ring-buffer: Add persistent ring buffer invalid-page inject test

Add a self-corrupting test for the persistent ring buffer.

This will inject an erroneous value to some sub-buffer pages (where
the index is even or multiples of 5) in the persistent ring buffer
when the kernel panics, and checks whether the number of detected
invalid pages and the total entry_bytes are the same as the recorded
values after reboot.

This ensures that the kernel can correctly recover a partially
corrupted persistent ring buffer after a reboot or panic.

The test only runs on the persistent ring buffer whose name is
"ptracingtest". The user has to fill it with events before a
kernel panic.

To run the test, enable CONFIG_RING_BUFFER_PERSISTENT_INJECT
and add the following kernel cmdline:

 reserve_mem=20M:2M:trace trace_instance=ptracingtest^traceoff@trace
 panic=1

Run the following commands after the 1st boot:

 cd /sys/kernel/tracing/instances/ptracingtest
 echo 1 > tracing_on
 echo 1 > events/enable
 sleep 3
 echo c > /proc/sysrq-trigger

After panic message, the kernel will reboot and run the verification
on the persistent ring buffer, e.g.

 Ring buffer meta [2] invalid buffer page detected
 Ring buffer meta [2] is from previous boot! (318 pages discarded)
 Ring buffer testing [2] invalid pages: PASSED (318/318)
 Ring buffer testing [2] entry_bytes: PASSED (1300476/1300476)

Link: https://patch.msgid.link/20260522171051.260140328@kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index 994f52b34344006c4b52ce1cc742ef6335b0d591..0670742b2d6013519ca26644e58a385b8734210c 100644 (file)
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -238,6 +238,7 @@ int ring_buffer_subbuf_size_get(struct trace_buffer *buffer);
 
 enum ring_buffer_flags {
        RB_FL_OVERWRITE         = 1 << 0,
+       RB_FL_TESTING           = 1 << 1,
 };
 
 #ifdef CONFIG_RING_BUFFER

diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index e130da35808f4178ff567706335ff9b2c50bf930..084f34dc6c9f3b0a5a4854d0bdbfead17ae35efc 100644 (file)
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -1202,6 +1202,40 @@ config RING_BUFFER_VALIDATE_TIME_DELTAS
          Only say Y if you understand what this does, and you
          still want it enabled. Otherwise say N
 
+config RING_BUFFER_PERSISTENT_INJECT
+       bool "Enable persistent ring buffer error injection test"
+       depends on RING_BUFFER
+       help
+         This option will have the kernel check if the persistent ring
+         buffer is named "ptracingtest". and if so, it will corrupt some
+         of its pages on a kernel panic. This is used to test if the
+         persistent ring buffer can recover from some of its sub-buffers
+         being corrupted.
+         To use this, boot a kernel with a "ptracingtest" persistent
+         ring buffer, e.g.
+
+          reserve_mem=20M:2M:trace trace_instance=ptracingtest@trace panic=1
+
+         And after the 1st boot, run the following commands:
+
+          cd /sys/kernel/tracing/instances/ptracingtest
+          echo 1 > events/enable
+          echo 1 > tracing_on
+          sleep 3
+          echo c > /proc/sysrq-trigger
+
+         After the panic message, the kernel will reboot and will show
+         the test results in the console output.
+
+         Note that events for the test ring buffer needs to be enabled
+         prior to crashing the kernel so that the ring buffer has content
+         that the test will corrupt.
+         As the test will corrupt events in the "ptracingtest" persistent
+         ring buffer, it should not be used for any other purpose other
+         than this test.
+
+         If unsure, say N
+
 config MMIOTRACE_TEST
        tristate "Test module for mmiotrace"
        depends on MMIOTRACE && m

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index c10cf4ba91d683c7758a7736c36d92b4d7492c4e..dc603d9c94148e6f8a165de6a5788006253c412f 100644 (file)
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -64,6 +64,10 @@ struct ring_buffer_cpu_meta {
        unsigned long   commit_buffer;
        __u32           subbuf_size;
        __u32           nr_subbufs;
+#ifdef CONFIG_RING_BUFFER_PERSISTENT_INJECT
+       __u32           nr_invalid;
+       __u32           entry_bytes;
+#endif
        int             buffers[];
 };
 
@@ -2101,6 +2105,21 @@ static void rb_meta_validate_events(struct ring_buffer_per_cpu *cpu_buffer)
        if (discarded)
                pr_cont(" (%d pages discarded)", discarded);
        pr_cont("\n");
+
+#ifdef CONFIG_RING_BUFFER_PERSISTENT_INJECT
+       if (meta->nr_invalid)
+               pr_warn("Ring buffer testing [%d] invalid pages: %s (%d/%d)\n",
+                       cpu_buffer->cpu,
+                       (discarded == meta->nr_invalid) ? "PASSED" : "FAILED",
+                       discarded, meta->nr_invalid);
+       if (meta->entry_bytes)
+               pr_warn("Ring buffer testing [%d] entry_bytes: %s (%ld/%ld)\n",
+                       cpu_buffer->cpu,
+                       (entry_bytes == meta->entry_bytes) ? "PASSED" : "FAILED",
+                       (long)entry_bytes, (long)meta->entry_bytes);
+       meta->nr_invalid = 0;
+       meta->entry_bytes = 0;
+#endif
        return;
 
  invalid:
@@ -2581,12 +2600,72 @@ static void rb_free_cpu_buffer(struct ring_buffer_per_cpu *cpu_buffer)
        kfree(cpu_buffer);
 }
 
+#ifdef CONFIG_RING_BUFFER_PERSISTENT_INJECT
+static void rb_test_inject_invalid_pages(struct trace_buffer *buffer)
+{
+       struct ring_buffer_per_cpu *cpu_buffer;
+       struct ring_buffer_cpu_meta *meta;
+       struct buffer_data_page *dpage;
+       unsigned long entry_bytes = 0;
+       unsigned long ptr;
+       int subbuf_size;
+       int invalid = 0;
+       int cpu;
+       int i;
+
+       if (!(buffer->flags & RB_FL_TESTING))
+               return;
+
+       guard(preempt)();
+       cpu = smp_processor_id();
+
+       cpu_buffer = buffer->buffers[cpu];
+       if (!cpu_buffer)
+               return;
+       meta = cpu_buffer->ring_meta;
+       if (!meta)
+               return;
+
+       ptr = (unsigned long)rb_subbufs_from_meta(meta);
+       subbuf_size = meta->subbuf_size;
+
+       for (i = 0; i < meta->nr_subbufs; i++) {
+               unsigned long idx = meta->buffers[i];
+
+               dpage = (void *)(ptr + idx * subbuf_size);
+               /* Skip unused pages */
+               if (!local_read(&dpage->commit))
+                       continue;
+
+               /*
+                * Invalidate even pages or multiples of 5. This will cause 3
+                * contiguous invalidated(empty) pages.
+                */
+               if (!(i & 0x1) || !(i % 5)) {
+                       local_add(subbuf_size + 1, &dpage->commit);
+                       invalid++;
+               } else {
+                       /* Count total commit bytes. */
+                       entry_bytes += local_read(&dpage->commit) & ~RB_MISSED_MASK;
+               }
+       }
+
+       pr_info("Inject invalidated %d pages on CPU%d, total size: %ld\n",
+               invalid, cpu, (long)entry_bytes);
+       meta->nr_invalid = invalid;
+       meta->entry_bytes = entry_bytes;
+}
+#else /* !CONFIG_RING_BUFFER_PERSISTENT_INJECT */
+#define rb_test_inject_invalid_pages(buffer)   do { } while (0)
+#endif
+
 /* Stop recording on a persistent buffer and flush cache if needed. */
 static int rb_flush_buffer_cb(struct notifier_block *nb, unsigned long event, void *data)
 {
        struct trace_buffer *buffer = container_of(nb, struct trace_buffer, flush_nb);
 
        ring_buffer_record_off(buffer);
+       rb_test_inject_invalid_pages(buffer);
        arch_ring_buffer_flush_range(buffer->range_addr_start, buffer->range_addr_end);
        return NOTIFY_DONE;
 }

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 6eb4d3097a4d54c84cdfc74e6654272d8a640dfd..4573f65d68ceb2546dabfc08a09020fbadbeb453 100644 (file)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -8383,6 +8383,8 @@ static void setup_trace_scratch(struct trace_array *tr,
        memset(tscratch, 0, size);
 }
 
+#define TRACE_TEST_PTRACING_NAME       "ptracingtest"
+
 int allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, int size)
 {
        enum ring_buffer_flags rb_flags;
@@ -8394,6 +8396,8 @@ int allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, int
        buf->tr = tr;
 
        if (tr->range_addr_start && tr->range_addr_size) {
+               if (tr->name && !strcmp(tr->name, TRACE_TEST_PTRACING_NAME))
+                       rb_flags |= RB_FL_TESTING;
                /* Add scratch buffer to handle 128 modules */
                buf->buffer = ring_buffer_alloc_range(size, rb_flags, 0,
                                                      tr->range_addr_start,