libtracefs(3) Manual Page

#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>

#include <tracefs.h>

static struct tep_event *open_event;
static struct tep_format_field *file_field;

static struct tep_event *openret_event;
static struct tep_format_field *ret_field;

static int callback(struct tep_event *event, struct tep_record *record,
                    int cpu, void *data)
{
        struct trace_seq seq;

        trace_seq_init(&seq);
        tep_print_event(event->tep, &seq, record, "%d-%s: ", TEP_PRINT_PID, TEP_PRINT_COMM);

        if (event->id == open_event->id) {
                trace_seq_puts(&seq, "open file='");
                tep_print_field(&seq, record->data, file_field);
                trace_seq_puts(&seq, "'\n");
        } else if (event->id == openret_event->id) {
                unsigned long long ret;
                tep_read_number_field(ret_field, record->data, &ret);
                trace_seq_printf(&seq, "open ret=%lld\n", ret);
        } else {
                goto out;
        }

        trace_seq_terminate(&seq);
        trace_seq_do_printf(&seq);
out:
        trace_seq_destroy(&seq);

        return 0;
}

static pid_t run_exec(char **argv, char **env)
{
        pid_t pid;

        pid = fork();
        if (pid)
                return pid;

        execve(argv[0], argv, env);
        perror("exec");
        exit(-1);
}

const char *mykprobe = "my_kprobes";

enum kprobe_type {
        KPROBE,
        KRETPROBE,
};

static void __kprobe_create(enum kprobe_type type, const char *event,
                            const char *addr, const char *fmt)
{
        char *err;
        int r;

        if (type == KPROBE)
                r = tracefs_kprobe_raw(mykprobe, event, addr, fmt);
        else
                r = tracefs_kretprobe_raw(mykprobe, event, addr, fmt);
        if (r < 0) {
                err = tracefs_error_last(NULL);
                perror("Failed to create kprobe:");
                if (err && strlen(err))
                        fprintf(stderr, "%s\n", err);
        }
}

static void kprobe_create(const char *event, const char *addr,
                          const char *fmt)
{
        __kprobe_create(KPROBE, event, addr, fmt);
}

static void kretprobe_create(const char *event, const char *addr,
                             const char *fmt)
{
        __kprobe_create(KRETPROBE, event, addr, fmt);
}

int main (int argc, char **argv, char **env)
{
        struct tracefs_instance *instance;
        struct tep_handle *tep;
        const char *sysnames[] = { mykprobe, NULL };
        pid_t pid;

        if (argc < 2) {
                printf("usage: %s command\n", argv[0]);
                exit(-1);
        }

        instance = tracefs_instance_create("exec_open");
        if (!instance) {
                perror("creating instance");
                exit(-1);
        }

        tracefs_dynevent_destroy_all(TRACEFS_DYNEVENT_KPROBE | TRACEFS_DYNEVENT_KRETPROBE, true);

        kprobe_create("open", "do_sys_openat2",
                      "file=+0($arg2):ustring flags=+0($arg3):x64 mode=+8($arg3):x64\n");

        kretprobe_create("openret", "do_sys_openat2", "ret=%ax");

        tep = tracefs_local_events_system(NULL, sysnames);
        if (!tep) {
                perror("reading events");
                exit(-1);
        }
        open_event = tep_find_event_by_name(tep, mykprobe, "open");
        file_field = tep_find_field(open_event, "file");

        openret_event = tep_find_event_by_name(tep, mykprobe, "openret");
        ret_field = tep_find_field(openret_event, "ret");

        tracefs_event_enable(instance, mykprobe, NULL);
        pid = run_exec(&argv[1], env);

        /* Let the child start to run */
        sched_yield();

        do {
                tracefs_load_cmdlines(NULL, tep);
                tracefs_iterate_raw_events(tep, instance, NULL, 0, callback, NULL);
        } while (waitpid(pid, NULL, WNOHANG) != pid);

        /* Will disable the events */
        tracefs_dynevent_destroy_all(TRACEFS_DYNEVENT_KPROBE | TRACEFS_DYNEVENT_KRETPROBE, true);
        tracefs_instance_destroy(instance);
        tep_free(tep);

        return 0;
}