tracing: expose current->comm to [ku]probe events

From: Omar Sandoval <[email protected]>

It has been undocumented since it was introduced in commit e09c8614b329 ("tracing/kprobes: Support "string" type").

Signed-off-by Omar Sandoval <[email protected]>

---
 Documentation/trace/kprobetrace.txt  | 11 ++++++-----
 Documentation/trace/uprobetracer.txt |  9 +++++----
 2 files changed, 11 insertions(+), 9 deletions(-)

Documentation/trace/kprobetrace.txt +6 -5

index d68ea5fc812b..4b3f5293b7bf 100644
@@ -43,8 +43,8 @@ Synopsis of kprobe_events
   +|-offs(FETCHARG) : Fetch memory at FETCHARG +|- offs address.(**)
   NAME=FETCHARG : Set NAME as the argument name of FETCHARG.
   FETCHARG:TYPE : Set TYPE as the type of FETCHARG. Currently, basic types
-		  (u8/u16/u32/u64/s8/s16/s32/s64), "string" and bitfield
-		  are supported.
+		  (u8/u16/u32/u64/s8/s16/s32/s64), "string", "string_size", and
+		  bitfield are supported.
 
   (*) only for return probe.
   (**) this is useful for fetching a field of data structures.

@@ -54,9 +54,10 @@ Types
 Several types are supported for fetch-args. Kprobe tracer will access memory
 by given type. Prefix 's' and 'u' means those types are signed and unsigned
 respectively. Traced arguments are shown in decimal (signed) or hex (unsigned).
-String type is a special type, which fetches a "null-terminated" string from
-kernel space. This means it will fail and store NULL if the string container
-has been paged out.
+"string" is a special type which fetches a null-terminated string from kernel
+space. This means it will fail and store NULL if the string container has been
+paged out. "string_size" is the length of a null-terminated string including
+the NUL byte.
 Bitfield is another special type, which takes 3 parameters, bit-width, bit-
 offset, and container-size (usually 32). The syntax is;
 

Documentation/trace/uprobetracer.txt +5 -4

index f1cf9a34ad9d..7e0480263c2f 100644
@@ -39,8 +39,8 @@ Synopsis of uprobe_tracer
    +|-offs(FETCHARG) : Fetch memory at FETCHARG +|- offs address.(**)
    NAME=FETCHARG     : Set NAME as the argument name of FETCHARG.
    FETCHARG:TYPE     : Set TYPE as the type of FETCHARG. Currently, basic types
-		       (u8/u16/u32/u64/s8/s16/s32/s64), "string" and bitfield
-		       are supported.
+		       (u8/u16/u32/u64/s8/s16/s32/s64), "string",
+		       "string_size", and bitfield are supported.
 
   (*) only for return probe.
   (**) this is useful for fetching a field of data structures.

@@ -50,8 +50,9 @@ Types
 Several types are supported for fetch-args. Uprobe tracer will access memory
 by given type. Prefix 's' and 'u' means those types are signed and unsigned
 respectively. Traced arguments are shown in decimal (signed) or hex (unsigned).
-String type is a special type, which fetches a "null-terminated" string from
-user space.
+"string" is a special type which fetches a null-terminated string from user
+space. "string_size" is the length of a null-terminated string including the
+NUL byte.
 Bitfield is another special type, which takes 3 parameters, bit-width, bit-
 offset, and container-size (usually 32). The syntax is;
 

Signature · 1 line

2.8.3

From: Omar Sandoval <[email protected]>

ftrace is very quick to give up on saving the task command line (see trace_save_cmdline()). The workaround for events which really care about the command line is to explicitly assign it as part of the entry. However, this doesn't work for kprobe events, as there's no straightforward way to get access to current->comm. Add a kprobe/uprobe event variable $comm which provides exactly that.

Signed-off-by Omar Sandoval <[email protected]>

---
 Documentation/trace/kprobetrace.txt  |  4 ++++
 Documentation/trace/uprobetracer.txt |  4 ++++
 kernel/trace/trace_kprobe.c          |  1 +
 kernel/trace/trace_probe.c           | 27 +++++++++++++++++++++++++++
 kernel/trace/trace_probe.h           | 10 ++++++++++
 5 files changed, 46 insertions(+)

Documentation/trace/kprobetrace.txt +2 -0

index 4b3f5293b7bf..0bf746656d06 100644
@@ -40,6 +40,7 @@ Synopsis of kprobe_events
   $stackN	: Fetch Nth entry of stack (N >= 0)
   $stack	: Fetch stack address.
   $retval	: Fetch return value.(*)
+  $comm		: Fetch current task comm.(***)
   +|-offs(FETCHARG) : Fetch memory at FETCHARG +|- offs address.(**)
   NAME=FETCHARG : Set NAME as the argument name of FETCHARG.
   FETCHARG:TYPE : Set TYPE as the type of FETCHARG. Currently, basic types

@@ -48,6 +49,7 @@ Synopsis of kprobe_events
 
   (*) only for return probe.
   (**) this is useful for fetching a field of data structures.
+  (***) you probably want this as a string, i.e., $comm:string
 
 Types
 -----

Documentation/trace/kprobetrace.txt +1 -0

+
 
 Per-Probe Event Filtering
 -------------------------

Documentation/trace/uprobetracer.txt +1 -0

index 7e0480263c2f..34754da46860 100644
@@ -36,6 +36,7 @@ Synopsis of uprobe_tracer
    $stackN	: Fetch Nth entry of stack (N >= 0)
    $stack	: Fetch stack address.
    $retval	: Fetch return value.(*)
+   $comm	: Fetch current task comm.(***)
    +|-offs(FETCHARG) : Fetch memory at FETCHARG +|- offs address.(**)
    NAME=FETCHARG     : Set NAME as the argument name of FETCHARG.
    FETCHARG:TYPE     : Set TYPE as the type of FETCHARG. Currently, basic types

Documentation/trace/uprobetracer.txt +2 -0

 Types
 -----

@@ -58,6 +60,8 @@ offset, and container-size (usually 32). The syntax is;
 
  b<bit-width>@<bit-offset>/<container-size>
 
+For $comm, the type must be either "string" or "string_size".
+
 
 Event Profiling
 ---------------

kernel/trace/trace_kprobe.c +1 -0

index 5546eec0505f..9aedb0b06683 100644
@@ -587,6 +587,7 @@ static int create_trace_kprobe(int argc, char **argv)
 	 *  $retval	: fetch return value
 	 *  $stack	: fetch stack address
 	 *  $stackN	: fetch Nth of stack (N:0-)
+	 *  $comm       : fetch current task comm
 	 *  @ADDR	: fetch memory at ADDR (ADDR should be in kernel)
 	 *  @SYM[+|-offs] : fetch memory at SYM +|- offs (SYM is a data symbol)
 	 *  %REG	: fetch register REG

kernel/trace/trace_probe.c +27 -0

index 1d372fa6fefb..3900b6e4a05d 100644
@@ -218,6 +218,28 @@ free_bitfield_fetch_param(struct bitfield_fetch_param *data)
 	kfree(data);
 }
 
+void FETCH_FUNC_NAME(comm, string)(struct pt_regs *regs,
+					  void *data, void *dest)
+{
+	int maxlen = get_rloc_len(*(u32 *)dest);
+	u8 *dst = get_rloc_data(dest);
+	long ret;
+
+	if (!maxlen)
+		return;
+
+	ret = strlcpy(dst, current->comm, maxlen);
+	*(u32 *)dest = make_data_rloc(ret, get_rloc_offs(*(u32 *)dest));
+}
+NOKPROBE_SYMBOL(FETCH_FUNC_NAME(comm, string));
+
+void FETCH_FUNC_NAME(comm, string_size)(struct pt_regs *regs,
+					       void *data, void *dest)
+{
+	*(u32 *)dest = strlen(current->comm) + 1;
+}
+NOKPROBE_SYMBOL(FETCH_FUNC_NAME(comm, string_size));
+
 static const struct fetch_type *find_fetch_type(const char *type,
 						const struct fetch_type *ftbl)
 {

@@ -348,6 +370,11 @@ static int parse_probe_vars(char *arg, const struct fetch_type *t,
 			}
 		} else
 			ret = -EINVAL;
+	} else if (strcmp(arg, "comm") == 0) {
+		if (strcmp(t->name, "string") != 0 &&
+		    strcmp(t->name, "string_size") != 0)
+			return -EINVAL;
+		f->fn = t->fetch[FETCH_MTD_comm];
 	} else
 		ret = -EINVAL;
 

kernel/trace/trace_probe.h +10 -0

index f6398db09114..45400ca5ded1 100644
@@ -102,6 +102,7 @@ enum {
 	FETCH_MTD_reg = 0,
 	FETCH_MTD_stack,
 	FETCH_MTD_retval,
+	FETCH_MTD_comm,
 	FETCH_MTD_memory,
 	FETCH_MTD_symbol,
 	FETCH_MTD_deref,

@@ -183,6 +184,14 @@ DECLARE_BASIC_FETCH_FUNCS(bitfield);
 #define fetch_bitfield_string			NULL
 #define fetch_bitfield_string_size		NULL
 
+/* comm only makes sense as a string */
+#define fetch_comm_u8		NULL
+#define fetch_comm_u16		NULL
+#define fetch_comm_u32		NULL
+#define fetch_comm_u64		NULL
+DECLARE_FETCH_FUNC(comm, string);
+DECLARE_FETCH_FUNC(comm, string_size);
+
 /*
  * Define macro for basic types - we don't need to define s* types, because
  * we have to care only about bitwidth at recording time.

@@ -213,6 +222,7 @@ DEFINE_FETCH_##method(u64)
 ASSIGN_FETCH_FUNC(reg, ftype),				\
 ASSIGN_FETCH_FUNC(stack, ftype),			\
 ASSIGN_FETCH_FUNC(retval, ftype),			\
+ASSIGN_FETCH_FUNC(comm, ftype),				\
 ASSIGN_FETCH_FUNC(memory, ftype),			\
 ASSIGN_FETCH_FUNC(symbol, ftype),			\
 ASSIGN_FETCH_FUNC(deref, ftype),			\

Signature · 1 line

2.8.3

Quoted 2 lines · On Thu, 2 Jun 2016 18:11:02 -0700 Omar Sandoval <[email protected]> wrote:

From: Omar Sandoval <[email protected]>

Quoted 7 lines

ftrace is very quick to give up on saving the task command line (see trace_save_cmdline()). The workaround for events which really care about the command line is to explicitly assign it as part of the entry. However, this doesn't work for kprobe events, as there's no straightforward way to get access to current->comm. Add a kprobe/uprobe event variable $comm which provides exactly that.

Quoted 30 lines

Signed-off-by Omar Sandoval <[email protected]>

---
 Documentation/trace/kprobetrace.txt  |  4 ++++
 Documentation/trace/uprobetracer.txt |  4 ++++
 kernel/trace/trace_kprobe.c          |  1 +
 kernel/trace/trace_probe.c           | 27 +++++++++++++++++++++++++++
 kernel/trace/trace_probe.h           | 10 ++++++++++
 5 files changed, 46 insertions(+)

Documentation/trace/kprobetrace.txt +2 -0

index 4b3f5293b7bf..0bf746656d06 100644
@@ -40,6 +40,7 @@ Synopsis of kprobe_events
   $stackN	: Fetch Nth entry of stack (N >= 0)
   $stack	: Fetch stack address.
   $retval	: Fetch return value.(*)
+  $comm		: Fetch current task comm.(***)
   +|-offs(FETCHARG) : Fetch memory at FETCHARG +|- offs address.(**)
   NAME=FETCHARG : Set NAME as the argument name of FETCHARG.
   FETCHARG:TYPE : Set TYPE as the type of FETCHARG. Currently, basic types

@@ -48,6 +49,7 @@ Synopsis of kprobe_events
 
   (*) only for return probe.
   (**) this is useful for fetching a field of data structures.
+  (***) you probably want this as a string, i.e., $comm:string
 
 Types
 -----

Documentation/trace/kprobetrace.txt offset, and container-size (usually 32). The syntax is; · line 68

Quoted 4 lines

Documentation/trace/kprobetrace.txt +1 -0

@@ -63,6 +65,8 @@ offset, and container-size (usually 32). The syntax is;
 
  b<bit-width>@<bit-offset>/<container-size>
 
+For $comm, the type must be either "string" or "string_size".

Please remove string_size, which is an internal type.

Quoted 17 lines

Documentation/trace/kprobetrace.txt +1 -0

+
 
 Per-Probe Event Filtering
 -------------------------

Documentation/trace/uprobetracer.txt +1 -0

index 7e0480263c2f..34754da46860 100644
@@ -36,6 +36,7 @@ Synopsis of uprobe_tracer
    $stackN	: Fetch Nth entry of stack (N >= 0)
    $stack	: Fetch stack address.
    $retval	: Fetch return value.(*)
+   $comm	: Fetch current task comm.(***)
    +|-offs(FETCHARG) : Fetch memory at FETCHARG +|- offs address.(**)
    NAME=FETCHARG     : Set NAME as the argument name of FETCHARG.
    FETCHARG:TYPE     : Set TYPE as the type of FETCHARG. Currently, basic types

Documentation/trace/uprobetracer.txt Synopsis of uprobe_tracer · line 48

Quoted 4 lines

Documentation/trace/uprobetracer.txt +1 -0

@@ -44,6 +45,7 @@ Synopsis of uprobe_tracer
 
   (*) only for return probe.
   (**) this is useful for fetching a field of data structures.
+  (***) you probably want this as a string, i.e., $comm:string

Ditto.

Other part looks OK for me :)

Acked-by Masami Hiramatsu <[email protected]>

Quoted 107 lines

Documentation/trace/uprobetracer.txt +2 -0

 Types
 -----

@@ -58,6 +60,8 @@ offset, and container-size (usually 32). The syntax is;
 
  b<bit-width>@<bit-offset>/<container-size>
 
+For $comm, the type must be either "string" or "string_size".
+
 
 Event Profiling
 ---------------

kernel/trace/trace_kprobe.c +1 -0

index 5546eec0505f..9aedb0b06683 100644
@@ -587,6 +587,7 @@ static int create_trace_kprobe(int argc, char **argv)
 	 *  $retval	: fetch return value
 	 *  $stack	: fetch stack address
 	 *  $stackN	: fetch Nth of stack (N:0-)
+	 *  $comm       : fetch current task comm
 	 *  @ADDR	: fetch memory at ADDR (ADDR should be in kernel)
 	 *  @SYM[+|-offs] : fetch memory at SYM +|- offs (SYM is a data symbol)
 	 *  %REG	: fetch register REG

kernel/trace/trace_probe.c +27 -0

index 1d372fa6fefb..3900b6e4a05d 100644
@@ -218,6 +218,28 @@ free_bitfield_fetch_param(struct bitfield_fetch_param *data)
 	kfree(data);
 }
 
+void FETCH_FUNC_NAME(comm, string)(struct pt_regs *regs,
+					  void *data, void *dest)
+{
+	int maxlen = get_rloc_len(*(u32 *)dest);
+	u8 *dst = get_rloc_data(dest);
+	long ret;
+
+	if (!maxlen)
+		return;
+
+	ret = strlcpy(dst, current->comm, maxlen);
+	*(u32 *)dest = make_data_rloc(ret, get_rloc_offs(*(u32 *)dest));
+}
+NOKPROBE_SYMBOL(FETCH_FUNC_NAME(comm, string));
+
+void FETCH_FUNC_NAME(comm, string_size)(struct pt_regs *regs,
+					       void *data, void *dest)
+{
+	*(u32 *)dest = strlen(current->comm) + 1;
+}
+NOKPROBE_SYMBOL(FETCH_FUNC_NAME(comm, string_size));
+
 static const struct fetch_type *find_fetch_type(const char *type,
 						const struct fetch_type *ftbl)
 {

@@ -348,6 +370,11 @@ static int parse_probe_vars(char *arg, const struct fetch_type *t,
 			}
 		} else
 			ret = -EINVAL;
+	} else if (strcmp(arg, "comm") == 0) {
+		if (strcmp(t->name, "string") != 0 &&
+		    strcmp(t->name, "string_size") != 0)
+			return -EINVAL;
+		f->fn = t->fetch[FETCH_MTD_comm];
 	} else
 		ret = -EINVAL;
 

kernel/trace/trace_probe.h +10 -0

index f6398db09114..45400ca5ded1 100644
@@ -102,6 +102,7 @@ enum {
 	FETCH_MTD_reg = 0,
 	FETCH_MTD_stack,
 	FETCH_MTD_retval,
+	FETCH_MTD_comm,
 	FETCH_MTD_memory,
 	FETCH_MTD_symbol,
 	FETCH_MTD_deref,

@@ -183,6 +184,14 @@ DECLARE_BASIC_FETCH_FUNCS(bitfield);
 #define fetch_bitfield_string			NULL
 #define fetch_bitfield_string_size		NULL
 
+/* comm only makes sense as a string */
+#define fetch_comm_u8		NULL
+#define fetch_comm_u16		NULL
+#define fetch_comm_u32		NULL
+#define fetch_comm_u64		NULL
+DECLARE_FETCH_FUNC(comm, string);
+DECLARE_FETCH_FUNC(comm, string_size);
+
 /*
  * Define macro for basic types - we don't need to define s* types, because
  * we have to care only about bitwidth at recording time.

@@ -213,6 +222,7 @@ DEFINE_FETCH_##method(u64)
 ASSIGN_FETCH_FUNC(reg, ftype),				\
 ASSIGN_FETCH_FUNC(stack, ftype),			\
 ASSIGN_FETCH_FUNC(retval, ftype),			\
+ASSIGN_FETCH_FUNC(comm, ftype),				\
 ASSIGN_FETCH_FUNC(memory, ftype),			\
 ASSIGN_FETCH_FUNC(symbol, ftype),			\
 ASSIGN_FETCH_FUNC(deref, ftype),			\

Signature · 1 line

2.8.3

Signature · 1 line

Masami Hiramatsu <[email protected]>

From: Omar Sandoval <[email protected]>

You'd only ever want $comm as a string, but the default is still u64. Push the type parsing later so we can decide based on the actual fetcharg and make "string" the default for $comm.

Quoted 5 lines · On Thu, 2 Jun 2016 18:11:03 -0700 Omar Sandoval <[email protected]> wrote:

From: Omar Sandoval <[email protected]>

You'd only ever want $comm as a string, but the default is still u64. Push the type parsing later so we can decide based on the actual fetcharg and make "string" the default for $comm.

Hmm, at this moment, I'd rather like a small hack in traceprobe_parse_probe_arg() as like below:

kernel/trace/trace_probe.c +6 -0

@@ -522,6 +522,12 @@ int traceprobe_parse_probe_arg(char *arg, ssize_t *size,
                arg[t - parg->comm] = '\0';
                t++;
        }
+       /*
+        * The default type of "$comm" should be a string, and it must not
+        * be dereferred
+        */
+       if (!t && strcmp("$comm", arg))
+               t = "string";
        parg->type = find_fetch_type(t, ftbl);
        if (!parg->type) {
                pr_info("Unsupported type: %s\n", t);

This is not general, but easy to review :)

Quoted 1 line

This is not general, but easy to review :)

+1