| 1 | |
| 2 | |
| 3 | * Copyright (C) 2019-2022 Red Hat, Inc. Daniel Bristot de Oliveira <[email protected]>
|
| 4 | *
|
| 5 | * This is the online Runtime Verification (RV) interface.
|
| 6 | *
|
| 7 | * RV is a lightweight (yet rigorous) method that complements classical
|
| 8 | * exhaustive verification techniques (such as model checking and
|
| 9 | * theorem proving) with a more practical approach to complex systems.
|
| 10 | *
|
| 11 | * RV works by analyzing the trace of the system's actual execution,
|
| 12 | * comparing it against a formal specification of the system behavior.
|
| 13 | * RV can give precise information on the runtime behavior of the
|
| 14 | * monitored system while enabling the reaction for unexpected
|
| 15 | * events, avoiding, for example, the propagation of a failure on
|
| 16 | * safety-critical systems.
|
| 17 | *
|
| 18 | * The development of this interface roots in the development of the
|
| 19 | * paper:
|
| 20 | *
|
| 21 | * De Oliveira, Daniel Bristot; Cucinotta, Tommaso; De Oliveira, Romulo
|
| 22 | * Silva. Efficient formal verification for the Linux kernel. In:
|
| 23 | * International Conference on Software Engineering and Formal Methods.
|
| 24 | * Springer, Cham, 2019. p. 315-332.
|
| 25 | *
|
| 26 | * And:
|
| 27 | *
|
| 28 | * De Oliveira, Daniel Bristot, et al. Automata-based formal analysis
|
| 29 | * and verification of the real-time Linux kernel. PhD Thesis, 2020.
|
| 30 | *
|
| 31 | * == Runtime monitor interface ==
|
| 32 | *
|
| 33 | * A monitor is the central part of the runtime verification of a system.
|
| 34 | *
|
| 35 | * The monitor stands in between the formal specification of the desired
|
| 36 | * (or undesired) behavior, and the trace of the actual system.
|
| 37 | *
|
| 38 | * In Linux terms, the runtime verification monitors are encapsulated
|
| 39 | * inside the "RV monitor" abstraction. A RV monitor includes a reference
|
| 40 | * model of the system, a set of instances of the monitor (per-cpu monitor,
|
| 41 | * per-task monitor, and so on), and the helper functions that glue the
|
| 42 | * monitor to the system via trace. Generally, a monitor includes some form
|
| 43 | * of trace output as a reaction for event parsing and exceptions,
|
| 44 | * as depicted below:
|
| 45 | *
|
| 46 | * Linux +----- RV Monitor ----------------------------------+ Formal
|
| 47 | * Realm | | Realm
|
| 48 | * +-------------------+ +----------------+ +-----------------+
|
| 49 | * | Linux kernel | | Monitor | | Reference |
|
| 50 | * | Tracing | -> | Instance(s) | <- | Model |
|
| 51 | * | (instrumentation) | | (verification) | | (specification) |
|
| 52 | * +-------------------+ +----------------+ +-----------------+
|
| 53 | * | | |
|
| 54 | * | V |
|
| 55 | * | +----------+ |
|
| 56 | * | | Reaction | |
|
| 57 | * | +--+--+--+-+ |
|
| 58 | * | | | | |
|
| 59 | * | | | +-> trace output ? |
|
| 60 | * +------------------------|--|----------------------+
|
| 61 | * | +----> panic ?
|
| 62 | * +-------> <user-specified>
|
| 63 | *
|
| 64 | * This file implements the interface for loading RV monitors, and
|
| 65 | * to control the verification session.
|
| 66 | *
|
| 67 | * == Registering monitors ==
|
| 68 | *
|
| 69 | * The struct rv_monitor defines a set of callback functions to control
|
| 70 | * a verification session. For instance, when a given monitor is enabled,
|
| 71 | * the "enable" callback function is called to hook the instrumentation
|
| 72 | * functions to the kernel trace events. The "disable" function is called
|
| 73 | * when disabling the verification session.
|
| 74 | *
|
| 75 | * A RV monitor is registered via:
|
| 76 | * int rv_register_monitor(struct rv_monitor *monitor);
|
| 77 | * And unregistered via:
|
| 78 | * int rv_unregister_monitor(struct rv_monitor *monitor);
|
| 79 | *
|
| 80 | * == User interface ==
|
| 81 | *
|
| 82 | * The user interface resembles kernel tracing interface. It presents
|
| 83 | * these files:
|
| 84 | *
|
| 85 | * "available_monitors"
|
| 86 | * - List the available monitors, one per line.
|
| 87 | *
|
| 88 | * For example:
|
| 89 | * # cat available_monitors
|
| 90 | * wip
|
| 91 | * wwnr
|
| 92 | *
|
| 93 | * "enabled_monitors"
|
| 94 | * - Lists the enabled monitors, one per line;
|
| 95 | * - Writing to it enables a given monitor;
|
| 96 | * - Writing a monitor name with a '!' prefix disables it;
|
| 97 | * - Truncating the file disables all enabled monitors.
|
| 98 | *
|
| 99 | * For example:
|
| 100 | * # cat enabled_monitors
|
| 101 | * # echo wip > enabled_monitors
|
| 102 | * # echo wwnr >> enabled_monitors
|
| 103 | * # cat enabled_monitors
|
| 104 | * wip
|
| 105 | * wwnr
|
| 106 | * # echo '!wip' >> enabled_monitors
|
| 107 | * # cat enabled_monitors
|
| 108 | * wwnr
|
| 109 | * # echo > enabled_monitors
|
| 110 | * # cat enabled_monitors
|
| 111 | * #
|
| 112 | *
|
| 113 | * Note that more than one monitor can be enabled concurrently.
|
| 114 | *
|
| 115 | * "monitoring_on"
|
| 116 | * - It is an on/off general switcher for monitoring. Note
|
| 117 | * that it does not disable enabled monitors or detach events,
|
| 118 | * but stops the per-entity monitors from monitoring the events
|
| 119 | * received from the instrumentation. It resembles the "tracing_on"
|
| 120 | * switcher.
|
| 121 | *
|
| 122 | * "monitors/"
|
| 123 | * Each monitor will have its own directory inside "monitors/". There
|
| 124 | * the monitor specific files will be presented.
|
| 125 | * The "monitors/" directory resembles the "events" directory on
|
| 126 | * tracefs.
|
| 127 | *
|
| 128 | * For example:
|
| 129 | * # cd monitors/wip/
|
| 130 | * # ls
|
| 131 | * desc enable
|
| 132 | * # cat desc
|
| 133 | * auto-generated wakeup in preemptive monitor.
|
| 134 | * # cat enable
|
| 135 | * 0
|
| 136 | *
|
| 137 | * For further information, see:
|
| 138 | * Documentation/trace/rv/runtime-verification.rst
|
| 139 |
|
| 140 |
|
| 141 | #include <linux/kernel.h>
|
| 142 | #include <linux/module.h>
|
| 143 | #include <linux/init.h>
|
| 144 | #include <linux/slab.h>
|
| 145 |
|
| 146 | #ifdef CONFIG_RV_MON_EVENTS
|
| 147 | #define CREATE_TRACE_POINTS
|
| 148 | #include <rv_trace.h>
|
| 149 | #endif
|
| 150 |
|
| 151 | #include "rv.h"
|
| 152 |
|
| 153 | DEFINE_MUTEX(rv_interface_lock);
|
| 154 |
|
| 155 | static struct rv_interface rv_root;
|
| 156 |
|
| 157 | struct dentry *get_monitors_root(void)
|
| 158 | {
|
| 159 | return rv_root.monitors_dir;
|
| 160 | }
|
| 161 |
|
| 162 | |
| 163 | * Interface for the monitor register.
|
| 164 |
|
| 165 | LIST_HEAD(rv_monitors_list);
|
| 166 |
|
| 167 | static bool task_monitor_slots[CONFIG_RV_PER_TASK_MONITORS];
|
| 168 |
|
| 169 | int rv_get_task_monitor_slot(void)
|
| 170 | {
|
| 171 | int i;
|
| 172 |
|
| 173 | lockdep_assert_held(&rv_interface_lock);
|
| 174 |
|
| 175 | for (i = 0; i < CONFIG_RV_PER_TASK_MONITORS; i++) {
|
| 176 | if (!task_monitor_slots[i]) {
|
| 177 | task_monitor_slots[i] = true;
|
| 178 | return i;
|
| 179 | }
|
| 180 | }
|
| 181 |
|
| 182 | return -EBUSY;
|
| 183 | }
|
| 184 | EXPORT_SYMBOL_GPL(rv_get_task_monitor_slot);
|
| 185 |
|
| 186 | void rv_put_task_monitor_slot(int slot)
|
| 187 | {
|
| 188 | lockdep_assert_held(&rv_interface_lock);
|
| 189 |
|
| 190 | if (slot < 0 || slot >= CONFIG_RV_PER_TASK_MONITORS) {
|
| 191 | WARN_ONCE(1, "RV releasing an invalid slot!: %d\n", slot);
|
| 192 | return;
|
| 193 | }
|
| 194 |
|
| 195 | if (WARN_ONCE(!task_monitor_slots[slot],
|
| 196 | "RV releasing unused task monitor slot: %d\n", slot))
|
| 197 | return;
|
| 198 |
|
| 199 | task_monitor_slots[slot] = false;
|
| 200 | }
|
| 201 | EXPORT_SYMBOL_GPL(rv_put_task_monitor_slot);
|
| 202 |
|
| 203 | |
| 204 | * Monitors with a parent are nested,
|
| 205 | * Monitors without a parent could be standalone or containers.
|
| 206 |
|
| 207 | bool rv_is_nested_monitor(struct rv_monitor *mon)
|
| 208 | {
|
| 209 | return mon->parent != NULL;
|
| 210 | }
|
| 211 |
|
| 212 | |
| 213 | * We set our list to have nested monitors listed after their parent
|
| 214 | * if a monitor has a child element its a container.
|
| 215 | * Containers can be also identified based on their function pointers:
|
| 216 | * as they are not real monitors they do not need function definitions
|
| 217 | * for enable()/disable(). Use this condition to find empty containers.
|
| 218 | * Keep both conditions in case we have some non-compliant containers.
|
| 219 |
|
| 220 | bool rv_is_container_monitor(struct rv_monitor *mon)
|
| 221 | {
|
| 222 | struct rv_monitor *next;
|
| 223 |
|
| 224 | if (list_is_last(&mon->list, &rv_monitors_list))
|
| 225 | return false;
|
| 226 |
|
| 227 | next = list_next_entry(mon, list);
|
| 228 |
|
| 229 | return next->parent == mon || !mon->enable;
|
| 230 | }
|
| 231 |
|
| 232 | |
| 233 | * This section collects the monitor/ files and folders.
|
| 234 |
|
| 235 | static ssize_t monitor_enable_read_data(struct file *filp, char __user *user_buf, size_t count,
|
| 236 | loff_t *ppos)
|
| 237 | {
|
| 238 | struct rv_monitor *mon = filp->private_data;
|
| 239 | const char *buff;
|
| 240 |
|
| 241 | buff = mon->enabled ? "1\n" : "0\n";
|
| 242 |
|
| 243 | return simple_read_from_buffer(user_buf, count, ppos, buff, strlen(buff)+1);
|
| 244 | }
|
| 245 |
|
| 246 | |
| 247 | * __rv_disable_monitor - disabled an enabled monitor
|
| 248 |
|
| 249 | static int __rv_disable_monitor(struct rv_monitor *mon, bool sync)
|
| 250 | {
|
| 251 | lockdep_assert_held(&rv_interface_lock);
|
| 252 |
|
| 253 | if (mon->enabled) {
|
| 254 | mon->enabled = 0;
|
| 255 | if (mon->disable)
|
| 256 | mon->disable();
|
| 257 |
|
| 258 | |
| 259 | * Wait for the execution of all events to finish.
|
| 260 | * Otherwise, the data used by the monitor could
|
| 261 | * be inconsistent. i.e., if the monitor is re-enabled.
|
| 262 |
|
| 263 | if (sync)
|
| 264 | tracepoint_synchronize_unregister();
|
| 265 | return 1;
|
| 266 | }
|
| 267 | return 0;
|
| 268 | }
|
| 269 |
|
| 270 | static void rv_disable_single(struct rv_monitor *mon)
|
| 271 | {
|
| 272 | __rv_disable_monitor(mon, true);
|
| 273 | }
|
| 274 |
|
| 275 | static int rv_enable_single(struct rv_monitor *mon)
|
| 276 | {
|
| 277 | int retval;
|
| 278 |
|
| 279 | lockdep_assert_held(&rv_interface_lock);
|
| 280 |
|
| 281 | if (mon->enabled)
|
| 282 | return 0;
|
| 283 |
|
| 284 | retval = mon->enable();
|
| 285 |
|
| 286 | if (!retval)
|
| 287 | mon->enabled = 1;
|
| 288 |
|
| 289 | return retval;
|
| 290 | }
|
| 291 |
|
| 292 | static void rv_disable_container(struct rv_monitor *mon)
|
| 293 | {
|
| 294 | struct rv_monitor *p = mon;
|
| 295 | int enabled = 0;
|
| 296 |
|
| 297 | list_for_each_entry_continue(p, &rv_monitors_list, list) {
|
| 298 | if (p->parent != mon)
|
| 299 | break;
|
| 300 | enabled += __rv_disable_monitor(p, false);
|
| 301 | }
|
| 302 | if (enabled)
|
| 303 | tracepoint_synchronize_unregister();
|
| 304 | mon->enabled = 0;
|
| 305 | }
|
| 306 |
|
| 307 | static int rv_enable_container(struct rv_monitor *mon)
|
| 308 | {
|
| 309 | struct rv_monitor *p = mon;
|
| 310 | int retval = 0;
|
| 311 |
|
| 312 | list_for_each_entry_continue(p, &rv_monitors_list, list) {
|
| 313 | if (retval || p->parent != mon)
|
| 314 | break;
|
| 315 | retval = rv_enable_single(p);
|
| 316 | }
|
| 317 | if (retval)
|
| 318 | rv_disable_container(mon);
|
| 319 | else
|
| 320 | mon->enabled = 1;
|
| 321 | return retval;
|
| 322 | }
|
| 323 |
|
| 324 | |
| 325 | * rv_disable_monitor - disable a given runtime monitor
|
| 326 | * @mon: Pointer to the monitor definition structure.
|
| 327 | *
|
| 328 | * Returns 0 on success.
|
| 329 |
|
| 330 | int rv_disable_monitor(struct rv_monitor *mon)
|
| 331 | {
|
| 332 | if (rv_is_container_monitor(mon))
|
| 333 | rv_disable_container(mon);
|
| 334 | else
|
| 335 | rv_disable_single(mon);
|
| 336 |
|
| 337 | return 0;
|
| 338 | }
|
| 339 |
|
| 340 | |
| 341 | * rv_enable_monitor - enable a given runtime monitor
|
| 342 | * @mon: Pointer to the monitor definition structure.
|
| 343 | *
|
| 344 | * Returns 0 on success, error otherwise.
|
| 345 |
|
| 346 | int rv_enable_monitor(struct rv_monitor *mon)
|
| 347 | {
|
| 348 | int retval;
|
| 349 |
|
| 350 | if (rv_is_container_monitor(mon))
|
| 351 | retval = rv_enable_container(mon);
|
| 352 | else
|
| 353 | retval = rv_enable_single(mon);
|
| 354 |
|
| 355 | return retval;
|
| 356 | }
|
| 357 |
|
| 358 | |
| 359 | * interface for enabling/disabling a monitor.
|
| 360 |
|
| 361 | static ssize_t monitor_enable_write_data(struct file *filp, const char __user *user_buf,
|
| 362 | size_t count, loff_t *ppos)
|
| 363 | {
|
| 364 | struct rv_monitor *mon = filp->private_data;
|
| 365 | int retval;
|
| 366 | bool val;
|
| 367 |
|
| 368 | retval = kstrtobool_from_user(user_buf, count, &val);
|
| 369 | if (retval)
|
| 370 | return retval;
|
| 371 |
|
| 372 | guard(mutex)(&rv_interface_lock);
|
| 373 |
|
| 374 | if (val)
|
| 375 | retval = rv_enable_monitor(mon);
|
| 376 | else
|
| 377 | retval = rv_disable_monitor(mon);
|
| 378 |
|
| 379 | return retval ? : count;
|
| 380 | }
|
| 381 |
|
| 382 | static const struct file_operations interface_enable_fops = {
|
| 383 | .open = simple_open,
|
| 384 | .write = monitor_enable_write_data,
|
| 385 | .read = monitor_enable_read_data,
|
| 386 | };
|
| 387 |
|
| 388 | |
| 389 | * Interface to read monitors description.
|
| 390 |
|
| 391 | static ssize_t monitor_desc_read_data(struct file *filp, char __user *user_buf, size_t count,
|
| 392 | loff_t *ppos)
|
| 393 | {
|
| 394 | struct rv_monitor *mon = filp->private_data;
|
| 395 | char buff[256];
|
| 396 |
|
| 397 | memset(buff, 0, sizeof(buff));
|
| 398 |
|
| 399 | snprintf(buff, sizeof(buff), "%s\n", mon->description);
|
| 400 |
|
| 401 | return simple_read_from_buffer(user_buf, count, ppos, buff, strlen(buff) + 1);
|
| 402 | }
|
| 403 |
|
| 404 | static const struct file_operations interface_desc_fops = {
|
| 405 | .open = simple_open,
|
| 406 | .read = monitor_desc_read_data,
|
| 407 | };
|
| 408 |
|
| 409 | |
| 410 | * During the registration of a monitor, this function creates
|
| 411 | * the monitor dir, where the specific options of the monitor
|
| 412 | * are exposed.
|
| 413 |
|
| 414 | static int create_monitor_dir(struct rv_monitor *mon, struct rv_monitor *parent)
|
| 415 | {
|
| 416 | struct dentry *root = parent ? parent->root_d : get_monitors_root();
|
| 417 | struct dentry *dir __free(rv_remove) = rv_create_dir(mon->name, root);
|
| 418 | struct dentry *tmp;
|
| 419 | int retval;
|
| 420 |
|
| 421 | if (!dir)
|
| 422 | return -ENOMEM;
|
| 423 |
|
| 424 | tmp = rv_create_file("enable", RV_MODE_WRITE, dir, mon, &interface_enable_fops);
|
| 425 | if (!tmp)
|
| 426 | return -ENOMEM;
|
| 427 |
|
| 428 | tmp = rv_create_file("desc", RV_MODE_READ, dir, mon, &interface_desc_fops);
|
| 429 | if (!tmp)
|
| 430 | return -ENOMEM;
|
| 431 |
|
| 432 | retval = reactor_populate_monitor(mon, dir);
|
| 433 | if (retval)
|
| 434 | return retval;
|
| 435 |
|
| 436 | mon->root_d = no_free_ptr(dir);
|
| 437 | return 0;
|
| 438 | }
|
| 439 |
|
| 440 | |
| 441 | * Available/Enable monitor shared seq functions.
|
| 442 |
|
| 443 | static int monitors_show(struct seq_file *m, void *p)
|
| 444 | {
|
| 445 | struct rv_monitor *mon = container_of(p, struct rv_monitor, list);
|
| 446 |
|
| 447 | if (mon->parent)
|
| 448 | seq_printf(m, "%s:%s\n", mon->parent->name, mon->name);
|
| 449 | else
|
| 450 | seq_printf(m, "%s\n", mon->name);
|
| 451 | return 0;
|
| 452 | }
|
| 453 |
|
| 454 | |
| 455 | * Used by the seq file operations at the end of a read
|
| 456 | * operation.
|
| 457 |
|
| 458 | static void monitors_stop(struct seq_file *m, void *p)
|
| 459 | {
|
| 460 | mutex_unlock(&rv_interface_lock);
|
| 461 | }
|
| 462 |
|
| 463 | |
| 464 | * Available monitor seq functions.
|
| 465 |
|
| 466 | static void *available_monitors_start(struct seq_file *m, loff_t *pos)
|
| 467 | {
|
| 468 | mutex_lock(&rv_interface_lock);
|
| 469 | return seq_list_start(&rv_monitors_list, *pos);
|
| 470 | }
|
| 471 |
|
| 472 | static void *available_monitors_next(struct seq_file *m, void *p, loff_t *pos)
|
| 473 | {
|
| 474 | return seq_list_next(p, &rv_monitors_list, pos);
|
| 475 | }
|
| 476 |
|
| 477 | |
| 478 | * Enable monitor seq functions.
|
| 479 |
|
| 480 | static void *enabled_monitors_next(struct seq_file *m, void *p, loff_t *pos)
|
| 481 | {
|
| 482 | struct rv_monitor *mon = container_of(p, struct rv_monitor, list);
|
| 483 |
|
| 484 | (*pos)++;
|
| 485 |
|
| 486 | list_for_each_entry_continue(mon, &rv_monitors_list, list) {
|
| 487 | if (mon->enabled)
|
| 488 | return &mon->list;
|
| 489 | }
|
| 490 |
|
| 491 | return NULL;
|
| 492 | }
|
| 493 |
|
| 494 | static void *enabled_monitors_start(struct seq_file *m, loff_t *pos)
|
| 495 | {
|
| 496 | struct list_head *head;
|
| 497 | loff_t l;
|
| 498 |
|
| 499 | mutex_lock(&rv_interface_lock);
|
| 500 |
|
| 501 | if (list_empty(&rv_monitors_list))
|
| 502 | return NULL;
|
| 503 |
|
| 504 | head = &rv_monitors_list;
|
| 505 |
|
| 506 | for (l = 0; l <= *pos; ) {
|
| 507 | head = enabled_monitors_next(m, head, &l);
|
| 508 | if (!head)
|
| 509 | break;
|
| 510 | }
|
| 511 |
|
| 512 | return head;
|
| 513 | }
|
| 514 |
|
| 515 | |
| 516 | * available/enabled monitors seq definition.
|
| 517 |
|
| 518 | static const struct seq_operations available_monitors_seq_ops = {
|
| 519 | .start = available_monitors_start,
|
| 520 | .next = available_monitors_next,
|
| 521 | .stop = monitors_stop,
|
| 522 | .show = monitors_show
|
| 523 | };
|
| 524 |
|
| 525 | static const struct seq_operations enabled_monitors_seq_ops = {
|
| 526 | .start = enabled_monitors_start,
|
| 527 | .next = enabled_monitors_next,
|
| 528 | .stop = monitors_stop,
|
| 529 | .show = monitors_show
|
| 530 | };
|
| 531 |
|
| 532 | |
| 533 | * available_monitors interface.
|
| 534 |
|
| 535 | static int available_monitors_open(struct inode *inode, struct file *file)
|
| 536 | {
|
| 537 | return seq_open(file, &available_monitors_seq_ops);
|
| 538 | };
|
| 539 |
|
| 540 | static const struct file_operations available_monitors_ops = {
|
| 541 | .open = available_monitors_open,
|
| 542 | .read = seq_read,
|
| 543 | .llseek = seq_lseek,
|
| 544 | .release = seq_release
|
| 545 | };
|
| 546 |
|
| 547 | |
| 548 | * enabled_monitors interface.
|
| 549 |
|
| 550 | static void disable_all_monitors(void)
|
| 551 | {
|
| 552 | struct rv_monitor *mon;
|
| 553 | int enabled = 0;
|
| 554 |
|
| 555 | guard(mutex)(&rv_interface_lock);
|
| 556 |
|
| 557 | list_for_each_entry(mon, &rv_monitors_list, list)
|
| 558 | enabled += __rv_disable_monitor(mon, false);
|
| 559 |
|
| 560 | if (enabled) {
|
| 561 | |
| 562 | * Wait for the execution of all events to finish.
|
| 563 | * Otherwise, the data used by the monitor could
|
| 564 | * be inconsistent. i.e., if the monitor is re-enabled.
|
| 565 |
|
| 566 | tracepoint_synchronize_unregister();
|
| 567 | }
|
| 568 | }
|
| 569 |
|
| 570 | static int enabled_monitors_open(struct inode *inode, struct file *file)
|
| 571 | {
|
| 572 | if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC))
|
| 573 | disable_all_monitors();
|
| 574 |
|
| 575 | return seq_open(file, &enabled_monitors_seq_ops);
|
| 576 | };
|
| 577 |
|
| 578 | static ssize_t enabled_monitors_write(struct file *filp, const char __user *user_buf,
|
| 579 | size_t count, loff_t *ppos)
|
| 580 | {
|
| 581 | char buff[MAX_RV_MONITOR_NAME_SIZE + 2];
|
| 582 | struct rv_monitor *mon;
|
| 583 | int retval = -EINVAL;
|
| 584 | bool enable = true;
|
| 585 | char *ptr, *tmp;
|
| 586 | int len;
|
| 587 |
|
| 588 | if (count < 1 || count > MAX_RV_MONITOR_NAME_SIZE + 1)
|
| 589 | return -EINVAL;
|
| 590 |
|
| 591 | memset(buff, 0, sizeof(buff));
|
| 592 |
|
| 593 | retval = simple_write_to_buffer(buff, sizeof(buff) - 1, ppos, user_buf, count);
|
| 594 | if (retval < 0)
|
| 595 | return -EFAULT;
|
| 596 |
|
| 597 | ptr = strim(buff);
|
| 598 |
|
| 599 | if (ptr[0] == '!') {
|
| 600 | enable = false;
|
| 601 | ptr++;
|
| 602 | }
|
| 603 |
|
| 604 | len = strlen(ptr);
|
| 605 | if (!len)
|
| 606 | return count;
|
| 607 |
|
| 608 | guard(mutex)(&rv_interface_lock);
|
| 609 |
|
| 610 | retval = -EINVAL;
|
| 611 |
|
| 612 |
|
| 613 | tmp = strstr(ptr, ":");
|
| 614 | if (tmp)
|
| 615 | ptr = tmp+1;
|
| 616 |
|
| 617 | list_for_each_entry(mon, &rv_monitors_list, list) {
|
| 618 | if (strcmp(ptr, mon->name) != 0)
|
| 619 | continue;
|
| 620 |
|
| 621 | |
| 622 | * Monitor found!
|
| 623 |
|
| 624 | if (enable)
|
| 625 | retval = rv_enable_monitor(mon);
|
| 626 | else
|
| 627 | retval = rv_disable_monitor(mon);
|
| 628 |
|
| 629 | if (retval)
|
| 630 | return retval;
|
| 631 | return count;
|
| 632 | }
|
| 633 |
|
| 634 | return retval;
|
| 635 | }
|
| 636 |
|
| 637 | static const struct file_operations enabled_monitors_ops = {
|
| 638 | .open = enabled_monitors_open,
|
| 639 | .read = seq_read,
|
| 640 | .write = enabled_monitors_write,
|
| 641 | .llseek = seq_lseek,
|
| 642 | .release = seq_release,
|
| 643 | };
|
| 644 |
|
| 645 | |
| 646 | * Monitoring on global switcher!
|
| 647 |
|
| 648 | static bool __read_mostly monitoring_on;
|
| 649 |
|
| 650 | |
| 651 | * rv_monitoring_on - checks if monitoring is on
|
| 652 | *
|
| 653 | * Returns 1 if on, 0 otherwise.
|
| 654 |
|
| 655 | bool rv_monitoring_on(void)
|
| 656 | {
|
| 657 | return READ_ONCE(monitoring_on);
|
| 658 | }
|
| 659 |
|
| 660 | |
| 661 | * monitoring_on general switcher.
|
| 662 |
|
| 663 | static ssize_t monitoring_on_read_data(struct file *filp, char __user *user_buf,
|
| 664 | size_t count, loff_t *ppos)
|
| 665 | {
|
| 666 | const char *buff;
|
| 667 |
|
| 668 | buff = rv_monitoring_on() ? "1\n" : "0\n";
|
| 669 |
|
| 670 | return simple_read_from_buffer(user_buf, count, ppos, buff, strlen(buff) + 1);
|
| 671 | }
|
| 672 |
|
| 673 | static void turn_monitoring_off(void)
|
| 674 | {
|
| 675 | WRITE_ONCE(monitoring_on, false);
|
| 676 | }
|
| 677 |
|
| 678 | static void reset_all_monitors(void)
|
| 679 | {
|
| 680 | struct rv_monitor *mon;
|
| 681 |
|
| 682 | list_for_each_entry(mon, &rv_monitors_list, list) {
|
| 683 | if (mon->enabled && mon->reset)
|
| 684 | mon->reset();
|
| 685 | }
|
| 686 | }
|
| 687 |
|
| 688 | static void turn_monitoring_on(void)
|
| 689 | {
|
| 690 | WRITE_ONCE(monitoring_on, true);
|
| 691 | }
|
| 692 |
|
| 693 | static void turn_monitoring_on_with_reset(void)
|
| 694 | {
|
| 695 | lockdep_assert_held(&rv_interface_lock);
|
| 696 |
|
| 697 | if (rv_monitoring_on())
|
| 698 | return;
|
| 699 |
|
| 700 | |
| 701 | * Monitors might be out of sync with the system if events were not
|
| 702 | * processed because of !rv_monitoring_on().
|
| 703 | *
|
| 704 | * Reset all monitors, forcing a re-sync.
|
| 705 |
|
| 706 | reset_all_monitors();
|
| 707 | turn_monitoring_on();
|
| 708 | }
|
| 709 |
|
| 710 | static ssize_t monitoring_on_write_data(struct file *filp, const char __user *user_buf,
|
| 711 | size_t count, loff_t *ppos)
|
| 712 | {
|
| 713 | int retval;
|
| 714 | bool val;
|
| 715 |
|
| 716 | retval = kstrtobool_from_user(user_buf, count, &val);
|
| 717 | if (retval)
|
| 718 | return retval;
|
| 719 |
|
| 720 | guard(mutex)(&rv_interface_lock);
|
| 721 |
|
| 722 | if (val)
|
| 723 | turn_monitoring_on_with_reset();
|
| 724 | else
|
| 725 | turn_monitoring_off();
|
| 726 |
|
| 727 | |
| 728 | * Wait for the execution of all events to finish
|
| 729 | * before returning to user-space.
|
| 730 |
|
| 731 | tracepoint_synchronize_unregister();
|
| 732 |
|
| 733 | return count;
|
| 734 | }
|
| 735 |
|
| 736 | static const struct file_operations monitoring_on_fops = {
|
| 737 | .open = simple_open,
|
| 738 | .write = monitoring_on_write_data,
|
| 739 | .read = monitoring_on_read_data,
|
| 740 | };
|
| 741 |
|
| 742 | static void destroy_monitor_dir(struct rv_monitor *mon)
|
| 743 | {
|
| 744 | rv_remove(mon->root_d);
|
| 745 | }
|
| 746 |
|
| 747 | |
| 748 | * rv_register_monitor - register a rv monitor.
|
| 749 | * @monitor: The rv_monitor to be registered.
|
| 750 | * @parent: The parent of the monitor to be registered, NULL if not nested.
|
| 751 | *
|
| 752 | * Returns 0 if successful, error otherwise.
|
| 753 |
|
| 754 | int rv_register_monitor(struct rv_monitor *monitor, struct rv_monitor *parent)
|
| 755 | {
|
| 756 | struct rv_monitor *r;
|
| 757 | int retval = 0;
|
| 758 |
|
| 759 | if (strlen(monitor->name) >= MAX_RV_MONITOR_NAME_SIZE) {
|
| 760 | pr_info("Monitor %s has a name longer than %d\n", monitor->name,
|
| 761 | MAX_RV_MONITOR_NAME_SIZE);
|
| 762 | return -EINVAL;
|
| 763 | }
|
| 764 |
|
| 765 | guard(mutex)(&rv_interface_lock);
|
| 766 |
|
| 767 | list_for_each_entry(r, &rv_monitors_list, list) {
|
| 768 | if (strcmp(monitor->name, r->name) == 0) {
|
| 769 | pr_info("Monitor %s is already registered\n", monitor->name);
|
| 770 | return -EEXIST;
|
| 771 | }
|
| 772 | }
|
| 773 |
|
| 774 | if (parent && rv_is_nested_monitor(parent)) {
|
| 775 | pr_info("Parent monitor %s is already nested, cannot nest further\n",
|
| 776 | parent->name);
|
| 777 | return -EINVAL;
|
| 778 | }
|
| 779 |
|
| 780 | monitor->parent = parent;
|
| 781 |
|
| 782 | retval = create_monitor_dir(monitor, parent);
|
| 783 | if (retval)
|
| 784 | return retval;
|
| 785 |
|
| 786 |
|
| 787 | if (parent)
|
| 788 | list_add(&monitor->list, &parent->list);
|
| 789 | else
|
| 790 | list_add_tail(&monitor->list, &rv_monitors_list);
|
| 791 |
|
| 792 | return 0;
|
| 793 | }
|
| 794 |
|
| 795 | |
| 796 | * rv_unregister_monitor - unregister a rv monitor.
|
| 797 | * @monitor: The rv_monitor to be unregistered.
|
| 798 | *
|
| 799 | * Returns 0 if successful, error otherwise.
|
| 800 |
|
| 801 | int rv_unregister_monitor(struct rv_monitor *monitor)
|
| 802 | {
|
| 803 | guard(mutex)(&rv_interface_lock);
|
| 804 |
|
| 805 | rv_disable_monitor(monitor);
|
| 806 | list_del(&monitor->list);
|
| 807 | destroy_monitor_dir(monitor);
|
| 808 |
|
| 809 | return 0;
|
| 810 | }
|
| 811 |
|
| 812 | int __init rv_init_interface(void)
|
| 813 | {
|
| 814 | struct dentry *tmp;
|
| 815 | int retval;
|
| 816 | struct dentry *root_dir __free(rv_remove) = rv_create_dir("rv", NULL);
|
| 817 |
|
| 818 | if (!root_dir)
|
| 819 | return 1;
|
| 820 |
|
| 821 | rv_root.monitors_dir = rv_create_dir("monitors", root_dir);
|
| 822 | if (!rv_root.monitors_dir)
|
| 823 | return 1;
|
| 824 |
|
| 825 | tmp = rv_create_file("available_monitors", RV_MODE_READ, root_dir, NULL,
|
| 826 | &available_monitors_ops);
|
| 827 | if (!tmp)
|
| 828 | return 1;
|
| 829 |
|
| 830 | tmp = rv_create_file("enabled_monitors", RV_MODE_WRITE, root_dir, NULL,
|
| 831 | &enabled_monitors_ops);
|
| 832 | if (!tmp)
|
| 833 | return 1;
|
| 834 |
|
| 835 | tmp = rv_create_file("monitoring_on", RV_MODE_WRITE, root_dir, NULL,
|
| 836 | &monitoring_on_fops);
|
| 837 | if (!tmp)
|
| 838 | return 1;
|
| 839 | retval = init_rv_reactors(root_dir);
|
| 840 | if (retval)
|
| 841 | return 1;
|
| 842 |
|
| 843 | turn_monitoring_on();
|
| 844 |
|
| 845 | rv_root.root_dir = no_free_ptr(root_dir);
|
| 846 |
|
| 847 | return 0;
|
| 848 | }
|
| 849 |
|
| 850 | #if IS_ENABLED(CONFIG_RV_MONITORS_KUNIT_TEST)
|
| 851 | #include <rv/kunit.h>
|
| 852 | #include <kunit/visibility.h>
|
| 853 |
|
| 854 | |
| 855 | * rv_set_testing - ensure mutual exclusion between KUnit tests and real monitors
|
| 856 | *
|
| 857 | * KUnit tests for RV monitors rely on stubs that are incompatible with
|
| 858 | * the execution of real monitors. Ensure mutual exclusion by acquiring
|
| 859 | * the rv_interface_lock for the duration of the suite.
|
| 860 | *
|
| 861 | * Returns 0 on success, -EBUSY if any real monitor is already enabled.
|
| 862 |
|
| 863 | int rv_set_testing(struct kunit_suite *suite)
|
| 864 | {
|
| 865 | struct rv_monitor *mon;
|
| 866 |
|
| 867 | mutex_lock(&rv_interface_lock);
|
| 868 |
|
| 869 | list_for_each_entry(mon, &rv_monitors_list, list) {
|
| 870 | if (mon->enabled) {
|
| 871 | mutex_unlock(&rv_interface_lock);
|
| 872 | return -EBUSY;
|
| 873 | }
|
| 874 | }
|
| 875 |
|
| 876 | return 0;
|
| 877 | }
|
| 878 | EXPORT_SYMBOL_IF_KUNIT(rv_set_testing);
|
| 879 |
|
| 880 | |
| 881 | * rv_clear_testing - allow real monitors to run again after KUnit tests
|
| 882 |
|
| 883 | void rv_clear_testing(struct kunit_suite *suite)
|
| 884 | {
|
| 885 | mutex_unlock(&rv_interface_lock);
|
| 886 | }
|
| 887 | EXPORT_SYMBOL_IF_KUNIT(rv_clear_testing);
|
| 888 |
|
| 889 | |
| 890 | * rv_get_mock_current() is called only if we are running from a KUnit test.
|
| 891 | * This can occur from a legitimate RV test or any unrelated test running when
|
| 892 | * a real RV monitor is active and triggering events.
|
| 893 | * We assume the former case is the only one where mock_current is not NULL and
|
| 894 | * can occur only sequentially (KUnit doesn't run tests in parallel).
|
| 895 | * We cannot rely on the test's context because there is no way to safely
|
| 896 | * understand from which test we are running and KUnit utilities require
|
| 897 | * locking, which is unsafe from NMI or scheduling context.
|
| 898 | * Note that it is not possible for a real RV monitor to run when the RV KUnit
|
| 899 | * tests are running (see rv_set_testing()).
|
| 900 |
|
| 901 | static struct task_struct *mock_current;
|
| 902 |
|
| 903 | void rv_mock_current(struct task_struct *tsk)
|
| 904 | {
|
| 905 | mock_current = tsk;
|
| 906 | }
|
| 907 | EXPORT_SYMBOL_IF_KUNIT(rv_mock_current);
|
| 908 |
|
| 909 | struct task_struct *rv_get_mock_current(void)
|
| 910 | {
|
| 911 | return mock_current ?: current;
|
| 912 | }
|
| 913 | EXPORT_SYMBOL_GPL(rv_get_mock_current);
|
| 914 | #endif
|