[RFC PATCH v2] Tracepoint: add exec tracepoint

[RFC PATCH v2] Tracepoint: add exec tracepoint

[David Smith]

New version corrects 2 small problems.  Include linux/binfmts.h in trace/events/sched.h to provide definition of 'struct linux_binprm'.  To avoid future abi problems, add 'struct task_struct' parameter (like most of the other sched tracepoints have).

---
From: David Smith <dsmith@redhat.com>

Added general purpose exec tracepoint.  The 'bprm' argument gives details of the exec.

Signed-off-by: David Smith <dsmith@redhat.com>
---
 fs/exec.c                    |    6 +++++-
 include/trace/events/sched.h |   23 +++++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index 25dcbe5..b0f4919 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -61,6 +61,8 @@
 #include <asm/tlb.h>
 #include "internal.h"
 
+#include <trace/events/sched.h>
+
 int core_uses_pid;
 char core_pattern[CORENAME_MAX_SIZE] = "core";
 unsigned int core_pipe_limit;
@@ -1401,9 +1403,11 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 			 */
 			bprm->recursion_depth = depth;
 			if (retval >= 0) {
-				if (depth == 0)
+				if (depth == 0) {
+					trace_sched_process_exec(current, bprm);
 					ptrace_event(PTRACE_EVENT_EXEC,
 							old_pid);
+				}
 				put_binfmt(fmt);
 				allow_write_access(bprm->file);
 				if (bprm->file)
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index 959ff18..ca8d084 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -6,6 +6,7 @@
 
 #include <linux/sched.h>
 #include <linux/tracepoint.h>
+#include <linux/binfmts.h>
 
 /*
  * Tracepoint for calling kthread_stop, performed to end a kthread:
@@ -276,6 +277,28 @@ TRACE_EVENT(sched_process_fork,
 );
 
 /*
+ * Tracepoint for exec:
+ */
+TRACE_EVENT(sched_process_exec,
+
+	TP_PROTO(struct task_struct *p, struct linux_binprm *bprm),
+
+	TP_ARGS(p, bprm),
+
+	TP_STRUCT__entry(
+		__string(	filename,	bprm->filename	)
+		__field(	pid_t,		pid		)
+	),
+
+	TP_fast_assign(
+		__assign_str(filename, bprm->filename);
+		__entry->pid	= p->pid;
+	),
+
+	TP_printk("filename=%s pid=%d", __get_str(filename), __entry->pid)
+);
+
+/*
  * XXX the below sched_stat tracepoints only apply to SCHED_OTHER/BATCH/IDLE
  *     adding sched_stat support to SCHED_FIFO/RR would be welcome.
  */

Re: [RFC PATCH v2] Tracepoint: add exec tracepoint

[Pedro Alves]

On Thursday 03 November 2011 15:59:48, David Smith wrote:
> +                               if (depth == 0) {
> +                                       trace_sched_process_exec(current, bprm);
>                                         ptrace_event(PTRACE_EVENT_EXEC,
>                                                         old_pid);
> +                               }

Won't tracepoints be interested in the old pid as well?  Or does bprm
carry that info?  That was only recently added to the ptrace event,
which probably postdates your original patch.

-- 
Pedro Alves

Re: [RFC PATCH v2] Tracepoint: add exec tracepoint

[David Smith]

On 11/04/2011 07:08 AM, Pedro Alves wrote:

> On Thursday 03 November 2011 15:59:48, David Smith wrote:
>> +                               if (depth == 0) {
>> +                                       trace_sched_process_exec(current, bprm);
>>                                         ptrace_event(PTRACE_EVENT_EXEC,
>>                                                         old_pid);
>> +                               }
> 
> Won't tracepoints be interested in the old pid as well?  Or does bprm
> carry that info?  That was only recently added to the ptrace event,
> which probably postdates your original patch.


Looking back at commit bb188d7 and the reasons why 'old_pid' was added,
it seems like a good idea to go ahead and add 'old_pid' to the
tracepoint as well.

v3 coming up...

Thanks for looking at this.

-- 
David Smith
dsmith@redhat.com
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)

Re: [RFC PATCH v2] Tracepoint: add exec tracepoint

[Peter Zijlstra]

On Thu, 2011-11-03 at 10:59 -0500, David Smith wrote:
> Added general purpose exec tracepoint.  The 'bprm' argument gives
> details of the exec.
> 
> 
This 'changelog' if one can call it that, is completely devoid of
rationale, why should we care and why should we merge.

Re: [RFC PATCH v2] Tracepoint: add exec tracepoint

[David Smith]

On 11/07/2011 06:56 AM, Peter Zijlstra wrote:

> On Thu, 2011-11-03 at 10:59 -0500, David Smith wrote:
>> Added general purpose exec tracepoint.  The 'bprm' argument gives
>> details of the exec.

>>

> This 'changelog' if one can call it that, is completely devoid of
> rationale, why should we care and why should we merge.


Sorry for being too terse.

Exec is an important major event in the life of a task (like fork or
exit).  If you want to watch a task start up, when it gets exec'ed is a
good place to start.  With the addition of this tracepoint, we can
monitor exec's and get a better picture of system activity in general.
This will also enable better process tracking, allowing you to answer
questions like "what process keeps starting up process X?".

This tracepoint can also be useful in ftrace filtering (i.e. starting or
stopping filtering when exec is called)

-- 
David Smith
dsmith@redhat.com
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)