linux-kernel - Re: Kprobe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 13 Apr 2011 10:58:47 +0800
From:	Lin Ming <minggr@...il.com>
To:	Artur Baruchi <mail.baruchi@...il.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: Kprobe

On Sun, Apr 10, 2011 at 10:28 PM, Artur Baruchi <mail.baruchi@...il.com> wrote:
> Hi Guys.
>
> Im using kprobe to probe a kernel function (find_get_page) and I would
> like to know more details, like which function is calling it, but I
> couldnt figure out a way to do that. Is it possible to use kprobe or
> other kind of probe to detect which function is calling find_get_page
> ?

Do you know the cool "perf" tool.
Its sub command "perf probe" is exactly what you want.

# cd linux-2.6/tools/perf
# make
# ./perf probe -k ~/vmlinux -s ~/linux-2.6/  find_get_page
# ./perf record -e probe:find_get_page -f -g -a
# ./perf report

# Events: 81K
#
# Overhead  Command      Shared Object         Symbol
# ........  .......  .................  .............
#
   100.00%     perf  [kernel.kallsyms]  [k] find_get_page
               |
               --- find_get_page
                  |
                  |--94.84%-- grab_cache_page_write_begin
                  |          ext3_write_begin
                  |          generic_file_buffered_write
                  |          __generic_file_aio_write
                  |          generic_file_aio_write
                  |          do_sync_write
                  |          vfs_write
                  |          sys_write
                  |          system_call_fastpath
                  |          __libc_write
                  |          |
                  |          |--68.98%-- mmap_read_all
                  |          |          __cmd_record
                  |          |          cmd_record
                  |          |          run_builtin
                  |          |          handle_internal_command
                  |          |          run_argv
                  |          |          main
                  |          |          __libc_start_main
                  |          |
                  |          |--29.30%-- mmap_read
                  |          |          mmap_read_all
                  |          |          __cmd_record
                  |          |          cmd_record
                  |          |          run_builtin
                  |          |          handle_internal_command
                  |          |          run_argv
                  |          |          main
                  |          |          __libc_start_main
                  |          |
                  |           --1.72%-- process_synthesized_event
                  |                     |
                  |                     |--87.99%--
perf_event__synthesize_mmap_events
                  |                     |          __event__synthesize_thread
                  |                     |
perf_event__synthesize_threads
                  |                     |          __cmd_record
                  |                     |          cmd_record
                  |                     |          run_builtin
                  |                     |          handle_internal_command
                  |                     |          run_argv
                  |                     |          main
                  |                     |          __libc_start_main

Have a try and you'll like it!

Lin Ming

>
> Thanks in advance.
>
> Att.
> Artur Baruchi
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/