|
@@ -1,4 +1,4 @@
|
|
- Kprobe-based Event Tracer
|
|
|
|
|
|
+ Kprobe-based Event Tracer
|
|
=========================
|
|
=========================
|
|
|
|
|
|
Documentation is written by Masami Hiramatsu
|
|
Documentation is written by Masami Hiramatsu
|
|
@@ -42,7 +42,6 @@ Synopsis of kprobe_events
|
|
$sa : Fetch stack address.
|
|
$sa : Fetch stack address.
|
|
$aN : Fetch function argument. (N >= 0)(*)
|
|
$aN : Fetch function argument. (N >= 0)(*)
|
|
$rv : Fetch return value.(**)
|
|
$rv : Fetch return value.(**)
|
|
- $ra : Fetch return address.(**)
|
|
|
|
+|-offs(FETCHARG) : Fetch memory at FETCHARG +|- offs address.(***)
|
|
+|-offs(FETCHARG) : Fetch memory at FETCHARG +|- offs address.(***)
|
|
NAME=FETCHARG: Set NAME as the argument name of FETCHARG.
|
|
NAME=FETCHARG: Set NAME as the argument name of FETCHARG.
|
|
|
|
|
|
@@ -91,10 +90,10 @@ as below.
|
|
1st to 4th arguments as "myprobe" event. As this example shows, users can
|
|
1st to 4th arguments as "myprobe" event. As this example shows, users can
|
|
choose more familiar names for each arguments.
|
|
choose more familiar names for each arguments.
|
|
|
|
|
|
- echo r:myretprobe do_sys_open $rv $ra >> /sys/kernel/debug/tracing/kprobe_events
|
|
|
|
|
|
+ echo r:myretprobe do_sys_open $rv >> /sys/kernel/debug/tracing/kprobe_events
|
|
|
|
|
|
This sets a kretprobe on the return point of do_sys_open() function with
|
|
This sets a kretprobe on the return point of do_sys_open() function with
|
|
-recording return value and return address as "myretprobe" event.
|
|
|
|
|
|
+recording return value as "myretprobe" event.
|
|
You can see the format of these events via
|
|
You can see the format of these events via
|
|
/sys/kernel/debug/tracing/events/kprobes/<EVENT>/format.
|
|
/sys/kernel/debug/tracing/events/kprobes/<EVENT>/format.
|
|
|
|
|
|
@@ -138,11 +137,11 @@ events, you need to enable it.
|
|
# TASK-PID CPU# TIMESTAMP FUNCTION
|
|
# TASK-PID CPU# TIMESTAMP FUNCTION
|
|
# | | | | |
|
|
# | | | | |
|
|
<...>-1447 [001] 1038282.286875: myprobe: (do_sys_open+0x0/0xd6) dfd=3 filename=7fffd1ec4440 flags=8000 mode=0
|
|
<...>-1447 [001] 1038282.286875: myprobe: (do_sys_open+0x0/0xd6) dfd=3 filename=7fffd1ec4440 flags=8000 mode=0
|
|
- <...>-1447 [001] 1038282.286878: myretprobe: (sys_openat+0xc/0xe <- do_sys_open) $rv=fffffffffffffffe $ra=ffffffff81367a3a
|
|
|
|
|
|
+ <...>-1447 [001] 1038282.286878: myretprobe: (sys_openat+0xc/0xe <- do_sys_open) $rv=fffffffffffffffe
|
|
<...>-1447 [001] 1038282.286885: myprobe: (do_sys_open+0x0/0xd6) dfd=ffffff9c filename=40413c flags=8000 mode=1b6
|
|
<...>-1447 [001] 1038282.286885: myprobe: (do_sys_open+0x0/0xd6) dfd=ffffff9c filename=40413c flags=8000 mode=1b6
|
|
- <...>-1447 [001] 1038282.286915: myretprobe: (sys_open+0x1b/0x1d <- do_sys_open) $rv=3 $ra=ffffffff81367a3a
|
|
|
|
|
|
+ <...>-1447 [001] 1038282.286915: myretprobe: (sys_open+0x1b/0x1d <- do_sys_open) $rv=3
|
|
<...>-1447 [001] 1038282.286969: myprobe: (do_sys_open+0x0/0xd6) dfd=ffffff9c filename=4041c6 flags=98800 mode=10
|
|
<...>-1447 [001] 1038282.286969: myprobe: (do_sys_open+0x0/0xd6) dfd=ffffff9c filename=4041c6 flags=98800 mode=10
|
|
- <...>-1447 [001] 1038282.286976: myretprobe: (sys_open+0x1b/0x1d <- do_sys_open) $rv=3 $ra=ffffffff81367a3a
|
|
|
|
|
|
+ <...>-1447 [001] 1038282.286976: myretprobe: (sys_open+0x1b/0x1d <- do_sys_open) $rv=3
|
|
|
|
|
|
|
|
|
|
Each line shows when the kernel hits an event, and <- SYMBOL means kernel
|
|
Each line shows when the kernel hits an event, and <- SYMBOL means kernel
|