1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Test module for in-kernel kprobe event creation and generation. 4 * 5 * Copyright (C) 2019 Tom Zanussi <zanussi@kernel.org> 6 */ 7 8 #include <linux/module.h> 9 #include <linux/trace_events.h> 10 11 /* 12 * This module is a simple test of basic functionality for in-kernel 13 * kprobe/kretprobe event creation. The first test uses 14 * kprobe_event_gen_cmd_start(), kprobe_event_add_fields() and 15 * kprobe_event_gen_cmd_end() to create a kprobe event, which is then 16 * enabled in order to generate trace output. The second creates a 17 * kretprobe event using kretprobe_event_gen_cmd_start() and 18 * kretprobe_event_gen_cmd_end(), and is also then enabled. 19 * 20 * To test, select CONFIG_KPROBE_EVENT_GEN_TEST and build the module. 21 * Then: 22 * 23 * # insmod kernel/trace/kprobe_event_gen_test.ko 24 * # cat /sys/kernel/debug/tracing/trace 25 * 26 * You should see many instances of the "gen_kprobe_test" and 27 * "gen_kretprobe_test" events in the trace buffer. 28 * 29 * To remove the events, remove the module: 30 * 31 * # rmmod kprobe_event_gen_test 32 * 33 */ 34 35 static struct trace_event_file *gen_kprobe_test; 36 static struct trace_event_file *gen_kretprobe_test; 37 38 #define KPROBE_GEN_TEST_FUNC "do_sys_open" 39 40 /* X86 */ 41 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_32) 42 #define KPROBE_GEN_TEST_ARG0 "dfd=%ax" 43 #define KPROBE_GEN_TEST_ARG1 "filename=%dx" 44 #define KPROBE_GEN_TEST_ARG2 "flags=%cx" 45 #define KPROBE_GEN_TEST_ARG3 "mode=+4($stack)" 46 47 /* ARM64 */ 48 #elif defined(CONFIG_ARM64) 49 #define KPROBE_GEN_TEST_ARG0 "dfd=%x0" 50 #define KPROBE_GEN_TEST_ARG1 "filename=%x1" 51 #define KPROBE_GEN_TEST_ARG2 "flags=%x2" 52 #define KPROBE_GEN_TEST_ARG3 "mode=%x3" 53 54 /* ARM */ 55 #elif defined(CONFIG_ARM) 56 #define KPROBE_GEN_TEST_ARG0 "dfd=%r0" 57 #define KPROBE_GEN_TEST_ARG1 "filename=%r1" 58 #define KPROBE_GEN_TEST_ARG2 "flags=%r2" 59 #define KPROBE_GEN_TEST_ARG3 "mode=%r3" 60 61 /* RISCV */ 62 #elif defined(CONFIG_RISCV) 63 #define KPROBE_GEN_TEST_ARG0 "dfd=%a0" 64 #define KPROBE_GEN_TEST_ARG1 "filename=%a1" 65 #define KPROBE_GEN_TEST_ARG2 "flags=%a2" 66 #define KPROBE_GEN_TEST_ARG3 "mode=%a3" 67 68 /* others */ 69 #else 70 #define KPROBE_GEN_TEST_ARG0 NULL 71 #define KPROBE_GEN_TEST_ARG1 NULL 72 #define KPROBE_GEN_TEST_ARG2 NULL 73 #define KPROBE_GEN_TEST_ARG3 NULL 74 #endif 75 76 77 /* 78 * Test to make sure we can create a kprobe event, then add more 79 * fields. 80 */ 81 static int __init test_gen_kprobe_cmd(void) 82 { 83 struct dynevent_cmd cmd; 84 char *buf; 85 int ret; 86 87 /* Create a buffer to hold the generated command */ 88 buf = kzalloc(MAX_DYNEVENT_CMD_LEN, GFP_KERNEL); 89 if (!buf) 90 return -ENOMEM; 91 92 /* Before generating the command, initialize the cmd object */ 93 kprobe_event_cmd_init(&cmd, buf, MAX_DYNEVENT_CMD_LEN); 94 95 /* 96 * Define the gen_kprobe_test event with the first 2 kprobe 97 * fields. 98 */ 99 ret = kprobe_event_gen_cmd_start(&cmd, "gen_kprobe_test", 100 KPROBE_GEN_TEST_FUNC, 101 KPROBE_GEN_TEST_ARG0, KPROBE_GEN_TEST_ARG1); 102 if (ret) 103 goto out; 104 105 /* Use kprobe_event_add_fields to add the rest of the fields */ 106 107 ret = kprobe_event_add_fields(&cmd, KPROBE_GEN_TEST_ARG2, KPROBE_GEN_TEST_ARG3); 108 if (ret) 109 goto out; 110 111 /* 112 * This actually creates the event. 113 */ 114 ret = kprobe_event_gen_cmd_end(&cmd); 115 if (ret) 116 goto out; 117 118 /* 119 * Now get the gen_kprobe_test event file. We need to prevent 120 * the instance and event from disappearing from underneath 121 * us, which trace_get_event_file() does (though in this case 122 * we're using the top-level instance which never goes away). 123 */ 124 gen_kprobe_test = trace_get_event_file(NULL, "kprobes", 125 "gen_kprobe_test"); 126 if (IS_ERR(gen_kprobe_test)) { 127 ret = PTR_ERR(gen_kprobe_test); 128 goto delete; 129 } 130 131 /* Enable the event or you won't see anything */ 132 ret = trace_array_set_clr_event(gen_kprobe_test->tr, 133 "kprobes", "gen_kprobe_test", true); 134 if (ret) { 135 trace_put_event_file(gen_kprobe_test); 136 goto delete; 137 } 138 out: 139 kfree(buf); 140 return ret; 141 delete: 142 /* We got an error after creating the event, delete it */ 143 ret = kprobe_event_delete("gen_kprobe_test"); 144 goto out; 145 } 146 147 /* 148 * Test to make sure we can create a kretprobe event. 149 */ 150 static int __init test_gen_kretprobe_cmd(void) 151 { 152 struct dynevent_cmd cmd; 153 char *buf; 154 int ret; 155 156 /* Create a buffer to hold the generated command */ 157 buf = kzalloc(MAX_DYNEVENT_CMD_LEN, GFP_KERNEL); 158 if (!buf) 159 return -ENOMEM; 160 161 /* Before generating the command, initialize the cmd object */ 162 kprobe_event_cmd_init(&cmd, buf, MAX_DYNEVENT_CMD_LEN); 163 164 /* 165 * Define the kretprobe event. 166 */ 167 ret = kretprobe_event_gen_cmd_start(&cmd, "gen_kretprobe_test", 168 KPROBE_GEN_TEST_FUNC, 169 "$retval"); 170 if (ret) 171 goto out; 172 173 /* 174 * This actually creates the event. 175 */ 176 ret = kretprobe_event_gen_cmd_end(&cmd); 177 if (ret) 178 goto out; 179 180 /* 181 * Now get the gen_kretprobe_test event file. We need to 182 * prevent the instance and event from disappearing from 183 * underneath us, which trace_get_event_file() does (though in 184 * this case we're using the top-level instance which never 185 * goes away). 186 */ 187 gen_kretprobe_test = trace_get_event_file(NULL, "kprobes", 188 "gen_kretprobe_test"); 189 if (IS_ERR(gen_kretprobe_test)) { 190 ret = PTR_ERR(gen_kretprobe_test); 191 goto delete; 192 } 193 194 /* Enable the event or you won't see anything */ 195 ret = trace_array_set_clr_event(gen_kretprobe_test->tr, 196 "kprobes", "gen_kretprobe_test", true); 197 if (ret) { 198 trace_put_event_file(gen_kretprobe_test); 199 goto delete; 200 } 201 out: 202 kfree(buf); 203 return ret; 204 delete: 205 /* We got an error after creating the event, delete it */ 206 ret = kprobe_event_delete("gen_kretprobe_test"); 207 goto out; 208 } 209 210 static int __init kprobe_event_gen_test_init(void) 211 { 212 int ret; 213 214 ret = test_gen_kprobe_cmd(); 215 if (ret) 216 return ret; 217 218 ret = test_gen_kretprobe_cmd(); 219 if (ret) { 220 WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr, 221 "kprobes", 222 "gen_kretprobe_test", false)); 223 trace_put_event_file(gen_kretprobe_test); 224 WARN_ON(kprobe_event_delete("gen_kretprobe_test")); 225 } 226 227 return ret; 228 } 229 230 static void __exit kprobe_event_gen_test_exit(void) 231 { 232 /* Disable the event or you can't remove it */ 233 WARN_ON(trace_array_set_clr_event(gen_kprobe_test->tr, 234 "kprobes", 235 "gen_kprobe_test", false)); 236 237 /* Now give the file and instance back */ 238 trace_put_event_file(gen_kprobe_test); 239 240 /* Now unregister and free the event */ 241 WARN_ON(kprobe_event_delete("gen_kprobe_test")); 242 243 /* Disable the event or you can't remove it */ 244 WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr, 245 "kprobes", 246 "gen_kretprobe_test", false)); 247 248 /* Now give the file and instance back */ 249 trace_put_event_file(gen_kretprobe_test); 250 251 /* Now unregister and free the event */ 252 WARN_ON(kprobe_event_delete("gen_kretprobe_test")); 253 } 254 255 module_init(kprobe_event_gen_test_init) 256 module_exit(kprobe_event_gen_test_exit) 257 258 MODULE_AUTHOR("Tom Zanussi"); 259 MODULE_DESCRIPTION("kprobe event generation test"); 260 MODULE_LICENSE("GPL v2"); 261