From 36430614d342020dc4c76f4ac5531ae84f211aab Mon Sep 17 00:00:00 2001 From: William Cohen Date: Thu, 18 Jun 2020 17:14:30 -0400 Subject: [PATCH] Use kernel.trace("sched:sched_process_fork") for kprocess.create when possible With optimization the copy_process function is often inlined making it impossible for kprocess.create to probe the return of the copy_process function. The equivalent tracepoint sched:sched_process_fork should be used instead to avoid that issue. This change allows the forktracker.stp and spawn_seekeer.stp examples to run even on kernels where copy_process has been inlined. --- tapset/linux/kprocess.stp | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/tapset/linux/kprocess.stp b/tapset/linux/kprocess.stp index 5f4a4ed5b..e07ff71ae 100644 --- a/tapset/linux/kprocess.stp +++ b/tapset/linux/kprocess.stp @@ -26,13 +26,21 @@ * Fires whenever a new process is successfully created, either as a result of * fork (or one of its syscall variants), or a new kernel thread. */ -probe kprocess.create = kernel.function("copy_process").return { +probe tp_kprocess.create = kernel.trace("sched:sched_process_fork") { + task = $child + if (_IS_ERR(task)) next + new_pid = task_pid(task) + new_tid = task_tid(task) +} + +probe dw_kprocess.create = kernel.function("copy_process").return { task = $return if (_IS_ERR(task)) next new_pid = task_pid(task) new_tid = task_tid(task) } +probe kprocess.create = tp_kprocess.create!, dw_kprocess.create {} /** * probe kprocess.start - Starting new process -- 2.43.5