1 Kprobe-based Event Tracer
2 =========================
4 Documentation is written by Masami Hiramatsu
9 This tracer is similar to the events tracer which is based on Tracepoint
10 infrastructure. Instead of Tracepoint, this tracer is based on kprobes(kprobe
11 and kretprobe). It probes anywhere where kprobes can probe(this means, all
12 functions body except for __kprobes functions).
14 Unlike the function tracer, this tracer can probe instructions inside of
15 kernel functions. It allows you to check which instruction has been executed.
17 Unlike the Tracepoint based events tracer, this tracer can add and remove
18 probe points on the fly.
20 Similar to the events tracer, this tracer doesn't need to be activated via
21 current_tracer, instead of that, just set probe points via
22 /sys/kernel/debug/tracing/kprobe_events. And you can set filters on each
23 probe events via /sys/kernel/debug/tracing/events/kprobes/<EVENT>/filter.
26 Synopsis of kprobe_events
27 -------------------------
28 p[:[GRP/]EVENT] SYMBOL[+offs]|MEMADDR [FETCHARGS] : Set a probe
29 r[:[GRP/]EVENT] SYMBOL[+0] [FETCHARGS] : Set a return probe
31 GRP : Group name. If omitted, use "kprobes" for it.
32 EVENT : Event name. If omitted, the event name is generated
33 based on SYMBOL+offs or MEMADDR.
34 SYMBOL[+offs] : Symbol+offset where the probe is inserted.
35 MEMADDR : Address where the probe is inserted.
37 FETCHARGS : Arguments. Each probe can have up to 128 args.
38 %REG : Fetch register REG
39 @ADDR : Fetch memory at ADDR (ADDR should be in kernel)
40 @SYM[+|-offs] : Fetch memory at SYM +|- offs (SYM should be a data symbol)
41 $sN : Fetch Nth entry of stack (N >= 0)
42 $sa : Fetch stack address.
43 $aN : Fetch function argument. (N >= 0)(*)
44 $rv : Fetch return value.(**)
45 $ra : Fetch return address.(**)
46 +|-offs(FETCHARG) : Fetch memory at FETCHARG +|- offs address.(***)
47 NAME=FETCHARG: Set NAME as the argument name of FETCHARG.
49 (*) aN may not correct on asmlinkaged functions and at the middle of
51 (**) only for return probe.
52 (***) this is useful for fetching a field of data structures.
55 Per-Probe Event Filtering
56 -------------------------
57 Per-probe event filtering feature allows you to set different filter on each
58 probe and gives you what arguments will be shown in trace buffer. If an event
59 name is specified right after 'p:' or 'r:' in kprobe_events, the tracer adds
60 an event under tracing/events/kprobes/<EVENT>, at the directory you can see
61 'id', 'enabled', 'format' and 'filter'.
64 You can enable/disable the probe by writing 1 or 0 on it.
67 This shows the format of this probe event.
70 You can write filtering rules of this event.
73 This shows the id of this probe event.
77 You can check the total number of probe hits and probe miss-hits via
78 /sys/kernel/debug/tracing/kprobe_profile.
79 The first column is event name, the second is the number of probe hits,
80 the third is the number of probe miss-hits.
85 To add a probe as a new event, write a new definition to kprobe_events
88 echo p:myprobe do_sys_open dfd=$a0 filename=$a1 flags=$a2 mode=$a3 > /sys/kernel/debug/tracing/kprobe_events
90 This sets a kprobe on the top of do_sys_open() function with recording
91 1st to 4th arguments as "myprobe" event. As this example shows, users can
92 choose more familiar names for each arguments.
94 echo r:myretprobe do_sys_open $rv $ra >> /sys/kernel/debug/tracing/kprobe_events
96 This sets a kretprobe on the return point of do_sys_open() function with
97 recording return value and return address as "myretprobe" event.
98 You can see the format of these events via
99 /sys/kernel/debug/tracing/events/kprobes/<EVENT>/format.
101 cat /sys/kernel/debug/tracing/events/kprobes/myprobe/format
105 field:unsigned short common_type; offset:0; size:2;
106 field:unsigned char common_flags; offset:2; size:1;
107 field:unsigned char common_preempt_count; offset:3; size:1;
108 field:int common_pid; offset:4; size:4;
109 field:int common_tgid; offset:8; size:4;
111 field: unsigned long ip; offset:16;tsize:8;
112 field: int nargs; offset:24;tsize:4;
113 field: unsigned long dfd; offset:32;tsize:8;
114 field: unsigned long filename; offset:40;tsize:8;
115 field: unsigned long flags; offset:48;tsize:8;
116 field: unsigned long mode; offset:56;tsize:8;
118 print fmt: "(%lx) dfd=%lx filename=%lx flags=%lx mode=%lx", REC->ip, REC->dfd, REC->filename, REC->flags, REC->mode
121 You can see that the event has 4 arguments as in the expressions you specified.
123 echo > /sys/kernel/debug/tracing/kprobe_events
125 This clears all probe points.
127 Right after definition, each event is disabled by default. For tracing these
128 events, you need to enable it.
130 echo 1 > /sys/kernel/debug/tracing/events/kprobes/myprobe/enable
131 echo 1 > /sys/kernel/debug/tracing/events/kprobes/myretprobe/enable
133 And you can see the traced information via /sys/kernel/debug/tracing/trace.
135 cat /sys/kernel/debug/tracing/trace
138 # TASK-PID CPU# TIMESTAMP FUNCTION
140 <...>-1447 [001] 1038282.286875: myprobe: (do_sys_open+0x0/0xd6) dfd=3 filename=7fffd1ec4440 flags=8000 mode=0
141 <...>-1447 [001] 1038282.286878: myretprobe: (sys_openat+0xc/0xe <- do_sys_open) $rv=fffffffffffffffe $ra=ffffffff81367a3a
142 <...>-1447 [001] 1038282.286885: myprobe: (do_sys_open+0x0/0xd6) dfd=ffffff9c filename=40413c flags=8000 mode=1b6
143 <...>-1447 [001] 1038282.286915: myretprobe: (sys_open+0x1b/0x1d <- do_sys_open) $rv=3 $ra=ffffffff81367a3a
144 <...>-1447 [001] 1038282.286969: myprobe: (do_sys_open+0x0/0xd6) dfd=ffffff9c filename=4041c6 flags=98800 mode=10
145 <...>-1447 [001] 1038282.286976: myretprobe: (sys_open+0x1b/0x1d <- do_sys_open) $rv=3 $ra=ffffffff81367a3a
148 Each line shows when the kernel hits an event, and <- SYMBOL means kernel
149 returns from SYMBOL(e.g. "sys_open+0x1b/0x1d <- do_sys_open" means kernel
150 returns from do_sys_open to sys_open+0x1b).