4 * LTTng syscall probes.
6 * Copyright (C) 2010-2012 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; only
11 * version 2.1 of the License.
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
23 #include <linux/module.h>
24 #include <linux/slab.h>
25 #include <linux/compat.h>
26 #include <linux/err.h>
27 #include <linux/bitmap.h>
29 #include <linux/in6.h>
30 #include <linux/seq_file.h>
31 #include <linux/stringify.h>
32 #include <linux/file.h>
33 #include <linux/anon_inodes.h>
34 #include <asm/ptrace.h>
35 #include <asm/syscall.h>
37 #include <lib/bitfield.h>
38 #include <wrapper/tracepoint.h>
39 #include <wrapper/file.h>
40 #include <wrapper/rcu.h>
41 #include <wrapper/syscall.h>
42 #include <lttng-events.h>
45 # ifndef is_compat_task
46 # define is_compat_task() (0)
50 /* in_compat_syscall appears in kernel 4.6. */
51 #ifndef in_compat_syscall
52 #define in_compat_syscall() is_compat_task()
62 #define SYSCALL_ENTRY_TOK syscall_entry_
63 #define COMPAT_SYSCALL_ENTRY_TOK compat_syscall_entry_
64 #define SYSCALL_EXIT_TOK syscall_exit_
65 #define COMPAT_SYSCALL_EXIT_TOK compat_syscall_exit_
67 #define SYSCALL_ENTRY_STR __stringify(SYSCALL_ENTRY_TOK)
68 #define COMPAT_SYSCALL_ENTRY_STR __stringify(COMPAT_SYSCALL_ENTRY_TOK)
69 #define SYSCALL_EXIT_STR __stringify(SYSCALL_EXIT_TOK)
70 #define COMPAT_SYSCALL_EXIT_STR __stringify(COMPAT_SYSCALL_EXIT_TOK)
73 void syscall_entry_probe(void *__data
, struct pt_regs
*regs
, long id
);
75 void syscall_exit_probe(void *__data
, struct pt_regs
*regs
, long ret
);
78 * Forward declarations for old kernels.
82 struct oldold_utsname
;
84 struct sel_arg_struct
;
85 struct mmap_arg_struct
;
90 * Forward declaration for kernels >= 5.6
97 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,6,0))
98 typedef __kernel_old_time_t
time_t;
101 #ifdef IA32_NR_syscalls
102 #define NR_compat_syscalls IA32_NR_syscalls
104 #define NR_compat_syscalls NR_syscalls
108 * Create LTTng tracepoint probes.
110 #define LTTNG_PACKAGE_BUILD
111 #define CREATE_TRACE_POINTS
112 #define TP_MODULE_NOINIT
113 #define TRACE_INCLUDE_PATH instrumentation/syscalls/headers
115 #define PARAMS(args...) args
117 /* Handle unknown syscalls */
119 #define TRACE_SYSTEM syscalls_unknown
120 #include <instrumentation/syscalls/headers/syscalls_unknown.h>
128 #define sc_in(...) __VA_ARGS__
132 #define sc_inout(...) __VA_ARGS__
134 /* Hijack probe callback for system call enter */
136 #define TP_PROBE_CB(_template) &syscall_entry_probe
137 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
138 LTTNG_TRACEPOINT_EVENT(syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
140 #define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
141 LTTNG_TRACEPOINT_EVENT_CODE(syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
142 PARAMS(_locvar), PARAMS(_code_pre), \
143 PARAMS(_fields), PARAMS(_code_post))
144 #define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
145 LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(syscall_entry_##_name, PARAMS(_fields))
146 #define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name) \
147 LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(syscall_entry_##_template, syscall_entry_##_name)
148 /* Enumerations only defined at first inclusion. */
149 #define SC_LTTNG_TRACEPOINT_ENUM(_name, _values) \
150 LTTNG_TRACEPOINT_ENUM(_name, PARAMS(_values))
152 #define TRACE_SYSTEM syscall_entry_integers
153 #define TRACE_INCLUDE_FILE syscalls_integers
154 #include <instrumentation/syscalls/headers/syscalls_integers.h>
155 #undef TRACE_INCLUDE_FILE
157 #define TRACE_SYSTEM syscall_entry_pointers
158 #define TRACE_INCLUDE_FILE syscalls_pointers
159 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
160 #undef TRACE_INCLUDE_FILE
162 #undef SC_LTTNG_TRACEPOINT_ENUM
163 #undef SC_LTTNG_TRACEPOINT_EVENT_CODE
164 #undef SC_LTTNG_TRACEPOINT_EVENT
165 #undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
166 #undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
168 #undef _TRACE_SYSCALLS_INTEGERS_H
169 #undef _TRACE_SYSCALLS_POINTERS_H
171 /* Hijack probe callback for compat system call enter */
172 #define TP_PROBE_CB(_template) &syscall_entry_probe
173 #define LTTNG_SC_COMPAT
174 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
175 LTTNG_TRACEPOINT_EVENT(compat_syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
177 #define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
178 LTTNG_TRACEPOINT_EVENT_CODE(compat_syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
179 PARAMS(_locvar), PARAMS(_code_pre), PARAMS(_fields), PARAMS(_code_post))
180 #define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
181 LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(compat_syscall_entry_##_name, PARAMS(_fields))
182 #define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name) \
183 LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(compat_syscall_entry_##_template, \
184 compat_syscall_entry_##_name)
185 /* Enumerations only defined at inital inclusion (not here). */
186 #define SC_LTTNG_TRACEPOINT_ENUM(_name, _values)
187 #define TRACE_SYSTEM compat_syscall_entry_integers
188 #define TRACE_INCLUDE_FILE compat_syscalls_integers
189 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
190 #undef TRACE_INCLUDE_FILE
192 #define TRACE_SYSTEM compat_syscall_entry_pointers
193 #define TRACE_INCLUDE_FILE compat_syscalls_pointers
194 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
195 #undef TRACE_INCLUDE_FILE
197 #undef SC_LTTNG_TRACEPOINT_ENUM
198 #undef SC_LTTNG_TRACEPOINT_EVENT_CODE
199 #undef SC_LTTNG_TRACEPOINT_EVENT
200 #undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
201 #undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
203 #undef _TRACE_SYSCALLS_INTEGERS_H
204 #undef _TRACE_SYSCALLS_POINTERS_H
205 #undef LTTNG_SC_COMPAT
212 #define sc_exit(...) __VA_ARGS__
216 #define sc_out(...) __VA_ARGS__
218 #define sc_inout(...) __VA_ARGS__
220 /* Hijack probe callback for system call exit */
221 #define TP_PROBE_CB(_template) &syscall_exit_probe
222 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
223 LTTNG_TRACEPOINT_EVENT(syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
225 #define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
226 LTTNG_TRACEPOINT_EVENT_CODE(syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
227 PARAMS(_locvar), PARAMS(_code_pre), PARAMS(_fields), PARAMS(_code_post))
228 #define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
229 LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(syscall_exit_##_name, PARAMS(_fields))
230 #define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name) \
231 LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(syscall_exit_##_template, \
232 syscall_exit_##_name)
233 /* Enumerations only defined at inital inclusion (not here). */
234 #define SC_LTTNG_TRACEPOINT_ENUM(_name, _values)
235 #define TRACE_SYSTEM syscall_exit_integers
236 #define TRACE_INCLUDE_FILE syscalls_integers
237 #include <instrumentation/syscalls/headers/syscalls_integers.h>
238 #undef TRACE_INCLUDE_FILE
240 #define TRACE_SYSTEM syscall_exit_pointers
241 #define TRACE_INCLUDE_FILE syscalls_pointers
242 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
243 #undef TRACE_INCLUDE_FILE
245 #undef SC_LTTNG_TRACEPOINT_ENUM
246 #undef SC_LTTNG_TRACEPOINT_EVENT_CODE
247 #undef SC_LTTNG_TRACEPOINT_EVENT
248 #undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
249 #undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
251 #undef _TRACE_SYSCALLS_INTEGERS_H
252 #undef _TRACE_SYSCALLS_POINTERS_H
255 /* Hijack probe callback for compat system call exit */
256 #define TP_PROBE_CB(_template) &syscall_exit_probe
257 #define LTTNG_SC_COMPAT
258 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
259 LTTNG_TRACEPOINT_EVENT(compat_syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
261 #define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
262 LTTNG_TRACEPOINT_EVENT_CODE(compat_syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
263 PARAMS(_locvar), PARAMS(_code_pre), PARAMS(_fields), PARAMS(_code_post))
264 #define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
265 LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(compat_syscall_exit_##_name, PARAMS(_fields))
266 #define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name) \
267 LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(compat_syscall_exit_##_template, \
268 compat_syscall_exit_##_name)
269 /* Enumerations only defined at inital inclusion (not here). */
270 #define SC_LTTNG_TRACEPOINT_ENUM(_name, _values)
271 #define TRACE_SYSTEM compat_syscall_exit_integers
272 #define TRACE_INCLUDE_FILE compat_syscalls_integers
273 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
274 #undef TRACE_INCLUDE_FILE
276 #define TRACE_SYSTEM compat_syscall_exit_pointers
277 #define TRACE_INCLUDE_FILE compat_syscalls_pointers
278 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
279 #undef TRACE_INCLUDE_FILE
281 #undef SC_LTTNG_TRACEPOINT_ENUM
282 #undef SC_LTTNG_TRACEPOINT_EVENT_CODE
283 #undef SC_LTTNG_TRACEPOINT_EVENT
284 #undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
285 #undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
287 #undef _TRACE_SYSCALLS_INTEGERS_H
288 #undef _TRACE_SYSCALLS_POINTERS_H
289 #undef LTTNG_SC_COMPAT
293 #undef TP_MODULE_NOINIT
294 #undef LTTNG_PACKAGE_BUILD
295 #undef CREATE_TRACE_POINTS
297 struct trace_syscall_entry
{
299 const struct lttng_event_desc
*desc
;
300 const struct lttng_event_field
*fields
;
304 #define CREATE_SYSCALL_TABLE
311 #undef TRACE_SYSCALL_TABLE
312 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs) \
314 .func = __event_probe__syscall_entry_##_template, \
315 .nrargs = (_nrargs), \
316 .fields = __event_fields___syscall_entry_##_template, \
317 .desc = &__event_desc___syscall_entry_##_name, \
320 /* Syscall enter tracing table */
321 static const struct trace_syscall_entry sc_table
[] = {
322 #include <instrumentation/syscalls/headers/syscalls_integers.h>
323 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
326 #undef TRACE_SYSCALL_TABLE
327 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs) \
329 .func = __event_probe__compat_syscall_entry_##_template, \
330 .nrargs = (_nrargs), \
331 .fields = __event_fields___compat_syscall_entry_##_template, \
332 .desc = &__event_desc___compat_syscall_entry_##_name, \
335 /* Compat syscall enter table */
336 const struct trace_syscall_entry compat_sc_table
[] = {
337 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
338 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
346 #define sc_exit(...) __VA_ARGS__
348 #undef TRACE_SYSCALL_TABLE
349 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs) \
351 .func = __event_probe__syscall_exit_##_template, \
352 .nrargs = (_nrargs), \
353 .fields = __event_fields___syscall_exit_##_template, \
354 .desc = &__event_desc___syscall_exit_##_name, \
357 /* Syscall exit table */
358 static const struct trace_syscall_entry sc_exit_table
[] = {
359 #include <instrumentation/syscalls/headers/syscalls_integers.h>
360 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
363 #undef TRACE_SYSCALL_TABLE
364 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs) \
366 .func = __event_probe__compat_syscall_exit_##_template, \
367 .nrargs = (_nrargs), \
368 .fields = __event_fields___compat_syscall_exit_##_template, \
369 .desc = &__event_desc___compat_syscall_exit_##_name, \
372 /* Compat syscall exit table */
373 const struct trace_syscall_entry compat_sc_exit_table
[] = {
374 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
375 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
380 #undef CREATE_SYSCALL_TABLE
382 struct lttng_syscall_filter
{
383 DECLARE_BITMAP(sc
, NR_syscalls
);
384 DECLARE_BITMAP(sc_compat
, NR_compat_syscalls
);
387 static void syscall_entry_unknown(struct lttng_event
*event
,
388 struct pt_regs
*regs
, unsigned int id
)
390 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
392 lttng_syscall_get_arguments(current
, regs
, args
);
393 if (unlikely(in_compat_syscall()))
394 __event_probe__compat_syscall_entry_unknown(event
, id
, args
);
396 __event_probe__syscall_entry_unknown(event
, id
, args
);
399 void syscall_entry_probe(void *__data
, struct pt_regs
*regs
, long id
)
401 struct lttng_channel
*chan
= __data
;
402 struct lttng_event
*event
, *unknown_event
;
403 const struct trace_syscall_entry
*table
, *entry
;
406 if (unlikely(in_compat_syscall())) {
407 struct lttng_syscall_filter
*filter
;
409 filter
= lttng_rcu_dereference(chan
->sc_filter
);
411 if (id
< 0 || id
>= NR_compat_syscalls
412 || !test_bit(id
, filter
->sc_compat
)) {
413 /* System call filtered out. */
417 table
= compat_sc_table
;
418 table_len
= ARRAY_SIZE(compat_sc_table
);
419 unknown_event
= chan
->sc_compat_unknown
;
421 struct lttng_syscall_filter
*filter
;
423 filter
= lttng_rcu_dereference(chan
->sc_filter
);
425 if (id
< 0 || id
>= NR_syscalls
426 || !test_bit(id
, filter
->sc
)) {
427 /* System call filtered out. */
432 table_len
= ARRAY_SIZE(sc_table
);
433 unknown_event
= chan
->sc_unknown
;
435 if (unlikely(id
< 0 || id
>= table_len
)) {
436 syscall_entry_unknown(unknown_event
, regs
, id
);
439 if (unlikely(in_compat_syscall()))
440 event
= chan
->compat_sc_table
[id
];
442 event
= chan
->sc_table
[id
];
443 if (unlikely(!event
)) {
444 syscall_entry_unknown(unknown_event
, regs
, id
);
448 WARN_ON_ONCE(!entry
);
450 switch (entry
->nrargs
) {
453 void (*fptr
)(void *__data
) = entry
->func
;
460 void (*fptr
)(void *__data
, unsigned long arg0
) = entry
->func
;
461 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
463 lttng_syscall_get_arguments(current
, regs
, args
);
464 fptr(event
, args
[0]);
469 void (*fptr
)(void *__data
,
471 unsigned long arg1
) = entry
->func
;
472 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
474 lttng_syscall_get_arguments(current
, regs
, args
);
475 fptr(event
, args
[0], args
[1]);
480 void (*fptr
)(void *__data
,
483 unsigned long arg2
) = entry
->func
;
484 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
486 lttng_syscall_get_arguments(current
, regs
, args
);
487 fptr(event
, args
[0], args
[1], args
[2]);
492 void (*fptr
)(void *__data
,
496 unsigned long arg3
) = entry
->func
;
497 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
499 lttng_syscall_get_arguments(current
, regs
, args
);
500 fptr(event
, args
[0], args
[1], args
[2], args
[3]);
505 void (*fptr
)(void *__data
,
510 unsigned long arg4
) = entry
->func
;
511 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
513 lttng_syscall_get_arguments(current
, regs
, args
);
514 fptr(event
, args
[0], args
[1], args
[2], args
[3], args
[4]);
519 void (*fptr
)(void *__data
,
525 unsigned long arg5
) = entry
->func
;
526 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
528 lttng_syscall_get_arguments(current
, regs
, args
);
529 fptr(event
, args
[0], args
[1], args
[2],
530 args
[3], args
[4], args
[5]);
538 static void syscall_exit_unknown(struct lttng_event
*event
,
539 struct pt_regs
*regs
, int id
, long ret
)
541 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
543 lttng_syscall_get_arguments(current
, regs
, args
);
544 if (unlikely(in_compat_syscall()))
545 __event_probe__compat_syscall_exit_unknown(event
, id
, ret
,
548 __event_probe__syscall_exit_unknown(event
, id
, ret
, args
);
551 void syscall_exit_probe(void *__data
, struct pt_regs
*regs
, long ret
)
553 struct lttng_channel
*chan
= __data
;
554 struct lttng_event
*event
, *unknown_event
;
555 const struct trace_syscall_entry
*table
, *entry
;
559 id
= syscall_get_nr(current
, regs
);
560 if (unlikely(in_compat_syscall())) {
561 struct lttng_syscall_filter
*filter
;
563 filter
= lttng_rcu_dereference(chan
->sc_filter
);
565 if (id
< 0 || id
>= NR_compat_syscalls
566 || !test_bit(id
, filter
->sc_compat
)) {
567 /* System call filtered out. */
571 table
= compat_sc_exit_table
;
572 table_len
= ARRAY_SIZE(compat_sc_exit_table
);
573 unknown_event
= chan
->compat_sc_exit_unknown
;
575 struct lttng_syscall_filter
*filter
;
577 filter
= lttng_rcu_dereference(chan
->sc_filter
);
579 if (id
< 0 || id
>= NR_syscalls
580 || !test_bit(id
, filter
->sc
)) {
581 /* System call filtered out. */
585 table
= sc_exit_table
;
586 table_len
= ARRAY_SIZE(sc_exit_table
);
587 unknown_event
= chan
->sc_exit_unknown
;
589 if (unlikely(id
< 0 || id
>= table_len
)) {
590 syscall_exit_unknown(unknown_event
, regs
, id
, ret
);
593 if (unlikely(in_compat_syscall()))
594 event
= chan
->compat_sc_exit_table
[id
];
596 event
= chan
->sc_exit_table
[id
];
597 if (unlikely(!event
)) {
598 syscall_exit_unknown(unknown_event
, regs
, id
, ret
);
602 WARN_ON_ONCE(!entry
);
604 switch (entry
->nrargs
) {
607 void (*fptr
)(void *__data
, long ret
) = entry
->func
;
614 void (*fptr
)(void *__data
,
616 unsigned long arg0
) = entry
->func
;
617 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
619 lttng_syscall_get_arguments(current
, regs
, args
);
620 fptr(event
, ret
, args
[0]);
625 void (*fptr
)(void *__data
,
628 unsigned long arg1
) = entry
->func
;
629 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
631 lttng_syscall_get_arguments(current
, regs
, args
);
632 fptr(event
, ret
, args
[0], args
[1]);
637 void (*fptr
)(void *__data
,
641 unsigned long arg2
) = entry
->func
;
642 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
644 lttng_syscall_get_arguments(current
, regs
, args
);
645 fptr(event
, ret
, args
[0], args
[1], args
[2]);
650 void (*fptr
)(void *__data
,
655 unsigned long arg3
) = entry
->func
;
656 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
658 lttng_syscall_get_arguments(current
, regs
, args
);
659 fptr(event
, ret
, args
[0], args
[1], args
[2], args
[3]);
664 void (*fptr
)(void *__data
,
670 unsigned long arg4
) = entry
->func
;
671 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
673 lttng_syscall_get_arguments(current
, regs
, args
);
674 fptr(event
, ret
, args
[0], args
[1], args
[2], args
[3], args
[4]);
679 void (*fptr
)(void *__data
,
686 unsigned long arg5
) = entry
->func
;
687 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
689 lttng_syscall_get_arguments(current
, regs
, args
);
690 fptr(event
, ret
, args
[0], args
[1], args
[2],
691 args
[3], args
[4], args
[5]);
700 * noinline to diminish caller stack size.
701 * Should be called with sessions lock held.
704 int fill_table(const struct trace_syscall_entry
*table
, size_t table_len
,
705 struct lttng_event
**chan_table
, struct lttng_channel
*chan
,
706 void *filter
, enum sc_type type
)
708 const struct lttng_event_desc
*desc
;
711 /* Allocate events for each syscall, insert into table */
712 for (i
= 0; i
< table_len
; i
++) {
713 struct lttng_kernel_event ev
;
714 desc
= table
[i
].desc
;
717 /* Unknown syscall */
721 * Skip those already populated by previous failed
722 * register for this channel.
726 memset(&ev
, 0, sizeof(ev
));
729 strncpy(ev
.name
, SYSCALL_ENTRY_STR
,
730 LTTNG_KERNEL_SYM_NAME_LEN
);
733 strncpy(ev
.name
, SYSCALL_EXIT_STR
,
734 LTTNG_KERNEL_SYM_NAME_LEN
);
736 case SC_TYPE_COMPAT_ENTRY
:
737 strncpy(ev
.name
, COMPAT_SYSCALL_ENTRY_STR
,
738 LTTNG_KERNEL_SYM_NAME_LEN
);
740 case SC_TYPE_COMPAT_EXIT
:
741 strncpy(ev
.name
, COMPAT_SYSCALL_EXIT_STR
,
742 LTTNG_KERNEL_SYM_NAME_LEN
);
748 strncat(ev
.name
, desc
->name
,
749 LTTNG_KERNEL_SYM_NAME_LEN
- strlen(ev
.name
) - 1);
750 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
751 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
752 chan_table
[i
] = _lttng_event_create(chan
, &ev
, filter
,
753 desc
, ev
.instrumentation
);
754 WARN_ON_ONCE(!chan_table
[i
]);
755 if (IS_ERR(chan_table
[i
])) {
757 * If something goes wrong in event registration
758 * after the first one, we have no choice but to
759 * leave the previous events in there, until
760 * deleted by session teardown.
762 return PTR_ERR(chan_table
[i
]);
769 * Should be called with sessions lock held.
771 int lttng_syscalls_register(struct lttng_channel
*chan
, void *filter
)
773 struct lttng_kernel_event ev
;
776 wrapper_vmalloc_sync_all();
778 if (!chan
->sc_table
) {
779 /* create syscall table mapping syscall to events */
780 chan
->sc_table
= kzalloc(sizeof(struct lttng_event
*)
781 * ARRAY_SIZE(sc_table
), GFP_KERNEL
);
785 if (!chan
->sc_exit_table
) {
786 /* create syscall table mapping syscall to events */
787 chan
->sc_exit_table
= kzalloc(sizeof(struct lttng_event
*)
788 * ARRAY_SIZE(sc_exit_table
), GFP_KERNEL
);
789 if (!chan
->sc_exit_table
)
795 if (!chan
->compat_sc_table
) {
796 /* create syscall table mapping compat syscall to events */
797 chan
->compat_sc_table
= kzalloc(sizeof(struct lttng_event
*)
798 * ARRAY_SIZE(compat_sc_table
), GFP_KERNEL
);
799 if (!chan
->compat_sc_table
)
803 if (!chan
->compat_sc_exit_table
) {
804 /* create syscall table mapping compat syscall to events */
805 chan
->compat_sc_exit_table
= kzalloc(sizeof(struct lttng_event
*)
806 * ARRAY_SIZE(compat_sc_exit_table
), GFP_KERNEL
);
807 if (!chan
->compat_sc_exit_table
)
811 if (!chan
->sc_unknown
) {
812 const struct lttng_event_desc
*desc
=
813 &__event_desc___syscall_entry_unknown
;
815 memset(&ev
, 0, sizeof(ev
));
816 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
817 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
818 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
819 chan
->sc_unknown
= _lttng_event_create(chan
, &ev
, filter
,
822 WARN_ON_ONCE(!chan
->sc_unknown
);
823 if (IS_ERR(chan
->sc_unknown
)) {
824 return PTR_ERR(chan
->sc_unknown
);
828 if (!chan
->sc_compat_unknown
) {
829 const struct lttng_event_desc
*desc
=
830 &__event_desc___compat_syscall_entry_unknown
;
832 memset(&ev
, 0, sizeof(ev
));
833 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
834 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
835 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
836 chan
->sc_compat_unknown
= _lttng_event_create(chan
, &ev
, filter
,
839 WARN_ON_ONCE(!chan
->sc_unknown
);
840 if (IS_ERR(chan
->sc_compat_unknown
)) {
841 return PTR_ERR(chan
->sc_compat_unknown
);
845 if (!chan
->compat_sc_exit_unknown
) {
846 const struct lttng_event_desc
*desc
=
847 &__event_desc___compat_syscall_exit_unknown
;
849 memset(&ev
, 0, sizeof(ev
));
850 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
851 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
852 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
853 chan
->compat_sc_exit_unknown
= _lttng_event_create(chan
, &ev
,
856 WARN_ON_ONCE(!chan
->compat_sc_exit_unknown
);
857 if (IS_ERR(chan
->compat_sc_exit_unknown
)) {
858 return PTR_ERR(chan
->compat_sc_exit_unknown
);
862 if (!chan
->sc_exit_unknown
) {
863 const struct lttng_event_desc
*desc
=
864 &__event_desc___syscall_exit_unknown
;
866 memset(&ev
, 0, sizeof(ev
));
867 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
868 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
869 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
870 chan
->sc_exit_unknown
= _lttng_event_create(chan
, &ev
, filter
,
871 desc
, ev
.instrumentation
);
872 WARN_ON_ONCE(!chan
->sc_exit_unknown
);
873 if (IS_ERR(chan
->sc_exit_unknown
)) {
874 return PTR_ERR(chan
->sc_exit_unknown
);
878 ret
= fill_table(sc_table
, ARRAY_SIZE(sc_table
),
879 chan
->sc_table
, chan
, filter
, SC_TYPE_ENTRY
);
882 ret
= fill_table(sc_exit_table
, ARRAY_SIZE(sc_exit_table
),
883 chan
->sc_exit_table
, chan
, filter
, SC_TYPE_EXIT
);
888 ret
= fill_table(compat_sc_table
, ARRAY_SIZE(compat_sc_table
),
889 chan
->compat_sc_table
, chan
, filter
,
890 SC_TYPE_COMPAT_ENTRY
);
893 ret
= fill_table(compat_sc_exit_table
, ARRAY_SIZE(compat_sc_exit_table
),
894 chan
->compat_sc_exit_table
, chan
, filter
,
895 SC_TYPE_COMPAT_EXIT
);
899 if (!chan
->sys_enter_registered
) {
900 ret
= lttng_wrapper_tracepoint_probe_register("sys_enter",
901 (void *) syscall_entry_probe
, chan
);
904 chan
->sys_enter_registered
= 1;
907 * We change the name of sys_exit tracepoint due to namespace
908 * conflict with sys_exit syscall entry.
910 if (!chan
->sys_exit_registered
) {
911 ret
= lttng_wrapper_tracepoint_probe_register("sys_exit",
912 (void *) syscall_exit_probe
, chan
);
914 WARN_ON_ONCE(lttng_wrapper_tracepoint_probe_unregister("sys_enter",
915 (void *) syscall_entry_probe
, chan
));
918 chan
->sys_exit_registered
= 1;
924 * Only called at session destruction.
926 int lttng_syscalls_unregister(struct lttng_channel
*chan
)
932 if (chan
->sys_enter_registered
) {
933 ret
= lttng_wrapper_tracepoint_probe_unregister("sys_enter",
934 (void *) syscall_entry_probe
, chan
);
937 chan
->sys_enter_registered
= 0;
939 if (chan
->sys_exit_registered
) {
940 ret
= lttng_wrapper_tracepoint_probe_unregister("sys_exit",
941 (void *) syscall_exit_probe
, chan
);
944 chan
->sys_exit_registered
= 0;
946 /* lttng_event destroy will be performed by lttng_session_destroy() */
947 kfree(chan
->sc_table
);
948 kfree(chan
->sc_exit_table
);
950 kfree(chan
->compat_sc_table
);
951 kfree(chan
->compat_sc_exit_table
);
953 kfree(chan
->sc_filter
);
958 int get_syscall_nr(const char *syscall_name
)
963 for (i
= 0; i
< ARRAY_SIZE(sc_table
); i
++) {
964 const struct trace_syscall_entry
*entry
;
967 entry
= &sc_table
[i
];
970 it_name
= entry
->desc
->name
;
971 it_name
+= strlen(SYSCALL_ENTRY_STR
);
972 if (!strcmp(syscall_name
, it_name
)) {
981 int get_compat_syscall_nr(const char *syscall_name
)
986 for (i
= 0; i
< ARRAY_SIZE(compat_sc_table
); i
++) {
987 const struct trace_syscall_entry
*entry
;
990 entry
= &compat_sc_table
[i
];
993 it_name
= entry
->desc
->name
;
994 it_name
+= strlen(COMPAT_SYSCALL_ENTRY_STR
);
995 if (!strcmp(syscall_name
, it_name
)) {
1004 uint32_t get_sc_tables_len(void)
1006 return ARRAY_SIZE(sc_table
) + ARRAY_SIZE(compat_sc_table
);
1009 int lttng_syscall_filter_enable(struct lttng_channel
*chan
,
1012 int syscall_nr
, compat_syscall_nr
, ret
;
1013 struct lttng_syscall_filter
*filter
;
1015 WARN_ON_ONCE(!chan
->sc_table
);
1018 /* Enable all system calls by removing filter */
1019 if (chan
->sc_filter
) {
1020 filter
= chan
->sc_filter
;
1021 rcu_assign_pointer(chan
->sc_filter
, NULL
);
1022 synchronize_trace();
1025 chan
->syscall_all
= 1;
1029 if (!chan
->sc_filter
) {
1030 if (chan
->syscall_all
) {
1032 * All syscalls are already enabled.
1036 filter
= kzalloc(sizeof(struct lttng_syscall_filter
),
1041 filter
= chan
->sc_filter
;
1043 syscall_nr
= get_syscall_nr(name
);
1044 compat_syscall_nr
= get_compat_syscall_nr(name
);
1045 if (syscall_nr
< 0 && compat_syscall_nr
< 0) {
1049 if (syscall_nr
>= 0) {
1050 if (test_bit(syscall_nr
, filter
->sc
)) {
1054 bitmap_set(filter
->sc
, syscall_nr
, 1);
1056 if (compat_syscall_nr
>= 0) {
1057 if (test_bit(compat_syscall_nr
, filter
->sc_compat
)) {
1061 bitmap_set(filter
->sc_compat
, compat_syscall_nr
, 1);
1063 if (!chan
->sc_filter
)
1064 rcu_assign_pointer(chan
->sc_filter
, filter
);
1068 if (!chan
->sc_filter
)
1073 int lttng_syscall_filter_disable(struct lttng_channel
*chan
,
1076 int syscall_nr
, compat_syscall_nr
, ret
;
1077 struct lttng_syscall_filter
*filter
;
1079 WARN_ON_ONCE(!chan
->sc_table
);
1081 if (!chan
->sc_filter
) {
1082 if (!chan
->syscall_all
)
1084 filter
= kzalloc(sizeof(struct lttng_syscall_filter
),
1088 /* Trace all system calls, then apply disable. */
1089 bitmap_set(filter
->sc
, 0, NR_syscalls
);
1090 bitmap_set(filter
->sc_compat
, 0, NR_compat_syscalls
);
1092 filter
= chan
->sc_filter
;
1096 /* Fail if all syscalls are already disabled. */
1097 if (bitmap_empty(filter
->sc
, NR_syscalls
)
1098 && bitmap_empty(filter
->sc_compat
,
1099 NR_compat_syscalls
)) {
1104 /* Disable all system calls */
1105 bitmap_clear(filter
->sc
, 0, NR_syscalls
);
1106 bitmap_clear(filter
->sc_compat
, 0, NR_compat_syscalls
);
1109 syscall_nr
= get_syscall_nr(name
);
1110 compat_syscall_nr
= get_compat_syscall_nr(name
);
1111 if (syscall_nr
< 0 && compat_syscall_nr
< 0) {
1115 if (syscall_nr
>= 0) {
1116 if (!test_bit(syscall_nr
, filter
->sc
)) {
1120 bitmap_clear(filter
->sc
, syscall_nr
, 1);
1122 if (compat_syscall_nr
>= 0) {
1123 if (!test_bit(compat_syscall_nr
, filter
->sc_compat
)) {
1127 bitmap_clear(filter
->sc_compat
, compat_syscall_nr
, 1);
1130 if (!chan
->sc_filter
)
1131 rcu_assign_pointer(chan
->sc_filter
, filter
);
1132 chan
->syscall_all
= 0;
1136 if (!chan
->sc_filter
)
1142 const struct trace_syscall_entry
*syscall_list_get_entry(loff_t
*pos
)
1144 const struct trace_syscall_entry
*entry
;
1147 for (entry
= sc_table
;
1148 entry
< sc_table
+ ARRAY_SIZE(sc_table
);
1153 for (entry
= compat_sc_table
;
1154 entry
< compat_sc_table
+ ARRAY_SIZE(compat_sc_table
);
1164 void *syscall_list_start(struct seq_file
*m
, loff_t
*pos
)
1166 return (void *) syscall_list_get_entry(pos
);
1170 void *syscall_list_next(struct seq_file
*m
, void *p
, loff_t
*ppos
)
1173 return (void *) syscall_list_get_entry(ppos
);
1177 void syscall_list_stop(struct seq_file
*m
, void *p
)
1182 int get_sc_table(const struct trace_syscall_entry
*entry
,
1183 const struct trace_syscall_entry
**table
,
1184 unsigned int *bitness
)
1186 if (entry
>= sc_table
&& entry
< sc_table
+ ARRAY_SIZE(sc_table
)) {
1188 *bitness
= BITS_PER_LONG
;
1193 if (!(entry
>= compat_sc_table
1194 && entry
< compat_sc_table
+ ARRAY_SIZE(compat_sc_table
))) {
1200 *table
= compat_sc_table
;
1205 int syscall_list_show(struct seq_file
*m
, void *p
)
1207 const struct trace_syscall_entry
*table
, *entry
= p
;
1208 unsigned int bitness
;
1209 unsigned long index
;
1213 ret
= get_sc_table(entry
, &table
, &bitness
);
1218 if (table
== sc_table
) {
1219 index
= entry
- table
;
1220 name
= &entry
->desc
->name
[strlen(SYSCALL_ENTRY_STR
)];
1222 index
= (entry
- table
) + ARRAY_SIZE(sc_table
);
1223 name
= &entry
->desc
->name
[strlen(COMPAT_SYSCALL_ENTRY_STR
)];
1225 seq_printf(m
, "syscall { index = %lu; name = %s; bitness = %u; };\n",
1226 index
, name
, bitness
);
1231 const struct seq_operations lttng_syscall_list_seq_ops
= {
1232 .start
= syscall_list_start
,
1233 .next
= syscall_list_next
,
1234 .stop
= syscall_list_stop
,
1235 .show
= syscall_list_show
,
1239 int lttng_syscall_list_open(struct inode
*inode
, struct file
*file
)
1241 return seq_open(file
, <tng_syscall_list_seq_ops
);
1244 const struct file_operations lttng_syscall_list_fops
= {
1245 .owner
= THIS_MODULE
,
1246 .open
= lttng_syscall_list_open
,
1248 .llseek
= seq_lseek
,
1249 .release
= seq_release
,
1252 long lttng_channel_syscall_mask(struct lttng_channel
*channel
,
1253 struct lttng_kernel_syscall_mask __user
*usyscall_mask
)
1255 uint32_t len
, sc_tables_len
, bitmask_len
;
1258 struct lttng_syscall_filter
*filter
;
1260 ret
= get_user(len
, &usyscall_mask
->len
);
1263 sc_tables_len
= get_sc_tables_len();
1264 bitmask_len
= ALIGN(sc_tables_len
, 8) >> 3;
1265 if (len
< sc_tables_len
) {
1266 return put_user(sc_tables_len
, &usyscall_mask
->len
);
1268 /* Array is large enough, we can copy array to user-space. */
1269 tmp_mask
= kzalloc(bitmask_len
, GFP_KERNEL
);
1272 filter
= channel
->sc_filter
;
1274 for (bit
= 0; bit
< ARRAY_SIZE(sc_table
); bit
++) {
1277 if (channel
->sc_table
) {
1279 state
= test_bit(bit
, filter
->sc
);
1285 bt_bitfield_write_be(tmp_mask
, char, bit
, 1, state
);
1287 for (; bit
< sc_tables_len
; bit
++) {
1290 if (channel
->compat_sc_table
) {
1292 state
= test_bit(bit
- ARRAY_SIZE(sc_table
),
1299 bt_bitfield_write_be(tmp_mask
, char, bit
, 1, state
);
1301 if (copy_to_user(usyscall_mask
->mask
, tmp_mask
, bitmask_len
))
1307 int lttng_abi_syscall_list(void)
1309 struct file
*syscall_list_file
;
1312 file_fd
= lttng_get_unused_fd();
1318 syscall_list_file
= anon_inode_getfile("[lttng_syscall_list]",
1319 <tng_syscall_list_fops
,
1321 if (IS_ERR(syscall_list_file
)) {
1322 ret
= PTR_ERR(syscall_list_file
);
1325 ret
= lttng_syscall_list_fops
.open(NULL
, syscall_list_file
);
1328 fd_install(file_fd
, syscall_list_file
);
1332 fput(syscall_list_file
);
1334 put_unused_fd(file_fd
);