1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
|
commit e9c4f51ad2b76ddbf90863c44085574197247ba3
Author: Auke Kok <auke-jan.h.kok@intel.com>
Date: Tue Jan 27 11:26:00 2009 -0800
trace: tracer for sys_open() - sreadahead
This tracer monitors regular file open() syscalls. This is a fast
and low-overhead alternative to strace, and does not allow or
require to be attached to every process.
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
diff --git a/fs/open.c b/fs/open.c
index a3a78ce..bd9eb9d 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -30,6 +30,10 @@
#include <linux/audit.h>
#include <linux/falloc.h>
+#include <trace/fs.h>
+
+DEFINE_TRACE(do_sys_open);
+
int vfs_statfs(struct dentry *dentry, struct kstatfs *buf)
{
int retval = -ENODEV;
@@ -1039,6 +1043,7 @@ long do_sys_open(int dfd, const char __user *filename, int flags, int mode)
} else {
fsnotify_open(f->f_path.dentry);
fd_install(fd, f);
+ trace_do_sys_open(f, flags, mode, fd);
}
}
putname(tmp);
diff --git a/include/trace/fs.h b/include/trace/fs.h
new file mode 100644
index 0000000..870eec2
--- /dev/null
+++ b/include/trace/fs.h
@@ -0,0 +1,11 @@
+#ifndef _TRACE_FS_H
+#define _TRACE_FS_H
+
+#include <linux/fs.h>
+#include <linux/tracepoint.h>
+
+DECLARE_TRACE(do_sys_open,
+ TPPROTO(struct file *filp, int flags, int mode, long fd),
+ TPARGS(filp, flags, mode, fd));
+
+#endif
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index e2a4ff6..d2a1ec1 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -149,6 +149,15 @@ config CONTEXT_SWITCH_TRACER
This tracer gets called from the context switch and records
all switching of tasks.
+config OPEN_TRACER
+ bool "Trace open() calls"
+ depends on DEBUG_KERNEL
+ select TRACING
+ select MARKERS
+ help
+ This tracer records open() syscalls. These calls are made when
+ files are accessed on disk.
+
config BOOT_TRACER
bool "Trace boot initcalls"
depends on DEBUG_KERNEL
diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
index 349d5a9..7f2a366 100644
--- a/kernel/trace/Makefile
+++ b/kernel/trace/Makefile
@@ -20,6 +20,7 @@ obj-$(CONFIG_RING_BUFFER) += ring_buffer.o
obj-$(CONFIG_TRACING) += trace.o
obj-$(CONFIG_CONTEXT_SWITCH_TRACER) += trace_sched_switch.o
+obj-$(CONFIG_OPEN_TRACER) += trace_open.o
obj-$(CONFIG_SYSPROF_TRACER) += trace_sysprof.o
obj-$(CONFIG_FUNCTION_TRACER) += trace_functions.o
obj-$(CONFIG_IRQSOFF_TRACER) += trace_irqsoff.o
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 4d3d381..24c17d2 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -30,6 +30,7 @@ enum trace_type {
TRACE_USER_STACK,
TRACE_HW_BRANCHES,
TRACE_POWER,
+ TRACE_OPEN,
__TRACE_LAST_TYPE
};
diff --git a/kernel/trace/trace_open.c b/kernel/trace/trace_open.c
new file mode 100644
index 0000000..7153dfc
--- /dev/null
+++ b/kernel/trace/trace_open.c
@@ -0,0 +1,149 @@
+/*
+ * trace open calls
+ * Copyright (C) 2009 Intel Corporation
+ *
+ * Based extensively on trace_sched_switch.c
+ * Copyright (C) 2007 Steven Rostedt <srostedt@redhat.com>
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/debugfs.h>
+#include <linux/kallsyms.h>
+#include <linux/uaccess.h>
+#include <linux/ftrace.h>
+#include <trace/fs.h>
+
+#include "trace.h"
+
+
+static struct trace_array *ctx_trace;
+static int __read_mostly open_trace_enabled;
+static atomic_t open_ref;
+
+static void probe_do_sys_open(struct file *filp, int flags, int mode, long fd)
+{
+ char *buf;
+ char *fname;
+
+ if (!atomic_read(&open_ref))
+ return;
+
+ if (!open_trace_enabled)
+ return;
+
+ buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
+ if (!buf)
+ return;
+
+ fname = d_path(&filp->f_path, buf, PAGE_SIZE);
+ if (IS_ERR(fname))
+ goto out;
+
+ ftrace_printk("%s: open(\"%s\", %d, %d) = %ld\n",
+ current->comm, fname, flags, mode, fd);
+
+out:
+ kfree(buf);
+}
+
+static void open_trace_reset(struct trace_array *tr)
+{
+ tr->time_start = ftrace_now(tr->cpu);
+ tracing_reset_online_cpus(tr);
+}
+
+static int open_trace_register(void)
+{
+ int ret;
+
+ ret = register_trace_do_sys_open(probe_do_sys_open);
+ if (ret) {
+ pr_info("open trace: Could not activate tracepoint"
+ " probe to do_open\n");
+ }
+
+ return ret;
+}
+
+static void open_trace_unregister(void)
+{
+ unregister_trace_do_sys_open(probe_do_sys_open);
+}
+
+static void open_trace_start(void)
+{
+ long ref;
+
+ ref = atomic_inc_return(&open_ref);
+ if (ref == 1)
+ open_trace_register();
+}
+
+static void open_trace_stop(void)
+{
+ long ref;
+
+ ref = atomic_dec_and_test(&open_ref);
+ if (ref)
+ open_trace_unregister();
+}
+
+void open_trace_start_cmdline_record(void)
+{
+ open_trace_start();
+}
+
+void open_trace_stop_cmdline_record(void)
+{
+ open_trace_stop();
+}
+
+static void open_start_trace(struct trace_array *tr)
+{
+ open_trace_reset(tr);
+ open_trace_start_cmdline_record();
+ open_trace_enabled = 1;
+}
+
+static void open_stop_trace(struct trace_array *tr)
+{
+ open_trace_enabled = 0;
+ open_trace_stop_cmdline_record();
+}
+
+static int open_trace_init(struct trace_array *tr)
+{
+ ctx_trace = tr;
+
+ open_start_trace(tr);
+ return 0;
+}
+
+static void reset_open_trace(struct trace_array *tr)
+{
+ open_stop_trace(tr);
+}
+
+static struct tracer open_trace __read_mostly =
+{
+ .name = "open",
+ .init = open_trace_init,
+ .reset = reset_open_trace,
+};
+
+__init static int init_open_trace(void)
+{
+ int ret = 0;
+
+ if (atomic_read(&open_ref))
+ ret = open_trace_register();
+ if (ret) {
+ pr_info("error registering open trace\n");
+ return ret;
+ }
+ return register_tracer(&open_trace);
+}
+device_initcall(init_open_trace);
+
|
