'\" t
.\" Title: libtracefs
.\" Author: [see the "AUTHOR" section]
.\" Generator: DocBook XSL Stylesheets vsnapshot
.\" Date: 10/08/2022
.\" Manual: libtracefs Manual
.\" Source: libtracefs 1.5.0
.\" Language: English
.\"
.TH "LIBTRACEFS" "3" "10/08/2022" "libtracefs 1\&.5\&.0" "libtracefs Manual"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
tracefs_kprobe_alloc, tracefs_kretprobe_alloc, tracefs_kprobe_raw, tracefs_kretprobe_raw \- Allocate, get, and create kprobes
.SH "SYNOPSIS"
.sp
.nf
\fB#include \fR
struct tracefs_dynevent *
\fBtracefs_kprobe_alloc\fR(const char *\fIsystem\fR, const char *\fIevent\fR,
const char *\fIaddr\fR, const char *\fIformat\fR);
struct tracefs_dynevent *
\fBtracefs_kretprobe_alloc\fR(const char *\fIsystem\fR, const char *\fIevent\fR,
const char *\fIaddr\fR, const char *\fIformat\fR, unsigned int \fImax\fR);
int \fBtracefs_kprobe_raw\fR(const char *\fIsystem\fR, const char *\fIevent\fR,
const char *\fIaddr\fR, const char *\fIformat\fR);
int \fBtracefs_kretprobe_raw\fR(const char *\fIsystem\fR, const char *\fIevent\fR,
const char *\fIaddr\fR, const char *\fIformat\fR);
.fi
.SH "DESCRIPTION"
.sp
\fBtracefs_kprobe_alloc\fR() allocates a new kprobe context\&. The kbrobe is not configured in the system\&. The new kprobe will be in the \fIsystem\fR group (or kprobes if \fIsystem\fR is NULL) and have the name of \fIevent\fR (or \fIaddr\fR if \fIevent\fR is NULL)\&. The kprobe will be inserted to \fIaddr\fR (function name, with or without offset, or a address), and the \fIformat\fR will define the format of the kprobe\&. See the Linux documentation file under: Documentation/trace/kprobetrace\&.rst
.sp
\fBtracefs_kretprobe_alloc\fR() is the same as \fBtracefs_kprobe_alloc\fR, but allocates context for kretprobe\&. It has one additional parameter, which is optional, \fImax\fR \- maxactive count\&. See description of kretprobes in the Documentation/trace/kprobetrace\&.rst file\&.
.sp
\fBtracefs_kprobe_raw\fR() will create a kprobe event\&. If \fIsystem\fR is NULL, then the default "kprobes" is used for the group (event system)\&. Otherwise if \fIsystem\fR is specified then the kprobe will be created under the group by that name\&. The \fIevent\fR is the name of the kprobe event to create\&. The \fIaddr\fR can be a function, a function and offset, or a kernel address\&. This is where the location of the kprobe will be inserted in the kernel\&. The \fIformat\fR is the kprobe format as specified as FETCHARGS in the Linux kernel source in the Documentation/trace/kprobetrace\&.rst document\&.
.sp
\fBtracefs_kretprobe_raw\fR() is the same as \fBtracefs_kprobe_raw()\fR, except that it creates a kretprobe instead of a kprobe\&. The difference is also described in the Linux kernel source in the Documentation/trace/kprobetrace\&.rst file\&.
.SH "RETURN VALUE"
.sp
\fBtracefs_kprobe_raw\fR() and \fBtracefs_kretprobe_raw\fR() return 0 on success, or \-1 on error\&. If a parsing error occurs on \fBtracefs_kprobe_raw\fR() or \fBtracefs_kretprobe_raw\fR() then \fBtracefs_error_last\fR(3) may be used to retrieve the error message explaining the parsing issue\&.
.sp
The \fBtracefs_kprobe_alloc\fR() and \fBtracefs_kretprobe_alloc\fR() APIs return a pointer to an allocated tracefs_dynevent structure, describing the probe\&. This pointer must be freed by \fBtracefs_dynevent_free\fR(3)\&. Note, this only allocates a descriptor representing the kprobe\&. It does not modify the running system\&.
.SH "ERRORS"
.sp
The following errors are for all the above calls:
.sp
\fBEPERM\fR Not run as root user
.sp
\fBENODEV\fR Kprobe events are not configured for the running kernel\&.
.sp
\fBENOMEM\fR Memory allocation error\&.
.sp
\fBtracefs_kprobe_raw\fR(), \fBtracefs_kretprobe_raw\fR(), \fBtracefs_kprobe_alloc\fR(), and \fBtracefs_kretprobe_alloc\fR() can fail with the following errors:
.sp
\fBEBADMSG\fR if \fIaddr\fR is NULL\&.
.sp
\fBEINVAL\fR Most likely a parsing error occurred (use \fBtracefs_error_last\fR(3) to possibly see what that error was)\&.
.sp
Other errors may also happen caused by internal system calls\&.
.SH "EXAMPLE"
.sp
.if n \{\
.RS 4
.\}
.nf
#include
#include
#include
#include
static struct tep_event *open_event;
static struct tep_format_field *file_field;
static struct tep_event *openret_event;
static struct tep_format_field *ret_field;
static int callback(struct tep_event *event, struct tep_record *record,
int cpu, void *data)
{
struct trace_seq seq;
trace_seq_init(&seq);
tep_print_event(event\->tep, &seq, record, "%d\-%s: ", TEP_PRINT_PID, TEP_PRINT_COMM);
if (event\->id == open_event\->id) {
trace_seq_puts(&seq, "open file=\*(Aq");
tep_print_field(&seq, record\->data, file_field);
trace_seq_puts(&seq, "\*(Aq\en");
} else if (event\->id == openret_event\->id) {
unsigned long long ret;
tep_read_number_field(ret_field, record\->data, &ret);
trace_seq_printf(&seq, "open ret=%lld\en", ret);
} else {
goto out;
}
trace_seq_terminate(&seq);
trace_seq_do_printf(&seq);
out:
trace_seq_destroy(&seq);
return 0;
}
static pid_t run_exec(char **argv, char **env)
{
pid_t pid;
pid = fork();
if (pid)
return pid;
execve(argv[0], argv, env);
perror("exec");
exit(\-1);
}
const char *mykprobe = "my_kprobes";
enum kprobe_type {
KPROBE,
KRETPROBE,
};
static void __kprobe_create(enum kprobe_type type, const char *event,
const char *addr, const char *fmt)
{
char *err;
int r;
if (type == KPROBE)
r = tracefs_kprobe_raw(mykprobe, event, addr, fmt);
else
r = tracefs_kretprobe_raw(mykprobe, event, addr, fmt);
if (r < 0) {
err = tracefs_error_last(NULL);
perror("Failed to create kprobe:");
if (err && strlen(err))
fprintf(stderr, "%s\en", err);
}
}
static void kprobe_create(const char *event, const char *addr,
const char *fmt)
{
__kprobe_create(KPROBE, event, addr, fmt);
}
static void kretprobe_create(const char *event, const char *addr,
const char *fmt)
{
__kprobe_create(KRETPROBE, event, addr, fmt);
}
int main (int argc, char **argv, char **env)
{
struct tracefs_instance *instance;
struct tep_handle *tep;
const char *sysnames[] = { mykprobe, NULL };
pid_t pid;
if (argc < 2) {
printf("usage: %s command\en", argv[0]);
exit(\-1);
}
instance = tracefs_instance_create("exec_open");
if (!instance) {
perror("creating instance");
exit(\-1);
}
tracefs_dynevent_destroy_all(TRACEFS_DYNEVENT_KPROBE | TRACEFS_DYNEVENT_KRETPROBE, true);
kprobe_create("open", "do_sys_openat2",
"file=+0($arg2):ustring flags=+0($arg3):x64 mode=+8($arg3):x64\en");
kretprobe_create("openret", "do_sys_openat2", "ret=%ax");
tep = tracefs_local_events_system(NULL, sysnames);
if (!tep) {
perror("reading events");
exit(\-1);
}
open_event = tep_find_event_by_name(tep, mykprobe, "open");
file_field = tep_find_field(open_event, "file");
openret_event = tep_find_event_by_name(tep, mykprobe, "openret");
ret_field = tep_find_field(openret_event, "ret");
tracefs_event_enable(instance, mykprobe, NULL);
pid = run_exec(&argv[1], env);
/* Let the child start to run */
sched_yield();
do {
tracefs_load_cmdlines(NULL, tep);
tracefs_iterate_raw_events(tep, instance, NULL, 0, callback, NULL);
} while (waitpid(pid, NULL, WNOHANG) != pid);
/* Will disable the events */
tracefs_dynevent_destroy_all(TRACEFS_DYNEVENT_KPROBE | TRACEFS_DYNEVENT_KRETPROBE, true);
tracefs_instance_destroy(instance);
tep_free(tep);
return 0;
}
.fi
.if n \{\
.RE
.\}
.SH "FILES"
.sp
.if n \{\
.RS 4
.\}
.nf
\fBtracefs\&.h\fR
Header file to include in order to have access to the library APIs\&.
\fB\-ltracefs\fR
Linker switch to add when building a program that uses the library\&.
.fi
.if n \{\
.RE
.\}
.SH "SEE ALSO"
.sp
\fBlibtracefs\fR(3), \fBlibtraceevent\fR(3), \fBtrace\-cmd\fR(1)
.SH "AUTHOR"
.sp
.if n \{\
.RS 4
.\}
.nf
\fBSteven Rostedt\fR <\m[blue]\fBrostedt@goodmis\&.org\fR\m[]\&\s-2\u[1]\d\s+2>
\fBTzvetomir Stoyanov\fR <\m[blue]\fBtz\&.stoyanov@gmail\&.com\fR\m[]\&\s-2\u[2]\d\s+2>
\fBsameeruddin shaik\fR <\m[blue]\fBsameeruddin\&.shaik8@gmail\&.com\fR\m[]\&\s-2\u[3]\d\s+2>
.fi
.if n \{\
.RE
.\}
.SH "REPORTING BUGS"
.sp
Report bugs to <\m[blue]\fBlinux\-trace\-devel@vger\&.kernel\&.org\fR\m[]\&\s-2\u[4]\d\s+2>
.SH "LICENSE"
.sp
libtracefs is Free Software licensed under the GNU LGPL 2\&.1
.SH "RESOURCES"
.sp
\m[blue]\fBhttps://git\&.kernel\&.org/pub/scm/libs/libtrace/libtracefs\&.git/\fR\m[]
.SH "COPYING"
.sp
Copyright (C) 2021 VMware, Inc\&. Free use of this software is granted under the terms of the GNU Public License (GPL)\&.
.SH "NOTES"
.IP " 1." 4
rostedt@goodmis.org
.RS 4
\%mailto:rostedt@goodmis.org
.RE
.IP " 2." 4
tz.stoyanov@gmail.com
.RS 4
\%mailto:tz.stoyanov@gmail.com
.RE
.IP " 3." 4
sameeruddin.shaik8@gmail.com
.RS 4
\%mailto:sameeruddin.shaik8@gmail.com
.RE
.IP " 4." 4
linux-trace-devel@vger.kernel.org
.RS 4
\%mailto:linux-trace-devel@vger.kernel.org
.RE