uretprobes: Documentation update

add the uretprobe syntax and update an example

Signed-off-by: Anton Arapov <anton@redhat.com>
Acked-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>

Documentation/trace/uprobetracer.txt

@@ -1,7 +1,9 @@
             Uprobe-tracer: Uprobe-based Event Tracing
             =========================================
+
            Documentation written by Srikar Dronamraju
 
+
 Overview
 --------
 Uprobe based trace events are similar to kprobe based trace events.
@@ -13,16 +15,18 @@ current_tracer. Instead of that, add probe points via
 /sys/kernel/debug/tracing/events/uprobes/<EVENT>/enabled.
 
 However unlike kprobe-event tracer, the uprobe event interface expects the
-user to calculate the offset of the probepoint in the object
+user to calculate the offset of the probepoint in the object.
 
 Synopsis of uprobe_tracer
 -------------------------
-  p[:[GRP/]EVENT] PATH:SYMBOL[+offs] [FETCHARGS]	: Set a probe
+  p[:[GRP/]EVENT] PATH:SYMBOL[+offs] [FETCHARGS] : Set a uprobe
+  r[:[GRP/]EVENT] PATH:SYMBOL[+offs] [FETCHARGS] : Set a return uprobe (uretprobe)
+  -:[GRP/]EVENT                                  : Clear uprobe or uretprobe event
 
- GRP		: Group name. If omitted, use "uprobes" for it.
+  GRP           : Group name. If omitted, "uprobes" is the default value.
- EVENT		: Event name. If omitted, the event name is generated
+  EVENT         : Event name. If omitted, the event name is generated based
-		  based on SYMBOL+offs.
+                  on SYMBOL+offs.
- PATH		: path to an executable or a library.
+  PATH          : Path to an executable or a library.
   SYMBOL[+offs] : Symbol+offset where the probe is inserted.
 
   FETCHARGS     : Arguments. Each probe can have up to 128 args.
@@ -37,20 +41,29 @@ the third is the number of probe miss-hits.
 
 Usage examples
 --------------
-To add a probe as a new event, write a new definition to uprobe_events
+ * Add a probe as a new uprobe event, write a new definition to uprobe_events
-as below.
+as below: (sets a uprobe at an offset of 0x4245c0 in the executable /bin/bash)
 
     echo 'p: /bin/bash:0x4245c0' > /sys/kernel/debug/tracing/uprobe_events
 
- This sets a uprobe at an offset of 0x4245c0 in the executable /bin/bash
+ * Add a probe as a new uretprobe event:
+
+    echo 'r: /bin/bash:0x4245c0' > /sys/kernel/debug/tracing/uprobe_events
+
+ * Unset registered event:
+
+    echo '-:bash_0x4245c0' >> /sys/kernel/debug/tracing/uprobe_events
+
+ * Print out the events that are registered:
+
+    cat /sys/kernel/debug/tracing/uprobe_events
+
+ * Clear all events:
 
     echo > /sys/kernel/debug/tracing/uprobe_events
 
- This clears all probe points.
+Following example shows how to dump the instruction pointer and %ax register
-
+at the probed text address. Probe zfree function in /bin/zsh:
-The following example shows how to dump the instruction pointer and %ax
-a register at the probed text address.  Here we are trying to probe
-function zfree in /bin/zsh
 
     # cd /sys/kernel/debug/tracing/
     # cat /proc/`pgrep zsh`/maps | grep /bin/zsh | grep r-xp
@@ -59,21 +72,26 @@ function zfree in /bin/zsh
     0000000000446420 g    DF .text  0000000000000012  Base        zfree
 
   0x46420 is the offset of zfree in object /bin/zsh that is loaded at
-0x00400000. Hence the command to probe would be :
+  0x00400000. Hence the command to uprobe would be:
 
-    # echo 'p /bin/zsh:0x46420 %ip %ax' > uprobe_events
+    # echo 'p:zfree_entry /bin/zsh:0x46420 %ip %ax' > uprobe_events
 
-Please note: User has to explicitly calculate the offset of the probepoint
+  And the same for the uretprobe would be:
+
+    # echo 'r:zfree_exit /bin/zsh:0x46420 %ip %ax' >> uprobe_events
+
+Please note: User has to explicitly calculate the offset of the probe-point
 in the object. We can see the events that are registered by looking at the
 uprobe_events file.
 
     # cat uprobe_events
-    p:uprobes/p_zsh_0x46420 /bin/zsh:0x00046420 arg1=%ip arg2=%ax
+    p:uprobes/zfree_entry /bin/zsh:0x00046420 arg1=%ip arg2=%ax
+    r:uprobes/zfree_exit /bin/zsh:0x00046420 arg1=%ip arg2=%ax
 
-The format of events can be seen by viewing the file events/uprobes/p_zsh_0x46420/format
+Format of events can be seen by viewing the file events/uprobes/zfree_entry/format
 
-    # cat events/uprobes/p_zsh_0x46420/format
+    # cat events/uprobes/zfree_entry/format
-    name: p_zsh_0x46420
+    name: zfree_entry
     ID: 922
     format:
          field:unsigned short common_type;         offset:0;  size:2; signed:0;
@@ -94,6 +112,7 @@ events, you need to enable it by:
     # echo 1 > events/uprobes/enable
 
 Lets disable the event after sleeping for some time.
+
     # sleep 20
     # echo 0 > events/uprobes/enable
 
@@ -104,10 +123,11 @@ And you can see the traced information via /sys/kernel/debug/tracing/trace.
     #
     #           TASK-PID    CPU#    TIMESTAMP  FUNCTION
     #              | |       |          |         |
-                 zsh-24842 [006] 258544.995456: p_zsh_0x46420: (0x446420) arg1=446421 arg2=79
+                 zsh-24842 [006] 258544.995456: zfree_entry: (0x446420) arg1=446420 arg2=79
-                 zsh-24842 [007] 258545.000270: p_zsh_0x46420: (0x446420) arg1=446421 arg2=79
+                 zsh-24842 [007] 258545.000270: zfree_exit:  (0x446540 <- 0x446420) arg1=446540 arg2=0
-                 zsh-24842 [002] 258545.043929: p_zsh_0x46420: (0x446420) arg1=446421 arg2=79
+                 zsh-24842 [002] 258545.043929: zfree_entry: (0x446420) arg1=446420 arg2=79
-                 zsh-24842 [004] 258547.046129: p_zsh_0x46420: (0x446420) arg1=446421 arg2=79
+                 zsh-24842 [004] 258547.046129: zfree_exit:  (0x446540 <- 0x446420) arg1=446540 arg2=0
 
-Each line shows us probes were triggered for a pid 24842 with ip being
+Output shows us uprobe was triggered for a pid 24842 with ip being 0x446420
-0x446421 and contents of ax register being 79.
+and contents of ax register being 79. And uretprobe was triggered with ip at
+0x446540 with counterpart function entry at 0x446420.