Re: [PATCH 0/2 v2] Syscalls tracing

Frederic Weisbecker
2009-03-13T15:16:51Z

On Fri, Mar 13, 2009 at 03:42:10PM +0100, Frederic Weisbecker wrote:
> tracing/syscalls: core infrastructure to trace syscalls
>
> This new iteration addresses a good part of the previous reviews.

Ah I just discovered that you applied the previous version today.
But the v2 is not a delta :-s

I can rebase them but not until Sunday.

> As suggested by Ingo Molnar and Peter Zijlstra, the syscalls
> prototypes probing is done by abusing the SYSCALL_DEFINE family
> macros.
> We now store automatically the arguments names, their types, their number
> and the name of the syscall.
>
> Also some fixes on output newlines and dangerous exporting of global_trace
> are provided.
>
> An example of the trace:
>
> echo syscall > /debugfs/tracing/current_tracer
>
>
> # tracer: syscall
> #
> # TASK-PID CPU# TIMESTAMP FUNCTION
> # | | | | |
> <...>-5080 [001] 132.192228: sys_dup2(oldfd: a, newfd: 1)
> <...>-5080 [001] 132.192239: sys_dup2 -> 0x1
> <...>-5080 [001] 132.192242: sys_fcntl(fd: a, cmd: 1, arg: 0)
> <...>-5080 [001] 132.192245: sys_fcntl -> 0x1
> <...>-5080 [001] 132.192248: sys_close(fd: a)
> <...>-5080 [001] 132.192250: sys_close -> 0x0
> <...>-5080 [001] 132.192265: sys_rt_sigprocmask(how: 0, set: 0, oset: 6cf808, sigsetsize: 8)
> <...>-5080 [001] 132.192267: sys_rt_sigprocmask -> 0x0
> <...>-5080 [001] 132.192271: sys_rt_sigaction(sig: 2, act: 7fffff4338f0, oact: 7fffff433850, sigsetsize: 8)
> <...>-5080 [001] 132.192273: sys_rt_sigaction -> 0x0
> <...>-5080 [001] 132.192285: sys_rt_sigprocmask(how: 0, set: 0, oset: 6cf808, sigsetsize: 8)
> <...>-5080 [001] 132.192287: sys_rt_sigprocmask -> 0x0
> <...>-5080 [001] 132.192415: sys_write(fd: 1, buf: 15dfc08, count: 21)
> <...>-5080 [001] 132.192436: sys_write -> 0x21
> <...>-4754 [000] 132.192478: sys_read(fd: 8, buf: 2a9340e, count: 1fee)
> <...>-5080 [001] 132.192487: sys_rt_sigprocmask(how: 0, set: 7fffff432a70, oset: 7fffff4329f0, sigsetsize: 8)
>
> And if you ask for the parameters types:
>
> echo syscall_arg_type > trace_options
>
> # tracer: syscall
> #
> # TASK-PID CPU# TIMESTAMP FUNCTION
> # | | | | |
> <...>-5080 [001] 132.192228: sys_dup2(unsigned int oldfd: a, unsigned int newfd: 1)
> <...>-5080 [001] 132.192239: sys_dup2 -> 0x1
> <...>-5080 [001] 132.192242: sys_fcntl(unsigned int fd: a, unsigned int cmd: 1, unsigned long arg: 0)
> <...>-5080 [001] 132.192245: sys_fcntl -> 0x1
> <...>-5080 [001] 132.192248: sys_close(unsigned int fd: a)
> <...>-5080 [001] 132.192250: sys_close -> 0x0
> <...>-5080 [001] 132.192265: sys_rt_sigprocmask(int how: 0, sigset_t * set: 0, sigset_t * oset: 6cf808, size_t sigsetsize: 8)
> <...>-5080 [001] 132.192267: sys_rt_sigprocmask -> 0x0
> <...>-5080 [001] 132.192271: sys_rt_sigaction(int sig: 2, const struct sigaction * act: 7fffff4338f0, struct sigaction * oact: 7fffff433850, size_t sigsetsize: 8)
> <...>-5080 [001] 132.192273: sys_rt_sigaction -> 0x0
> <...>-5080 [001] 132.192285: sys_rt_sigprocmask(int how: 0, sigset_t * set: 0, sigset_t * oset: 6cf808, size_t sigsetsize: 8)
> <...>-5080 [001] 132.192287: sys_rt_sigprocmask -> 0x0
> <...>-5080 [001] 132.192415: sys_write(unsigned int fd: 1, const char * buf: 15dfc08, size_t count: 21)
> <...>-5080 [001] 132.192436: sys_write -> 0x21
>
> TODO:
>
> - add a single mask on the struct syscall_metadata to provide quickly which arguments is
> a pointer (usually type __user *p) so that the user can decide if he wants to save them of tracing time
>
> - now that we have each parameter type as strings, add a new field on struct syscall_metadata to have the parameter types
> encoded as single enum values (for quick checks) so that we can use specific callbacks for each parameter type
> to be displayed.
>
> NOTE: this is still not overlapping with a potential future merge of utrace, since the low-level hooks on
> the syscalls remain somewhat basic.
>
> NOTE2: I've only tested it on x86-64 for now, so only x86-64 support is provided.
> --
>
> Frederic Weisbecker (2):
> tracing/syscalls: core infrastructure for syscalls tracing
> tracing/syscalls: support for syscalls tracing on x86-64
>
> arch/x86/Kconfig | 1 +
> arch/x86/include/asm/ftrace.h | 7 +
> arch/x86/include/asm/thread_info.h | 9 +-
> arch/x86/kernel/ftrace.c | 63 +++++++++
> arch/x86/kernel/ptrace.c | 7 +
> include/asm-generic/vmlinux.lds.h | 11 ++-
> include/linux/ftrace.h | 29 +++++
> include/linux/syscalls.h | 60 +++++++++-
> kernel/trace/Kconfig | 10 ++
> kernel/trace/Makefile | 1 +
> kernel/trace/trace.h | 19 +++
> kernel/trace/trace_syscalls.c | 243 ++++++++++++++++++++++++++++++++++++
> 12 files changed, 454 insertions(+), 6 deletions(-)
> create mode 100644 kernel/trace/trace_syscalls.c
>