一、ftrace的宏
1. struct tracepoint 结构
使用 struct tracepoint 变量来描述一个 trace point。
//include/linux/tracepoint-defs.h struct tracepoint { const char *name; //trace point的名字，内核中通过hash表管理所有的trace point，找到对应的hash slot后，需要通过name来识别具体的trace point。 struct static_key key; //trace point状态，0表示disable，1表示enable，static_key_false(&key)判断的其实就只是key的真假。 struct static_call_key *static_call_key; void *static_call_tramp; void *iterator; int (*regfunc)(void); //添加桩函数的函数 void (*unregfunc)(void); //卸载桩函数的函数 struct tracepoint_func __rcu *funcs; //trace point中所有的桩函数链表. 是个数组 }; struct tracepoint_func { void *func; void *data; int prio; };
static key使用见：https://www.cnblogs.com/hellokitty2/p/15026568.html
2. DEFINE_TRACE_FN 展开后是
/* * include/linux/tracepoint.h * 就是定义一个名为 __tracepoint_##_name 的 struct tracepoint 结构， * 然后定义一个名为 __traceiter_##_name 的函数，它对 struct tracepoint::funcs[] 成员数组中的每个函数都进行调用，数组尾部要以NULL结尾。 */ #define DEFINE_TRACE_FN(_name, _reg, _unreg, proto, args) \ static const char __tpstrtab_##_name[] \ __section("__tracepoints_strings") = #_name; \ extern struct static_call_key __SCK__tp_func_##_name; \ int __traceiter_##_name(void *__data, proto); \ struct tracepoint __tracepoint_##_name __used __section("__tracepoints") = { \ .name = __tpstrtab_##_name, \ .key = STATIC_KEY_INIT_FALSE, \ .static_call_key = &__SCK__tp_func_##_name, \ .static_call_tramp = NULL, \ .iterator = &__traceiter_##_name, \ .regfunc = _reg, \ .unregfunc = _unreg, \ .funcs = NULL \ }; \ __TRACEPOINT_ENTRY(_name); \ int __nocfi __traceiter_##_name(void *__data, proto) \ { \ struct tracepoint_func *it_func_ptr; \ void *it_func; \ it_func_ptr = rcu_dereference_raw((&__tracepoint_##_name)->funcs); \ if (it_func_ptr) { \ do { \ it_func = (it_func_ptr)->func; \ __data = (it_func_ptr)->data; \ ((void(*)(void *, proto))(it_func))(__data, args); \ } while ((++it_func_ptr)->func); \ } \ return 0; \ } \ extern struct static_call_key __SCK__tp_func_##_name; \ extern typeof(__traceiter_##_name) __SCT__tp_func_##_name; \ struct static_call_key __SCK__tp_func_##_name = { \ .func = __traceiter_##_name, \ }
3. __DECLARE_TRACE 宏展开后就是：
/* * include/linux/tracepoint.h * 这个宏主要定义了一系列函数集合，常用的有 register_trace_##name、 * trace_##name##_enabled * rcuidle 的还特殊弄了一个函数，还可以注册带有优先级的trace */ #define __DECLARE_TRACE(name, proto, args, cond, data_proto, data_args) \ extern int __traceiter_##name(data_proto); \ extern struct static_call_key __SCK__tp_func_##name; \ extern typeof(__traceiter_##name) __SCT__tp_func_##name; \ extern struct tracepoint __tracepoint_##name; \ static inline void __nocfi trace_##name(proto) \ { \ if (static_key_false(&__tracepoint_##name.key)) \ do { \ struct tracepoint_func *it_func_ptr; \ int __maybe_unused __idx = 0; \ void *__data; \ \ if (!(cond)) \ return; \ /* keep srcu and sched-rcu usage consistent */ \ preempt_disable_notrace(); \ it_func_ptr = rcu_dereference_raw((&__tracepoint_##name)->funcs); \ if (it_func_ptr) { \ __data = (it_func_ptr)->data; \ __traceiter_##name(data_args); \ } \ preempt_enable_notrace(); \ } while (0) \ if (IS_ENABLED(CONFIG_LOCKDEP) && (cond)) { \ rcu_read_lock_sched_notrace(); \ rcu_dereference_sched(__tracepoint_##name.funcs);\ rcu_read_unlock_sched_notrace(); \ } \ } \ static inline void trace_##name##_rcuidle(proto) \ { \ if (static_key_false(&__tracepoint_##name.key)) \ do { \ struct tracepoint_func *it_func_ptr; \ int __maybe_unused __idx = 0; \ void *__data; \ \ if (!(cond)) \ return; \ \ /* srcu can't be used from NMI */ \ WARN_ON_ONCE(in_nmi()); \ \ /* keep srcu and sched-rcu usage consistent */ \ preempt_disable_notrace(); \ \ /* \ * For rcuidle callers, use srcu since sched-rcu \ * doesn't work from the idle path. \ */ \ __idx = srcu_read_lock_notrace(&tracepoint_srcu);\ rcu_irq_enter_irqson(); \ \ it_func_ptr = rcu_dereference_raw((&__tracepoint_##name)->funcs); \ if (it_func_ptr) { \ __data = (it_func_ptr)->data; \ __traceiter_##name(data_args); \ } \ \ rcu_irq_exit_irqson(); \ srcu_read_unlock_notrace(&tracepoint_srcu, __idx);\ \ preempt_enable_notrace(); \ } while (0) \ } \ static inline int register_trace_##name(void (*probe)(data_proto), void *data) \ { \ return tracepoint_probe_register(&__tracepoint_##name, (void *)probe, data); \ } \ static inline int register_trace_prio_##name(void (*probe)(data_proto), void *data, int prio) \ { \ return tracepoint_probe_register_prio(&__tracepoint_##name, (void *)probe, data, prio); \ } \ static inline int unregister_trace_##name(void (*probe)(data_proto), void *data) \ { \ return tracepoint_probe_unregister(&__tracepoint_##name, (void *)probe, data); \ } \ static inline void check_trace_callback_type_##name(void (*cb)(data_proto)) \ { \ } \ static inline bool trace_##name##_enabled(void) \ { \ return static_key_false(&__tracepoint_##name.key); \ }
trace_##name(proto) 中判断 __tracepoint_##name.key 的值为真才会调用执行各个钩子函数，在下面路径中会将这个key设置为真。
register_trace_##name() //具体tracepoint的define位置 tracepoint_probe_register //tracepoint.c tracepoint_probe_register_prio //tracepoint.c tracepoint_add_func //tracepoint.c static_key_enable(&tp->key);
也就是说注册了 hook 才会真，否则为假。
4. 使用 DECLARE_TRACE 的宏
#define DEFINE_TRACE(name, proto, args) DEFINE_TRACE_FN(name, NULL, NULL, PARAMS(proto), PARAMS(args)); //为空 #define TRACE_EVENT_FLAGS(event, flag) //为空 #define TRACE_EVENT_PERF_PERM(event, expr...) /* * include/linux/tracepoint-defs.h * 不建议直接使用，此头文件是包含在最head位置的 */ #define DECLARE_TRACEPOINT(tp) extern struct tracepoint __tracepoint_##tp /* * 建议使用，它的作用和 trace_##name##_enabled(void) 一致，但是在头文件中 * 使用是安全的，然而 trace_##name##_enabled(void) 在头文件中是不安全的，应 * 该是因为不能重复定义一个函数。 */ #define tracepoint_enabled(tp) static_key_false(&(__tracepoint_##tp).key) /* * include/linux/tracepoint.h * 就是上面的一组函数集合，包含register_trace_##name、trace_##name##_enabled 等 */ #define DECLARE_TRACE(name, proto, args) \ __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), cpu_online(raw_smp_processor_id()), PARAMS(void *__data, proto), PARAMS(__data, args)) /* * 两个宏之间的区别就是后者 arg4 逻辑与上了 cond 参数，主要是 trace_##name、trace_##name##_rcuidle 两个函数中使用，若是判断 cond 为假， * 就直接返回了。 */ #define DECLARE_TRACE_CONDITION(name, proto, args, cond) \ __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), cpu_online(raw_smp_processor_id()) && (PARAMS(cond)), PARAMS(void *__data, proto), PARAMS(__data, args)) /* include/linux/tracepoint.h */ #define DECLARE_EVENT_CLASS(name, proto, args, tstruct, assign, print) #define DEFINE_EVENT(template, name, proto, args) DECLARE_TRACE(name, PARAMS(proto), PARAMS(args)) #define DEFINE_EVENT_FN(template, name, proto, args, reg, unreg) DECLARE_TRACE(name, PARAMS(proto), PARAMS(args)) #define DEFINE_EVENT_PRINT(template, name, proto, args, print) DECLARE_TRACE(name, PARAMS(proto), PARAMS(args)) #define DEFINE_EVENT_CONDITION(template, name, proto, args, cond) DECLARE_TRACE_CONDITION(name, PARAMS(proto), PARAMS(args), PARAMS(cond)) #define TRACE_EVENT(name, proto, args, struct, assign, print) DECLARE_TRACE(name, PARAMS(proto), PARAMS(args)) #define TRACE_EVENT_FN(name, proto, args, struct, assign, print, reg, unreg) DECLARE_TRACE(name, PARAMS(proto), PARAMS(args)) #define TRACE_EVENT_FN_COND(name, proto, args, cond, struct, assign, print, reg, unreg) DECLARE_TRACE_CONDITION(name, PARAMS(proto), PARAMS(args), PARAMS(cond)) #define TRACE_EVENT_CONDITION(name, proto, args, cond, struct, assign, print) DECLARE_TRACE_CONDITION(name, PARAMS(proto), PARAMS(args), PARAMS(cond)) #define TRACE_EVENT_FLAGS(event, flag) #define TRACE_EVENT_PERF_PERM(event, expr...) #define DECLARE_EVENT_NOP(name, proto, args) \ static inline void trace_##name(proto) \ { } \ static inline bool trace_##name##_enabled(void) \ { \ return false; \ } #define TRACE_EVENT_NOP(name, proto, args, struct, assign, print) DECLARE_EVENT_NOP(name, PARAMS(proto), PARAMS(args)) #define DECLARE_EVENT_CLASS_NOP(name, proto, args, tstruct, assign, print) #define DEFINE_EVENT_NOP(template, name, proto, args) DECLARE_EVENT_NOP(name, PARAMS(proto), PARAMS(args))
tracepoint.h 中的定义可能不是最终的，因为有文件中会先执行 #undef XXX，然后重新进行 define。观察可以发现，这些宏主要使用的是 DECLARE_TRACE，对照展开后的函数，显示是不完整的，因为 DEFINE_TRACE 相关的部分没有。因此每个trace应该还存在对 DEFINE_TRACE 进行使用的一部分。两者都存在，一个trace才圆满。
5. 使用 DEFINE_TRACE 的部分
/* include/trace/define_trace.h */ #undef TRACE_EVENT #define TRACE_EVENT(name, proto, args, tstruct, assign, print) DEFINE_TRACE(name, PARAMS(proto), PARAMS(args)) #undef TRACE_EVENT_CONDITION #define TRACE_EVENT_CONDITION(name, proto, args, cond, tstruct, assign, print) \ TRACE_EVENT(name, PARAMS(proto), PARAMS(args), PARAMS(tstruct), PARAMS(assign), PARAMS(print)) #undef TRACE_EVENT_FN #define TRACE_EVENT_FN(name, proto, args, tstruct, assign, print, reg, unreg) \ DEFINE_TRACE_FN(name, reg, unreg, PARAMS(proto), PARAMS(args)) #undef TRACE_EVENT_FN_COND #define TRACE_EVENT_FN_COND(name, proto, args, cond, tstruct, assign, print, reg, unreg) \ DEFINE_TRACE_FN(name, reg, unreg, PARAMS(proto), PARAMS(args)) #undef TRACE_EVENT_NOP #define TRACE_EVENT_NOP(name, proto, args, struct, assign, print) #undef DEFINE_EVENT_NOP #define DEFINE_EVENT_NOP(template, name, proto, args) #undef DEFINE_EVENT #define DEFINE_EVENT(template, name, proto, args) DEFINE_TRACE(name, PARAMS(proto), PARAMS(args)) #undef DEFINE_EVENT_FN #define DEFINE_EVENT_FN(template, name, proto, args, reg, unreg) \ DEFINE_TRACE_FN(name, reg, unreg, PARAMS(proto), PARAMS(args)) #undef DEFINE_EVENT_PRINT #define DEFINE_EVENT_PRINT(template, name, proto, args, print) \ DEFINE_TRACE(name, PARAMS(proto), PARAMS(args)) #undef DEFINE_EVENT_CONDITION #define DEFINE_EVENT_CONDITION(template, name, proto, args, cond) \ DEFINE_EVENT(template, name, PARAMS(proto), PARAMS(args)) #undef DECLARE_TRACE #define DECLARE_TRACE(name, proto, args) DEFINE_TRACE(name, PARAMS(proto), PARAMS(args))
6. EXPORT_TRACEPOINT_SYMBOL_GPL 和 EXPORT_TRACEPOINT_SYMBOL
导出这些trace符号后，模块中才能在模块中使用
/* * include/linux/tracepoint.h * 展开后就是 */ #define EXPORT_TRACEPOINT_SYMBOL_GPL(name) \ EXPORT_SYMBOL_GPL(__tracepoint_##name); \ EXPORT_SYMBOL_GPL(__traceiter_##name); \ EXPORT_SYMBOL_GPL(__SCK__tp_func_##name); #define EXPORT_TRACEPOINT_SYMBOL(name) \ EXPORT_SYMBOL(__tracepoint_##name); \ EXPORT_SYMBOL(__traceiter_##name); \ EXPORT_SYMBOL(__SCK__tp_func_##name)
7. 定义一个trace，TRACE_EVENT 各个成员使用的宏
/* include/linux/tracepoint.h */ #define PARAMS(args...) args #define TP_PROTO(args...) args #define TP_ARGS(args...) args #define TP_CONDITION(args...) args //include/trace/trace_events.h #define TP_STRUCT__entry(args...) args #define TP_fast_assign(args...) args #define TP_printk(fmt, args...) "\"" fmt "\", " __stringify(args)
include/trace/events/sched.h 文件中定义了大量的CPU调度相关的trace，但是它只include了 linux/tracepoint.h 文件，说明其使用的宏全部都是来自linux/tracepoint.h 文件的，但是 tracepoint.h 中又包含了其它头文件，不排除其它头文件中又包含了其它头文件，比如 include/trace/trace_events.h 。
8. 以 sched_migrate_task 为例来看 TRACE_EVENT
//include/trace/events/sched.h TRACE_EVENT(sched_migrate_task, TP_PROTO(struct task_struct *p, int dest_cpu), TP_ARGS(p, dest_cpu), TP_STRUCT__entry( __array( char, comm, TASK_COMM_LEN ) __field( pid_t, pid ) __field( int, prio ) __field( int, orig_cpu ) __field( int, dest_cpu ) __field( int, running ) ), TP_fast_assign( memcpy(__entry->comm, p->comm, TASK_COMM_LEN); __entry->pid = p->pid; __entry->prio = p->prio; /* XXX SCHED_DEADLINE */ __entry->orig_cpu = task_cpu(p); __entry->dest_cpu = dest_cpu; __entry->running = (p->state == TASK_RUNNING); ), TP_printk("comm=%s pid=%d prio=%d orig_cpu=%d dest_cpu=%d running=%d", __entry->comm, __entry->pid, __entry->prio, __entry->orig_cpu, __entry->dest_cpu, __entry->running) );
include/linux/tracepoint.h 中有注释：__field(pid_t, prev_prid) 等于 pid_t prev_pid; __array(char, prev_comm, TASK_COMM_LEN) 等于 char prev_comm[TASK_COMM_LEN];
声明的 'local variable' 叫做 '__entry'，可以在 TP_fast_assign 中使用 __entry->XX 来引用。TP_STRUCT__entry 指定环形缓冲区中的存储格式，也是 /sys/kernel/debug/tracing/events/<*>/format 导出到用户空间的格式。
按照如下宏定义进行展开：
#define TRACE_EVENT(name, proto, args, struct, assign, print) DECLARE_TRACE(name, PARAMS(proto), PARAMS(args)) #define DECLARE_TRACE(name, proto, args) \ __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), cpu_online(raw_smp_processor_id()), PARAMS(void *__data, proto), PARAMS(__data, args)) //直接映射也就是： #define TRACE_EVENT(name, proto, args, struct, assign, print) \ __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), cpu_online(raw_smp_processor_id()), PARAMS(void *__data, proto), PARAMS(__data, args)) #define TRACE_EVENT(name, proto, args, struct, assign, print) DEFINE_TRACE(name, PARAMS(proto), PARAMS(args)) #define DEFINE_TRACE(name, proto, args) DEFINE_TRACE_FN(name, NULL, NULL, PARAMS(proto), PARAMS(args)); //直接映射也就是： #define TRACE_EVENT(name, proto, args, struct, assign, print) DEFINE_TRACE_FN(name, NULL, NULL, PARAMS(proto), PARAMS(args));
全部展开后为：
#define __DECLARE_TRACE(name, proto, args, cond, data_proto, data_args) \ extern int __traceiter_sched_migrate_task(void *__data, struct task_struct *p, int dest_cpu); \ extern struct static_call_key __SCK__tp_func_sched_migrate_task; \ extern typeof(__traceiter_sched_migrate_task) __SCT__tp_func_sched_migrate_task; \ extern struct tracepoint __tracepoint_sched_migrate_task; \ static inline void __nocfi trace_sched_migrate_task(struct task_struct *p, int dest_cpu) \ { \ if (static_key_false(&__tracepoint_sched_migrate_task.key)) \ do { \ struct tracepoint_func *it_func_ptr; \ int __maybe_unused __idx = 0; \ void *__data; \ \ if (!cpu_online(raw_smp_processor_id())) \ return; \ /* keep srcu and sched-rcu usage consistent */ \ preempt_disable_notrace(); \ it_func_ptr = rcu_dereference_raw((&__tracepoint_sched_migrate_task)->funcs); \ if (it_func_ptr) { \ __data = (it_func_ptr)->data; \ __traceiter_sched_migrate_task(__data, p, dest_cpu); \ } \ preempt_enable_notrace(); \ } while (0) \ if (IS_ENABLED(CONFIG_LOCKDEP) && cpu_online(raw_smp_processor_id())) { \ rcu_read_lock_sched_notrace(); \ rcu_dereference_sched(__tracepoint_sched_migrate_task.funcs);\ rcu_read_unlock_sched_notrace(); \ } \ } \ static inline void trace_sched_migrate_task_rcuidle(struct task_struct *p, int dest_cpu) \ { \ if (static_key_false(&__tracepoint_sched_migrate_task.key)) \ do { \ struct tracepoint_func *it_func_ptr; \ int __maybe_unused __idx = 0; \ void *__data; \ \ if (!cpu_online(raw_smp_processor_id())) \ return; \ \ /* srcu can't be used from NMI */ \ WARN_ON_ONCE(in_nmi()); \ \ /* keep srcu and sched-rcu usage consistent */ \ preempt_disable_notrace(); \ \ /* \ * For rcuidle callers, use srcu since sched-rcu \ * doesn't work from the idle path. \ */ \ __idx = srcu_read_lock_notrace(&tracepoint_srcu);\ rcu_irq_enter_irqson(); \ \ it_func_ptr = rcu_dereference_raw((&__tracepoint_sched_migrate_task)->funcs); \ if (it_func_ptr) { \ __data = (it_func_ptr)->data; \ __traceiter_sched_migrate_task(__data, p, dest_cpu); \ } \ \ rcu_irq_exit_irqson(); \ srcu_read_unlock_notrace(&tracepoint_srcu, __idx);\ \ preempt_enable_notrace(); \ } while (0) \ } \ static inline int register_trace_sched_migrate_task(void (*probe)(void *__data, struct task_struct *p, int dest_cpu), void *data) \ { \ return tracepoint_probe_register(&__tracepoint_sched_migrate_task, (void *)probe, data); \ } \ static inline int register_trace_prio_sched_migrate_task(void (*probe)(void *__data, struct task_struct *p, int dest_cpu), void *data, int prio) \ { \ return tracepoint_probe_register_prio(&__tracepoint_sched_migrate_task, (void *)probe, data, prio); \ } \ static inline int unregister_trace_sched_migrate_task(void (*probe)(void *__data, struct task_struct *p, int dest_cpu), void *data) \ { \ return tracepoint_probe_unregister(&__tracepoint_sched_migrate_task, (void *)probe, data); \ } \ static inline void check_trace_callback_type_sched_migrate_task(void (*cb)(void *__data, struct task_struct *p, int dest_cpu)) \ { \ } \ static inline bool trace_sched_migrate_task_enabled(void) \ { \ return static_key_false(&__tracepoint_sched_migrate_task.key); \ } #define DEFINE_TRACE_FN(_name, _reg, _unreg, proto, args) \ static const char __tpstrtab_sched_migrate_task[] \ __section("__tracepoints_strings") = "sched_migrate_task"; \ extern struct static_call_key __SCK__tp_func_sched_migrate_task; \ int __traceiter_sched_migrate_task(void *__data, struct task_struct *p, int dest_cpu); \ struct tracepoint __tracepoint_sched_migrate_task __used __section("__tracepoints") = { \ .name = __tpstrtab_sched_migrate_task, \ .key = STATIC_KEY_INIT_FALSE, \ .static_call_key = &__SCK__tp_func_sched_migrate_task, \ .static_call_tramp = NULL, \ .iterator = &__traceiter_sched_migrate_task, \ .regfunc = NULL, \ .unregfunc = NULL, \ .funcs = NULL \ }; \ __TRACEPOINT_ENTRY(sched_migrate_task); \ int __nocfi __traceiter_sched_migrate_task(void *__data, struct task_struct *p, int dest_cpu) \ { \ struct tracepoint_func *it_func_ptr; \ void *it_func; \ it_func_ptr = rcu_dereference_raw((&__tracepoint_sched_migrate_task)->funcs); \ if (it_func_ptr) { \ do { \ it_func = (it_func_ptr)->func; \ __data = (it_func_ptr)->data; \ ((void(*)(void *, struct task_struct *p, int dest_cpu))(it_func))(__data, p, dest_cpu); \ } while ((++it_func_ptr)->func); \ } \ return 0; \ } \ extern struct static_call_key __SCK__tp_func_sched_migrate_task; \ extern typeof(__traceiter_sched_migrate_task) __SCT__tp_func_sched_migrate_task; \ struct static_call_key __SCK__tp_func_sched_migrate_task = { \ .func = __traceiter_sched_migrate_task, \ }
TODO: 其它部分是怎么起作用的？
从展开后的内容可以看到，当调用 trace_sched_migrate_task() 进行trace的时候，会调用 __traceiter_sched_migrate_task() 来遍历 struct tracepoint::funcs 数组中的每一个函数进行trace，也就是说一个trace上可以注册多个hook函数。
若使用 EXPORT_TRACEPOINT_SYMBOL_GPL(sched_migrate_task) 导出，上面加黑加粗的 __tracepoint_sched_migrate_task __traceiter_sched_migrate_task __SCK__tp_func_sched_migrate_task 三个符号会被导出来。
9. 一个trace上注册多个hook
既然一个trace上可以注册多个hook，那么一定会涉及到这些hook函数的调用次序的问题，见 tracepoint_probe_register 实现可知，有一个默认优先级 TRACEPOINT_DEFAULT_PRIO=10，注册函数中会传递给 struct tracepoint_func::prio，在插入到 struct tracepoint::funcs 数组时会判断优先级，优先级数值越大，越插在靠前的位置，相同优先级的话，后注册的插在后面。 比如此例子中，注册默认优先级的使用函数 register_trace_sched_migrate_task，自己指定优先级使用函数 register_trace_prio_sched_migrate_task。
int tracepoint_probe_register(struct tracepoint *tp, void *probe, void *data) { return tracepoint_probe_register_prio(tp, probe, data, TRACEPOINT_DEFAULT_PRIO); } EXPORT_SYMBOL_GPL(tracepoint_probe_register);
二、Google搞的vendor hook
1. hook 的 DEFINE_HOOK_FN 解析后是
//include/trace/hooks/vendor_hooks.h #define DEFINE_HOOK_FN(_name, _reg, _unreg, proto, args) \ static const char __tpstrtab_##_name[] \ __section("__tracepoints_strings") = #_name; \ extern struct static_call_key __SCK__tp_func_##_name; \ int __traceiter_##_name(void *__data, proto); \ struct tracepoint __tracepoint_##_name __used __section("__tracepoints") = { \ .name = __tpstrtab_##_name, \ .key = STATIC_KEY_INIT_FALSE, \ .static_call_key = &__SCK__tp_func_##_name, \ .static_call_tramp = NULL, \ .iterator = &__traceiter_##_name, \ .regfunc = _reg, \ .unregfunc = _unreg, \ .funcs = NULL }; \ __TRACEPOINT_ENTRY(_name); \ int __nocfi __traceiter_##_name(void *__data, proto) \ { \ struct tracepoint_func *it_func_ptr; \ void *it_func; \ \ it_func_ptr = (&__tracepoint_##_name)->funcs; //不同：这里是直接访问的,ftrace是rcu_dereference_raw \ it_func = (it_func_ptr)->func; //不同：这里是先获取一个，ftrace中的是先判断it_func_ptr \ do { \ __data = (it_func_ptr)->data; \ ((void(*)(void *, proto))(it_func))(__data, args); \ it_func = READ_ONCE((++it_func_ptr)->func); \ } while (it_func); \ return 0; \ } \ extern struct static_call_key __SCK__tp_func_##_name; \ extern typeof(__traceiter_##_name) __SCT__tp_func_##_name; \ struct static_call_key __SCK__tp_func_##_name = { \ .func = __traceiter_##_name, \ }
注意备注上的一些和ftrace之间的不同点。
2. hook 的 __DECLARE_HOOK 解析后是：
//include/trace/hooks/vendor_hooks.h #define __DECLARE_HOOK(name, proto, args, cond, data_proto, data_args) \ extern int __traceiter_##name(data_proto); \ extern struct static_call_key __SCK__tp_func_##name; \ extern typeof(__traceiter_##name) __SCT__tp_func_##name; extern struct tracepoint __tracepoint_##name; \ \ static inline void __nocfi trace_##name(proto) \ { \ if (static_key_false(&__tracepoint_##name.key)) \ do { \ struct tracepoint_func *it_func_ptr; \ void *__data; \ \ if (!(cond)) \ return; \ \ it_func_ptr = (&__tracepoint_##name)->funcs; \ if (it_func_ptr) { \ __data = (it_func_ptr)->data; \ __traceiter_##name(data_args); \ } \ } while (0) \ } \ static inline bool trace_##name##_enabled(void) \ { \ return static_key_false(&__tracepoint_##name.key); \ } \ static inline int register_trace_##name(void (*probe)(data_proto), void *data) \ { \ return android_rvh_probe_register(&__tracepoint_##name, (void *)probe, data); \ } \ /* vendor hooks cannot be unregistered */ \
相比与ftrace，hook的trace 删除了 trace_##name##_rcuidle()、register_trace_prio_##name()、unregister_trace_##name()、check_trace_callback_type_##name()
3. 其它宏
#undef DECLARE_RESTRICTED_HOOK #define DECLARE_RESTRICTED_HOOK(name, proto, args, cond) \ DEFINE_HOOK_FN(name, NULL, NULL, PARAMS(proto), PARAMS(args)) #undef DECLARE_RESTRICTED_HOOK #define DECLARE_RESTRICTED_HOOK(name, proto, args, cond) \ __DECLARE_HOOK(name, PARAMS(proto), PARAMS(args), cond, PARAMS(void *__data, proto),PARAMS(__data, args))
4. 总结
Google的vendor hook在ftrace的基础上做了改动，由于Google的Hook宏删除了ftrace中的 register_trace_prio_##name()，因此不能注册带有优先级的钩子函数了。
三、实验
1. 对5.10内核中的 util_est_update 中的trace添加hook
static inline void util_est_update(struct cfs_rq *cfs_rq, struct task_struct *p, bool task_sleep) //fair.c { ... //Google 搞的 vendor hook trace_android_rvh_util_est_update(cfs_rq, p, task_sleep, &ret); if (ret) return; ... //普通的ftrace trace_sched_util_est_se_tp(&p->se); }
这两个trace符号Google已经导出来了：
EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_util_est_update); //vendor_hooks.c EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_se_tp); //core.c
2. 实验代码
/* 1. 包含头文件 */ #include <trace/events/sched.h> /* 2. 实现handler钩子函数，类型要与 trace##name() 的类型相同 */ //util_est_update() //fair.c void android_rvh_util_est_update_handler(void *data, struct cfs_rq *cfs_rq, struct task_struct *p, bool task_sleep, int *ret_o) { struct util_est *se_ue = &p->se.avg.util_est; struct util_est *rq_ue = &cfs_rq->avg.util_est; trace_printk("start: first_register: se_ue->enqueued=%d, se_ue->ewma=%d, rq_ue->enqueued=%d, rq_ue->ewma=%d, task_sleep=%d\n", se_ue->enqueued, se_ue->ewma, rq_ue->enqueued, rq_ue->ewma, task_sleep); *ret_o = 0; } void android_rvh_util_est_update_handler_second(void *data, struct cfs_rq *cfs_rq, struct task_struct *p, bool task_sleep, int *ret_o) { struct util_est *se_ue = &p->se.avg.util_est; struct util_est *rq_ue = &cfs_rq->avg.util_est; trace_printk("start: second_register: se_ue->enqueued=%d, se_ue->ewma=%d, rq_ue->enqueued=%d, rq_ue->ewma=%d, task_sleep=%d\n", se_ue->enqueued, se_ue->ewma, rq_ue->enqueued, rq_ue->ewma, task_sleep); *ret_o = 0; } //只改变这一个debug优先级, 默认优先级是10 void sched_util_est_se_tp_handler(void *data, struct sched_entity *se) { static int count = 0; int prio = 10; if (entity_is_task(se)) { struct task_struct *p = container_of(se, struct task_struct, se); struct rq *rq = cpu_rq(task_cpu(p)); struct cfs_rq *cfs_rq = &rq->cfs; struct util_est *se_ue = &p->se.avg.util_est; struct util_est *rq_ue = &cfs_rq->avg.util_est; trace_printk("end: count=%d, prio=%d, se_ue->enqueued=%d, se_ue->ewma=%d, rq_ue->enqueued=%d, rq_ue->ewma=%d\n", count++, prio, se_ue->enqueued, se_ue->ewma, rq_ue->enqueued, rq_ue->ewma); } else { trace_printk("end: se is not task\n"); } } void sched_util_est_se_tp_handler_prio_12(void *data, struct sched_entity *se) { static int count = 0; int prio = 12; if (entity_is_task(se)) { struct task_struct *p = container_of(se, struct task_struct, se); struct rq *rq = cpu_rq(task_cpu(p)); struct cfs_rq *cfs_rq = &rq->cfs; struct util_est *se_ue = &p->se.avg.util_est; struct util_est *rq_ue = &cfs_rq->avg.util_est; trace_printk("end: count=%d, prio=%d, se_ue->enqueued=%d, se_ue->ewma=%d, rq_ue->enqueued=%d, rq_ue->ewma=%d\n", count++, prio, se_ue->enqueued, se_ue->ewma, rq_ue->enqueued, rq_ue->ewma); } else { trace_printk("end: se is not task\n"); } } /* 3. 注册handler */ //common register register_trace_android_rvh_util_est_update(android_rvh_util_est_update_handler, NULL); register_trace_sched_util_est_se_tp(sched_util_est_se_tp_handler, NULL); //google vendor couldn't use prio, because not defined. register_trace_android_rvh_util_est_update(android_rvh_util_est_update_handler_second, NULL); //ftrace register with prio. register_trace_prio_sched_util_est_se_tp(sched_util_est_se_tp_handler_prio_12, NULL, 12);
3. 实验结果，打印的前后关系：
# echo 1 > tracing_on # cat trace_pipe <...>-338 [005] d..3 32.158404: sched_util_est_se_tp_handler_prio_12: end: count=28494, prio=12, se_ue->enqueued=39, se_ue->ewma=48, rq_ue->enqueued=87, rq_ue->ewma=0 <...>-338 [005] d..3 32.158404: sched_util_est_se_tp_handler: end: count=28493, prio=10, se_ue->enqueued=39, se_ue->ewma=48, rq_ue->enqueued=87, rq_ue->ewma=0 <...>-338 [005] d..2 32.158410: android_rvh_util_est_update_handler: start: first_register: se_ue->enqueued=39, se_ue->ewma=48, rq_ue->enqueued=87, rq_ue->ewma=0, task_sleep=1 <...>-338 [005] d..2 32.158410: android_rvh_util_est_update_handler_second: start: second_register: se_ue->enqueued=39, se_ue->ewma=48, rq_ue->enqueued=87, rq_ue->ewma=0, task_sleep=1
普通ftrace，注册时指定的优先级数值越大，越先调用。vendor hook 没有带有优先级注册的钩子函数，先注册的钩子函数调用在前，后注册的钩子函数调用在后。
看代码实现，就算是不执行 “echo 1 > tracing_on” 这些钩子函数应该也会被调用执行，只不过不会打印出来。
4. 另一种注册trace hook的方法
struct tracepoints_table { const char *name; void *func; struct tracepoint *tp; bool registered; }; static struct tracepoints_table g_tracepoints_table[] = { {.name = "android_rvh_util_est_update", .func = android_rvh_util_est_update_handler}, {.name = "sched_util_est_se_tp", .func = sched_util_est_se_tp_handler}, }; static void lookup_tracepoints(struct tracepoint *tp, void *ignore) { int i; for (i = 0; i < ARRAY_SIZE(g_tracepoints_table); i++) { if (!strcmp(g_tracepoints_table[i].name, tp->name)) g_tracepoints_table[i].tp = tp; } } static void register_tracepoints_table(void) { int i, ret; struct tracepoints_table *tt; for_each_kernel_tracepoint(lookup_tracepoints, NULL); //找到匹配的tracepoint结构 for (i = 0; i < ARRAY_SIZE(g_tracepoints_table); i++) { tt = &g_tracepoints_table[i]; if (tt->tp) { ret = tracepoint_probe_register(tt->tp, tt->func, NULL); if (ret) { pr_info("couldn't activate tracepoint %pf\n", tt->func); tracepoint_cleanup(i); } tt->registered = true; } } } void tracepoint_cleanup(int index) { int i; struct tracepoints_table *tt; for (i = 0; i < index; i++) { tracepoints_table *tt = &g_tracepoints_table[i]; if (tt->registered) { tracepoint_probe_unregister(tt->tp, tt->func, NULL); tt->registered = false; } } }
可见这种注册需要便利 tracepoint 区域对name进行对比，效率比较低，优点是涉及的文件比较少。