^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) ==================================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) Using the Linux Kernel Tracepoints
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) ==================================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) :Author: Mathieu Desnoyers
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) This document introduces Linux Kernel Tracepoints and their use. It
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) provides examples of how to insert tracepoints in the kernel and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) connect probe functions to them and provides some examples of probe
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) functions.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) Purpose of tracepoints
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) ----------------------
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) A tracepoint placed in code provides a hook to call a function (probe)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) that you can provide at runtime. A tracepoint can be "on" (a probe is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) connected to it) or "off" (no probe is attached). When a tracepoint is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) "off" it has no effect, except for adding a tiny time penalty
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) (checking a condition for a branch) and space penalty (adding a few
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) bytes for the function call at the end of the instrumented function
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) and adds a data structure in a separate section). When a tracepoint
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) is "on", the function you provide is called each time the tracepoint
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) is executed, in the execution context of the caller. When the function
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) provided ends its execution, it returns to the caller (continuing from
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) the tracepoint site).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) You can put tracepoints at important locations in the code. They are
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) lightweight hooks that can pass an arbitrary number of parameters,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) which prototypes are described in a tracepoint declaration placed in a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) header file.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) They can be used for tracing and performance accounting.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) Usage
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) -----
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) Two elements are required for tracepoints :
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) - A tracepoint definition, placed in a header file.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) - The tracepoint statement, in C code.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) In order to use tracepoints, you should include linux/tracepoint.h.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) In include/trace/events/subsys.h::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) #undef TRACE_SYSTEM
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) #define TRACE_SYSTEM subsys
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) #if !defined(_TRACE_SUBSYS_H) || defined(TRACE_HEADER_MULTI_READ)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) #define _TRACE_SUBSYS_H
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) #include <linux/tracepoint.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) DECLARE_TRACE(subsys_eventname,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) TP_PROTO(int firstarg, struct task_struct *p),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) TP_ARGS(firstarg, p));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) #endif /* _TRACE_SUBSYS_H */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) /* This part must be outside protection */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) #include <trace/define_trace.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) In subsys/file.c (where the tracing statement must be added)::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) #include <trace/events/subsys.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) #define CREATE_TRACE_POINTS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) DEFINE_TRACE(subsys_eventname);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) void somefct(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) ...
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) trace_subsys_eventname(arg, task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) ...
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) Where :
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) - subsys_eventname is an identifier unique to your event
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) - subsys is the name of your subsystem.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) - eventname is the name of the event to trace.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) - `TP_PROTO(int firstarg, struct task_struct *p)` is the prototype of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) function called by this tracepoint.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) - `TP_ARGS(firstarg, p)` are the parameters names, same as found in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) prototype.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) - if you use the header in multiple source files, `#define CREATE_TRACE_POINTS`
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) should appear only in one source file.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) Connecting a function (probe) to a tracepoint is done by providing a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) probe (function to call) for the specific tracepoint through
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) register_trace_subsys_eventname(). Removing a probe is done through
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) unregister_trace_subsys_eventname(); it will remove the probe.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) tracepoint_synchronize_unregister() must be called before the end of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) the module exit function to make sure there is no caller left using
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) the probe. This, and the fact that preemption is disabled around the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) probe call, make sure that probe removal and module unload are safe.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) The tracepoint mechanism supports inserting multiple instances of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) same tracepoint, but a single definition must be made of a given
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) tracepoint name over all the kernel to make sure no type conflict will
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) occur. Name mangling of the tracepoints is done using the prototypes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) to make sure typing is correct. Verification of probe type correctness
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) is done at the registration site by the compiler. Tracepoints can be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) put in inline functions, inlined static functions, and unrolled loops
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) as well as regular functions.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) The naming scheme "subsys_event" is suggested here as a convention
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) intended to limit collisions. Tracepoint names are global to the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) kernel: they are considered as being the same whether they are in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) core kernel image or in modules.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) If the tracepoint has to be used in kernel modules, an
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) EXPORT_TRACEPOINT_SYMBOL_GPL() or EXPORT_TRACEPOINT_SYMBOL() can be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) used to export the defined tracepoints.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) If you need to do a bit of work for a tracepoint parameter, and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) that work is only used for the tracepoint, that work can be encapsulated
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) within an if statement with the following::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) if (trace_foo_bar_enabled()) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) int tot = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) for (i = 0; i < count; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) tot += calculate_nuggets();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) trace_foo_bar(tot);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) All trace_<tracepoint>() calls have a matching trace_<tracepoint>_enabled()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) function defined that returns true if the tracepoint is enabled and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) false otherwise. The trace_<tracepoint>() should always be within the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) block of the if (trace_<tracepoint>_enabled()) to prevent races between
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) the tracepoint being enabled and the check being seen.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) The advantage of using the trace_<tracepoint>_enabled() is that it uses
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) the static_key of the tracepoint to allow the if statement to be implemented
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) with jump labels and avoid conditional branches.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) .. note:: The convenience macro TRACE_EVENT provides an alternative way to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) define tracepoints. Check http://lwn.net/Articles/379903,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) http://lwn.net/Articles/381064 and http://lwn.net/Articles/383362
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) for a series of articles with more details.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) If you require calling a tracepoint from a header file, it is not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) recommended to call one directly or to use the trace_<tracepoint>_enabled()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) function call, as tracepoints in header files can have side effects if a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) header is included from a file that has CREATE_TRACE_POINTS set, as
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) well as the trace_<tracepoint>() is not that small of an inline
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) and can bloat the kernel if used by other inlined functions. Instead,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) include tracepoint-defs.h and use tracepoint_enabled().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) In a C file::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) void do_trace_foo_bar_wrapper(args)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) trace_foo_bar(args);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) In the header file::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) DECLARE_TRACEPOINT(foo_bar);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) static inline void some_inline_function()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) [..]
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) if (tracepoint_enabled(foo_bar))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) do_trace_foo_bar_wrapper(args);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) [..]
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) }