From patchwork Mon Apr 8 09:01:54 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marco Elver X-Patchwork-Id: 13620829 Received: from mail-yb1-f202.google.com (mail-yb1-f202.google.com [209.85.219.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A6DCE41AAB for ; Mon, 8 Apr 2024 09:02:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712566970; cv=none; b=iPUMDMWWC2ZWDUD8bFa0ZHX3JtD4f7wVe5gLZUct3StRC5e50n2ZY5fnSD3hniNqCi8AJTYwm+1lY6xoLzCLd+zLzpeVu2fWQugCqZVjHjZ19nKa0dxxXS85z0/5kdL7fO6NtuNz4P4fNgswfdEMwHcgAwlaTYEbovs5VZNrRlI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712566970; c=relaxed/simple; bh=aVuKcbnpYY4FjU+CNW2JrarqfTioWso04jtw3oU+lTI=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=qVqgmymIk4dxMnNhTPJEWhe1zJUvWRFJhD7Hkbj4oRiIkMWM0fT0GJ1RAwkgx3n4huBqZivFIJsH0UtfdVLz7IZHABbn5uQT/1n9EfzIE+fUotxKf0YPUvx1x7TiTxgzh/VJ8lVM9aPFWuqWad6xs3CGMW4/Cx3KxBT6b+RE/qk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--elver.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=LTzLQuKB; arc=none smtp.client-ip=209.85.219.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--elver.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="LTzLQuKB" Received: by mail-yb1-f202.google.com with SMTP id 3f1490d57ef6-de0b4063e59so2564321276.3 for ; Mon, 08 Apr 2024 02:02:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1712566967; x=1713171767; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=dRUfOG22gFtzSxXckMYpwWSYVbuVuH++MvjmfSoLS8Y=; b=LTzLQuKBm8g7OHxnQdc0+7vk/JxEO9pIvGEIpIY9Qv3Pp4ikHBvaIYm6Cy7ggG0/92 kzxeF7ctzHX+UrhFvnfBx0ik7SAEvAFpNyR6JiJGArUqqx6WvHytqCRKvJuGFxbvA9Cv NcOmnj3cWGsroecHaTyDmKfk8c9OXiwR0bOeW9n1nkf16P6qJ0y4B5+yZMzUtHoeyvsZ uZ0/FQQw3URmaL3m4LsZgzl+WhkOCcix74EGIlvZeTBClEeBqyfKg7PJVksc229yhln5 el3atGe0wU2ZuH2FlKwnJC7EJ8cl0hMGgobLV81DCEBR+F0W2EIslSTcBBjewRMJy7xh IMQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712566967; x=1713171767; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=dRUfOG22gFtzSxXckMYpwWSYVbuVuH++MvjmfSoLS8Y=; b=Rsc1gStOiC6chsSkv5fvx9GsHwbcERRkj9BmXRkiD2HEQFJQmAe4jFZTuLnnekz3Gu +lIH8FaHzSNtzcEZbS5xKuMpfziitSgUU/32yG1rXneX07wkK2dstCEwHlsvpPWahaCJ yO0y2Ux69pPMZlN/o3EmFB/QQe/nHGeMb5ooMWTrsSDR+lxzP8mMleLBr7jVVjWZl7fy EmZAVpNqvCzka3ieiAHHiMt5M9f7S+B8y1dOE0JTrlmXQPw1XdMnJ9w6JkpM/kdQux9J VxXM3EABGjXdb2tw0nWo3zUXGixq3ShLMPmFwV5xoeKB9ZZV0NmH/3KN/DpkPWBp32dd Xfig== X-Forwarded-Encrypted: i=1; AJvYcCVSP1dRc9+GSvMA3PURVlNFUpcFFxNvA60TJ/nkHQyoA8nFuLj5QNHpa/aFa9ubk27SwEYIoaAFrk1pf6xQ+24xYBqxnyQLQNOj+my0CgInImgF X-Gm-Message-State: AOJu0YzT/zA0KIdpItha4Z2l2e+m7xGWv1AevWUqqsrpuGn6EfIYyzRb rd7RuAeOgikBMncRqTw0a/mIQlCKEOmEQub2eDzsFeuD/d39dnLmKhaACIxaivpzd40kzI3sAg= = X-Google-Smtp-Source: AGHT+IF7fNc9CfA3rN0FPE5cCB/FJRCFpa71D/Uyw6NdHdjHjjwDmKUZCoP0gpqMqi3bqfDBxO1+PAF/cA== X-Received: from elver.muc.corp.google.com ([2a00:79e0:9c:201:ea4d:dc81:62c5:eeb9]) (user=elver job=sendgmr) by 2002:a05:6902:c09:b0:dcd:b431:7f5b with SMTP id fs9-20020a0569020c0900b00dcdb4317f5bmr2823872ybb.0.1712566967683; Mon, 08 Apr 2024 02:02:47 -0700 (PDT) Date: Mon, 8 Apr 2024 11:01:54 +0200 Precedence: bulk X-Mailing-List: linux-trace-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.44.0.478.gd926399ef9-goog Message-ID: <20240408090205.3714934-1-elver@google.com> Subject: [PATCH] tracing: Add new_exec tracepoint From: Marco Elver To: elver@google.com, Steven Rostedt Cc: Eric Biederman , Kees Cook , Alexander Viro , Christian Brauner , Jan Kara , Masami Hiramatsu , Mathieu Desnoyers , linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, Dmitry Vyukov Add "new_exec" tracepoint, which is run right after the point of no return but before the current task assumes its new exec identity. Unlike the tracepoint "sched_process_exec", the "new_exec" tracepoint runs before flushing the old exec, i.e. while the task still has the original state (such as original MM), but when the new exec either succeeds or crashes (but never returns to the original exec). Being able to trace this event can be helpful in a number of use cases: * allowing tracing eBPF programs access to the original MM on exec, before current->mm is replaced; * counting exec in the original task (via perf event); * profiling flush time ("new_exec" to "sched_process_exec"). Example of tracing output ("new_exec" and "sched_process_exec"): $ cat /sys/kernel/debug/tracing/trace_pipe <...>-379 [003] ..... 179.626921: new_exec: filename=/usr/bin/sshd pid=379 comm=sshd <...>-379 [003] ..... 179.629131: sched_process_exec: filename=/usr/bin/sshd pid=379 old_pid=379 <...>-381 [002] ..... 180.048580: new_exec: filename=/bin/bash pid=381 comm=sshd <...>-381 [002] ..... 180.053122: sched_process_exec: filename=/bin/bash pid=381 old_pid=381 <...>-385 [001] ..... 180.068277: new_exec: filename=/usr/bin/tty pid=385 comm=bash <...>-385 [001] ..... 180.069485: sched_process_exec: filename=/usr/bin/tty pid=385 old_pid=385 <...>-389 [006] ..... 192.020147: new_exec: filename=/usr/bin/dmesg pid=389 comm=bash bash-389 [006] ..... 192.021377: sched_process_exec: filename=/usr/bin/dmesg pid=389 old_pid=389 Signed-off-by: Marco Elver --- fs/exec.c | 2 ++ include/trace/events/task.h | 30 ++++++++++++++++++++++++++++++ 2 files changed, 32 insertions(+) diff --git a/fs/exec.c b/fs/exec.c index 38bf71cbdf5e..ab778ae1fc06 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1268,6 +1268,8 @@ int begin_new_exec(struct linux_binprm * bprm) if (retval) return retval; + trace_new_exec(current, bprm); + /* * Ensure all future errors are fatal. */ diff --git a/include/trace/events/task.h b/include/trace/events/task.h index 47b527464d1a..8853dc44783d 100644 --- a/include/trace/events/task.h +++ b/include/trace/events/task.h @@ -56,6 +56,36 @@ TRACE_EVENT(task_rename, __entry->newcomm, __entry->oom_score_adj) ); +/** + * new_exec - called before setting up new exec + * @task: pointer to the current task + * @bprm: pointer to linux_binprm used for new exec + * + * Called before flushing the old exec, but at the point of no return during + * switching to the new exec. + */ +TRACE_EVENT(new_exec, + + TP_PROTO(struct task_struct *task, struct linux_binprm *bprm), + + TP_ARGS(task, bprm), + + TP_STRUCT__entry( + __string( filename, bprm->filename ) + __field( pid_t, pid ) + __string( comm, task->comm ) + ), + + TP_fast_assign( + __assign_str(filename, bprm->filename); + __entry->pid = task->pid; + __assign_str(comm, task->comm); + ), + + TP_printk("filename=%s pid=%d comm=%s", + __get_str(filename), __entry->pid, __get_str(comm)) +); + #endif /* This part must be outside protection */