Re: [PATCH v2 RESEND] function_graph: Support recording and printing the function return address

[Google]

On Wed,  9 Oct 2024 11:03:40 +0800
Donglin Peng <dolinux.peng@xxxxxxxxx> wrote:

> From: Donglin Peng <pengdonglin@xxxxxxxxxx>
> 
> When using function_graph tracer to analyze the flow of kernel function
> execution, it is often necessary to quickly locate the exact line of code
> where the call occurs. While this may be easy at times, it can be more
> time-consuming when some functions are inlined or the flow is too long.
> 
> This feature aims to simplify the process by recording the return address
> of traced funcions and printing it when outputing trace logs.
> 
> To enhance human readability, the prefix 'ret=' is used for the kernel return
> value, while '<-' serves as the prefix for the return address in trace logs to
> make it look more like the function tracer.
> 
> A new trace option named 'funcgraph-retaddr' has been introduced, and the
> existing option 'sym-addr' can be used to control the format of the return
> address.
> 
> See below logs with both funcgraph-retval and funcgraph-retaddr enabled.
> 
> 0)             | load_elf_binary() { /* <-bprm_execve+0x249/0x600 */
> 0)             |   load_elf_phdrs() { /* <-load_elf_binary+0x84/0x1730 */
> 0)             |     __kmalloc_noprof() { /* <-load_elf_phdrs+0x4a/0xb0 */
> 0)   3.657 us  |       __cond_resched(); /* <-__kmalloc_noprof+0x28c/0x390 ret=0x0 */
> 0) + 24.335 us |     } /* __kmalloc_noprof ret=0xffff8882007f3000 */
> 0)             |     kernel_read() { /* <-load_elf_phdrs+0x6c/0xb0 */
> 0)             |       rw_verify_area() { /* <-kernel_read+0x2b/0x50 */
> 0)             |         security_file_permission() { /* <-kernel_read+0x2b/0x50 */
> 0)             |           selinux_file_permission() { /* <-security_file_permission+0x26/0x40 */
> 0)             |             __inode_security_revalidate() { /* <-selinux_file_permission+0x6d/0x140 */
> 0)   2.034 us  |               __cond_resched(); /* <-__inode_security_revalidate+0x5f/0x80 ret=0x0 */
> 0)   6.602 us  |             } /* __inode_security_revalidate ret=0x0 */
> 0)   2.214 us  |             avc_policy_seqno(); /* <-selinux_file_permission+0x107/0x140 ret=0x0 */
> 0) + 16.670 us |           } /* selinux_file_permission ret=0x0 */
> 0) + 20.809 us |         } /* security_file_permission ret=0x0 */
> 0) + 25.217 us |       } /* rw_verify_area ret=0x0 */
> 0)             |       __kernel_read() { /* <-load_elf_phdrs+0x6c/0xb0 */
> 0)             |         ext4_file_read_iter() { /* <-__kernel_read+0x160/0x2e0 */
> 
> Then, we can use the faddr2line to locate the source code, for example:
> 
> $ ./scripts/faddr2line ./vmlinux load_elf_phdrs+0x6c/0xb0
> load_elf_phdrs+0x6c/0xb0:
> elf_read at fs/binfmt_elf.c:471
> (inlined by) load_elf_phdrs at fs/binfmt_elf.c:531

Hi, I found this introduced "extras" to the fgraph callback interface
but it is only used in function_graph tracer. Can we move this in the
function_graph tracer, like below?

Thank you,