- Kprobe-based Event Tracer
+ Kprobe-based Event Tracer
=========================
Documentation is written by Masami Hiramatsu
$sa : Fetch stack address.
$aN : Fetch function argument. (N >= 0)(*)
$rv : Fetch return value.(**)
- $ra : Fetch return address.(**)
+|-offs(FETCHARG) : Fetch memory at FETCHARG +|- offs address.(***)
NAME=FETCHARG: Set NAME as the argument name of FETCHARG.
1st to 4th arguments as "myprobe" event. As this example shows, users can
choose more familiar names for each arguments.
- echo r:myretprobe do_sys_open $rv $ra >> /sys/kernel/debug/tracing/kprobe_events
+ echo r:myretprobe do_sys_open $rv >> /sys/kernel/debug/tracing/kprobe_events
This sets a kretprobe on the return point of do_sys_open() function with
-recording return value and return address as "myretprobe" event.
+recording return value as "myretprobe" event.
You can see the format of these events via
/sys/kernel/debug/tracing/events/kprobes/<EVENT>/format.
# TASK-PID CPU# TIMESTAMP FUNCTION
# | | | | |
<...>-1447 [001] 1038282.286875: myprobe: (do_sys_open+0x0/0xd6) dfd=3 filename=7fffd1ec4440 flags=8000 mode=0
- <...>-1447 [001] 1038282.286878: myretprobe: (sys_openat+0xc/0xe <- do_sys_open) $rv=fffffffffffffffe $ra=ffffffff81367a3a
+ <...>-1447 [001] 1038282.286878: myretprobe: (sys_openat+0xc/0xe <- do_sys_open) $rv=fffffffffffffffe
<...>-1447 [001] 1038282.286885: myprobe: (do_sys_open+0x0/0xd6) dfd=ffffff9c filename=40413c flags=8000 mode=1b6
- <...>-1447 [001] 1038282.286915: myretprobe: (sys_open+0x1b/0x1d <- do_sys_open) $rv=3 $ra=ffffffff81367a3a
+ <...>-1447 [001] 1038282.286915: myretprobe: (sys_open+0x1b/0x1d <- do_sys_open) $rv=3
<...>-1447 [001] 1038282.286969: myprobe: (do_sys_open+0x0/0xd6) dfd=ffffff9c filename=4041c6 flags=98800 mode=10
- <...>-1447 [001] 1038282.286976: myretprobe: (sys_open+0x1b/0x1d <- do_sys_open) $rv=3 $ra=ffffffff81367a3a
+ <...>-1447 [001] 1038282.286976: myretprobe: (sys_open+0x1b/0x1d <- do_sys_open) $rv=3
Each line shows when the kernel hits an event, and <- SYMBOL means kernel
return regs_return_value(regs);
}
-static __kprobes unsigned long fetch_ip(struct pt_regs *regs, void *dummy)
-{
- return instruction_pointer(regs);
-}
-
static __kprobes unsigned long fetch_stack_address(struct pt_regs *regs,
void *dummy)
{
ret = snprintf(buf, n, "@%s%+ld", sc->symbol, sc->offset);
} else if (ff->func == fetch_retvalue)
ret = snprintf(buf, n, "$rv");
- else if (ff->func == fetch_ip)
- ret = snprintf(buf, n, "$ra");
else if (ff->func == fetch_stack_address)
ret = snprintf(buf, n, "$sa");
else if (ff->func == fetch_indirect) {
if (is_return && arg[1] == 'v') {
ff->func = fetch_retvalue;
ff->data = NULL;
- } else if (is_return && arg[1] == 'a') {
- ff->func = fetch_ip;
- ff->data = NULL;
} else
ret = -EINVAL;
break;
* Fetch args:
* $aN : fetch Nth of function argument. (N:0-)
* $rv : fetch return value
- * $ra : fetch return address
* $sa : fetch stack address
* $sN : fetch Nth of stack (N:0-)
* @ADDR : fetch memory at ADDR (ADDR should be in kernel)