[v8] Re: [PATCH v9 00/11] tracing: Add fprobe events

[Masami Hiramatsu (Google) <mhiramat@kernel.org>]

Oops, the title version is wrong, this is 8th version. Hmm, it must be my typo...

On Tue,  2 May 2023 00:08:45 +0900
"Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:

> Hi,
> 
> Here is the 8th version of improve fprobe and add a basic fprobe event
> support for ftrace (tracefs) and perf. Here is the previous version.
> 
> https://lore.kernel.org/all/168255826500.2565678.17719875734305974633.stgit@mhiramat.roam.corp.google.com/
> 
> This version is a minor update for fixing wrong indentation [8/11]
> and update kconfig help message[6/11].
> 
> You can also get this series from:
> 
> git://git.kernel.org/pub/scm/linux/kernel/git/mhiramat/linux.git topic/fprobe-event-ext
> 
> With this fprobe events, we can continue to trace function entry/exit
> even if the CONFIG_KPROBES_ON_FTRACE is not available. Since
> CONFIG_KPROBES_ON_FTRACE requires the CONFIG_DYNAMIC_FTRACE_WITH_REGS,
> it is not available if the architecture only supports
> CONFIG_DYNAMIC_FTRACE_WITH_ARGS (e.g. arm64). And that means kprobe
> events can not probe function entry/exit effectively on such architecture.
> But this problem can be solved if the dynamic events supports fprobe events
> because fprobe events doesn't use kprobe but ftrace via fprobe.
> 
> FPROBE EVENTS
> =============
> 
> Fprobe events allows user to add new events on the entry and exit of kernel
> functions (which can be ftraced). Unlike kprobe events, the fprobe events
> can only probe the function entry and exit, and it can only trace the
> function args, return value, and stacks. (no registers)
> For probing function body, users can continue to use the kprobe events.
> 
> The tracepoint probe events (tprobe events) also allows user to add new
> events dynamically on the tracepoint. Most of the tracepoint already has
> trace-events, so this feature is useful if you only want to know a
> specific parameter, or trace the tracepoints which has no trace-events
> (e.g. sched_*_tp tracepoints only exposes the tracepoints.)
> 
> The fprobe events syntax is;
> 
>  f[:[GRP/][EVENT]] FUNCTION [FETCHARGS]
>  f[MAXACTIVE][:[GRP/][EVENT]] FUNCTION%return [FETCHARGS]
> 
> And tracepoint probe events syntax is;
> 
>  t[:[GRP/][EVENT]] TRACEPOINT [FETCHARGS]
> 
> This series includes BTF argument support for fprobe/tracepoint events,
> and kprobe events. This allows us to fetch a specific function parameter
> by name, and all parameters by '$$args'.
> Note that enabling this feature, you need to enable CONFIG_BPF_SYSCALL and
> confirm that your arch supports CONFIG_HAVE_FUNCTION_ARG_ACCESS_API.
> 
> E.g.
> 
>  # echo 't kfree ptr' >> dynamic_events
>  # echo 'f kfree object' >> dynamic_events
>  # cat dynamic_events 
> t:tracepoints/kfree kfree ptr=ptr
> f:fprobes/kfree__entry kfree object=object
>  # echo 1 > events/fprobes/enable
>  # echo 1 > events/tracepoints/enable
>  # echo > trace
>  # head -n 20 trace | tail
> #           TASK-PID     CPU#  |||||  TIMESTAMP  FUNCTION
> #              | |         |   |||||     |         |
>             tail-84      [000] .....  1324.561958: kfree__entry: (kfree+0x4/0x140) object=0xffff888006383c00
>             tail-84      [000] ...1.  1324.561961: kfree: (__probestub_kfree+0x4/0x10) ptr=0xffff888006383c00
>             tail-84      [000] .....  1324.561988: kfree__entry: (kfree+0x4/0x140) object=0x0
>             tail-84      [000] ...1.  1324.561988: kfree: (__probestub_kfree+0x4/0x10) ptr=0x0
>             tail-84      [000] .....  1324.561989: kfree__entry: (kfree+0x4/0x140) object=0xffff88800671e600
>             tail-84      [000] ...1.  1324.561989: kfree: (__probestub_kfree+0x4/0x10) ptr=0xffff88800671e600
>             tail-84      [000] .....  1324.562368: kfree__entry: (kfree+0x4/0x140) object=0xffff8880065e0580
>             tail-84      [000] ...1.  1324.562369: kfree: (__probestub_kfree+0x4/0x10) ptr=0xffff8880065e0580
> 
> 
> Thank you,
> 
> ---
> 
> Masami Hiramatsu (Google) (11):
>       fprobe: Pass return address to the handlers
>       tracing/probes: Add fprobe events for tracing function entry and exit.
>       selftests/ftrace: Add fprobe related testcases
>       tracing/probes: Add tracepoint support on fprobe_events
>       tracing/probes: Move event parameter fetching code to common parser
>       tracing/probes: Support function parameters if BTF is available
>       tracing/probes: Add $$args meta argument for all function args
>       tracing/probes: Add BTF retval type support
>       selftests/ftrace: Add tracepoint probe test case
>       selftests/ftrace: Add BTF arguments test cases
>       Documentation: tracing/probes: Add fprobe event tracing document
> 
> 
>  Documentation/trace/fprobetrace.rst                |  187 +++
>  Documentation/trace/index.rst                      |    1 
>  include/linux/fprobe.h                             |   11 
>  include/linux/rethook.h                            |    2 
>  include/linux/trace_events.h                       |    3 
>  include/linux/tracepoint-defs.h                    |    1 
>  include/linux/tracepoint.h                         |    5 
>  kernel/kprobes.c                                   |    1 
>  kernel/trace/Kconfig                               |   26 
>  kernel/trace/Makefile                              |    1 
>  kernel/trace/bpf_trace.c                           |    6 
>  kernel/trace/fprobe.c                              |   17 
>  kernel/trace/rethook.c                             |    3 
>  kernel/trace/trace.c                               |   13 
>  kernel/trace/trace.h                               |   11 
>  kernel/trace/trace_eprobe.c                        |   44 -
>  kernel/trace/trace_fprobe.c                        | 1194 ++++++++++++++++++++
>  kernel/trace/trace_kprobe.c                        |   33 -
>  kernel/trace/trace_probe.c                         |  504 +++++++-
>  kernel/trace/trace_probe.h                         |   43 +
>  kernel/trace/trace_uprobe.c                        |    8 
>  lib/test_fprobe.c                                  |   10 
>  samples/fprobe/fprobe_example.c                    |    6 
>  .../ftrace/test.d/dynevent/add_remove_btfarg.tc    |   54 +
>  .../ftrace/test.d/dynevent/add_remove_fprobe.tc    |   26 
>  .../ftrace/test.d/dynevent/add_remove_tprobe.tc    |   27 
>  .../ftrace/test.d/dynevent/fprobe_syntax_errors.tc |   99 ++
>  .../ftrace/test.d/dynevent/tprobe_syntax_errors.tc |   82 +
>  .../ftrace/test.d/kprobe/kprobe_syntax_errors.tc   |   13 
>  29 files changed, 2291 insertions(+), 140 deletions(-)
>  create mode 100644 Documentation/trace/fprobetrace.rst
>  create mode 100644 kernel/trace/trace_fprobe.c
>  create mode 100644 tools/testing/selftests/ftrace/test.d/dynevent/add_remove_btfarg.tc
>  create mode 100644 tools/testing/selftests/ftrace/test.d/dynevent/add_remove_fprobe.tc
>  create mode 100644 tools/testing/selftests/ftrace/test.d/dynevent/add_remove_tprobe.tc
>  create mode 100644 tools/testing/selftests/ftrace/test.d/dynevent/fprobe_syntax_errors.tc
>  create mode 100644 tools/testing/selftests/ftrace/test.d/dynevent/tprobe_syntax_errors.tc
> 
> --
> Masami Hiramatsu (Google) <mhiramat@kernel.org>


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>