From nobody Sun Feb 8 23:25:24 2026 Received: from mail-ej1-f74.google.com (mail-ej1-f74.google.com [209.85.218.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5A605145FF0 for ; Thu, 11 Apr 2024 10:22:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712830926; cv=none; b=kzj0TKROSIbaoGraXNuYXmdzC8iAfdmXuMXf+I7CNLL3CfpfH6KE5402e22PvIcZwVpzqyR6nP3oNCSNohfB7qFtVYS8P2Nd+NaA8QzOarxNH4/HJ6vbKQ/H6UDzGvrpKOqYlUGsjUtassO6ZSlz+WamaR1WIinsIKvQcTEpA14= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712830926; c=relaxed/simple; bh=kwjGtNvLpK325ZnrzYNhpHBo59AhLmuaGY0i7QoIDKs=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=HFj8ezUafP3jPxzlyw3ITRA2xdvhQvrPL+aPLWRlhDJULJevqpa0kzdDESfq+8HovRjHJ8/FLl5ldO/yIgbLnAI5Gamc19TNygCUyBxaYLbNb8TF5Jz3ukAFWBHRuNWzr9v5TGE9xqbeQ1hqIGp2Umm6Usa5EnqJ36iuMChGPro= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--elver.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=UJtvKh72; arc=none smtp.client-ip=209.85.218.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--elver.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="UJtvKh72" Received: by mail-ej1-f74.google.com with SMTP id a640c23a62f3a-a51c03c9b8bso210959866b.1 for ; Thu, 11 Apr 2024 03:22:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1712830923; x=1713435723; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=+rR9HIwFgg/0oSpb0w3lX+KECeC+/l7rF3yPb/nkNJ0=; b=UJtvKh72FY0JKCgLC7XKqPpkHTMXqKfhlej8TUr/dhEtFPjcok9sFMi9wKlnSjq22R ln/b+k57z8Bu3tY0f+fPiD1lL0dZy7xC9X4ZGR1/wzB0NJ85KsOFkF7cSMnzscYKYk4F G5ODG9kH3ZWjiMQUaQ0ZE1UO5Lqds5ayLc/ZRw+pIJGJREiO5/4pfVkZM0Ycg2M2oD+w IvAhTVZj5B5TxBUEZz56oarrEvmF0+VQo4uIi331EFsJA2E0D/2VWVjv85Cy2SMQi7R7 qLY1xMDZpb0sN3VS+jICF/jcw8tDXMRdFjKRnoHf9ETOyMAEP/m6XCKaVFJ6aYg9v0xk i2yQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712830923; x=1713435723; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=+rR9HIwFgg/0oSpb0w3lX+KECeC+/l7rF3yPb/nkNJ0=; b=iJvkN9HXmMEc2VFbulWAtScaLhO6CCtDkxKBUZs39iOhz3TtudNMO+DMMPrrgsFr2v Xc6l1M/Vwp1znp9VlIcQ/BYkQC/2IUO29InN+pgBATKM8KFJLlahNCwRvtpTiCRiu3Xo hGhonn6dHLHAZjs4n9VtqKvpeyF40gd1whPUhRmS/IXBa1Wn74+VxHYX1thv2QcFRs8I x6HMAqm0jWwBpgpY8RwOlb5Ze2HHSKgudmUvvG+HgV1XvsczHuSvmoIsMKp7nDIeqw4A U5Wxy6vTPnXGi0Ry2sHkRfwgimN+hMGihXv39nfmz6NbpdxwSWRhCapZ/sn4fKAQYqiC ifDQ== X-Forwarded-Encrypted: i=1; AJvYcCV0P5qgHEY18wPKNK9kmN2oP4ww27bseb0dsfsVeiWnfL9UiCy2bpeMuoH/yUByFUTBbbexv+6LN6xDwT3qplKf5SK8MT/qAqKDZgr/ X-Gm-Message-State: AOJu0YxGt6VLAgkWGLv8lG5atMKRtn3mKo2Fug4OpPEe+GScckgxeHkN mFMUCsqegpW1eWiqi1JByEp88nWF0kttHI4rHzM/4Li3KZl3k3RfGj/1Y6YmQ2F+8geV12uX0g= = X-Google-Smtp-Source: AGHT+IFXG6iOFjgVBIzBx0eWBP5cDueeQuL6me8jmVrtbOPiz1Cb0gwJMrq43P1HgLFWtX3oaOdfw2/1NQ== X-Received: from elver.muc.corp.google.com ([2a00:79e0:9c:201:5b29:b86f:ece8:1df5]) (user=elver job=sendgmr) by 2002:a17:906:857:b0:a51:abd7:85a5 with SMTP id f23-20020a170906085700b00a51abd785a5mr4613ejd.15.1712830922433; Thu, 11 Apr 2024 03:22:02 -0700 (PDT) Date: Thu, 11 Apr 2024 12:20:57 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.44.0.478.gd926399ef9-goog Message-ID: <20240411102158.1272267-1-elver@google.com> Subject: [PATCH v2] tracing: Add sched_prepare_exec tracepoint From: Marco Elver To: elver@google.com, Steven Rostedt Cc: Alexander Viro , Christian Brauner , Jan Kara , Eric Biederman , Kees Cook , Masami Hiramatsu , Mathieu Desnoyers , Azeem Shaikh , linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, Dmitry Vyukov Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add "sched_prepare_exec" tracepoint, which is run right after the point of no return but before the current task assumes its new exec identity. Unlike the tracepoint "sched_process_exec", the "sched_prepare_exec" tracepoint runs before flushing the old exec, i.e. while the task still has the original state (such as original MM), but when the new exec either succeeds or crashes (but never returns to the original exec). Being able to trace this event can be helpful in a number of use cases: * allowing tracing eBPF programs access to the original MM on exec, before current->mm is replaced; * counting exec in the original task (via perf event); * profiling flush time ("sched_prepare_exec" to "sched_process_exec"). Example of tracing output: $ cat /sys/kernel/debug/tracing/trace_pipe <...>-379 [003] ..... 179.626921: sched_prepare_exec: interp=3D/usr/b= in/sshd filename=3D/usr/bin/sshd pid=3D379 comm=3Dsshd <...>-381 [002] ..... 180.048580: sched_prepare_exec: interp=3D/bin/b= ash filename=3D/bin/bash pid=3D381 comm=3Dsshd <...>-385 [001] ..... 180.068277: sched_prepare_exec: interp=3D/usr/b= in/tty filename=3D/usr/bin/tty pid=3D385 comm=3Dbash <...>-389 [006] ..... 192.020147: sched_prepare_exec: interp=3D/usr/b= in/dmesg filename=3D/usr/bin/dmesg pid=3D389 comm=3Dbash Signed-off-by: Marco Elver Acked-by: Kees Cook Acked-by: Steven Rostedt (Google) Reviewed-by: Masami Hiramatsu (Google) --- v2: * Add more documentation. * Also show bprm->interp in trace. * Rename to sched_prepare_exec. --- fs/exec.c | 8 ++++++++ include/trace/events/sched.h | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+) diff --git a/fs/exec.c b/fs/exec.c index 38bf71cbdf5e..57fee729dd92 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1268,6 +1268,14 @@ int begin_new_exec(struct linux_binprm * bprm) if (retval) return retval; =20 + /* + * This tracepoint marks the point before flushing the old exec where + * the current task is still unchanged, but errors are fatal (point of + * no return). The later "sched_process_exec" tracepoint is called after + * the current task has successfully switched to the new exec. + */ + trace_sched_prepare_exec(current, bprm); + /* * Ensure all future errors are fatal. */ diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h index dbb01b4b7451..226f47c6939c 100644 --- a/include/trace/events/sched.h +++ b/include/trace/events/sched.h @@ -420,6 +420,41 @@ TRACE_EVENT(sched_process_exec, __entry->pid, __entry->old_pid) ); =20 +/** + * sched_prepare_exec - called before setting up new exec + * @task: pointer to the current task + * @bprm: pointer to linux_binprm used for new exec + * + * Called before flushing the old exec, where @task is still unchanged, bu= t at + * the point of no return during switching to the new exec. At the point i= t is + * called the exec will either succeed, or on failure terminate the task. = Also + * see the "sched_process_exec" tracepoint, which is called right after @t= ask + * has successfully switched to the new exec. + */ +TRACE_EVENT(sched_prepare_exec, + + TP_PROTO(struct task_struct *task, struct linux_binprm *bprm), + + TP_ARGS(task, bprm), + + TP_STRUCT__entry( + __string( interp, bprm->interp ) + __string( filename, bprm->filename ) + __field( pid_t, pid ) + __string( comm, task->comm ) + ), + + TP_fast_assign( + __assign_str(interp, bprm->interp); + __assign_str(filename, bprm->filename); + __entry->pid =3D task->pid; + __assign_str(comm, task->comm); + ), + + TP_printk("interp=3D%s filename=3D%s pid=3D%d comm=3D%s", + __get_str(interp), __get_str(filename), + __entry->pid, __get_str(comm)) +); =20 #ifdef CONFIG_SCHEDSTATS #define DEFINE_EVENT_SCHEDSTAT DEFINE_EVENT --=20 2.44.0.478.gd926399ef9-goog