linux-kernel - Re: [PATCH 2/4] ftrace: Add 'function-fork' trace option

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170328221852.71367fd0@grimm.local.home>
Date:   Tue, 28 Mar 2017 22:18:52 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Namhyung Kim <namhyung@...nel.org>
Cc:     Ingo Molnar <mingo@...nel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>, kernel-team@....com
Subject: Re: [PATCH 2/4] ftrace: Add 'function-fork' trace option

On Wed, 29 Mar 2017 10:46:23 +0900
Namhyung Kim <namhyung@...nel.org> wrote:

> The function-fork option is same as event-fork that it tracks task
> fork/exit and set the pid filter properly.  This can be useful if user
> wants to trace selected tasks including their children only.

Actually, I had every set, but it appears I stopped at this step. You
just finished it ;-)

Although, I think there was some issues with function tracing. I'll
have to do some more testing an analysis tomorrow. But looking at this
code, it currently appears fine.

-- Steve


> 
> Signed-off-by: Namhyung Kim <namhyung@...nel.org>
> ---
>  kernel/trace/ftrace.c | 37 +++++++++++++++++++++++++++++++++++++
>  kernel/trace/trace.c  |  5 ++++-
>  kernel/trace/trace.h  |  6 +++++-
>  3 files changed, 46 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
> index b451a860e885..7ca2ed8d0a48 100644
> --- a/kernel/trace/ftrace.c
> +++ b/kernel/trace/ftrace.c
> @@ -5575,6 +5575,43 @@ ftrace_filter_pid_sched_switch_probe(void *data, bool preempt,
>  		       trace_ignore_this_task(pid_list, next));
>  }
>  
> +static void
> +ftrace_pid_follow_sched_process_fork(void *data,
> +				     struct task_struct *self,
> +				     struct task_struct *task)
> +{
> +	struct trace_pid_list *pid_list;
> +	struct trace_array *tr = data;
> +
> +	pid_list = rcu_dereference_sched(tr->function_pids);
> +	trace_filter_add_remove_task(pid_list, self, task);
> +}
> +
> +static void
> +ftrace_pid_follow_sched_process_exit(void *data, struct task_struct *task)
> +{
> +	struct trace_pid_list *pid_list;
> +	struct trace_array *tr = data;
> +
> +	pid_list = rcu_dereference_sched(tr->function_pids);
> +	trace_filter_add_remove_task(pid_list, NULL, task);
> +}
> +
> +void ftrace_pid_follow_fork(struct trace_array *tr, bool enable)
> +{
> +	if (enable) {
> +		register_trace_sched_process_fork(ftrace_pid_follow_sched_process_fork,
> +						  tr);
> +		register_trace_sched_process_exit(ftrace_pid_follow_sched_process_exit,
> +						  tr);
> +	} else {
> +		unregister_trace_sched_process_fork(ftrace_pid_follow_sched_process_fork,
> +						    tr);
> +		unregister_trace_sched_process_exit(ftrace_pid_follow_sched_process_exit,
> +						    tr);
> +	}
> +}
> +
>  static void clear_ftrace_pids(struct trace_array *tr)
>  {
>  	struct trace_pid_list *pid_list;
> diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> index b92489dfa829..291d8fc9dc36 100644
> --- a/kernel/trace/trace.c
> +++ b/kernel/trace/trace.c
> @@ -257,7 +257,7 @@ unsigned long long ns2usecs(u64 nsec)
>  
>  /* trace_flags that are default zero for instances */
>  #define ZEROED_TRACE_FLAGS \
> -	TRACE_ITER_EVENT_FORK
> +	(TRACE_ITER_EVENT_FORK | TRACE_ITER_FUNC_FORK)
>  
>  /*
>   * The global_trace is the descriptor that holds the top-level tracing
> @@ -4205,6 +4205,9 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
>  	if (mask == TRACE_ITER_EVENT_FORK)
>  		trace_event_follow_fork(tr, enabled);
>  
> +	if (mask == TRACE_ITER_FUNC_FORK)
> +		ftrace_pid_follow_fork(tr, enabled);
> +
>  	if (mask == TRACE_ITER_OVERWRITE) {
>  		ring_buffer_change_overwrite(tr->trace_buffer.buffer, enabled);
>  #ifdef CONFIG_TRACER_MAX_TRACE
> diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
> index 4d9804fd9a2d..bacf5e845c55 100644
> --- a/kernel/trace/trace.h
> +++ b/kernel/trace/trace.h
> @@ -898,6 +898,7 @@ void ftrace_init_tracefs_toplevel(struct trace_array *tr,
>  				  struct dentry *d_tracer);
>  int init_function_trace(void);
>  void ftrace_pid_reset(struct trace_array *tr, bool update);
> +void ftrace_pid_follow_fork(struct trace_array *tr, bool enable);
>  #else
>  static inline int ftrace_trace_task(struct trace_array *tr)
>  {
> @@ -918,6 +919,7 @@ static inline void ftrace_init_tracefs(struct trace_array *tr, struct dentry *d)
>  static inline void ftrace_init_tracefs_toplevel(struct trace_array *tr, struct dentry *d) { }
>  static inline int init_function_trace(void) { return 0; }
>  static inline void ftrace_pid_reset(struct trace_array *tr, bool update) { }
> +static inline void ftrace_pid_follow_fork(struct trace_array *tr, bool enable) { }
>  /* ftace_func_t type is not defined, use macro instead of static inline */
>  #define ftrace_init_array_ops(tr, func) do { } while (0)
>  #endif /* CONFIG_FUNCTION_TRACER */
> @@ -991,11 +993,13 @@ extern int trace_get_user(struct trace_parser *parser, const char __user *ubuf,
>  
>  #ifdef CONFIG_FUNCTION_TRACER
>  # define FUNCTION_FLAGS						\
> -		C(FUNCTION,		"function-trace"),
> +		C(FUNCTION,		"function-trace"),	\
> +		C(FUNC_FORK,		"function-fork"),
>  # define FUNCTION_DEFAULT_FLAGS		TRACE_ITER_FUNCTION
>  #else
>  # define FUNCTION_FLAGS
>  # define FUNCTION_DEFAULT_FLAGS		0UL
> +# define TRACE_ITER_FUNC_FORK		0UL
>  #endif
>  
>  #ifdef CONFIG_STACKTRACE