| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 2 May 2023 09:01:33 +0900
From: Masami Hiramatsu (Google) <mhiramat@...nel.org>
To: "Masami Hiramatsu (Google)" <mhiramat@...nel.org>
Cc: linux-trace-kernel@...r.kernel.org, linux-kernel@...r.kernel.org,
Steven Rostedt <rostedt@...dmis.org>,
Florent Revest <revest@...omium.org>,
Mark Rutland <mark.rutland@....com>,
Will Deacon <will@...nel.org>,
Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
Martin KaFai Lau <martin.lau@...ux.dev>, bpf@...r.kernel.org
Subject: [v8] Re: [PATCH v9 00/11] tracing: Add fprobe events
Oops, the title version is wrong, this is 8th version. Hmm, it must be my typo...
On Tue, 2 May 2023 00:08:45 +0900
"Masami Hiramatsu (Google)" <mhiramat@...nel.org> wrote:
> Hi,
>
> Here is the 8th version of improve fprobe and add a basic fprobe event
> support for ftrace (tracefs) and perf. Here is the previous version.
>
> https://lore.kernel.org/all/168255826500.2565678.17719875734305974633.stgit@mhiramat.roam.corp.google.com/
>
> This version is a minor update for fixing wrong indentation [8/11]
> and update kconfig help message[6/11].
>
> You can also get this series from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/mhiramat/linux.git topic/fprobe-event-ext
>
> With this fprobe events, we can continue to trace function entry/exit
> even if the CONFIG_KPROBES_ON_FTRACE is not available. Since
> CONFIG_KPROBES_ON_FTRACE requires the CONFIG_DYNAMIC_FTRACE_WITH_REGS,
> it is not available if the architecture only supports
> CONFIG_DYNAMIC_FTRACE_WITH_ARGS (e.g. arm64). And that means kprobe
> events can not probe function entry/exit effectively on such architecture.
> But this problem can be solved if the dynamic events supports fprobe events
> because fprobe events doesn't use kprobe but ftrace via fprobe.
>
> FPROBE EVENTS
> =============
>
> Fprobe events allows user to add new events on the entry and exit of kernel
> functions (which can be ftraced). Unlike kprobe events, the fprobe events
> can only probe the function entry and exit, and it can only trace the
> function args, return value, and stacks. (no registers)
> For probing function body, users can continue to use the kprobe events.
>
> The tracepoint probe events (tprobe events) also allows user to add new
> events dynamically on the tracepoint. Most of the tracepoint already has
> trace-events, so this feature is useful if you only want to know a
> specific parameter, or trace the tracepoints which has no trace-events
> (e.g. sched_*_tp tracepoints only exposes the tracepoints.)
>
> The fprobe events syntax is;
>
> f[:[GRP/][EVENT]] FUNCTION [FETCHARGS]
> f[MAXACTIVE][:[GRP/][EVENT]] FUNCTION%return [FETCHARGS]
>
> And tracepoint probe events syntax is;
>
> t[:[GRP/][EVENT]] TRACEPOINT [FETCHARGS]
>
> This series includes BTF argument support for fprobe/tracepoint events,
> and kprobe events. This allows us to fetch a specific function parameter
> by name, and all parameters by '$$args'.
> Note that enabling this feature, you need to enable CONFIG_BPF_SYSCALL and
> confirm that your arch supports CONFIG_HAVE_FUNCTION_ARG_ACCESS_API.
>
> E.g.
>
> # echo 't kfree ptr' >> dynamic_events
> # echo 'f kfree object' >> dynamic_events
> # cat dynamic_events
> t:tracepoints/kfree kfree ptr=ptr
> f:fprobes/kfree__entry kfree object=object
> # echo 1 > events/fprobes/enable
> # echo 1 > events/tracepoints/enable
> # echo > trace
> # head -n 20 trace | tail
> # TASK-PID CPU# ||||| TIMESTAMP FUNCTION
> # | | | ||||| | |
> tail-84 [000] ..... 1324.561958: kfree__entry: (kfree+0x4/0x140) object=0xffff888006383c00
> tail-84 [000] ...1. 1324.561961: kfree: (__probestub_kfree+0x4/0x10) ptr=0xffff888006383c00
> tail-84 [000] ..... 1324.561988: kfree__entry: (kfree+0x4/0x140) object=0x0
> tail-84 [000] ...1. 1324.561988: kfree: (__probestub_kfree+0x4/0x10) ptr=0x0
> tail-84 [000] ..... 1324.561989: kfree__entry: (kfree+0x4/0x140) object=0xffff88800671e600
> tail-84 [000] ...1. 1324.561989: kfree: (__probestub_kfree+0x4/0x10) ptr=0xffff88800671e600
> tail-84 [000] ..... 1324.562368: kfree__entry: (kfree+0x4/0x140) object=0xffff8880065e0580
> tail-84 [000] ...1. 1324.562369: kfree: (__probestub_kfree+0x4/0x10) ptr=0xffff8880065e0580
>
>
> Thank you,
>
> ---
>
> Masami Hiramatsu (Google) (11):
> fprobe: Pass return address to the handlers
> tracing/probes: Add fprobe events for tracing function entry and exit.
> selftests/ftrace: Add fprobe related testcases
> tracing/probes: Add tracepoint support on fprobe_events
> tracing/probes: Move event parameter fetching code to common parser
> tracing/probes: Support function parameters if BTF is available
> tracing/probes: Add $$args meta argument for all function args
> tracing/probes: Add BTF retval type support
> selftests/ftrace: Add tracepoint probe test case
> selftests/ftrace: Add BTF arguments test cases
> Documentation: tracing/probes: Add fprobe event tracing document
>
>
> Documentation/trace/fprobetrace.rst | 187 +++
> Documentation/trace/index.rst | 1
> include/linux/fprobe.h | 11
> include/linux/rethook.h | 2
> include/linux/trace_events.h | 3
> include/linux/tracepoint-defs.h | 1
> include/linux/tracepoint.h | 5
> kernel/kprobes.c | 1
> kernel/trace/Kconfig | 26
> kernel/trace/Makefile | 1
> kernel/trace/bpf_trace.c | 6
> kernel/trace/fprobe.c | 17
> kernel/trace/rethook.c | 3
> kernel/trace/trace.c | 13
> kernel/trace/trace.h | 11
> kernel/trace/trace_eprobe.c | 44 -
> kernel/trace/trace_fprobe.c | 1194 ++++++++++++++++++++
> kernel/trace/trace_kprobe.c | 33 -
> kernel/trace/trace_probe.c | 504 +++++++-
> kernel/trace/trace_probe.h | 43 +
> kernel/trace/trace_uprobe.c | 8
> lib/test_fprobe.c | 10
> samples/fprobe/fprobe_example.c | 6
> .../ftrace/test.d/dynevent/add_remove_btfarg.tc | 54 +
> .../ftrace/test.d/dynevent/add_remove_fprobe.tc | 26
> .../ftrace/test.d/dynevent/add_remove_tprobe.tc | 27
> .../ftrace/test.d/dynevent/fprobe_syntax_errors.tc | 99 ++
> .../ftrace/test.d/dynevent/tprobe_syntax_errors.tc | 82 +
> .../ftrace/test.d/kprobe/kprobe_syntax_errors.tc | 13
> 29 files changed, 2291 insertions(+), 140 deletions(-)
> create mode 100644 Documentation/trace/fprobetrace.rst
> create mode 100644 kernel/trace/trace_fprobe.c
> create mode 100644 tools/testing/selftests/ftrace/test.d/dynevent/add_remove_btfarg.tc
> create mode 100644 tools/testing/selftests/ftrace/test.d/dynevent/add_remove_fprobe.tc
> create mode 100644 tools/testing/selftests/ftrace/test.d/dynevent/add_remove_tprobe.tc
> create mode 100644 tools/testing/selftests/ftrace/test.d/dynevent/fprobe_syntax_errors.tc
> create mode 100644 tools/testing/selftests/ftrace/test.d/dynevent/tprobe_syntax_errors.tc
>
> --
> Masami Hiramatsu (Google) <mhiramat@...nel.org>
--
Masami Hiramatsu (Google) <mhiramat@...nel.org>
Powered by blists - more mailing lists