Skip to content

tracing: Show contents of syscall trace event user space fields

Steven Rostedt linux-perf-users linux-trace-kernel lkml 5 versions – New

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v5 Latest13 patches 0 repliesNew
  2. v413 patches 1 replySuperseded
  3. v313 patches 2 repliesSuperseded
Earlier versions · 2
VersionPostedPatchesRepliesStatus
v28 patches3 repliesSuperseded
v17 patches9 repliesSuperseded

Patches in v5 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/13tracing: Make trace_user_fault_read() exposed to rest of tracingkernel/trace/trace.c kernel/trace/trace.h+205 -620 replies
2/13tracing: Have syscall trace events read user space stringinclude/trace/syscall.h kernel/trace/trace_syscalls.c+420 -200 replies
3/13perf: tracing: Simplify perf_sysenter_enable/disable() with guardskernel/trace/trace_syscalls.c+22 -260 replies
4/13perf: tracing: Have perf system calls read user spacekernel/trace/trace_syscalls.c+90 -460 replies
5/13tracing: Have system call events record user array datainclude/trace/syscall.h kernel/trace/trace_syscalls.c+90 -350 replies
6/13tracing: Display some syscall arrays as stringsinclude/trace/syscall.h kernel/trace/trace_syscalls.c+22 -40 replies
7/13tracing: Allow syscall trace events to read more than one user parameterkernel/trace/trace_syscalls.c+229 -1080 replies
8/13tracing: Add a config and syscall_user_buf_size file to limit amount writtenDocumentation/trace/ftrace.rst kernel/trace/Kconfig kernel/trace/trace.c +2 more+105 -220 replies
9/13tracing: Show printable characters in syscall arrayskernel/trace/trace_syscalls.c+21 -00 replies
10/13tracing: Add trace_seq_pop() and seq_buf_pop()include/linux/seq_buf.h include/linux/trace_seq.h+30 -00 replies
11/13tracing: Add parsing of flags to the sys_enter_openat trace eventkernel/trace/trace_syscalls.c+182 -100 replies
12/13tracing: Check for printable characters when printing field dyn stringskernel/trace/trace_output.c+25 -20 replies
13/13tracing: Have persistent ring buffer print syscalls normallykernel/trace/trace.c+23 -40 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v5 yet.

Read the v5 thread

Cover letter [PATCH v5 00/13] tracing: Show contents of syscall trace event user space fields

As of commit 654ced4a1377 ("tracing: Introduce tracepoint_is_faultable()") system call trace events allow faulting in user space memory. Have some of the system call trace events take advantage of this.

Also, commit 64cf7d058a00 ("tracing: Have trace_marker use per-cpu data to read user space") added the method to use per CPU buffers to read data from user space in critical sections. Instead of recreating that code, make that code generic so that the system calls can utilize it as well.

Update the system call trace events to read user space for various system calls (like openat, execve, etc).

A new file is created in the tracefs directory (and also per instance) that allows the user to shorten the amount copied from user space. It can be completely disabled if set to zero (it will only display "" or (, ...) but no copying from user space will be performed). The max size to copy is hard coded to 165, which should be enough for this purpose. The default size is 63 bytes.

This allows the output to look like this:

sys_access(filename: 0x7f8c55368470 "/etc/ld.so.preload", mode: 4)
sys_execve(filename: 0x564ebcf5a6b8 "/usr/bin/emacs", argv: 0x7fff357c0300, envp: 0x564ebc4a4820) sys_write(fd: 1, buf: 0x56430f353be0 (2f:72:6f:6f:74:0a) "/root.", count: 6)
sys_sethostname(name: 0x5584310eb2a0 "debian", len: 6)
sys_renameat2(olddfd: 0xffffff9c, oldname: 0x7ffe02facdff "/tmp/x", newdfd: 0xffffff9c, newname: 0x7ffe02face06 "/tmp/y", flags: 1)

Perf system call logic is also updated to take advantage of this work.

The openat system call was updated to show the flags as well:

sys_openat(dfd: 18446744073709551516, filename: 140733603151330 "/tmp/x", flags: O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, mode: 0666)

Changes since v4: https://lore.kernel.org/linux-trace-kernel/[email protected]/

- Hide __NR_<syscall> values in switch statement when not defined (kernel test robot)

Steven Rostedt (13):
tracing: Make trace_user_fault_read() exposed to rest of tracing
tracing: Have syscall trace events read user space string
perf: tracing: Simplify perf_sysenter_enable/disable() with guards
perf: tracing: Have perf system calls read user space
tracing: Have system call events record user array data
tracing: Display some syscall arrays as strings
tracing: Allow syscall trace events to read more than one user parameter
tracing: Add a config and syscall_user_buf_size file to limit amount written
tracing: Show printable characters in syscall arrays
tracing: Add trace_seq_pop() and seq_buf_pop()
tracing: Add parsing of flags to the sys_enter_openat trace event
tracing: Check for printable characters when printing field dyn strings
tracing: Have persistent ring buffer print syscalls normally

----

 Documentation/trace/ftrace.rst |   8 +
 include/linux/seq_buf.h        |  17 +
 include/linux/trace_seq.h      |  13 +
 include/trace/syscall.h        |   8 +-
 kernel/trace/Kconfig           |  14 +
 kernel/trace/trace.c           | 327 ++++++++++++---
 kernel/trace/trace.h           |  20 +
 kernel/trace/trace_output.c    |  27 +-
 kernel/trace/trace_syscalls.c  | 929 ++++++++++++++++++++++++++++++++++++++---
 9 files changed, 1244 insertions(+), 119 deletions(-)