tracing: kprobe-tracer plugin core
Subsystems (3)
PATCH v4 5/6 tracing: kprobe-tracer plugin core
Add kprobes based event tracer on ftrace.
This tracer is similar to the events tracer which is based on Tracepoint infrastructure. Instead of Tracepoint, this tracer is based on kprobes(kprobe and kretprobe). It probes anywhere where kprobes can probe(this means, all functions body except for __kprobes functions).
changes from v3:
- warn if the probe address is not an instruction boundary.
Signed-off-by Masami Hiramatsu <[email protected]>
Cc Steven Rostedt <[email protected]>
Cc Ananth N Mavinakayanahalli <[email protected]>
Cc Ingo Molnar <[email protected]>
Cc Frederic Weisbecker <[email protected]>
---
Documentation/ftrace.txt | 55 ++++++ kernel/trace/Kconfig | 9 + kernel/trace/Makefile | 1 kernel/trace/trace_kprobe.c | 400 +++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 465 insertions(+), 0 deletions(-) create mode 100644 kernel/trace/trace_kprobe.c
Documentation/ftrace.txt +55 -0
@@ -1310,6 +1310,61 @@ dereference in a kernel module: [...] +kprobe-based event tracer +--------------------------- + +This tracer is similar to the events tracer which is based on Tracepoint +infrastructure. Instead of Tracepoint, this tracer is based on kprobes(kprobe +and kretprobe). It probes anywhere where kprobes can probe(this means, all +functions body except for __kprobes functions). + +Unlike the function tracer, this tracer can probe instructions inside of +kernel functions. It allows you to check which instruction has been executed. + +Unlike the Tracepoint based events tracer, this tracer can add new probe points +on the fly. + +Similar to the events tracer, this tracer doesn't need to be activated via +current_tracer, instead of that, just set probe points via +/debug/tracing/kprobe_probes. + +Synopsis of kprobe_probes: + p SYMBOL[+offs|-offs]|MEMADDR : set a probe + r SYMBOL[+0] : set a return probe + +E.g. + echo p sys_open > /debug/tracing/kprobe_probes + + This sets a kprobe on the top of sys_open() function. + + echo r sys_open >> /debug/tracing/kprobe_probes + + This sets a kretprobe on the return point of sys_open() function. + + echo > /debug/tracing/kprobe_probes + + This clears all probe points. and you can see the traced information via +/debug/tracing/trace. + + cat /debug/tracing/trace +# tracer: nop +# +# TASK-PID CPU# TIMESTAMP FUNCTION +# | | | | | + <...>-5117 [003] 416.481638: sys_open: @sys_open+0 + <...>-5117 [003] 416.481662: syscall_call: <-sys_open+0 + <...>-5117 [003] 416.481739: sys_open: @sys_open+0 + <...>-5117 [003] 416.481762: sysenter_do_call: <-sys_open+0 + <...>-5117 [003] 416.481818: sys_open: @sys_open+0 + <...>-5117 [003] 416.481842: sysenter_do_call: <-sys_open+0 + <...>-5117 [003] 416.481882: sys_open: @sys_open+0 + <...>-5117 [003] 416.481905: sysenter_do_call: <-sys_open+0 + + @SYMBOL means that kernel hits a probe, and <-SYMBOL means kernel returns +from SYMBOL(e.g. "sysenter_do_call: <-sys_open+0" means kernel returns from +sys_open to sysenter_do_call). + + function graph tracer ---------------------------
kernel/trace/Kconfig +9 -0
@@ -357,6 +357,15 @@ config BLK_DEV_IO_TRACE If unsure, say N. +config KPROBE_TRACER + depends on KPROBES + depends on X86 + bool "Trace kprobes" + select TRACING + help + This tracer probes everywhere where kprobes can probe it, and + records various registers and memories specified by user. + config DYNAMIC_FTRACE bool "enable/disable ftrace tracepoints dynamically" depends on FUNCTION_TRACER
kernel/trace/Makefile +1 -0
@@ -46,5 +46,6 @@ obj-$(CONFIG_EVENT_TRACER) += trace_export.o obj-$(CONFIG_FTRACE_SYSCALLS) += trace_syscalls.o obj-$(CONFIG_EVENT_PROFILE) += trace_event_profile.o obj-$(CONFIG_EVENT_TRACER) += trace_events_filter.o +obj-$(CONFIG_KPROBE_TRACER) += trace_kprobe.o libftrace-y := ftrace.o
kernel/trace/trace_kprobe.c new file +400 -0
400 lines not on this page · raw message
Signature · 7 lines
Masami Hiramatsu Software Engineer Hitachi Computer Products (America) Inc. Software Solutions Division e-mail: [email protected]