From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B06ACD128A for ; Wed, 10 Apr 2024 13:56:58 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 916376B00BC; Wed, 10 Apr 2024 09:56:57 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 8C5206B00BE; Wed, 10 Apr 2024 09:56:57 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 78D306B00BF; Wed, 10 Apr 2024 09:56:57 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 593FA6B00BC for ; Wed, 10 Apr 2024 09:56:57 -0400 (EDT) Received: from smtpin21.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 187A1806E8 for ; Wed, 10 Apr 2024 13:56:57 +0000 (UTC) X-FDA: 81993773274.21.65C1F34 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf29.hostedemail.com (Postfix) with ESMTP id 888D7120025 for ; Wed, 10 Apr 2024 13:56:55 +0000 (UTC) Authentication-Results: imf29.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=eNj8Q1fe; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf29.hostedemail.com: domain of mhiramat@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=mhiramat@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1712757415; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=M6rx/vJvCFhkLkXRtIZsPg9zdrTxtSoaZ9Qf1cAIy5s=; b=jp3clzAcrRlQgpAko5R4SS/P6pulalm2K2TzVOZt70eCr/pSC9AAKlzE4mSKwrSlMqsx07 YYSP+cBerp5xoQmUA+4Cdx/tJ8QQmyGq18NJ/UAlBuI/spNat7iOlFIwCUWIAyX9GLXg6U +OG5gq72MYzRs4E4H8MoAIw0BCAChQQ= ARC-Authentication-Results: i=1; imf29.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=eNj8Q1fe; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf29.hostedemail.com: domain of mhiramat@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=mhiramat@kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1712757415; a=rsa-sha256; cv=none; b=Dkm2o7uQlH4JRh8Xu8R1L2rvRYwQuHHvaQa7K/Ujvo9jpxzLzgwL5/SX7YRaLxx67GpRUj egkKqEpAixs26nJ08+CIM95zyP4jHdkDi8Y3tz05JLXMWUaY3fS7fe328vfWMSEmKh7XkH KGgUGt4Ub2MLLPqIHuA4wHPWYjrYPbM= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 8DFA261BE9; Wed, 10 Apr 2024 13:56:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BEAFCC433F1; Wed, 10 Apr 2024 13:56:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1712757414; bh=lhXxlgOSdVu5J2H9D+fqrRFhQyc0zvYsi/r8+KBO404=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=eNj8Q1feNt/ZrcbKAt3E0RlvlQqaaAhjlBqqhBHsKqcvtX/mgO8NfSZ1mDFgDS12N F0dFBSZkCLbZT9xKaO/Vgh86z/bnZspm3mlRs+RuoUUvVX00FT4KGxJSnErE9uwoyi I0eIpRFvGHxnDJ8T4F2PYIgk97HMrp+Ym7+kLZLndFSaKt1ZUdElWLLaJ9/3RSjhYE gkRqoYoITucNFR6egzQyMTP/1JuvQZ631XYuk/OVN6hjja6UBaAmkobTZ8YgS44J0B e/AYhdcbcczpPEcAG+iptJCUShzY0lBzKpjwZ/+Q6sUf/pHKqzRbneMVG2bSOFWBaw 4dvnSb22JSJrQ== Date: Wed, 10 Apr 2024 22:56:48 +0900 From: Masami Hiramatsu (Google) To: Marco Elver Cc: Steven Rostedt , Eric Biederman , Kees Cook , Alexander Viro , Christian Brauner , Jan Kara , Masami Hiramatsu , Mathieu Desnoyers , linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, Dmitry Vyukov Subject: Re: [PATCH] tracing: Add new_exec tracepoint Message-Id: <20240410225648.7a815ba873c8d55c44385c24@kernel.org> In-Reply-To: <20240408090205.3714934-1-elver@google.com> References: <20240408090205.3714934-1-elver@google.com> X-Mailer: Sylpheed 3.7.0 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Rspam-User: X-Stat-Signature: yg3ex5pzjgo1m3i35fwq6dpnm5xkjsz4 X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 888D7120025 X-HE-Tag: 1712757415-249733 X-HE-Meta: U2FsdGVkX1+UWHSgV7UT8sGAhW6t7lBU55ZhPp/HI4v55iPaSjso1Zg3bBGiLB75YzZNm4oVsWYhUb1Zkj2axSa1VU8Igr5S3kzdjF9wqoEW03xAf5BKP5G2j1os8wKaeCLMblPAMVGk/qz98W6hnoC0SabYLzrHCUuOVI77HhN52DOWhvtSxFwC+xJ7Xw6kabIFSihtLxKMnkR2N4VJiwG+GlQyet/4aNQLeQWeFU88FgCqHP6d473//FjfDiLqxHDOmSd6WekeUoxjOzw+HlFftyysC//FoJJdUE7qY1CbrSVlWzCQ9JGj7bki12jjKFy1M3zUvA9JEcrZ36wOFBRXrfLzYKgq2DOaRwTOUt7iKw3SYHc327VrC7wgGwovLytEBZ08zJYXgY5vNMCot8qMV652RuDkbO7sF45YCcfu/HQp/PA2gtyMEKaEoWpDehrTgiG1xZ87yetiC3C5TG7FKCacy5bATmFimaulitcbWyDGcEE/eID2baLV7XBDyFLc43dMJ8US+3j2Sn7lQlBGEK+O5kgaitT5BzCjmzXbcvIMFT/+m3VycseVdW84i5HbiwyKVOyFBVRDL0Xnu5sFUyrI2uPt2iOwCij9r7inCSd9buPePjdKquMQaXBrJ4z5OBpmU9RKAYFBKl0gmQFqyPnaJcBMAFVTlhOsHS+5AY8BOuT3FXbQkw9hZdmcMNmeoKeV1u6Xgaqol6MdArcl66ScW7kdC67pYIXa+pjpNlukPfjWVHFwA6Z71ap4O4dKOD8Of8OZmqkZgNvaddNI5D+L15NC5suE64nwmxdYIxpK9wGEHZrMREg9MR3pD/+5vpBolrs8gptoEZWrJzNIomcR2oeKFBilI4TrihXo/CIOlvXJTCi7muE6/ER8DWKiG5/t9rpKEZe/IiBxro01rS5LodVacw46tkGLZQnuaSnQlMBh45xrBDaIRBmIMkYgzBwmPNW6S2D02WC RIw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, 8 Apr 2024 11:01:54 +0200 Marco Elver wrote: > Add "new_exec" tracepoint, which is run right after the point of no > return but before the current task assumes its new exec identity. > > Unlike the tracepoint "sched_process_exec", the "new_exec" tracepoint > runs before flushing the old exec, i.e. while the task still has the > original state (such as original MM), but when the new exec either > succeeds or crashes (but never returns to the original exec). > > Being able to trace this event can be helpful in a number of use cases: > > * allowing tracing eBPF programs access to the original MM on exec, > before current->mm is replaced; > * counting exec in the original task (via perf event); > * profiling flush time ("new_exec" to "sched_process_exec"). > > Example of tracing output ("new_exec" and "sched_process_exec"): nit: "new_exec" name a bit stands out compared to other events, and hard to expect it comes before or after "sched_process_exec". Since "begin_new_exec" is internal implementation name, IMHO, it should not exposed to user. What do you think about calling this "sched_prepare_exec" ? Thank you, > > $ cat /sys/kernel/debug/tracing/trace_pipe > <...>-379 [003] ..... 179.626921: new_exec: filename=/usr/bin/sshd pid=379 comm=sshd > <...>-379 [003] ..... 179.629131: sched_process_exec: filename=/usr/bin/sshd pid=379 old_pid=379 > <...>-381 [002] ..... 180.048580: new_exec: filename=/bin/bash pid=381 comm=sshd > <...>-381 [002] ..... 180.053122: sched_process_exec: filename=/bin/bash pid=381 old_pid=381 > <...>-385 [001] ..... 180.068277: new_exec: filename=/usr/bin/tty pid=385 comm=bash > <...>-385 [001] ..... 180.069485: sched_process_exec: filename=/usr/bin/tty pid=385 old_pid=385 > <...>-389 [006] ..... 192.020147: new_exec: filename=/usr/bin/dmesg pid=389 comm=bash > bash-389 [006] ..... 192.021377: sched_process_exec: filename=/usr/bin/dmesg pid=389 old_pid=389 > > Signed-off-by: Marco Elver > --- > fs/exec.c | 2 ++ > include/trace/events/task.h | 30 ++++++++++++++++++++++++++++++ > 2 files changed, 32 insertions(+) > > diff --git a/fs/exec.c b/fs/exec.c > index 38bf71cbdf5e..ab778ae1fc06 100644 > --- a/fs/exec.c > +++ b/fs/exec.c > @@ -1268,6 +1268,8 @@ int begin_new_exec(struct linux_binprm * bprm) > if (retval) > return retval; > > + trace_new_exec(current, bprm); > + > /* > * Ensure all future errors are fatal. > */ > diff --git a/include/trace/events/task.h b/include/trace/events/task.h > index 47b527464d1a..8853dc44783d 100644 > --- a/include/trace/events/task.h > +++ b/include/trace/events/task.h > @@ -56,6 +56,36 @@ TRACE_EVENT(task_rename, > __entry->newcomm, __entry->oom_score_adj) > ); > > +/** > + * new_exec - called before setting up new exec > + * @task: pointer to the current task > + * @bprm: pointer to linux_binprm used for new exec > + * > + * Called before flushing the old exec, but at the point of no return during > + * switching to the new exec. > + */ > +TRACE_EVENT(new_exec, > + > + TP_PROTO(struct task_struct *task, struct linux_binprm *bprm), > + > + TP_ARGS(task, bprm), > + > + TP_STRUCT__entry( > + __string( filename, bprm->filename ) > + __field( pid_t, pid ) > + __string( comm, task->comm ) > + ), > + > + TP_fast_assign( > + __assign_str(filename, bprm->filename); > + __entry->pid = task->pid; > + __assign_str(comm, task->comm); > + ), > + > + TP_printk("filename=%s pid=%d comm=%s", > + __get_str(filename), __entry->pid, __get_str(comm)) > +); > + > #endif > > /* This part must be outside protection */ > -- > 2.44.0.478.gd926399ef9-goog > -- Masami Hiramatsu (Google)