1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Test module for in-kernel kprobe event creation and generation. 4 * 5 * Copyright (C) 2019 Tom Zanussi <zanussi@kernel.org> 6 */ 7 8 #include <linux/module.h> 9 #include <linux/trace_events.h> 10 11 /* 12 * This module is a simple test of basic functionality for in-kernel 13 * kprobe/kretprobe event creation. The first test uses 14 * kprobe_event_gen_cmd_start(), kprobe_event_add_fields() and 15 * kprobe_event_gen_cmd_end() to create a kprobe event, which is then 16 * enabled in order to generate trace output. The second creates a 17 * kretprobe event using kretprobe_event_gen_cmd_start() and 18 * kretprobe_event_gen_cmd_end(), and is also then enabled. 19 * 20 * To test, select CONFIG_KPROBE_EVENT_GEN_TEST and build the module. 21 * Then: 22 * 23 * # insmod kernel/trace/kprobe_event_gen_test.ko 24 * # cat /sys/kernel/debug/tracing/trace 25 * 26 * You should see many instances of the "gen_kprobe_test" and 27 * "gen_kretprobe_test" events in the trace buffer. 28 * 29 * To remove the events, remove the module: 30 * 31 * # rmmod kprobe_event_gen_test 32 * 33 */ 34 35 static struct trace_event_file *gen_kprobe_test; 36 static struct trace_event_file *gen_kretprobe_test; 37 38 #define KPROBE_GEN_TEST_FUNC "do_sys_open" 39 40 /* X86 */ 41 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_32) 42 #define KPROBE_GEN_TEST_ARG0 "dfd=%ax" 43 #define KPROBE_GEN_TEST_ARG1 "filename=%dx" 44 #define KPROBE_GEN_TEST_ARG2 "flags=%cx" 45 #define KPROBE_GEN_TEST_ARG3 "mode=+4($stack)" 46 47 /* ARM64 */ 48 #elif defined(CONFIG_ARM64) 49 #define KPROBE_GEN_TEST_ARG0 "dfd=%x0" 50 #define KPROBE_GEN_TEST_ARG1 "filename=%x1" 51 #define KPROBE_GEN_TEST_ARG2 "flags=%x2" 52 #define KPROBE_GEN_TEST_ARG3 "mode=%x3" 53 54 /* ARM */ 55 #elif defined(CONFIG_ARM) 56 #define KPROBE_GEN_TEST_ARG0 "dfd=%r0" 57 #define KPROBE_GEN_TEST_ARG1 "filename=%r1" 58 #define KPROBE_GEN_TEST_ARG2 "flags=%r2" 59 #define KPROBE_GEN_TEST_ARG3 "mode=%r3" 60 61 /* RISCV */ 62 #elif defined(CONFIG_RISCV) 63 #define KPROBE_GEN_TEST_ARG0 "dfd=%a0" 64 #define KPROBE_GEN_TEST_ARG1 "filename=%a1" 65 #define KPROBE_GEN_TEST_ARG2 "flags=%a2" 66 #define KPROBE_GEN_TEST_ARG3 "mode=%a3" 67 68 /* others */ 69 #else 70 #define KPROBE_GEN_TEST_ARG0 NULL 71 #define KPROBE_GEN_TEST_ARG1 NULL 72 #define KPROBE_GEN_TEST_ARG2 NULL 73 #define KPROBE_GEN_TEST_ARG3 NULL 74 #endif 75 76 77 /* 78 * Test to make sure we can create a kprobe event, then add more 79 * fields. 80 */ 81 static int __init test_gen_kprobe_cmd(void) 82 { 83 struct dynevent_cmd cmd; 84 char *buf; 85 int ret; 86 87 /* Create a buffer to hold the generated command */ 88 buf = kzalloc(MAX_DYNEVENT_CMD_LEN, GFP_KERNEL); 89 if (!buf) 90 return -ENOMEM; 91 92 /* Before generating the command, initialize the cmd object */ 93 kprobe_event_cmd_init(&cmd, buf, MAX_DYNEVENT_CMD_LEN); 94 95 /* 96 * Define the gen_kprobe_test event with the first 2 kprobe 97 * fields. 98 */ 99 ret = kprobe_event_gen_cmd_start(&cmd, "gen_kprobe_test", 100 KPROBE_GEN_TEST_FUNC, 101 KPROBE_GEN_TEST_ARG0, KPROBE_GEN_TEST_ARG1); 102 if (ret) 103 goto free; 104 105 /* Use kprobe_event_add_fields to add the rest of the fields */ 106 107 ret = kprobe_event_add_fields(&cmd, KPROBE_GEN_TEST_ARG2, KPROBE_GEN_TEST_ARG3); 108 if (ret) 109 goto free; 110 111 /* 112 * This actually creates the event. 113 */ 114 ret = kprobe_event_gen_cmd_end(&cmd); 115 if (ret) 116 goto free; 117 118 /* 119 * Now get the gen_kprobe_test event file. We need to prevent 120 * the instance and event from disappearing from underneath 121 * us, which trace_get_event_file() does (though in this case 122 * we're using the top-level instance which never goes away). 123 */ 124 gen_kprobe_test = trace_get_event_file(NULL, "kprobes", 125 "gen_kprobe_test"); 126 if (IS_ERR(gen_kprobe_test)) { 127 ret = PTR_ERR(gen_kprobe_test); 128 goto delete; 129 } 130 131 /* Enable the event or you won't see anything */ 132 ret = trace_array_set_clr_event(gen_kprobe_test->tr, 133 "kprobes", "gen_kprobe_test", true); 134 if (ret) { 135 trace_put_event_file(gen_kprobe_test); 136 goto delete; 137 } 138 out: 139 return ret; 140 delete: 141 /* We got an error after creating the event, delete it */ 142 ret = kprobe_event_delete("gen_kprobe_test"); 143 free: 144 kfree(buf); 145 146 goto out; 147 } 148 149 /* 150 * Test to make sure we can create a kretprobe event. 151 */ 152 static int __init test_gen_kretprobe_cmd(void) 153 { 154 struct dynevent_cmd cmd; 155 char *buf; 156 int ret; 157 158 /* Create a buffer to hold the generated command */ 159 buf = kzalloc(MAX_DYNEVENT_CMD_LEN, GFP_KERNEL); 160 if (!buf) 161 return -ENOMEM; 162 163 /* Before generating the command, initialize the cmd object */ 164 kprobe_event_cmd_init(&cmd, buf, MAX_DYNEVENT_CMD_LEN); 165 166 /* 167 * Define the kretprobe event. 168 */ 169 ret = kretprobe_event_gen_cmd_start(&cmd, "gen_kretprobe_test", 170 KPROBE_GEN_TEST_FUNC, 171 "$retval"); 172 if (ret) 173 goto free; 174 175 /* 176 * This actually creates the event. 177 */ 178 ret = kretprobe_event_gen_cmd_end(&cmd); 179 if (ret) 180 goto free; 181 182 /* 183 * Now get the gen_kretprobe_test event file. We need to 184 * prevent the instance and event from disappearing from 185 * underneath us, which trace_get_event_file() does (though in 186 * this case we're using the top-level instance which never 187 * goes away). 188 */ 189 gen_kretprobe_test = trace_get_event_file(NULL, "kprobes", 190 "gen_kretprobe_test"); 191 if (IS_ERR(gen_kretprobe_test)) { 192 ret = PTR_ERR(gen_kretprobe_test); 193 goto delete; 194 } 195 196 /* Enable the event or you won't see anything */ 197 ret = trace_array_set_clr_event(gen_kretprobe_test->tr, 198 "kprobes", "gen_kretprobe_test", true); 199 if (ret) { 200 trace_put_event_file(gen_kretprobe_test); 201 goto delete; 202 } 203 out: 204 return ret; 205 delete: 206 /* We got an error after creating the event, delete it */ 207 ret = kprobe_event_delete("gen_kretprobe_test"); 208 free: 209 kfree(buf); 210 211 goto out; 212 } 213 214 static int __init kprobe_event_gen_test_init(void) 215 { 216 int ret; 217 218 ret = test_gen_kprobe_cmd(); 219 if (ret) 220 return ret; 221 222 ret = test_gen_kretprobe_cmd(); 223 if (ret) { 224 WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr, 225 "kprobes", 226 "gen_kretprobe_test", false)); 227 trace_put_event_file(gen_kretprobe_test); 228 WARN_ON(kprobe_event_delete("gen_kretprobe_test")); 229 } 230 231 return ret; 232 } 233 234 static void __exit kprobe_event_gen_test_exit(void) 235 { 236 /* Disable the event or you can't remove it */ 237 WARN_ON(trace_array_set_clr_event(gen_kprobe_test->tr, 238 "kprobes", 239 "gen_kprobe_test", false)); 240 241 /* Now give the file and instance back */ 242 trace_put_event_file(gen_kprobe_test); 243 244 /* Now unregister and free the event */ 245 WARN_ON(kprobe_event_delete("gen_kprobe_test")); 246 247 /* Disable the event or you can't remove it */ 248 WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr, 249 "kprobes", 250 "gen_kretprobe_test", false)); 251 252 /* Now give the file and instance back */ 253 trace_put_event_file(gen_kretprobe_test); 254 255 /* Now unregister and free the event */ 256 WARN_ON(kprobe_event_delete("gen_kretprobe_test")); 257 } 258 259 module_init(kprobe_event_gen_test_init) 260 module_exit(kprobe_event_gen_test_exit) 261 262 MODULE_AUTHOR("Tom Zanussi"); 263 MODULE_DESCRIPTION("kprobe event generation test"); 264 MODULE_LICENSE("GPL v2"); 265