ftrace-uses.rst 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302
  1. =================================
  2. Using ftrace to hook to functions
  3. =================================
  4. .. Copyright 2017 VMware Inc.
  5. .. Author: Steven Rostedt <srostedt@goodmis.org>
  6. .. License: The GNU Free Documentation License, Version 1.2
  7. .. (dual licensed under the GPL v2)
  8. Written for: 4.14
  9. Introduction
  10. ============
  11. The ftrace infrastructure was originally created to attach callbacks to the
  12. beginning of functions in order to record and trace the flow of the kernel.
  13. But callbacks to the start of a function can have other use cases. Either
  14. for live kernel patching, or for security monitoring. This document describes
  15. how to use ftrace to implement your own function callbacks.
  16. The ftrace context
  17. ==================
  18. .. warning::
  19. The ability to add a callback to almost any function within the
  20. kernel comes with risks. A callback can be called from any context
  21. (normal, softirq, irq, and NMI). Callbacks can also be called just before
  22. going to idle, during CPU bring up and takedown, or going to user space.
  23. This requires extra care to what can be done inside a callback. A callback
  24. can be called outside the protective scope of RCU.
  25. The ftrace infrastructure has some protections against recursions and RCU
  26. but one must still be very careful how they use the callbacks.
  27. The ftrace_ops structure
  28. ========================
  29. To register a function callback, a ftrace_ops is required. This structure
  30. is used to tell ftrace what function should be called as the callback
  31. as well as what protections the callback will perform and not require
  32. ftrace to handle.
  33. There is only one field that is needed to be set when registering
  34. an ftrace_ops with ftrace:
  35. .. code-block:: c
  36. struct ftrace_ops ops = {
  37. .func = my_callback_func,
  38. .flags = MY_FTRACE_FLAGS
  39. .private = any_private_data_structure,
  40. };
  41. Both .flags and .private are optional. Only .func is required.
  42. To enable tracing call::
  43. register_ftrace_function(&ops);
  44. To disable tracing call::
  45. unregister_ftrace_function(&ops);
  46. The above is defined by including the header::
  47. #include <linux/ftrace.h>
  48. The registered callback will start being called some time after the
  49. register_ftrace_function() is called and before it returns. The exact time
  50. that callbacks start being called is dependent upon architecture and scheduling
  51. of services. The callback itself will have to handle any synchronization if it
  52. must begin at an exact moment.
  53. The unregister_ftrace_function() will guarantee that the callback is
  54. no longer being called by functions after the unregister_ftrace_function()
  55. returns. Note that to perform this guarantee, the unregister_ftrace_function()
  56. may take some time to finish.
  57. The callback function
  58. =====================
  59. The prototype of the callback function is as follows (as of v4.14):
  60. .. code-block:: c
  61. void callback_func(unsigned long ip, unsigned long parent_ip,
  62. struct ftrace_ops *op, struct pt_regs *regs);
  63. @ip
  64. This is the instruction pointer of the function that is being traced.
  65. (where the fentry or mcount is within the function)
  66. @parent_ip
  67. This is the instruction pointer of the function that called the
  68. the function being traced (where the call of the function occurred).
  69. @op
  70. This is a pointer to ftrace_ops that was used to register the callback.
  71. This can be used to pass data to the callback via the private pointer.
  72. @regs
  73. If the FTRACE_OPS_FL_SAVE_REGS or FTRACE_OPS_FL_SAVE_REGS_IF_SUPPORTED
  74. flags are set in the ftrace_ops structure, then this will be pointing
  75. to the pt_regs structure like it would be if an breakpoint was placed
  76. at the start of the function where ftrace was tracing. Otherwise it
  77. either contains garbage, or NULL.
  78. The ftrace FLAGS
  79. ================
  80. The ftrace_ops flags are all defined and documented in include/linux/ftrace.h.
  81. Some of the flags are used for internal infrastructure of ftrace, but the
  82. ones that users should be aware of are the following:
  83. FTRACE_OPS_FL_SAVE_REGS
  84. If the callback requires reading or modifying the pt_regs
  85. passed to the callback, then it must set this flag. Registering
  86. a ftrace_ops with this flag set on an architecture that does not
  87. support passing of pt_regs to the callback will fail.
  88. FTRACE_OPS_FL_SAVE_REGS_IF_SUPPORTED
  89. Similar to SAVE_REGS but the registering of a
  90. ftrace_ops on an architecture that does not support passing of regs
  91. will not fail with this flag set. But the callback must check if
  92. regs is NULL or not to determine if the architecture supports it.
  93. FTRACE_OPS_FL_RECURSION_SAFE
  94. By default, a wrapper is added around the callback to
  95. make sure that recursion of the function does not occur. That is,
  96. if a function that is called as a result of the callback's execution
  97. is also traced, ftrace will prevent the callback from being called
  98. again. But this wrapper adds some overhead, and if the callback is
  99. safe from recursion, it can set this flag to disable the ftrace
  100. protection.
  101. Note, if this flag is set, and recursion does occur, it could cause
  102. the system to crash, and possibly reboot via a triple fault.
  103. It is OK if another callback traces a function that is called by a
  104. callback that is marked recursion safe. Recursion safe callbacks
  105. must never trace any function that are called by the callback
  106. itself or any nested functions that those functions call.
  107. If this flag is set, it is possible that the callback will also
  108. be called with preemption enabled (when CONFIG_PREEMPTION is set),
  109. but this is not guaranteed.
  110. FTRACE_OPS_FL_IPMODIFY
  111. Requires FTRACE_OPS_FL_SAVE_REGS set. If the callback is to "hijack"
  112. the traced function (have another function called instead of the
  113. traced function), it requires setting this flag. This is what live
  114. kernel patches uses. Without this flag the pt_regs->ip can not be
  115. modified.
  116. Note, only one ftrace_ops with FTRACE_OPS_FL_IPMODIFY set may be
  117. registered to any given function at a time.
  118. FTRACE_OPS_FL_RCU
  119. If this is set, then the callback will only be called by functions
  120. where RCU is "watching". This is required if the callback function
  121. performs any rcu_read_lock() operation.
  122. RCU stops watching when the system goes idle, the time when a CPU
  123. is taken down and comes back online, and when entering from kernel
  124. to user space and back to kernel space. During these transitions,
  125. a callback may be executed and RCU synchronization will not protect
  126. it.
  127. FTRACE_OPS_FL_PERMANENT
  128. If this is set on any ftrace ops, then the tracing cannot disabled by
  129. writing 0 to the proc sysctl ftrace_enabled. Equally, a callback with
  130. the flag set cannot be registered if ftrace_enabled is 0.
  131. Livepatch uses it not to lose the function redirection, so the system
  132. stays protected.
  133. Filtering which functions to trace
  134. ==================================
  135. If a callback is only to be called from specific functions, a filter must be
  136. set up. The filters are added by name, or ip if it is known.
  137. .. code-block:: c
  138. int ftrace_set_filter(struct ftrace_ops *ops, unsigned char *buf,
  139. int len, int reset);
  140. @ops
  141. The ops to set the filter with
  142. @buf
  143. The string that holds the function filter text.
  144. @len
  145. The length of the string.
  146. @reset
  147. Non-zero to reset all filters before applying this filter.
  148. Filters denote which functions should be enabled when tracing is enabled.
  149. If @buf is NULL and reset is set, all functions will be enabled for tracing.
  150. The @buf can also be a glob expression to enable all functions that
  151. match a specific pattern.
  152. See Filter Commands in :file:`Documentation/trace/ftrace.rst`.
  153. To just trace the schedule function:
  154. .. code-block:: c
  155. ret = ftrace_set_filter(&ops, "schedule", strlen("schedule"), 0);
  156. To add more functions, call the ftrace_set_filter() more than once with the
  157. @reset parameter set to zero. To remove the current filter set and replace it
  158. with new functions defined by @buf, have @reset be non-zero.
  159. To remove all the filtered functions and trace all functions:
  160. .. code-block:: c
  161. ret = ftrace_set_filter(&ops, NULL, 0, 1);
  162. Sometimes more than one function has the same name. To trace just a specific
  163. function in this case, ftrace_set_filter_ip() can be used.
  164. .. code-block:: c
  165. ret = ftrace_set_filter_ip(&ops, ip, 0, 0);
  166. Although the ip must be the address where the call to fentry or mcount is
  167. located in the function. This function is used by perf and kprobes that
  168. gets the ip address from the user (usually using debug info from the kernel).
  169. If a glob is used to set the filter, functions can be added to a "notrace"
  170. list that will prevent those functions from calling the callback.
  171. The "notrace" list takes precedence over the "filter" list. If the
  172. two lists are non-empty and contain the same functions, the callback will not
  173. be called by any function.
  174. An empty "notrace" list means to allow all functions defined by the filter
  175. to be traced.
  176. .. code-block:: c
  177. int ftrace_set_notrace(struct ftrace_ops *ops, unsigned char *buf,
  178. int len, int reset);
  179. This takes the same parameters as ftrace_set_filter() but will add the
  180. functions it finds to not be traced. This is a separate list from the
  181. filter list, and this function does not modify the filter list.
  182. A non-zero @reset will clear the "notrace" list before adding functions
  183. that match @buf to it.
  184. Clearing the "notrace" list is the same as clearing the filter list
  185. .. code-block:: c
  186. ret = ftrace_set_notrace(&ops, NULL, 0, 1);
  187. The filter and notrace lists may be changed at any time. If only a set of
  188. functions should call the callback, it is best to set the filters before
  189. registering the callback. But the changes may also happen after the callback
  190. has been registered.
  191. If a filter is in place, and the @reset is non-zero, and @buf contains a
  192. matching glob to functions, the switch will happen during the time of
  193. the ftrace_set_filter() call. At no time will all functions call the callback.
  194. .. code-block:: c
  195. ftrace_set_filter(&ops, "schedule", strlen("schedule"), 1);
  196. register_ftrace_function(&ops);
  197. msleep(10);
  198. ftrace_set_filter(&ops, "try_to_wake_up", strlen("try_to_wake_up"), 1);
  199. is not the same as:
  200. .. code-block:: c
  201. ftrace_set_filter(&ops, "schedule", strlen("schedule"), 1);
  202. register_ftrace_function(&ops);
  203. msleep(10);
  204. ftrace_set_filter(&ops, NULL, 0, 1);
  205. ftrace_set_filter(&ops, "try_to_wake_up", strlen("try_to_wake_up"), 0);
  206. As the latter will have a short time where all functions will call
  207. the callback, between the time of the reset, and the time of the
  208. new setting of the filter.