• Marco Elver's avatar
    tracing: Add sched_prepare_exec tracepoint · c8238994
    Marco Elver authored
    Add "sched_prepare_exec" tracepoint, which is run right after the point
    of no return but before the current task assumes its new exec identity.
    
    Unlike the tracepoint "sched_process_exec", the "sched_prepare_exec"
    tracepoint runs before flushing the old exec, i.e. while the task still
    has the original state (such as original MM), but when the new exec
    either succeeds or crashes (but never returns to the original exec).
    
    Being able to trace this event can be helpful in a number of use cases:
    
      * allowing tracing eBPF programs access to the original MM on exec,
        before current->mm is replaced;
      * counting exec in the original task (via perf event);
      * profiling flush time ("sched_prepare_exec" to "sched_process_exec").
    
    Example of tracing output:
    
     $ cat /sys/kernel/debug/tracing/trace_pipe
        <...>-379  [003] .....  179.626921: sched_prepare_exec: interp=/usr/bin/sshd filename=/usr/bin/sshd pid=379 comm=sshd
        <...>-381  [002] .....  180.048580: sched_prepare_exec: interp=/bin/bash filename=/bin/bash pid=381 comm=sshd
        <...>-385  [001] .....  180.068277: sched_prepare_exec: interp=/usr/bin/tty filename=/usr/bin/tty pid=385 comm=bash
        <...>-389  [006] .....  192.020147: sched_prepare_exec: interp=/usr/bin/dmesg filename=/usr/bin/dmesg pid=389 comm=bash
    Signed-off-by: default avatarMarco Elver <elver@google.com>
    Acked-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
    Reviewed-by: default avatarMasami Hiramatsu (Google) <mhiramat@kernel.org>
    Link: https://lore.kernel.org/r/20240411102158.1272267-1-elver@google.comSigned-off-by: default avatarKees Cook <keescook@chromium.org>
    c8238994
exec.c 52.7 KB