Tracepoint: add exec tracepoint

RFC PATCH Superseded David Smith 3 participants 4 messages Oct 18, 2011

Subsystems (3)

VFS Tracing exec and binfmt

lore

Share & tools

lore

David Smith

author

2011-10-18 18:41 UTC #0 lore raw

RFC PATCH 1/1 Tracepoint: add exec tracepoint

Added general purpose exec tracepoint. The 'bprm' argument gives details of the exec.

Signed-off-by David Smith <[email protected]>

Acked-by Steven Rostedt <[email protected]>

---
 fs/exec.c                    |    6 +++++-
 include/trace/events/sched.h |   22 ++++++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletions(-)

fs/exec.c +5 -1

index 25dcbe5..fdb1686 100644
@@ -61,6 +61,8 @@
 #include <asm/tlb.h>
 #include "internal.h"
 
+#include <trace/events/sched.h>
+
 int core_uses_pid;
 char core_pattern[CORENAME_MAX_SIZE] = "core";
 unsigned int core_pipe_limit;

@@ -1401,9 +1403,11 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 			 */
 			bprm->recursion_depth = depth;
 			if (retval >= 0) {
-				if (depth == 0)
+				if (depth == 0) {
+					trace_sched_process_exec(bprm);
 					ptrace_event(PTRACE_EVENT_EXEC,
 							old_pid);
+				}
 				put_binfmt(fmt);
 				allow_write_access(bprm->file);
 				if (bprm->file)

include/trace/events/sched.h +22 -0

index f633478..3054a97 100644
@@ -275,6 +275,28 @@ TRACE_EVENT(sched_process_fork,
 );
 
 /*
+ * Tracepoint for exec:
+ */
+TRACE_EVENT(sched_process_exec,
+
+	TP_PROTO(struct linux_binprm *bprm),
+
+	TP_ARGS(bprm),
+
+	TP_STRUCT__entry(
+		__string(	filename,	bprm->filename	)
+		__field(	pid_t,		pid		)
+	),
+
+	TP_fast_assign(
+		__assign_str(filename, bprm->filename);
+		__entry->pid	= current->pid;
+	),
+
+	TP_printk("filename=%s pid=%d", __get_str(filename), __entry->pid)
+);
+
+/*
  * XXX the below sched_stat tracepoints only apply to SCHED_OTHER/BATCH/IDLE
  *     adding sched_stat support to SCHED_FIFO/RR would be welcome.
  */

Christoph Hellwig

2011-10-18 18:58 UTC #1 lore raw

Quoted 1 line · David Smith

Added general purpose exec tracepoint. The 'bprm' argument gives details of the exec.

Given that you only need the filename from the bprm please just pass it directly.

David Smith

author

2011-10-18 19:31 UTC #2 lore raw

Quoted 5 lines · Christoph Hellwig

Quoted 1 line · David Smith
Added general purpose exec tracepoint. The 'bprm' argument gives details of the exec.
Given that you only need the filename from the bprm please just pass it directly.

Thanks for looking at the patch.

I'm not totally opposed to this change, but passing bprm allows custom tracepoint handlers to look at other fields in bprm besides filename, which could be useful (depending on your needs).

But, I don't have a real strong opinion here.

Signature · 6 lines

David Smith
[email protected]
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)

Steven Rostedt

maintainer

2011-10-18 20:28 UTC #3 lore raw

Quoted 9 lines · David Smith

Quoted 5 lines · Christoph Hellwig
Quoted 1 line · David Smith
Added general purpose exec tracepoint. The 'bprm' argument gives details of the exec.
Given that you only need the filename from the bprm please just pass it directly.

Quoted 5 lines

Thanks for looking at the patch.
I'm not totally opposed to this change, but passing bprm allows custom tracepoint handlers to look at other fields in bprm besides filename, which could be useful (depending on your needs).

I like flexible tracepoints too.

Quoted 3 lines

But, I don't have a real strong opinion here.

I rather pass the pointer. If we pass the string, gcc may not optimize when tracing is disabled and still do the work to dereference the pointer unnecessarily.

-- Steve