Merge branch 'uprobes/core' of... (b5210b2a) · Commits · e / devices / android_kernel_teracube_emerald

Documentation/trace/uprobetracer.txt

+67 −47

Original line number	Original line	Diff line number	Diff line
	Uprobe-tracer: Uprobe-based Event Tracing		Uprobe-tracer: Uprobe-based Event Tracing
	=========================================		=========================================

	Documentation written by Srikar Dronamraju		Documentation written by Srikar Dronamraju


	Overview		Overview
	--------		--------
	Uprobe based trace events are similar to kprobe based trace events.		Uprobe based trace events are similar to kprobe based trace events.
	@@ -13,16 +15,18 @@ current_tracer. Instead of that, add probe points via
	/sys/kernel/debug/tracing/events/uprobes/<EVENT>/enabled.		/sys/kernel/debug/tracing/events/uprobes/<EVENT>/enabled.

	However unlike kprobe-event tracer, the uprobe event interface expects the		However unlike kprobe-event tracer, the uprobe event interface expects the
	user to calculate the offset of the probepoint in the object		user to calculate the offset of the probepoint in the object.

	Synopsis of uprobe_tracer		Synopsis of uprobe_tracer
	-------------------------		-------------------------
	p[:[GRP/]EVENT] PATH:SYMBOL[+offs] [FETCHARGS] : Set a probe		p[:[GRP/]EVENT] PATH:SYMBOL[+offs] [FETCHARGS] : Set a uprobe
			r[:[GRP/]EVENT] PATH:SYMBOL[+offs] [FETCHARGS] : Set a return uprobe (uretprobe)
	GRP : Group name. If omitted, use "uprobes" for it.		-:[GRP/]EVENT : Clear uprobe or uretprobe event
	EVENT : Event name. If omitted, the event name is generated
	based on SYMBOL+offs.		GRP : Group name. If omitted, "uprobes" is the default value.
	PATH : path to an executable or a library.		EVENT : Event name. If omitted, the event name is generated based
			on SYMBOL+offs.
			PATH : Path to an executable or a library.
	SYMBOL[+offs] : Symbol+offset where the probe is inserted.		SYMBOL[+offs] : Symbol+offset where the probe is inserted.

	FETCHARGS : Arguments. Each probe can have up to 128 args.		FETCHARGS : Arguments. Each probe can have up to 128 args.
	@@ -37,20 +41,29 @@ the third is the number of probe miss-hits.

	Usage examples		Usage examples
	--------------		--------------
	To add a probe as a new event, write a new definition to uprobe_events		* Add a probe as a new uprobe event, write a new definition to uprobe_events
	as below.		as below: (sets a uprobe at an offset of 0x4245c0 in the executable /bin/bash)

	echo 'p: /bin/bash:0x4245c0' > /sys/kernel/debug/tracing/uprobe_events		echo 'p: /bin/bash:0x4245c0' > /sys/kernel/debug/tracing/uprobe_events

	This sets a uprobe at an offset of 0x4245c0 in the executable /bin/bash		* Add a probe as a new uretprobe event:

	echo > /sys/kernel/debug/tracing/uprobe_events		echo 'r: /bin/bash:0x4245c0' > /sys/kernel/debug/tracing/uprobe_events

			* Unset registered event:

			echo '-:bash_0x4245c0' >> /sys/kernel/debug/tracing/uprobe_events

			* Print out the events that are registered:

	This clears all probe points.		cat /sys/kernel/debug/tracing/uprobe_events

	The following example shows how to dump the instruction pointer and %ax		* Clear all events:
	a register at the probed text address. Here we are trying to probe
	function zfree in /bin/zsh		echo > /sys/kernel/debug/tracing/uprobe_events

			Following example shows how to dump the instruction pointer and %ax register
			at the probed text address. Probe zfree function in /bin/zsh:

	# cd /sys/kernel/debug/tracing/		# cd /sys/kernel/debug/tracing/
	# cat /proc/`pgrep zsh`/maps \| grep /bin/zsh \| grep r-xp		# cat /proc/`pgrep zsh`/maps \| grep /bin/zsh \| grep r-xp
	@@ -59,21 +72,26 @@ function zfree in /bin/zsh
	0000000000446420 g DF .text 0000000000000012 Base zfree		0000000000446420 g DF .text 0000000000000012 Base zfree

	0x46420 is the offset of zfree in object /bin/zsh that is loaded at		0x46420 is the offset of zfree in object /bin/zsh that is loaded at
	0x00400000. Hence the command to probe would be :		0x00400000. Hence the command to uprobe would be:

			# echo 'p:zfree_entry /bin/zsh:0x46420 %ip %ax' > uprobe_events

	# echo 'p /bin/zsh:0x46420 %ip %ax' > uprobe_events		And the same for the uretprobe would be:

	Please note: User has to explicitly calculate the offset of the probepoint		# echo 'r:zfree_exit /bin/zsh:0x46420 %ip %ax' >> uprobe_events

			Please note: User has to explicitly calculate the offset of the probe-point
	in the object. We can see the events that are registered by looking at the		in the object. We can see the events that are registered by looking at the
	uprobe_events file.		uprobe_events file.

	# cat uprobe_events		# cat uprobe_events
	p:uprobes/p_zsh_0x46420 /bin/zsh:0x00046420 arg1=%ip arg2=%ax		p:uprobes/zfree_entry /bin/zsh:0x00046420 arg1=%ip arg2=%ax
			r:uprobes/zfree_exit /bin/zsh:0x00046420 arg1=%ip arg2=%ax

	The format of events can be seen by viewing the file events/uprobes/p_zsh_0x46420/format		Format of events can be seen by viewing the file events/uprobes/zfree_entry/format

	# cat events/uprobes/p_zsh_0x46420/format		# cat events/uprobes/zfree_entry/format
	name: p_zsh_0x46420		name: zfree_entry
	ID: 922		ID: 922
	format:		format:
	field:unsigned short common_type; offset:0; size:2; signed:0;		field:unsigned short common_type; offset:0; size:2; signed:0;
	@@ -94,6 +112,7 @@ events, you need to enable it by:
	# echo 1 > events/uprobes/enable		# echo 1 > events/uprobes/enable

	Lets disable the event after sleeping for some time.		Lets disable the event after sleeping for some time.

	# sleep 20		# sleep 20
	# echo 0 > events/uprobes/enable		# echo 0 > events/uprobes/enable

	@@ -104,10 +123,11 @@ And you can see the traced information via /sys/kernel/debug/tracing/trace.
	#		#
	# TASK-PID CPU# TIMESTAMP FUNCTION		# TASK-PID CPU# TIMESTAMP FUNCTION
	# \| \| \| \| \|		# \| \| \| \| \|
	zsh-24842 [006] 258544.995456: p_zsh_0x46420: (0x446420) arg1=446421 arg2=79		zsh-24842 [006] 258544.995456: zfree_entry: (0x446420) arg1=446420 arg2=79
	zsh-24842 [007] 258545.000270: p_zsh_0x46420: (0x446420) arg1=446421 arg2=79		zsh-24842 [007] 258545.000270: zfree_exit: (0x446540 <- 0x446420) arg1=446540 arg2=0
	zsh-24842 [002] 258545.043929: p_zsh_0x46420: (0x446420) arg1=446421 arg2=79		zsh-24842 [002] 258545.043929: zfree_entry: (0x446420) arg1=446420 arg2=79
	zsh-24842 [004] 258547.046129: p_zsh_0x46420: (0x446420) arg1=446421 arg2=79		zsh-24842 [004] 258547.046129: zfree_exit: (0x446540 <- 0x446420) arg1=446540 arg2=0

	Each line shows us probes were triggered for a pid 24842 with ip being		Output shows us uprobe was triggered for a pid 24842 with ip being 0x446420
	0x446421 and contents of ax register being 79.		and contents of ax register being 79. And uretprobe was triggered with ip at
			0x446540 with counterpart function entry at 0x446420.

arch/powerpc/include/asm/uprobes.h

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -51,4 +51,5 @@ extern int arch_uprobe_post_xol(struct arch_uprobe aup, struct pt_regs regs);
	extern bool arch_uprobe_xol_was_trapped(struct task_struct *tsk);		extern bool arch_uprobe_xol_was_trapped(struct task_struct *tsk);
	extern int arch_uprobe_exception_notify(struct notifier_block self, unsigned long val, void data);		extern int arch_uprobe_exception_notify(struct notifier_block self, unsigned long val, void data);
	extern void arch_uprobe_abort_xol(struct arch_uprobe aup, struct pt_regs regs);		extern void arch_uprobe_abort_xol(struct arch_uprobe aup, struct pt_regs regs);
			extern unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs);
	#endif /* _ASM_UPROBES_H */		#endif /* _ASM_UPROBES_H */

arch/powerpc/kernel/uprobes.c

+23 −6

Original line number	Original line	Diff line number	Diff line
	@@ -30,6 +30,16 @@

	#define UPROBE_TRAP_NR UINT_MAX		#define UPROBE_TRAP_NR UINT_MAX

			/**
			* is_trap_insn - check if the instruction is a trap variant
			* @insn: instruction to be checked.
			* Returns true if @insn is a trap variant.
			*/
			bool is_trap_insn(uprobe_opcode_t *insn)
			{
			return (is_trap(*insn));
			}

	/**		/**
	* arch_uprobe_analyze_insn		* arch_uprobe_analyze_insn
	* @mm: the probed address space.		* @mm: the probed address space.
	@@ -43,12 +53,6 @@ int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe,
	if (addr & 0x03)		if (addr & 0x03)
	return -EINVAL;		return -EINVAL;

	/*
	* We currently don't support a uprobe on an already
	* existing breakpoint instruction underneath
	*/
	if (is_trap(auprobe->ainsn))
	return -ENOTSUPP;
	return 0;		return 0;
	}		}

	@@ -188,3 +192,16 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe auprobe, struct pt_regs regs)

	return false;		return false;
	}		}

			unsigned long
			arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
			{
			unsigned long orig_ret_vaddr;

			orig_ret_vaddr = regs->link;

			/* Replace the return addr with trampoline addr */
			regs->link = trampoline_vaddr;

			return orig_ret_vaddr;
			}

arch/x86/include/asm/uprobes.h

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -55,4 +55,5 @@ extern int arch_uprobe_post_xol(struct arch_uprobe aup, struct pt_regs regs);
	extern bool arch_uprobe_xol_was_trapped(struct task_struct *tsk);		extern bool arch_uprobe_xol_was_trapped(struct task_struct *tsk);
	extern int arch_uprobe_exception_notify(struct notifier_block self, unsigned long val, void data);		extern int arch_uprobe_exception_notify(struct notifier_block self, unsigned long val, void data);
	extern void arch_uprobe_abort_xol(struct arch_uprobe aup, struct pt_regs regs);		extern void arch_uprobe_abort_xol(struct arch_uprobe aup, struct pt_regs regs);
			extern unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs);
	#endif /* _ASM_UPROBES_H */		#endif /* _ASM_UPROBES_H */

arch/x86/kernel/uprobes.c

+29 −0

Original line number	Original line	Diff line number	Diff line
	@@ -697,3 +697,32 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe auprobe, struct pt_regs regs)
	send_sig(SIGTRAP, current, 0);		send_sig(SIGTRAP, current, 0);
	return ret;		return ret;
	}		}

			unsigned long
			arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
			{
			int rasize, ncopied;
			unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */

			rasize = is_ia32_task() ? 4 : 8;
			ncopied = copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize);
			if (unlikely(ncopied))
			return -1;

			/* check whether address has been already hijacked */
			if (orig_ret_vaddr == trampoline_vaddr)
			return orig_ret_vaddr;

			ncopied = copy_to_user((void __user *)regs->sp, &trampoline_vaddr, rasize);
			if (likely(!ncopied))
			return orig_ret_vaddr;

			if (ncopied != rasize) {
			pr_err("uprobe: return address clobbered: pid=%d, %%sp=%#lx, "
			"%%ip=%#lx\n", current->pid, regs->sp, regs->ip);

			force_sig_info(SIGSEGV, SEND_SIG_FORCED, current);
			}

			return -1;
			}