tracing: kprobe-based event tracer and x86 instruction decoder

Add x86 instruction decoder to arch-specific libraries. This decoder can decode x86 instructions used in kernel into prefix, opcode, modrm, sib, displacement and immediates. This can also show the length of instructions.

Quoted 4 lines · Masami Hiramatsu

Add x86 instruction decoder to arch-specific libraries. This decoder can decode x86 instructions used in kernel into prefix, opcode, modrm, sib, displacement and immediates. This can also show the length of instructions.

Could also be used to implement a simple disasembler for OOPS output ala arch/s390/kernel/dis.c?

arch/x86/scripts/gen-insn-attr-x86.awk line 1

Quoted 3 lines · Masami Hiramatsu

+++ b/arch/x86/scripts/gen-insn-attr-x86.awk

arch/x86/scripts/gen-insn-attr-x86.awk new file +1 -0

@@ -0,0 +1,314 @@
+#!/bin/awk -f

On some distributions (debian) it is /usr/bin/awk.

Quoted 5 lines · Gleb Natapov

arch/x86/scripts/gen-insn-attr-x86.awk line 1

Quoted 3 lines · Masami Hiramatsu

+++ b/arch/x86/scripts/gen-insn-attr-x86.awk

arch/x86/scripts/gen-insn-attr-x86.awk new file +1 -0

@@ -0,0 +1,314 @@
+#!/bin/awk -f

On some distributions (debian) it is /usr/bin/awk.

True, but on most of them (all?) there is also an appropriate link in /bin.

If shebang could have more that one argument, then '/usr/bin/env awk -f' would be the best solution I think.

Quoted 7 lines · Przemysssaw Paweeeczyk

Quoted 5 lines · Gleb Natapov

arch/x86/scripts/gen-insn-attr-x86.awk line 1

Quoted 3 lines · Masami Hiramatsu

+++ b/arch/x86/scripts/gen-insn-attr-x86.awk

arch/x86/scripts/gen-insn-attr-x86.awk new file +1 -0

@@ -0,0 +1,314 @@
+#!/bin/awk -f

On some distributions (debian) it is /usr/bin/awk.

True, but on most of them (all?) there is also an appropriate link in /bin.

Nope, not on debian testing. Although I assume if kernel compilation will start to fail it will appear :)

Quoted 2 lines

If shebang could have more that one argument, then '/usr/bin/env awk -f' would be the best solution I think.

Quoted 13 lines · Gleb Natapov

Quoted 7 lines · Przemysssaw Paweeeczyk

Quoted 5 lines · Gleb Natapov

arch/x86/scripts/gen-insn-attr-x86.awk line 1

Quoted 3 lines · Masami Hiramatsu

+++ b/arch/x86/scripts/gen-insn-attr-x86.awk

arch/x86/scripts/gen-insn-attr-x86.awk new file +1 -0

@@ -0,0 +1,314 @@
+#!/bin/awk -f

On some distributions (debian) it is /usr/bin/awk.

True, but on most of them (all?) there is also an appropriate link in /bin.

Nope, not on debian testing. Although I assume if kernel compilation will start to fail it will appear :)

Quoted 2 lines

If shebang could have more that one argument, then '/usr/bin/env awk -f' would be the best solution I think.

Ah, I see.
Actually, it will be executed from Makefile with 'awk -f'.

Quoted 6 lines

arch/x86/lib/Makefile +0 -0

@@ -2,12 +2,21 @@
 # Makefile for x86 specific library files.
 #
 

arch/x86/lib/Makefile line 7

Quoted 3 lines

arch/x86/lib/Makefile +3 -0

+quiet_cmd_inat_tables = GEN     $@
+      cmd_inat_tables = awk -f $(srctree)/arch/x86/scripts/gen-insn-attr-x86.awk $(srctree)/arch/x86/lib/x86-opcode-map.txt > $@
+

So, if awk is on the PATH, it will pass.

Maybe, I need to add 'HOSTAWK = awk' line in Makefile.

Ensure safeness of inserting kprobes by checking whether the specified address is at the first byte of a instruction on x86.
This is done by decoding probed function from its head to the probe point.

Signed-off-by Masami Hiramatsu <[email protected]>

Cc Ananth N Mavinakayanahalli <[email protected]>

Cc Jim Keniston <[email protected]>

Cc Ingo Molnar <[email protected]>

---

 arch/x86/kernel/kprobes.c |   54 +++++++++++++++++++++++++++++++++++++++++++++
 1 files changed, 54 insertions(+), 0 deletions(-)

arch/x86/kernel/kprobes.c +2 -0

index 7b5169d..3d5e85f 100644
@@ -48,12 +48,14 @@
 #include <linux/preempt.h>
 #include <linux/module.h>
 #include <linux/kdebug.h>
+#include <linux/kallsyms.h>
 
 #include <asm/cacheflush.h>
 #include <asm/desc.h>
 #include <asm/pgtable.h>
 #include <asm/uaccess.h>
 #include <asm/alternative.h>
+#include <asm/insn.h>
 
 void jprobe_return_end(void);
 

@@ -244,6 +246,56 @@ retry:
 	}

arch/x86/kernel/kprobes.c +5 -0

+	return 0;
+}
+
+/* Dummy buffers for kallsyms_lookup */
+static char __dummy_buf[KSYM_NAME_LEN];

arch/x86/kernel/kprobes.c +8 -0

+		}
+		insn_get_length(&insn);
+		addr += insn.length;
+	}
+
+	return (addr == paddr);
+}
+
 /*
  * Returns non-zero if opcode modifies the interrupt flag.
  */

arch/x86/kernel/kprobes.c +0 -0

 	if (!p->ainsn.insn)

Signature · 8 lines

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: [email protected]

Quoted 36 lines · Masami Hiramatsu

Ensure safeness of inserting kprobes by checking whether the specified address is at the first byte of a instruction on x86.
This is done by decoding probed function from its head to the probe point.

Signed-off-by Masami Hiramatsu <[email protected]>

Cc Ananth N Mavinakayanahalli <[email protected]>

Cc Jim Keniston <[email protected]>

Cc Ingo Molnar <[email protected]>

---

 arch/x86/kernel/kprobes.c |   54 +++++++++++++++++++++++++++++++++++++++++++++
 1 files changed, 54 insertions(+), 0 deletions(-)

arch/x86/kernel/kprobes.c +2 -0

index 7b5169d..3d5e85f 100644
@@ -48,12 +48,14 @@
 #include <linux/preempt.h>
 #include <linux/module.h>
 #include <linux/kdebug.h>
+#include <linux/kallsyms.h>
 
 #include <asm/cacheflush.h>
 #include <asm/desc.h>
 #include <asm/pgtable.h>
 #include <asm/uaccess.h>
 #include <asm/alternative.h>
+#include <asm/insn.h>
 
 void jprobe_return_end(void);
 

@@ -244,6 +246,56 @@ retry:
 	}
 }
 

arch/x86/kernel/kprobes.c retry: · line 256

Quoted 8 lines

arch/x86/kernel/kprobes.c +8 -0

+/* Recover the probed instruction at addr for further analysis. */
+static int recover_probed_instruction(kprobe_opcode_t *buf, unsigned long addr)
+{
+	struct kprobe *kp;
+	kp = get_kprobe((void *)addr);
+	if (!kp)
+		return -EINVAL;
+

I'm just doing a casual scan of the patch set.

arch/x86/kernel/kprobes.c retry: · line 258

Quoted 3 lines

arch/x86/kernel/kprobes.c +2 -0

+	/*
+	 * Don't use p->ainsn.insn, which could be modified -- e.g.,

This comment talks about "p", what's that? It's not used in this function.

arch/x86/kernel/kprobes.c retry: · line 262

Quoted 5 lines

arch/x86/kernel/kprobes.c +4 -0

+	 * by fix_riprel().
+	 */
+	memcpy(buf, kp->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
+	buf[0] = kp->opcode;

Why is it OK to copy addr to "buf" and then rewrite the first character of buf? Does it have something to do with the above "p"?

I don't mean to be critical here, but I've been doing "Mother Day" activities all weekend and for some reason that was also the best time for everyone to Cc me on patches. I'm way behind in my email, and it would be nice if the comments described why things that "look" wrong are not.

Quoted 10 lines

arch/x86/kernel/kprobes.c +10 -0

+	return 0;
+}
+
+/* Dummy buffers for kallsyms_lookup */
+static char __dummy_buf[KSYM_NAME_LEN];
+
+/* Check if paddr is at an instruction boundary */
+static int __kprobes can_probe(unsigned long paddr)
+{
+	int ret;

arch/x86/kernel/kprobes.c retry: · line 277

Quoted 5 lines

arch/x86/kernel/kprobes.c +5 -0

+	unsigned long addr, offset = 0;
+	struct insn insn;
+	kprobe_opcode_t buf[MAX_INSN_SIZE];
+
+	/* Lookup symbol including addr */

The above comment is very close to a "add one to i" for i++ type of comment.

arch/x86/kernel/kprobes.c retry: · line 287

Quoted 11 lines

arch/x86/kernel/kprobes.c +10 -0

+	if (!kallsyms_lookup(paddr, NULL, &offset, NULL, __dummy_buf))
+		return 0;
+
+	/* Decode instructions */
+	addr = paddr - offset;
+	while (addr < paddr) {
+		insn_init_kernel(&insn, (void *)addr);
+		insn_get_opcode(&insn);
+		if (OPCODE1(&insn) == BREAKPOINT_INSTRUCTION) {
+			ret = recover_probed_instruction(buf, addr);

Oh, the above puts back the original op code. That is why it is OK?

I'd comment that a little bit more. Just so that reviewers have an easier idea of what is happening.

arch/x86/kernel/kprobes.c retry: · line 290

Quoted 3 lines

arch/x86/kernel/kprobes.c +3 -0

+			if (ret)
+				return 0;
+			insn_init_kernel(&insn, buf);

insn_init_kernel? Is that like a text poke or something?

Quoted 12 lines

arch/x86/kernel/kprobes.c +8 -0

+		}
+		insn_get_length(&insn);
+		addr += insn.length;
+	}
+
+	return (addr == paddr);
+}
+
 /*
  * Returns non-zero if opcode modifies the interrupt flag.
  */

arch/x86/kernel/kprobes.c static void __kprobes arch_copy_kprobe(struct kprobe *p) · line 417

Quoted 7 lines

arch/x86/kernel/kprobes.c +2 -0

@@ -359,6 +411,8 @@ static void __kprobes arch_copy_kprobe(struct kprobe *p)
 
 int __kprobes arch_prepare_kprobe(struct kprobe *p)
 {
+	if (!can_probe((unsigned long)p->addr))
+		return -EILSEQ;
 	/* insn: must be on special executable page on x86. */
 	p->ainsn.insn = get_insn_slot();

Oh look, I found the phantom "p"!

-- Steve

Quoted 12 lines

arch/x86/kernel/kprobes.c +0 -0

 	if (!p->ainsn.insn)

Signature · 8 lines

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: [email protected]

Quoted 11 lines

arch/x86/kernel/kprobes.c retry: · line 287

Quoted 10 lines

arch/x86/kernel/kprobes.c +10 -0

+	if (!kallsyms_lookup(paddr, NULL, &offset, NULL, __dummy_buf))
+		return 0;
+
+	/* Decode instructions */
+	addr = paddr - offset;
+	while (addr < paddr) {
+		insn_init_kernel(&insn, (void *)addr);
+		insn_get_opcode(&insn);
+		if (OPCODE1(&insn) == BREAKPOINT_INSTRUCTION) {
+			ret = recover_probed_instruction(buf, addr);

Oh, the above puts back the original op code. That is why it is OK?

Oops, no. I have to use get_kprobe() instead. Thanks!

Quoted 9 lines

arch/x86/kernel/kprobes.c retry: · line 262

Quoted 6 lines

arch/x86/kernel/kprobes.c +4 -0

+	 * by fix_riprel().
+	 */
+	memcpy(buf, kp->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
+	buf[0] = kp->opcode;

Why is it OK to copy addr to "buf" and then rewrite the first character of buf? Does it have something to do with the above "p"?

Yes, each kprobe copied probed instruction to kp->ainsn.insn, which is an executable buffer for single stepping.
So, basically, kp->ainsn.insn has an original instruction. However, RIP-relative instruction can not do single-stepping at different place, fix_riprel() tweaks the displacement of that instruction. In that case, we can't recover the instruction from the kp->ainsn.insn.

On the other hand, kp->opcode has a copy of the first byte of the probed instruction, which is overwritten by int3. And the instruction at kp->addr is not modified by kprobes except for the first byte, we can recover the original instruction from it and kp->opcode.

Quoted 14 lines · Masami Hiramatsu

Quoted 6 lines

arch/x86/kernel/kprobes.c retry: · line 262

Quoted 4 lines

arch/x86/kernel/kprobes.c +4 -0

+	 * by fix_riprel().
+	 */
+	memcpy(buf, kp->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
+	buf[0] = kp->opcode;

Why is it OK to copy addr to "buf" and then rewrite the first character of buf? Does it have something to do with the above "p"?

Yes, each kprobe copied probed instruction to kp->ainsn.insn, which is an executable buffer for single stepping.
So, basically, kp->ainsn.insn has an original instruction. However, RIP-relative instruction can not do single-stepping at different place, fix_riprel() tweaks the displacement of that instruction. In that case, we can't recover the instruction from the kp->ainsn.insn.

Quoted 5 lines

On the other hand, kp->opcode has a copy of the first byte of the probed instruction, which is overwritten by int3. And the instruction at kp->addr is not modified by kprobes except for the first byte, we can recover the original instruction from it and kp->opcode.

For code that is awkward, complex or non-trivial, don't be afraid to put in a paragraph explaining the code. The above explanation should be a comment in the code. Otherwise people like me would just look at it and say "huh?".

Note, I'm a bit cranky this morning, so I hope I don't offend anyone.

Add kprobes based event tracer on ftrace.

This tracer is similar to the events tracer which is based on Tracepoint infrastructure. Instead of Tracepoint, this tracer is based on kprobes(kprobe and kretprobe). It probes anywhere where kprobes can probe(this means, all functions body except for __kprobes functions).

Changes from v4:
 - Change interface name from 'kprobe_probes' to 'kprobe_events'
 - Skip comments (words after '#') from inputs of 'kprobe_events'.

Signed-off-by Masami Hiramatsu <[email protected]>

Cc Steven Rostedt <[email protected]>

Cc Ananth N Mavinakayanahalli <[email protected]>

Cc Ingo Molnar <[email protected]>

Cc Frederic Weisbecker <[email protected]>

---

 Documentation/trace/ftrace.txt |   55 +++++
 kernel/trace/Kconfig           |    9 +
 kernel/trace/Makefile          |    1
 kernel/trace/trace_kprobe.c    |  404 ++++++++++++++++++++++++++++++++++++++++

 4 files changed, 469 insertions(+), 0 deletions(-)

 create mode 100644 kernel/trace/trace_kprobe.c

Documentation/trace/ftrace.txt +55 -0

index fd9a3e6..2b8ead6 100644
@@ -1310,6 +1310,61 @@ dereference in a kernel module:
[...]
 
 
+kprobe-based event tracer
+---------------------------
+
+This tracer is similar to the events tracer which is based on Tracepoint
+infrastructure. Instead of Tracepoint, this tracer is based on kprobes(kprobe
+and kretprobe). It probes anywhere where kprobes can probe(this means, all
+functions body except for __kprobes functions).
+
+Unlike the function tracer, this tracer can probe instructions inside of
+kernel functions. It allows you to check which instruction has been executed.
+
+Unlike the Tracepoint based events tracer, this tracer can add new probe points
+on the fly.
+
+Similar to the events tracer, this tracer doesn't need to be activated via
+current_tracer, instead of that, just set probe points via
+/debug/tracing/kprobe_events.
+
+Synopsis of kprobe_events:
+  p SYMBOL[+offs|-offs]|MEMADDR        : set a probe
+  r SYMBOL[+0]                 : set a return probe
+
+E.g.
+  echo p sys_open > /debug/tracing/kprobe_events
+
+ This sets a kprobe on the top of sys_open() function.
+
+  echo r sys_open >> /debug/tracing/kprobe_events
+
+ This sets a kretprobe on the return point of sys_open() function.
+
+  echo > /debug/tracing/kprobe_events
+
+ This clears all probe points. and you can see the traced information via
+/debug/tracing/trace.
+
+  cat /debug/tracing/trace
+# tracer: nop
+#
+#           TASK-PID    CPU#    TIMESTAMP  FUNCTION
+#              | |       |          |         |
+           <...>-5117  [003]   416.481638: sys_open: @sys_open+0
+           <...>-5117  [003]   416.481662: syscall_call: <-sys_open+0
+           <...>-5117  [003]   416.481739: sys_open: @sys_open+0
+           <...>-5117  [003]   416.481762: sysenter_do_call: <-sys_open+0
+           <...>-5117  [003]   416.481818: sys_open: @sys_open+0
+           <...>-5117  [003]   416.481842: sysenter_do_call: <-sys_open+0
+           <...>-5117  [003]   416.481882: sys_open: @sys_open+0
+           <...>-5117  [003]   416.481905: sysenter_do_call: <-sys_open+0
+
+ @SYMBOL means that kernel hits a probe, and <-SYMBOL means kernel returns
+from SYMBOL(e.g. "sysenter_do_call: <-sys_open+0" means kernel returns from
+sys_open to sysenter_do_call).
+
+

 function graph tracer
 ---------------------------

kernel/trace/Kconfig +0 -0

index 7370253..914df9c 100644
@@ -398,6 +398,15 @@ config BLK_DEV_IO_TRACE
 

         If unsure, say N.

kernel/trace/Kconfig +9 -0

+config KPROBE_TRACER
+       depends on KPROBES
+       depends on X86
+       bool "Trace kprobes"
+       select TRACING
+       help
+         This tracer probes everywhere where kprobes can probe it, and
+         records various registers and memories specified by user.
+

 config DYNAMIC_FTRACE
       bool "enable/disable ftrace tracepoints dynamically" depends on FUNCTION_TRACER

kernel/trace/Makefile +0 -0

index 06b8585..166c859 100644
@@ -51,5 +51,6 @@ obj-$(CONFIG_EVENT_TRACING) += trace_export.o

 obj-$(CONFIG_FTRACE_SYSCALLS) += trace_syscalls.o obj-$(CONFIG_EVENT_PROFILE) += trace_event_profile.o obj-$(CONFIG_EVENT_TRACING) += trace_events_filter.o +obj-$(CONFIG_KPROBE_TRACER) += trace_kprobe.o

 libftrace-y := ftrace.o

kernel/trace/trace_kprobe.c new file +373 -0

new file mode 100644
index 0000000..8112505
@@ -0,0 +1,404 @@
+/*
+ * kprobe based kernel tracer
+ *
+ * Created by Masami Hiramatsu <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/module.h>
+#include <linux/uaccess.h>
+#include <linux/kprobes.h>
+#include <linux/seq_file.h>
+#include <linux/slab.h>
+#include <linux/smp.h>
+#include <linux/debugfs.h>
+#include <linux/types.h>
+#include <linux/string.h>
+#include <linux/ctype.h>
+
+#include <linux/ftrace.h>
+#include "trace.h"
+
+/**
+ * kprobe_trace_core
+ */
+#define TRACE_MAXARGS 6
+
+struct trace_probe {
+       struct list_head        list;
+       union {
+               struct kprobe           kp;
+               struct kretprobe        rp;
+       };
+       const char              *symbol;        /* symbol name */
+};
+
+static void kprobe_trace_record(unsigned long ip, struct trace_probe *tp,
+                               struct pt_regs *regs);
+
+static int kprobe_trace_func(struct kprobe *kp, struct pt_regs *regs)
+{
+       struct trace_probe *tp = container_of(kp, struct trace_probe, kp);
+
+       kprobe_trace_record(instruction_pointer(regs), tp, regs);
+       return 0;
+}
+
+static int kretprobe_trace_func(struct kretprobe_instance *ri,
+                               struct pt_regs *regs)
+{
+       struct trace_probe *tp = container_of(ri->rp, struct trace_probe, rp);
+
+       kprobe_trace_record((unsigned long)ri->ret_addr, tp, regs);
+       return 0;
+}
+
+static int probe_is_return(struct trace_probe *tp)
+{
+       return (tp->rp.handler == kretprobe_trace_func);
+}
+
+static const char *probe_symbol(struct trace_probe *tp)
+{
+       return tp->symbol ? tp->symbol : "unknown";
+}
+
+static long probe_offset(struct trace_probe *tp)
+{
+       return (probe_is_return(tp)) ? tp->rp.kp.offset : tp->kp.offset;
+}
+
+static void *probe_address(struct trace_probe *tp)
+{
+       return (probe_is_return(tp)) ? tp->rp.kp.addr : tp->kp.addr;
+}
+
+
+static DEFINE_MUTEX(probe_lock);
+static LIST_HEAD(probe_list);
+
+static struct trace_probe *alloc_trace_probe(const char *symbol)
+{
+       struct trace_probe *tp;
+
+       tp = kzalloc(sizeof(struct trace_probe), GFP_KERNEL);
+       if (!tp)
+               return ERR_PTR(-ENOMEM);
+
+       if (symbol) {
+               tp->symbol = kstrdup(symbol, GFP_KERNEL);
+               if (!tp->symbol) {
+                       kfree(tp);
+                       return ERR_PTR(-ENOMEM);
+               }
+       }
+
+       INIT_LIST_HEAD(&tp->list);
+       return tp;
+}
+
+static void free_trace_probe(struct trace_probe *tp)
+{
+       kfree(tp->symbol);
+       kfree(tp);
+}
+
+static int register_trace_probe(struct trace_probe *tp)
+{
+       int ret;
+
+       mutex_lock(&probe_lock);
+       list_add_tail(&tp->list, &probe_list);
+
+       if (probe_is_return(tp))
+               ret = register_kretprobe(&tp->rp);
+       else
+               ret = register_kprobe(&tp->kp);
+
+       if (ret) {
+               pr_warning("Could not insert probe(%d)\n", ret);
+               if (ret == -EILSEQ) {
+                       pr_warning("Probing address(0x%p) is not an "
+                                  "instruction boundary.\n",
+                                  probe_address(tp));
+                       ret = -EINVAL;
+               }
+               list_del(&tp->list);
+       }
+       mutex_unlock(&probe_lock);
+       return ret;
+}
+
+static void unregister_trace_probe(struct trace_probe *tp)
+{
+       if (probe_is_return(tp))
+               unregister_kretprobe(&tp->rp);
+       else
+               unregister_kprobe(&tp->kp);
+       list_del(&tp->list);
+}
+
+static int create_trace_probe(int argc, char **argv)
+{
+       /*
+        * Argument syntax:
+        *  - Add kprobe: p SYMBOL[+OFFS|-OFFS]|ADDRESS
+        *  - Add kretprobe: r SYMBOL[+0]
+        */
+       struct trace_probe *tp;
+       struct kprobe *kp;
+       char *tmp;
+       int ret = 0;
+       int is_return = 0;
+       char *symbol = NULL;
+       long offset = 0;
+       void *addr = NULL;
+
+       if (argc < 2)
+               return -EINVAL;
+
+       if (argv[0][0] == 'p')
+               is_return = 0;
+       else if (argv[0][0] == 'r')
+               is_return = 1;
+       else
+               return -EINVAL;
+
+       if (isdigit(argv[1][0])) {
+               if (is_return)
+                       return -EINVAL;
+               /* an address specified */
+               ret = strict_strtoul(&argv[0][2], 0, (unsigned long *)&addr);
+               if (ret)
+                       return ret;
+       } else {
+               /* a symbol specified */
+               symbol = argv[1];
+               /* TODO: support .init module functions */
+               tmp = strchr(symbol, '+');
+               if (!tmp)
+                       tmp = strchr(symbol, '-');
+
+               if (tmp) {
+                       /* skip sign because strict_strtol doesn't accept '+' */
+                       ret = strict_strtol(tmp + 1, 0, &offset);
+                       if (ret)
+                               return ret;
+                       if (*tmp == '-')
+                               offset = -offset;
+                       *tmp = '\0';
+               }
+               if (offset && is_return)
+                       return -EINVAL;
+       }
+
+       /* setup a probe */
+       tp = alloc_trace_probe(symbol);
+       if (IS_ERR(tp))
+               return PTR_ERR(tp);
+
+       if (is_return) {
+               kp = &tp->rp.kp;
+               tp->rp.handler = kretprobe_trace_func;
+       } else {
+               kp = &tp->kp;
+               tp->kp.pre_handler = kprobe_trace_func;
+       }
+
+       if (tp->symbol) {
+               /* TODO: check offset is collect by using insn_decoder */
+               kp->symbol_name = tp->symbol;
+               kp->offset = offset;
+       } else
+               kp->addr = addr;
+
+       ret = register_trace_probe(tp);
+       if (ret)
+               goto error;
+       return 0;
+
+error:
+       free_trace_probe(tp);
+       return ret;
+}
+
+static void cleanup_all_probes(void)
+{
+       struct trace_probe *tp;
+       mutex_lock(&probe_lock);
+       /* TODO: Use batch unregistration */
+       while (!list_empty(&probe_list)) {
+               tp = list_entry(probe_list.next, struct trace_probe, list);
+               unregister_trace_probe(tp);
+               free_trace_probe(tp);
+       }
+       mutex_unlock(&probe_lock);
+}
+
+
+/* Probes listing interfaces */
+static void *probes_seq_start(struct seq_file *m, loff_t *pos)
+{
+       mutex_lock(&probe_lock);
+       return seq_list_start(&probe_list, *pos);
+}
+
+static void *probes_seq_next(struct seq_file *m, void *v, loff_t *pos)
+{
+       return seq_list_next(v, &probe_list, pos);
+}
+
+static void probes_seq_stop(struct seq_file *m, void *v)
+{
+       mutex_unlock(&probe_lock);
+}
+
+static int probes_seq_show(struct seq_file *m, void *v)
+{
+       struct trace_probe *tp = v;
+
+       if (tp == NULL)
+               return 0;
+
+       if (tp->symbol)
+               seq_printf(m, "%c %s%+ld\n",
+                       probe_is_return(tp) ? 'r' : 'p',
+                       probe_symbol(tp), probe_offset(tp));
+       else
+               seq_printf(m, "%c 0x%p\n",
+                       probe_is_return(tp) ? 'r' : 'p',
+                       probe_address(tp));
+       return 0;
+}
+
+static const struct seq_operations probes_seq_op = {
+       .start  = probes_seq_start,
+       .next   = probes_seq_next,
+       .stop   = probes_seq_stop,
+       .show   = probes_seq_show
+};
+
+static int probes_open(struct inode *inode, struct file *file)
+{
+       if ((file->f_mode & FMODE_WRITE) &&
+           !(file->f_flags & O_APPEND))
+               cleanup_all_probes();
+
+       return seq_open(file, &probes_seq_op);
+}
+
+
+#define WRITE_BUFSIZE 128
+
+static ssize_t probes_write(struct file *file, const char __user *buffer,
+                           size_t count, loff_t *ppos)
+{
+       char *kbuf, *tmp;
+       char **argv = NULL;
+       int argc = 0;
+       int ret;
+       size_t done;
+       size_t size;
+
+       if (!count || count < 0)
+               return 0;
+
+       kbuf = kmalloc(WRITE_BUFSIZE, GFP_KERNEL);
+       if (!kbuf)
+               return -ENOMEM;
+
+       ret = done = 0;
+       do {
+               size = count - done;
+               if (size > WRITE_BUFSIZE)
+                       size = WRITE_BUFSIZE;
+               if (copy_from_user(kbuf, buffer + done, size)) {
+                       ret = -EFAULT;
+                       goto out;
+               }
+               kbuf[size] = '\0';
+               tmp = strchr(kbuf, '\n');
+               if (!tmp) {
+                       pr_warning("Line length is too long: "
+                                  "Should be less than %d.", WRITE_BUFSIZE);
+                       ret = -EINVAL;
+                       goto out;
+               }
+               *tmp = '\0';
+               size = tmp - kbuf + 1;
+               done += size;
+               /* Remove comments */
+               tmp = strchr(kbuf, '#');
+               if (tmp)
+                       *tmp = '\0';
+
+               argv = argv_split(GFP_KERNEL, kbuf, &argc);
+               if (!argv) {
+                       ret = -ENOMEM;
+                       goto out;
+               }
+
+               if (argc)
+                       ret = create_trace_probe(argc, argv);
+
+               argv_free(argv);
+               if (ret < 0)
+                       goto out;
+
+       } while (done < count);
+       ret = done;
+out:
+       kfree(kbuf);
+       return ret;
+}
+
+static const struct file_operations kprobe_events_ops = {
+       .owner          = THIS_MODULE,
+       .open           = probes_open,
+       .read           = seq_read,
+       .llseek         = seq_lseek,
+       .release        = seq_release,
+       .write          = probes_write,

kernel/trace/trace_kprobe.c new file +21 -1

+
+/* Make a debugfs interface for controling probe points */
+static __init int init_kprobe_trace(void)
+{
+       struct dentry *d_tracer;
+       struct dentry *entry;
+
+       d_tracer = tracing_init_dentry();
+       if (!d_tracer)
+               return 0;
+
+       entry = debugfs_create_file("kprobe_events", 0644, d_tracer,
+                                   NULL, &kprobe_events_ops);
+
+       if (!entry)
+               pr_warning("Could not create debugfs "
+                          "'kprobe_events' entry\n");
+       return 0;
+}
+fs_initcall(init_kprobe_trace);
+
 
 
--

Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: [email protected]

Hi,

2009/5/9 Masami Hiramatsu <[email protected]>:

kernel/trace/trace_kprobe.c line 383

Quoted 9 lines

kernel/trace/trace_kprobe.c new file +9 -0

+
+/* event recording functions */
+static void kprobe_trace_record(unsigned long ip, struct trace_probe *tp,
+                               struct pt_regs *regs)
+{
+       __trace_bprintk(ip, "%s%s%+ld\n",
+                       probe_is_return(tp) ? "<-" : "@",
+                       probe_symbol(tp), probe_offset(tp));
+}

What happens here if you have:

kprobe_trace_record() {
      probe_symbol() {
            ....                         probes_open() {
                                              cleanup_all_probes() {
                                                         free_trace_probe();
     return tp->symbol ? ....; //crack!

I wonder if you shouldn't use a per_cpu list of probes, spinlocked/irqsaved accessed
and also a kind of prevention against nmi.

Quoted 3 lines · Frédéric Weisbecker

Hi,

2009/5/9 Masami Hiramatsu <[email protected]>:

[...]

Quoted 21 lines

kernel/trace/trace_kprobe.c line 383

Quoted 9 lines

kernel/trace/trace_kprobe.c new file +9 -0

+
+/* event recording functions */
+static void kprobe_trace_record(unsigned long ip, struct trace_probe *tp,
+                               struct pt_regs *regs)
+{
+       __trace_bprintk(ip, "%s%s%+ld\n",
+                       probe_is_return(tp) ? "<-" : "@",
+                       probe_symbol(tp), probe_offset(tp));
+}

What happens here if you have:

kprobe_trace_record() {
      probe_symbol() {
            ....                         probes_open() {
                                              cleanup_all_probes() {
                                                         free_trace_probe();
     return tp->symbol ? ....; //crack!

Quoted 3 lines

I wonder if you shouldn't use a per_cpu list of probes, spinlocked/irqsaved accessed
and also a kind of prevention against nmi.

Sure, cleanup_all_probes() invokes unregister_kprobe() via unregister_trace_probe(), which waits running probe-handlers by using synchronize_sched()(because kprobes disables preemption around its handlers), before free_trace_probe().

So you don't need any locks there :-)

Thank you,

Add kprobes based event tracer on ftrace.

This tracer is similar to the events tracer which is based on Tracepoint infrastructure. Instead of Tracepoint, this tracer is based on kprobes(kprobe and kretprobe). It probes anywhere where kprobes can probe(this means, all functions body except for __kprobes functions).

Quoted 7 lines · Masami Hiramatsu

Add kprobes based event tracer on ftrace.

This tracer is similar to the events tracer which is based on Tracepoint infrastructure. Instead of Tracepoint, this tracer is based on kprobes(kprobe and kretprobe). It probes anywhere where kprobes can probe(this means, all functions body except for __kprobes functions).

That's some pretty cool functionality, especially together with patch 7.

But as with so many tracing bits in the kernel it's just lowlevel bits without a good user interface. We'd really need some high-level way for sysadmins/developers to use it. E.g. a version of the systemtap compiler that doesn't build a kernel module but instead uses the event tracer + the kprobes tracer.

Or a model like Tom's zedtrace where a perl script would do the dwarf lookups and generates these probes in addition to the filtered event traces.

[...] But as with so many tracing bits in the kernel it's just lowlevel bits without a good user interface. We'd really need some high-level way for sysadmins/developers to use it. E.g. a version of the systemtap compiler that doesn't build a kernel module but instead uses the event tracer + the kprobes tracer. [...]

Use &regs->sp instead of regs for getting the top of stack in kernel mode. (on x86-64, regs->sp always points the top of stack)

Quoted 2 lines · Masami Hiramatsu

Use &regs->sp instead of regs for getting the top of stack in kernel mode. (on x86-64, regs->sp always points the top of stack)

Shouldn't this patch be sent for inclusion ASAP instead of sitting in this series?

Support following probe arguments and add fetch functions on kprobe-based event tracer.

%REG : Fetch register REG
sN : Fetch Nth entry of stack (N >= 0)
@ADDR : Fetch memory at ADDR (ADDR should be in kernel)

  @SYM[+|-offs] : Fetch memory at SYM +|- offs (SYM should be a data symbol)
  aN    : Fetch function argument. (N >= 0)
  rv    : Fetch return value.
  ra    : Fetch return address.

+|-offs(FETCHARG) : fetch memory at FETCHARG +|- offs address.

Signed-off-by Masami Hiramatsu <[email protected]>

Cc Steven Rostedt <[email protected]>

Cc Ananth N Mavinakayanahalli <[email protected]>

Cc Ingo Molnar <[email protected]>

Cc Frederic Weisbecker <[email protected]>

---

 Documentation/trace/ftrace.txt |   47 +++-
 kernel/trace/trace_kprobe.c    |  431 ++++++++++++++++++++++++++++++++++++++--
 2 files changed, 441 insertions(+), 37 deletions(-)

Documentation/trace/ftrace.txt +0 -0

index 2b8ead6..ce91398 100644

+++ b/Documentation/trace/ftrace.txt

Documentation/trace/ftrace.txt +23 -6

@@ -1329,17 +1329,34 @@ current_tracer, instead of that, just set probe points via
 /debug/tracing/kprobe_events.
 
 Synopsis of kprobe_events:
-  p SYMBOL[+offs|-offs]|MEMADDR	: set a probe
-  r SYMBOL[+0]			: set a return probe
+  p SYMBOL[+offs|-offs]|MEMADDR [FETCHARGS]	: set a probe
+  r SYMBOL[+0] [FETCHARGS]			: set a return probe
+
+ FETCHARGS:
+  %REG	: Fetch register REG
+  sN	: Fetch Nth entry of stack (N >= 0)
+  @ADDR	: Fetch memory at ADDR (ADDR should be in kernel)
+  @SYM[+|-offs]	: Fetch memory at SYM +|- offs (SYM should be a data symbol)
+  aN	: Fetch function argument. (N >= 0)(*)
+  rv	: Fetch return value.(**)
+  ra	: Fetch return address.(**)
+  +|-offs(FETCHARG) : fetch memory at FETCHARG +|- offs address.(***)
+
+  (*) aN may not correct on asmlinkaged functions and at the middle of
+      function body.
+  (**) only for return probe.
+  (***) this is useful for fetching a field of data structures.
 
 E.g.
-  echo p sys_open > /debug/tracing/kprobe_events
+  echo p do_sys_open a0 a1 a2 a3 > /debug/tracing/kprobe_events
 
- This sets a kprobe on the top of sys_open() function.
+ This sets a kprobe on the top of do_sys_open() function with recording
+1st to 4th arguments.
 
-  echo r sys_open >> /debug/tracing/kprobe_events
+  echo r do_sys_open rv ra >> /debug/tracing/kprobe_events
 
- This sets a kretprobe on the return point of sys_open() function.
+ This sets a kretprobe on the return point of do_sys_open() function with
+recording return value and return address.
 
   echo > /debug/tracing/kprobe_events
 

Hi,

Here are the patches of kprobe-based event tracer for x86, version 5, which allows you to probe various kernel events through ftrace interface.

This version supports only x86(-32/-64) (but porting it on other arch just needs kprobes/kretprobes and register and stack access APIs).

This patchset also includes x86(-64) instruction decoder which supports non-SSE/FP opcodes and includes x86 opcode map. I think it will be possible to share this opcode map with KVM's decoder.

This series can be applied on the latest linux-2.6-tip tree.

This patchset includes following changes:
- Add x86 instruction decoder [1/7]
- Check insertion point safety in kprobe [2/7]
- Cleanup fix_riprel() with insn decoder [3/7]
- Add kprobe-tracer plugin [4/7]
- Fix kernel_trap_sp() on x86 according to systemtap runtime. [5/7]
- Add arch-dep register and stack fetching functions [6/7]
- Support fetching various status (register/stack/memory/etc.) [7/7]

Future items:
- .init function tracing support.
- Support primitive types(long, ulong, int, uint, etc) for args.

E.g.
echo p do_sys_open a0 a1 a2 a3 > /debug/tracing/kprobe_events

This sets a kprobe on the top of do_sys_open() function with recording
1st to 4th arguments.

echo r do_sys_open rv rp >> /debug/tracing/kprobe_events

Quoted 25 lines · Masami Hiramatsu

Hi,

Here are the patches of kprobe-based event tracer for x86, version 5, which allows you to probe various kernel events through ftrace interface.

This version supports only x86(-32/-64) (but porting it on other arch just needs kprobes/kretprobes and register and stack access APIs).

This patchset also includes x86(-64) instruction decoder which supports non-SSE/FP opcodes and includes x86 opcode map. I think it will be possible to share this opcode map with KVM's decoder.

This series can be applied on the latest linux-2.6-tip tree.

This patchset includes following changes:
- Add x86 instruction decoder [1/7]
- Check insertion point safety in kprobe [2/7]
- Cleanup fix_riprel() with insn decoder [3/7]
- Add kprobe-tracer plugin [4/7]
- Fix kernel_trap_sp() on x86 according to systemtap runtime. [5/7]
- Add arch-dep register and stack fetching functions [6/7]
- Support fetching various status (register/stack/memory/etc.) [7/7]

Quoted 3 lines

Future items:
- .init function tracing support.
- Support primitive types(long, ulong, int, uint, etc) for args.

Ok, this looks pretty complete already.

Two high-level comments:

- There's no self-test - would it be possible to add one? See trace_selftest* in kernel/trace/

- No generic integration.

It would be nice if these ops:

Quoted 7 lines

E.g.
echo p do_sys_open a0 a1 a2 a3 > /debug/tracing/kprobe_events

This sets a kprobe on the top of do_sys_open() function with recording
1st to 4th arguments.

echo r do_sys_open rv rp >> /debug/tracing/kprobe_events

were just generally available in just about any other tracer - a bit like the event tracer.

It would also be nice to use the 'function attributes' facilities of the function tracer, combined with a new special syntax of the function-filter regex parser, to enable the recovery of return values (or the call arguments), for selected set of functions.

For example, today we can already do things like:

echo 'sys_read:traceon:4' > /debug/tracing/set_ftrace_filter

for 'trace triggers': the above will trigger tracing to be enabled on the entry of sys_read(), 4 times.

Likewise, something like:

echo 'sys_read:args' > /debug/tracing/set_ftrace_filter echo 'sys_read:return' > /debug/tracing/set_ftrace_filter

Could activate kprobes based argument and return-value tracing.

Quoted 5 lines

Two high-level comments:

- There's no self-test - would it be possible to add one? See trace_selftest* in kernel/trace/

I'm not so sure. Currently, it seems that those self-tests are only for tracers which define new event-entry on ring-buffer. Since this tracer just use ftrace_bprintk, it might need another kind of selftest. e.g. comparing outputs with expected patterns.
In that case, would it be better to make a user-space self test including filters and tracepoints?

Quoted 11 lines · Masami Hiramatsu

Quoted 4 lines

Two high-level comments:

- There's no self-test - would it be possible to add one? See trace_selftest* in kernel/trace/

I'm not so sure. Currently, it seems that those self-tests are only for tracers which define new event-entry on ring-buffer. Since this tracer just use ftrace_bprintk, it might need another kind of selftest. e.g. comparing outputs with expected patterns.
In that case, would it be better to make a user-space self test including filters and tracepoints?

Or have the workings in the selftest in kernel. As if a user started it. It does not need to write to the ring buffer, that is just what I did. The event selftests don't check if anything was written to the ring buffer, they just make sure that the tests don't crash the system.

Quoted 13 lines · Steven Rostedt

Quoted 11 lines · Masami Hiramatsu

Quoted 4 lines

Two high-level comments:

- There's no self-test - would it be possible to add one? See trace_selftest* in kernel/trace/

I'm not so sure. Currently, it seems that those self-tests are only for tracers which define new event-entry on ring-buffer. Since this tracer just use ftrace_bprintk, it might need another kind of selftest. e.g. comparing outputs with expected patterns.
In that case, would it be better to make a user-space self test including filters and tracepoints?

Quoted 4 lines

Or have the workings in the selftest in kernel. As if a user started it. It does not need to write to the ring buffer, that is just what I did. The event selftests don't check if anything was written to the ring buffer, they just make sure that the tests don't crash the system.

Would you mean that it is enough to enable some probes and just see what happened at boot time?
That's so easy to add.

Quoted 25 lines · Masami Hiramatsu

Hi,

Here are the patches of kprobe-based event tracer for x86, version 5, which allows you to probe various kernel events through ftrace interface.

This version supports only x86(-32/-64) (but porting it on other arch just needs kprobes/kretprobes and register and stack access APIs).

This patchset also includes x86(-64) instruction decoder which supports non-SSE/FP opcodes and includes x86 opcode map. I think it will be possible to share this opcode map with KVM's decoder.

This series can be applied on the latest linux-2.6-tip tree.

This patchset includes following changes:
- Add x86 instruction decoder [1/7]
- Check insertion point safety in kprobe [2/7]
- Cleanup fix_riprel() with insn decoder [3/7]
- Add kprobe-tracer plugin [4/7]
- Fix kernel_trap_sp() on x86 according to systemtap runtime. [5/7]
- Add arch-dep register and stack fetching functions [6/7]
- Support fetching various status (register/stack/memory/etc.) [7/7]

Quoted 3 lines

Future items:
- .init function tracing support.
- Support primitive types(long, ulong, int, uint, etc) for args.

Ok, this looks pretty complete already.

Two high-level comments:

- There's no self-test - would it be possible to add one? See trace_selftest* in kernel/trace/

- No generic integration.

Quoted 35 lines · Ingo Molnar

Quoted 25 lines · Masami Hiramatsu

Hi,

Here are the patches of kprobe-based event tracer for x86, version 5, which allows you to probe various kernel events through ftrace interface.

This version supports only x86(-32/-64) (but porting it on other arch just needs kprobes/kretprobes and register and stack access APIs).

This patchset also includes x86(-64) instruction decoder which supports non-SSE/FP opcodes and includes x86 opcode map. I think it will be possible to share this opcode map with KVM's decoder.

This series can be applied on the latest linux-2.6-tip tree.

This patchset includes following changes:
- Add x86 instruction decoder [1/7]
- Check insertion point safety in kprobe [2/7]
- Cleanup fix_riprel() with insn decoder [3/7]
- Add kprobe-tracer plugin [4/7]
- Fix kernel_trap_sp() on x86 according to systemtap runtime. [5/7]
- Add arch-dep register and stack fetching functions [6/7]
- Support fetching various status (register/stack/memory/etc.) [7/7]

Quoted 3 lines

Future items:
- .init function tracing support.
- Support primitive types(long, ulong, int, uint, etc) for args.

Ok, this looks pretty complete already.

Two high-level comments:

Quoted 4 lines

- There's no self-test - would it be possible to add one? See trace_selftest* in kernel/trace/

- No generic integration.

Hmm, Ingo, could you tell me what I can do for the integration? Would you means that I should use filters?