diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2009-12-05 18:30:21 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-12-05 18:30:21 -0500 |
commit | c3fa27d1367fac63ac8533d6f20ea851d0d70a10 (patch) | |
tree | e7731554085e22b6b63411b1ebb401079f3e0bbb /Documentation | |
parent | 96fa2b508d2d3fe040cf4ef2fffb955f0a537ea1 (diff) | |
parent | d103d01e4b19f185d3c85f77402b605534c32e89 (diff) |
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
* 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: (470 commits)
x86: Fix comments of register/stack access functions
perf tools: Replace %m with %a in sscanf
hw-breakpoints: Keep track of user disabled breakpoints
tracing/syscalls: Make syscall events print callbacks static
tracing: Add DEFINE_EVENT(), DEFINE_SINGLE_EVENT() support to docbook
perf: Don't free perf_mmap_data until work has been done
perf_event: Fix compile error
perf tools: Fix _GNU_SOURCE macro related strndup() build error
trace_syscalls: Remove unused syscall_name_to_nr()
trace_syscalls: Simplify syscall profile
trace_syscalls: Remove duplicate init_enter_##sname()
trace_syscalls: Add syscall_nr field to struct syscall_metadata
trace_syscalls: Remove enter_id exit_id
trace_syscalls: Set event_enter_##sname->data to its metadata
trace_syscalls: Remove unused event_syscall_enter and event_syscall_exit
perf_event: Initialize data.period in perf_swevent_hrtimer()
perf probe: Simplify event naming
perf probe: Add --list option for listing current probe events
perf probe: Add argv_split() from lib/argv_split.c
perf probe: Move probe event utility functions to probe-event.c
...
Diffstat (limited to 'Documentation')
-rw-r--r-- | Documentation/DocBook/tracepoint.tmpl | 5 | ||||
-rw-r--r-- | Documentation/trace/kprobetrace.txt | 149 |
2 files changed, 154 insertions, 0 deletions
diff --git a/Documentation/DocBook/tracepoint.tmpl b/Documentation/DocBook/tracepoint.tmpl index b0756d0fd579..8bca1d5cec09 100644 --- a/Documentation/DocBook/tracepoint.tmpl +++ b/Documentation/DocBook/tracepoint.tmpl | |||
@@ -86,4 +86,9 @@ | |||
86 | !Iinclude/trace/events/irq.h | 86 | !Iinclude/trace/events/irq.h |
87 | </chapter> | 87 | </chapter> |
88 | 88 | ||
89 | <chapter id="signal"> | ||
90 | <title>SIGNAL</title> | ||
91 | !Iinclude/trace/events/signal.h | ||
92 | </chapter> | ||
93 | |||
89 | </book> | 94 | </book> |
diff --git a/Documentation/trace/kprobetrace.txt b/Documentation/trace/kprobetrace.txt new file mode 100644 index 000000000000..47aabeebbdf6 --- /dev/null +++ b/Documentation/trace/kprobetrace.txt | |||
@@ -0,0 +1,149 @@ | |||
1 | Kprobe-based Event Tracing | ||
2 | ========================== | ||
3 | |||
4 | Documentation is written by Masami Hiramatsu | ||
5 | |||
6 | |||
7 | Overview | ||
8 | -------- | ||
9 | These events are similar to tracepoint based events. Instead of Tracepoint, | ||
10 | this is based on kprobes (kprobe and kretprobe). So it can probe wherever | ||
11 | kprobes can probe (this means, all functions body except for __kprobes | ||
12 | functions). Unlike the Tracepoint based event, this can be added and removed | ||
13 | dynamically, on the fly. | ||
14 | |||
15 | To enable this feature, build your kernel with CONFIG_KPROBE_TRACING=y. | ||
16 | |||
17 | Similar to the events tracer, this doesn't need to be activated via | ||
18 | current_tracer. Instead of that, add probe points via | ||
19 | /sys/kernel/debug/tracing/kprobe_events, and enable it via | ||
20 | /sys/kernel/debug/tracing/events/kprobes/<EVENT>/enabled. | ||
21 | |||
22 | |||
23 | Synopsis of kprobe_events | ||
24 | ------------------------- | ||
25 | p[:[GRP/]EVENT] SYMBOL[+offs]|MEMADDR [FETCHARGS] : Set a probe | ||
26 | r[:[GRP/]EVENT] SYMBOL[+0] [FETCHARGS] : Set a return probe | ||
27 | |||
28 | GRP : Group name. If omitted, use "kprobes" for it. | ||
29 | EVENT : Event name. If omitted, the event name is generated | ||
30 | based on SYMBOL+offs or MEMADDR. | ||
31 | SYMBOL[+offs] : Symbol+offset where the probe is inserted. | ||
32 | MEMADDR : Address where the probe is inserted. | ||
33 | |||
34 | FETCHARGS : Arguments. Each probe can have up to 128 args. | ||
35 | %REG : Fetch register REG | ||
36 | @ADDR : Fetch memory at ADDR (ADDR should be in kernel) | ||
37 | @SYM[+|-offs] : Fetch memory at SYM +|- offs (SYM should be a data symbol) | ||
38 | $stackN : Fetch Nth entry of stack (N >= 0) | ||
39 | $stack : Fetch stack address. | ||
40 | $argN : Fetch function argument. (N >= 0)(*) | ||
41 | $retval : Fetch return value.(**) | ||
42 | +|-offs(FETCHARG) : Fetch memory at FETCHARG +|- offs address.(***) | ||
43 | NAME=FETCHARG: Set NAME as the argument name of FETCHARG. | ||
44 | |||
45 | (*) aN may not correct on asmlinkaged functions and at the middle of | ||
46 | function body. | ||
47 | (**) only for return probe. | ||
48 | (***) this is useful for fetching a field of data structures. | ||
49 | |||
50 | |||
51 | Per-Probe Event Filtering | ||
52 | ------------------------- | ||
53 | Per-probe event filtering feature allows you to set different filter on each | ||
54 | probe and gives you what arguments will be shown in trace buffer. If an event | ||
55 | name is specified right after 'p:' or 'r:' in kprobe_events, it adds an event | ||
56 | under tracing/events/kprobes/<EVENT>, at the directory you can see 'id', | ||
57 | 'enabled', 'format' and 'filter'. | ||
58 | |||
59 | enabled: | ||
60 | You can enable/disable the probe by writing 1 or 0 on it. | ||
61 | |||
62 | format: | ||
63 | This shows the format of this probe event. | ||
64 | |||
65 | filter: | ||
66 | You can write filtering rules of this event. | ||
67 | |||
68 | id: | ||
69 | This shows the id of this probe event. | ||
70 | |||
71 | |||
72 | Event Profiling | ||
73 | --------------- | ||
74 | You can check the total number of probe hits and probe miss-hits via | ||
75 | /sys/kernel/debug/tracing/kprobe_profile. | ||
76 | The first column is event name, the second is the number of probe hits, | ||
77 | the third is the number of probe miss-hits. | ||
78 | |||
79 | |||
80 | Usage examples | ||
81 | -------------- | ||
82 | To add a probe as a new event, write a new definition to kprobe_events | ||
83 | as below. | ||
84 | |||
85 | echo p:myprobe do_sys_open dfd=$arg0 filename=$arg1 flags=$arg2 mode=$arg3 > /sys/kernel/debug/tracing/kprobe_events | ||
86 | |||
87 | This sets a kprobe on the top of do_sys_open() function with recording | ||
88 | 1st to 4th arguments as "myprobe" event. As this example shows, users can | ||
89 | choose more familiar names for each arguments. | ||
90 | |||
91 | echo r:myretprobe do_sys_open $retval >> /sys/kernel/debug/tracing/kprobe_events | ||
92 | |||
93 | This sets a kretprobe on the return point of do_sys_open() function with | ||
94 | recording return value as "myretprobe" event. | ||
95 | You can see the format of these events via | ||
96 | /sys/kernel/debug/tracing/events/kprobes/<EVENT>/format. | ||
97 | |||
98 | cat /sys/kernel/debug/tracing/events/kprobes/myprobe/format | ||
99 | name: myprobe | ||
100 | ID: 75 | ||
101 | format: | ||
102 | field:unsigned short common_type; offset:0; size:2; | ||
103 | field:unsigned char common_flags; offset:2; size:1; | ||
104 | field:unsigned char common_preempt_count; offset:3; size:1; | ||
105 | field:int common_pid; offset:4; size:4; | ||
106 | field:int common_tgid; offset:8; size:4; | ||
107 | |||
108 | field: unsigned long ip; offset:16;tsize:8; | ||
109 | field: int nargs; offset:24;tsize:4; | ||
110 | field: unsigned long dfd; offset:32;tsize:8; | ||
111 | field: unsigned long filename; offset:40;tsize:8; | ||
112 | field: unsigned long flags; offset:48;tsize:8; | ||
113 | field: unsigned long mode; offset:56;tsize:8; | ||
114 | |||
115 | print fmt: "(%lx) dfd=%lx filename=%lx flags=%lx mode=%lx", REC->ip, REC->dfd, REC->filename, REC->flags, REC->mode | ||
116 | |||
117 | |||
118 | You can see that the event has 4 arguments as in the expressions you specified. | ||
119 | |||
120 | echo > /sys/kernel/debug/tracing/kprobe_events | ||
121 | |||
122 | This clears all probe points. | ||
123 | |||
124 | Right after definition, each event is disabled by default. For tracing these | ||
125 | events, you need to enable it. | ||
126 | |||
127 | echo 1 > /sys/kernel/debug/tracing/events/kprobes/myprobe/enable | ||
128 | echo 1 > /sys/kernel/debug/tracing/events/kprobes/myretprobe/enable | ||
129 | |||
130 | And you can see the traced information via /sys/kernel/debug/tracing/trace. | ||
131 | |||
132 | cat /sys/kernel/debug/tracing/trace | ||
133 | # tracer: nop | ||
134 | # | ||
135 | # TASK-PID CPU# TIMESTAMP FUNCTION | ||
136 | # | | | | | | ||
137 | <...>-1447 [001] 1038282.286875: myprobe: (do_sys_open+0x0/0xd6) dfd=3 filename=7fffd1ec4440 flags=8000 mode=0 | ||
138 | <...>-1447 [001] 1038282.286878: myretprobe: (sys_openat+0xc/0xe <- do_sys_open) $retval=fffffffffffffffe | ||
139 | <...>-1447 [001] 1038282.286885: myprobe: (do_sys_open+0x0/0xd6) dfd=ffffff9c filename=40413c flags=8000 mode=1b6 | ||
140 | <...>-1447 [001] 1038282.286915: myretprobe: (sys_open+0x1b/0x1d <- do_sys_open) $retval=3 | ||
141 | <...>-1447 [001] 1038282.286969: myprobe: (do_sys_open+0x0/0xd6) dfd=ffffff9c filename=4041c6 flags=98800 mode=10 | ||
142 | <...>-1447 [001] 1038282.286976: myretprobe: (sys_open+0x1b/0x1d <- do_sys_open) $retval=3 | ||
143 | |||
144 | |||
145 | Each line shows when the kernel hits an event, and <- SYMBOL means kernel | ||
146 | returns from SYMBOL(e.g. "sys_open+0x1b/0x1d <- do_sys_open" means kernel | ||
147 | returns from do_sys_open to sys_open+0x1b). | ||
148 | |||
149 | |||