function entry (in byte)
		SRC:	Source code path
		LINE:	Line number
		ARG:	Probe argument (local variable name or
			kprobe-tracer argument format is supported.)

Examples
--------
1) Add a new kprobe probe on a line of C source code.
./perf kprobe -P 'p:myprobe,@fs/bio.c:162,bv,idx'
Adding new event: p:myprobe bvec_free_bs+17 bv=%bx idx=%cx

2) Add a new kretprobe probe on a function return.
./perf kprobe -P 'r:myretprobe,vfs_read,$rv'
Adding new event: r:myretprobe vfs_read+0 $rv

3) Check it in the perf list.
./perf list
...
  rNNN                                       [raw hardware event descriptor]

  kprobes:myprobe                            [Tracepoint event]
  kprobes:myretprobe                         [Tracepoint event]
  skb:kfree_skb                              [Tracepoint event]
...

4) Check its format

$ cat /sys/kernel/debug/tracing/events/kprobes/myprobe/format
name: myprobe
ID: 687
format:
	field:unsigned short common_type;	offset:0;	size:2;
	field:unsigned char common_flags;	offset:2;	size:1;
	field:unsigned char common_preempt_count;	offset:3;	size:1;
	field:int common_pid;	offset:4;	size:4;
	field:int common_lock_depth;	offset:8;	size:4;

	field: unsigned long __probe_ip;	offset:12;	size:4;
	field: int __probe_nargs;	offset:16;	size:4;
	field: unsigned long bv;	offset:20;	size:4;
	field: unsigned long idx;	offset:24;	size:4;


print fmt: "(%lx) bv=%lx idx=%lx", REC->__probe_ip, REC->bv, REC->idx


Syntax Issue
------------
This version picks '-P event-definition' syntax, but I think
'-p event -a arg' is also possible. I'd like to ask you
which you like or support both?


TODO
----
There are still many enhancements required for catching up
'tracing side' of systemtap. I think it should be done one by one.
I hope that systemtap developers cooperate with us on this
development.

 - Support sys_perf_counter_open (non-root)
 - Type support
 - Non-auto static variable
 - Fields of data structure (var->field)
 - Bit fields
 - Array (var[N])
 - Dynamic array indexing (var[var2])
 - String/dynamic arrays (var:string, var[N..M])
 - Force Type casting ((type)var)
 - Non-inline search
 - libdw, libdwfl

Thank you,

---

Masami Hiramatsu (5):
      perf: kprobe command supports without libdwarf
      perf: Support perf kprobe command for kprobe-event setup helper
      tracing/kprobes: Rename fixed field name
      tracing/kprobes: Avoid field name confliction
      tracing/kprobes: Rename special variables syntax


 Documentation/trace/kprobetrace.txt |   10 -
 kernel/trace/trace_kprobe.c         |  124 +++++-
 tools/perf/Makefile                 |   10 +
 tools/perf/builtin-kprobe.c         |  340 +++++++++++++++++
 tools/perf/builtin.h                |    1 
 tools/perf/perf.c                   |    1 
 tools/perf/util/probe-finder.c      |  684 +++++++++++++++++++++++++++++++++++
 tools/perf/util/probe-finder.h      |   70 ++++
 8 files changed, 1200 insertions(+), 40 deletions(-)
 create mode 100644 tools/perf/builtin-kprobe.c
 create mode 100644 tools/perf/util/probe-finder.c
 create mode 100644 tools/perf/util/probe-finder.h

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America), Inc.
Software Solutions Division

e-mail: mhiramat@...hat.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/