kprobes-base-268-rc3.patch
cover kprobes-base-268-rc3.patch
Hi,
Here are the set of patches to demonistrate network tracing as suggested by Andi Kleen.
[0/3] kprobes-base-268-rc3.patch
[1/3] kprobes-func-args-268-rc3.patch
[2/3] kprobes-netfilter-268-rc3.patch
[3/3] kprobes-netpktlog-268-rc3.patch
Please see the description of individual patches for more details.
Your comments are welcome!
Thanks
prasanna
Signature · 5 lines
Prasanna S Panchamukhi Linux Technology Center India Software Labs, IBM Bangalore Ph: 91-80-25044636 [email protected]
Originally from: Vamsi Krishna S. <[email protected]> DESC
Kernel Dynamic Probes (kprobes) : Base Patch EDESC
Helps developers to trap at almost any kernel code address, specifying a handler routine to be invoked when the breakpoint is hit. Useful for analysing the Linux kernel by collecting debugging information non-disruptively. Employs single-stepping out-of-line to avoid probe misses on SMP and may be especially useful in aiding debugging elusive races and problems on live systems. More elaborate dynamic tracing tools such as DProbes can be built over the kprobes interface.
Sample usage:
To place a probe on __blockdev_direct_IO:
static int probe_handler(struct kprobe *p, struct pt_regs *)
{
... whatever ...
}
struct kprobe kp = {
.addr = __blockdev_direct_IO,
.pre_handler = probe_handler
};
register_kprobe(&kp);---
arch/i386/Kconfig renamed from arch/i386/Kconfig~kprobes-base-268-rc1 +9 -0
@@ -1207,6 +1207,15 @@ config EARLY_PRINTK with klogd/syslogd or the X server. You should normally N here, unless you want to debug such a crash. +config KPROBES + bool "Kprobes" + depends on DEBUG_KERNEL + help + Kprobes allows you to trap at almost any kernel address, using + register_kprobe(), and providing a callback function. This is useful + for kernel debugging, non-intrusive instrumentation and testing. If + in doubt, say "N". + config DEBUG_STACKOVERFLOW bool "Check for stack overflows" depends on DEBUG_KERNEL
arch/i386/kernel/Makefile renamed from arch/i386/kernel/Makefile~kprobes-base-268-rc1 +1 -0
@@ -25,6 +25,7 @@ obj-$(CONFIG_X86_LOCAL_APIC) += apic.o n obj-$(CONFIG_X86_IO_APIC) += io_apic.o obj-$(CONFIG_X86_NUMAQ) += numaq.o obj-$(CONFIG_X86_SUMMIT_NUMA) += summit.o +obj-$(CONFIG_KPROBES) += kprobes.o obj-$(CONFIG_MODULES) += module.o obj-y += sysenter.o vsyscall.o obj-$(CONFIG_ACPI_SRAT) += srat.o
arch/i386/kernel/entry.S renamed from arch/i386/kernel/entry.S~kprobes-base-268-rc1 +19 -5
@@ -489,9 +489,16 @@ ENTRY(debug) jne debug_stack_correct FIX_STACK(12, debug_stack_correct, debug_esp_fix_insn) debug_stack_correct: - pushl $0 - pushl $do_debug - jmp error_code + pushl $-1 # mark this as an int + SAVE_ALL + movl %esp,%edx + pushl $0 + pushl %edx + call do_debug + addl $8,%esp + testl %eax,%eax + jnz restore_all + jmp ret_from_exception /* * NMI is doubly nasty. It can happen _while_ we're handling
@@ -540,9 +547,16 @@ nmi_debug_stack_fixup: jmp nmi_stack_correct ENTRY(int3) + pushl $-1 # mark this as an int + SAVE_ALL + movl %esp,%edx pushl $0 - pushl $do_int3 - jmp error_code + pushl %edx + call do_int3 + addl $8,%esp + testl %eax,%eax + jnz restore_all + jmp ret_from_exception ENTRY(overflow) pushl $0
arch/i386/kernel/kprobes.c new file +222 -0
222 lines not on this page · raw message
arch/i386/kernel/traps.c renamed from arch/i386/kernel/traps.c~kprobes-base-268-rc1 +25 -6
@@ -26,6 +26,7 @@#include <linux/kallsyms.h> #include <linux/ptrace.h> #include <linux/version.h> +#include <linux/kprobes.h> #ifdef CONFIG_EISA #include <linux/ioport.h>
@@ -419,7 +420,6 @@ asmlinkage void do_##name(struct pt_regs } DO_VM86_ERROR_INFO( 0, SIGFPE, "divide error", divide_error, FPE_INTDIV, regs->eip) -DO_VM86_ERROR( 3, SIGTRAP, "int3", int3) DO_VM86_ERROR( 4, SIGSEGV, "overflow", overflow) DO_VM86_ERROR( 5, SIGSEGV, "bounds", bounds)DO_ERROR_INFO (6 ,SIGILL ,"invalid operand" , invalid_op,ILL_ILLOPN , regs->eip)
@@ -437,6 +437,9 @@ asmlinkage void do_general_protection(stif (regs->eflags &VM_MASK ) goto gp_in_vm86; +if (kprobe_running () &&kprobe_fault_handler (regs,13 )) +return ; +if (!(regs->xcs &3 )) goto gp_in_kernel;
@@ -557,6 +560,17 @@ void unset_nmi_callback(void) nmi_callback = dummy_nmi_callback; } +asmlinkage int do_int3(struct pt_regs *regs, long error_code) +{ +if (kprobe_handler (regs)) +return 1 ; +/* This is an interrupt gate, because kprobes wants interrupts +disabled. Normal trap handlers don't. */ +restore_interrupts (regs); +do_trap (3 ,SIGTRAP ,"int3" ,1 , regs, error_code,NULL ); +return 0 ; +} +/* * Our handling of the processor debug registers is non-trivial. * We do not clear them on entry and exit from the kernel. Therefore
@@ -579,12 +593,15 @@ void unset_nmi_callback(void)* find every occurrence of the TF bit that could be saved away even * by user code) */ -asmlinkage void do_debug(struct pt_regs * regs, long error_code) +asmlinkage int do_debug(struct pt_regs * regs, long error_code) {unsigned int condition;struct task_struct *tsk = current;siginfo_t info; +if (post_kprobe_handler (regs)) +return 1 ; + __asm__ __volatile__("movl %%db6,%0" :"=r" (condition));/* It's safe to allow irq's after DR6 has been saved */
@@ -641,17 +658,17 @@ clear_dr7: __asm__("movl %0,%%db7" :/* no output */ :"r" (0 )); -return ; +return 0 ; debug_vm86:handle_vm86_trap ((struct kernel_vm86_regs *) regs, error_code,1 ); -return ; +return 0 ; clear_TF_reenable:set_tsk_thread_flag (tsk,TIF_SINGLESTEP ); clear_TF: regs->eflags &= ~TF_MASK ; -return ; +return 0 ; }/*
@@ -817,6 +834,8 @@ asmlinkage void math_state_restore(strucstruct thread_info *thread =current_thread_info ();struct task_struct *tsk = thread->task; +if (kprobe_running () &&kprobe_fault_handler (®s,7 )) +return ;clts ();/* Allow maths ops (or we recurse) */ if (!tsk->used_math)init_fpu (tsk);
@@ -911,7 +930,7 @@ void __init trap_init(void)set_trap_gate (0 ,÷_error);set_intr_gate (1 ,&debug);set_intr_gate (2 ,&nmi); -set_system_gate (3 ,&int3);/* int3-5 can be called from all */ +_set_gate (idt_table+3 ,14 ,3 ,&int3,__KERNEL_CS);/* int3-5 can be called from all */ set_system_gate (4 ,&overflow);set_system_gate (5 ,&bounds);set_trap_gate (6 ,&invalid_op);
arch/i386/mm/fault.c renamed from arch/i386/mm/fault.c~kprobes-base-268-rc1 +4 -0
@@ -21,6 +21,7 @@#include <linux/vt_kern.h> /* For unblank_screen() */ #include <linux/highmem.h> #include <linux/module.h> +#include <linux/kprobes.h> #include <asm/system.h> #include <asm/uaccess.h>
@@ -226,6 +227,9 @@ asmlinkage void do_page_fault(struct pt_/* get the address */ __asm__("movl %%cr2,%0" :"=r" (address)); +if (kprobe_running () &&kprobe_fault_handler (regs,14 )) +return ; +/* It's safe to allow irq's after cr2 has been saved */ if (regs->eflags & (X86_EFLAGS_IF |VM_MASK ))local_irq_enable ();
include/asm-i386/kprobes.h new file +56 -0
56 lines not on this page · raw message
include/linux/kprobes.h new file +88 -0
88 lines not on this page · raw message
kernel/Makefile renamed from kernel/Makefile~kprobes-base-268-rc1 +1 -0
@@ -23,6 +23,7 @@ obj-$(CONFIG_IKCONFIG_PROC) += configs.o obj-$(CONFIG_STOP_MACHINE) += stop_machine.o obj-$(CONFIG_AUDIT) += audit.o obj-$(CONFIG_AUDITSYSCALL) += auditsc.o +obj-$(CONFIG_KPROBES) += kprobes.o ifneq ($(CONFIG_IA64),y) # According to Alan Modra <[email protected]>, the -fno-omit-frame-pointer is
kernel/kprobes.c new file +111 -0
111 lines not on this page · raw message
_