4 * LTTng syscall probes.
6 * Copyright (C) 2010-2012 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; only
11 * version 2.1 of the License.
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
23 #include <linux/module.h>
24 #include <linux/slab.h>
25 #include <linux/compat.h>
26 #include <linux/err.h>
27 #include <linux/bitmap.h>
29 #include <linux/in6.h>
30 #include <linux/seq_file.h>
31 #include <linux/stringify.h>
32 #include <linux/file.h>
33 #include <linux/anon_inodes.h>
34 #include <asm/ptrace.h>
35 #include <asm/syscall.h>
37 #include <lib/bitfield.h>
38 #include <wrapper/tracepoint.h>
39 #include <wrapper/file.h>
40 #include <wrapper/rcu.h>
41 #include <lttng-events.h>
44 # ifndef is_compat_task
45 # define is_compat_task() (0)
49 /* in_compat_syscall appears in kernel 4.6. */
50 #ifndef in_compat_syscall
51 #define in_compat_syscall() is_compat_task()
61 #define SYSCALL_ENTRY_TOK syscall_entry_
62 #define COMPAT_SYSCALL_ENTRY_TOK compat_syscall_entry_
63 #define SYSCALL_EXIT_TOK syscall_exit_
64 #define COMPAT_SYSCALL_EXIT_TOK compat_syscall_exit_
66 #define SYSCALL_ENTRY_STR __stringify(SYSCALL_ENTRY_TOK)
67 #define COMPAT_SYSCALL_ENTRY_STR __stringify(COMPAT_SYSCALL_ENTRY_TOK)
68 #define SYSCALL_EXIT_STR __stringify(SYSCALL_EXIT_TOK)
69 #define COMPAT_SYSCALL_EXIT_STR __stringify(COMPAT_SYSCALL_EXIT_TOK)
72 void syscall_entry_probe(void *__data
, struct pt_regs
*regs
, long id
);
74 void syscall_exit_probe(void *__data
, struct pt_regs
*regs
, long ret
);
77 * Forward declarations for old kernels.
81 struct oldold_utsname
;
83 struct sel_arg_struct
;
84 struct mmap_arg_struct
;
88 #ifdef IA32_NR_syscalls
89 #define NR_compat_syscalls IA32_NR_syscalls
91 #define NR_compat_syscalls NR_syscalls
95 * Create LTTng tracepoint probes.
97 #define LTTNG_PACKAGE_BUILD
98 #define CREATE_TRACE_POINTS
99 #define TP_MODULE_NOINIT
100 #define TRACE_INCLUDE_PATH instrumentation/syscalls/headers
102 #define PARAMS(args...) args
104 /* Handle unknown syscalls */
106 #define TRACE_SYSTEM syscalls_unknown
107 #include <instrumentation/syscalls/headers/syscalls_unknown.h>
115 #define sc_in(...) __VA_ARGS__
119 #define sc_inout(...) __VA_ARGS__
121 /* Hijack probe callback for system call enter */
123 #define TP_PROBE_CB(_template) &syscall_entry_probe
124 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
125 LTTNG_TRACEPOINT_EVENT(syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
127 #define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
128 LTTNG_TRACEPOINT_EVENT_CODE(syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
129 PARAMS(_locvar), PARAMS(_code_pre), \
130 PARAMS(_fields), PARAMS(_code_post))
131 #define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
132 LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(syscall_entry_##_name, PARAMS(_fields))
133 #define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name) \
134 LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(syscall_entry_##_template, syscall_entry_##_name)
135 /* Enumerations only defined at first inclusion. */
136 #define SC_LTTNG_TRACEPOINT_ENUM(_name, _values) \
137 LTTNG_TRACEPOINT_ENUM(_name, PARAMS(_values))
139 #define TRACE_SYSTEM syscall_entry_integers
140 #define TRACE_INCLUDE_FILE syscalls_integers
141 #include <instrumentation/syscalls/headers/syscalls_integers.h>
142 #undef TRACE_INCLUDE_FILE
144 #define TRACE_SYSTEM syscall_entry_pointers
145 #define TRACE_INCLUDE_FILE syscalls_pointers
146 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
147 #undef TRACE_INCLUDE_FILE
149 #undef SC_LTTNG_TRACEPOINT_ENUM
150 #undef SC_LTTNG_TRACEPOINT_EVENT_CODE
151 #undef SC_LTTNG_TRACEPOINT_EVENT
152 #undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
153 #undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
155 #undef _TRACE_SYSCALLS_INTEGERS_H
156 #undef _TRACE_SYSCALLS_POINTERS_H
158 /* Hijack probe callback for compat system call enter */
159 #define TP_PROBE_CB(_template) &syscall_entry_probe
160 #define LTTNG_SC_COMPAT
161 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
162 LTTNG_TRACEPOINT_EVENT(compat_syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
164 #define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
165 LTTNG_TRACEPOINT_EVENT_CODE(compat_syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
166 PARAMS(_locvar), PARAMS(_code_pre), PARAMS(_fields), PARAMS(_code_post))
167 #define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
168 LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(compat_syscall_entry_##_name, PARAMS(_fields))
169 #define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name) \
170 LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(compat_syscall_entry_##_template, \
171 compat_syscall_entry_##_name)
172 /* Enumerations only defined at inital inclusion (not here). */
173 #define SC_LTTNG_TRACEPOINT_ENUM(_name, _values)
174 #define TRACE_SYSTEM compat_syscall_entry_integers
175 #define TRACE_INCLUDE_FILE compat_syscalls_integers
176 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
177 #undef TRACE_INCLUDE_FILE
179 #define TRACE_SYSTEM compat_syscall_entry_pointers
180 #define TRACE_INCLUDE_FILE compat_syscalls_pointers
181 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
182 #undef TRACE_INCLUDE_FILE
184 #undef SC_LTTNG_TRACEPOINT_ENUM
185 #undef SC_LTTNG_TRACEPOINT_EVENT_CODE
186 #undef SC_LTTNG_TRACEPOINT_EVENT
187 #undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
188 #undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
190 #undef _TRACE_SYSCALLS_INTEGERS_H
191 #undef _TRACE_SYSCALLS_POINTERS_H
192 #undef LTTNG_SC_COMPAT
199 #define sc_exit(...) __VA_ARGS__
203 #define sc_out(...) __VA_ARGS__
205 #define sc_inout(...) __VA_ARGS__
207 /* Hijack probe callback for system call exit */
208 #define TP_PROBE_CB(_template) &syscall_exit_probe
209 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
210 LTTNG_TRACEPOINT_EVENT(syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
212 #define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
213 LTTNG_TRACEPOINT_EVENT_CODE(syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
214 PARAMS(_locvar), PARAMS(_code_pre), PARAMS(_fields), PARAMS(_code_post))
215 #define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
216 LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(syscall_exit_##_name, PARAMS(_fields))
217 #define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name) \
218 LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(syscall_exit_##_template, \
219 syscall_exit_##_name)
220 /* Enumerations only defined at inital inclusion (not here). */
221 #define SC_LTTNG_TRACEPOINT_ENUM(_name, _values)
222 #define TRACE_SYSTEM syscall_exit_integers
223 #define TRACE_INCLUDE_FILE syscalls_integers
224 #include <instrumentation/syscalls/headers/syscalls_integers.h>
225 #undef TRACE_INCLUDE_FILE
227 #define TRACE_SYSTEM syscall_exit_pointers
228 #define TRACE_INCLUDE_FILE syscalls_pointers
229 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
230 #undef TRACE_INCLUDE_FILE
232 #undef SC_LTTNG_TRACEPOINT_ENUM
233 #undef SC_LTTNG_TRACEPOINT_EVENT_CODE
234 #undef SC_LTTNG_TRACEPOINT_EVENT
235 #undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
236 #undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
238 #undef _TRACE_SYSCALLS_INTEGERS_H
239 #undef _TRACE_SYSCALLS_POINTERS_H
242 /* Hijack probe callback for compat system call exit */
243 #define TP_PROBE_CB(_template) &syscall_exit_probe
244 #define LTTNG_SC_COMPAT
245 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
246 LTTNG_TRACEPOINT_EVENT(compat_syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
248 #define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
249 LTTNG_TRACEPOINT_EVENT_CODE(compat_syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
250 PARAMS(_locvar), PARAMS(_code_pre), PARAMS(_fields), PARAMS(_code_post))
251 #define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
252 LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(compat_syscall_exit_##_name, PARAMS(_fields))
253 #define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name) \
254 LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(compat_syscall_exit_##_template, \
255 compat_syscall_exit_##_name)
256 /* Enumerations only defined at inital inclusion (not here). */
257 #define SC_LTTNG_TRACEPOINT_ENUM(_name, _values)
258 #define TRACE_SYSTEM compat_syscall_exit_integers
259 #define TRACE_INCLUDE_FILE compat_syscalls_integers
260 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
261 #undef TRACE_INCLUDE_FILE
263 #define TRACE_SYSTEM compat_syscall_exit_pointers
264 #define TRACE_INCLUDE_FILE compat_syscalls_pointers
265 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
266 #undef TRACE_INCLUDE_FILE
268 #undef SC_LTTNG_TRACEPOINT_ENUM
269 #undef SC_LTTNG_TRACEPOINT_EVENT_CODE
270 #undef SC_LTTNG_TRACEPOINT_EVENT
271 #undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
272 #undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
274 #undef _TRACE_SYSCALLS_INTEGERS_H
275 #undef _TRACE_SYSCALLS_POINTERS_H
276 #undef LTTNG_SC_COMPAT
280 #undef TP_MODULE_NOINIT
281 #undef LTTNG_PACKAGE_BUILD
282 #undef CREATE_TRACE_POINTS
284 struct trace_syscall_entry
{
286 const struct lttng_event_desc
*desc
;
287 const struct lttng_event_field
*fields
;
291 #define CREATE_SYSCALL_TABLE
298 #undef TRACE_SYSCALL_TABLE
299 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs) \
301 .func = __event_probe__syscall_entry_##_template, \
302 .nrargs = (_nrargs), \
303 .fields = __event_fields___syscall_entry_##_template, \
304 .desc = &__event_desc___syscall_entry_##_name, \
307 /* Syscall enter tracing table */
308 static const struct trace_syscall_entry sc_table
[] = {
309 #include <instrumentation/syscalls/headers/syscalls_integers.h>
310 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
313 #undef TRACE_SYSCALL_TABLE
314 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs) \
316 .func = __event_probe__compat_syscall_entry_##_template, \
317 .nrargs = (_nrargs), \
318 .fields = __event_fields___compat_syscall_entry_##_template, \
319 .desc = &__event_desc___compat_syscall_entry_##_name, \
322 /* Compat syscall enter table */
323 const struct trace_syscall_entry compat_sc_table
[] = {
324 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
325 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
333 #define sc_exit(...) __VA_ARGS__
335 #undef TRACE_SYSCALL_TABLE
336 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs) \
338 .func = __event_probe__syscall_exit_##_template, \
339 .nrargs = (_nrargs), \
340 .fields = __event_fields___syscall_exit_##_template, \
341 .desc = &__event_desc___syscall_exit_##_name, \
344 /* Syscall exit table */
345 static const struct trace_syscall_entry sc_exit_table
[] = {
346 #include <instrumentation/syscalls/headers/syscalls_integers.h>
347 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
350 #undef TRACE_SYSCALL_TABLE
351 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs) \
353 .func = __event_probe__compat_syscall_exit_##_template, \
354 .nrargs = (_nrargs), \
355 .fields = __event_fields___compat_syscall_exit_##_template, \
356 .desc = &__event_desc___compat_syscall_exit_##_name, \
359 /* Compat syscall exit table */
360 const struct trace_syscall_entry compat_sc_exit_table
[] = {
361 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
362 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
367 #undef CREATE_SYSCALL_TABLE
369 struct lttng_syscall_filter
{
370 DECLARE_BITMAP(sc
, NR_syscalls
);
371 DECLARE_BITMAP(sc_compat
, NR_compat_syscalls
);
374 static void syscall_entry_unknown(struct lttng_event
*event
,
375 struct pt_regs
*regs
, unsigned int id
)
377 unsigned long args
[UNKNOWN_SYSCALL_NRARGS
];
379 syscall_get_arguments(current
, regs
, 0, UNKNOWN_SYSCALL_NRARGS
, args
);
380 if (unlikely(in_compat_syscall()))
381 __event_probe__compat_syscall_entry_unknown(event
, id
, args
);
383 __event_probe__syscall_entry_unknown(event
, id
, args
);
386 void syscall_entry_probe(void *__data
, struct pt_regs
*regs
, long id
)
388 struct lttng_channel
*chan
= __data
;
389 struct lttng_event
*event
, *unknown_event
;
390 const struct trace_syscall_entry
*table
, *entry
;
393 if (unlikely(in_compat_syscall())) {
394 struct lttng_syscall_filter
*filter
;
396 filter
= lttng_rcu_dereference(chan
->sc_filter
);
398 if (id
< 0 || id
>= NR_compat_syscalls
399 || !test_bit(id
, filter
->sc_compat
)) {
400 /* System call filtered out. */
404 table
= compat_sc_table
;
405 table_len
= ARRAY_SIZE(compat_sc_table
);
406 unknown_event
= chan
->sc_compat_unknown
;
408 struct lttng_syscall_filter
*filter
;
410 filter
= lttng_rcu_dereference(chan
->sc_filter
);
412 if (id
< 0 || id
>= NR_syscalls
413 || !test_bit(id
, filter
->sc
)) {
414 /* System call filtered out. */
419 table_len
= ARRAY_SIZE(sc_table
);
420 unknown_event
= chan
->sc_unknown
;
422 if (unlikely(id
< 0 || id
>= table_len
)) {
423 syscall_entry_unknown(unknown_event
, regs
, id
);
426 if (unlikely(in_compat_syscall()))
427 event
= chan
->compat_sc_table
[id
];
429 event
= chan
->sc_table
[id
];
430 if (unlikely(!event
)) {
431 syscall_entry_unknown(unknown_event
, regs
, id
);
435 WARN_ON_ONCE(!entry
);
437 switch (entry
->nrargs
) {
440 void (*fptr
)(void *__data
) = entry
->func
;
447 void (*fptr
)(void *__data
, unsigned long arg0
) = entry
->func
;
448 unsigned long args
[1];
450 syscall_get_arguments(current
, regs
, 0, entry
->nrargs
, args
);
451 fptr(event
, args
[0]);
456 void (*fptr
)(void *__data
,
458 unsigned long arg1
) = entry
->func
;
459 unsigned long args
[2];
461 syscall_get_arguments(current
, regs
, 0, entry
->nrargs
, args
);
462 fptr(event
, args
[0], args
[1]);
467 void (*fptr
)(void *__data
,
470 unsigned long arg2
) = entry
->func
;
471 unsigned long args
[3];
473 syscall_get_arguments(current
, regs
, 0, entry
->nrargs
, args
);
474 fptr(event
, args
[0], args
[1], args
[2]);
479 void (*fptr
)(void *__data
,
483 unsigned long arg3
) = entry
->func
;
484 unsigned long args
[4];
486 syscall_get_arguments(current
, regs
, 0, entry
->nrargs
, args
);
487 fptr(event
, args
[0], args
[1], args
[2], args
[3]);
492 void (*fptr
)(void *__data
,
497 unsigned long arg4
) = entry
->func
;
498 unsigned long args
[5];
500 syscall_get_arguments(current
, regs
, 0, entry
->nrargs
, args
);
501 fptr(event
, args
[0], args
[1], args
[2], args
[3], args
[4]);
506 void (*fptr
)(void *__data
,
512 unsigned long arg5
) = entry
->func
;
513 unsigned long args
[6];
515 syscall_get_arguments(current
, regs
, 0, entry
->nrargs
, args
);
516 fptr(event
, args
[0], args
[1], args
[2],
517 args
[3], args
[4], args
[5]);
525 static void syscall_exit_unknown(struct lttng_event
*event
,
526 struct pt_regs
*regs
, int id
, long ret
)
528 unsigned long args
[UNKNOWN_SYSCALL_NRARGS
];
530 syscall_get_arguments(current
, regs
, 0, UNKNOWN_SYSCALL_NRARGS
, args
);
531 if (unlikely(in_compat_syscall()))
532 __event_probe__compat_syscall_exit_unknown(event
, id
, ret
,
535 __event_probe__syscall_exit_unknown(event
, id
, ret
, args
);
538 void syscall_exit_probe(void *__data
, struct pt_regs
*regs
, long ret
)
540 struct lttng_channel
*chan
= __data
;
541 struct lttng_event
*event
, *unknown_event
;
542 const struct trace_syscall_entry
*table
, *entry
;
546 id
= syscall_get_nr(current
, regs
);
547 if (unlikely(in_compat_syscall())) {
548 struct lttng_syscall_filter
*filter
;
550 filter
= lttng_rcu_dereference(chan
->sc_filter
);
552 if (id
< 0 || id
>= NR_compat_syscalls
553 || !test_bit(id
, filter
->sc_compat
)) {
554 /* System call filtered out. */
558 table
= compat_sc_exit_table
;
559 table_len
= ARRAY_SIZE(compat_sc_exit_table
);
560 unknown_event
= chan
->compat_sc_exit_unknown
;
562 struct lttng_syscall_filter
*filter
;
564 filter
= lttng_rcu_dereference(chan
->sc_filter
);
566 if (id
< 0 || id
>= NR_syscalls
567 || !test_bit(id
, filter
->sc
)) {
568 /* System call filtered out. */
572 table
= sc_exit_table
;
573 table_len
= ARRAY_SIZE(sc_exit_table
);
574 unknown_event
= chan
->sc_exit_unknown
;
576 if (unlikely(id
< 0 || id
>= table_len
)) {
577 syscall_exit_unknown(unknown_event
, regs
, id
, ret
);
580 if (unlikely(in_compat_syscall()))
581 event
= chan
->compat_sc_exit_table
[id
];
583 event
= chan
->sc_exit_table
[id
];
584 if (unlikely(!event
)) {
585 syscall_exit_unknown(unknown_event
, regs
, id
, ret
);
589 WARN_ON_ONCE(!entry
);
591 switch (entry
->nrargs
) {
594 void (*fptr
)(void *__data
, long ret
) = entry
->func
;
601 void (*fptr
)(void *__data
,
603 unsigned long arg0
) = entry
->func
;
604 unsigned long args
[1];
606 syscall_get_arguments(current
, regs
, 0, entry
->nrargs
, args
);
607 fptr(event
, ret
, args
[0]);
612 void (*fptr
)(void *__data
,
615 unsigned long arg1
) = entry
->func
;
616 unsigned long args
[2];
618 syscall_get_arguments(current
, regs
, 0, entry
->nrargs
, args
);
619 fptr(event
, ret
, args
[0], args
[1]);
624 void (*fptr
)(void *__data
,
628 unsigned long arg2
) = entry
->func
;
629 unsigned long args
[3];
631 syscall_get_arguments(current
, regs
, 0, entry
->nrargs
, args
);
632 fptr(event
, ret
, args
[0], args
[1], args
[2]);
637 void (*fptr
)(void *__data
,
642 unsigned long arg3
) = entry
->func
;
643 unsigned long args
[4];
645 syscall_get_arguments(current
, regs
, 0, entry
->nrargs
, args
);
646 fptr(event
, ret
, args
[0], args
[1], args
[2], args
[3]);
651 void (*fptr
)(void *__data
,
657 unsigned long arg4
) = entry
->func
;
658 unsigned long args
[5];
660 syscall_get_arguments(current
, regs
, 0, entry
->nrargs
, args
);
661 fptr(event
, ret
, args
[0], args
[1], args
[2], args
[3], args
[4]);
666 void (*fptr
)(void *__data
,
673 unsigned long arg5
) = entry
->func
;
674 unsigned long args
[6];
676 syscall_get_arguments(current
, regs
, 0, entry
->nrargs
, args
);
677 fptr(event
, ret
, args
[0], args
[1], args
[2],
678 args
[3], args
[4], args
[5]);
687 * noinline to diminish caller stack size.
688 * Should be called with sessions lock held.
691 int fill_table(const struct trace_syscall_entry
*table
, size_t table_len
,
692 struct lttng_event
**chan_table
, struct lttng_channel
*chan
,
693 void *filter
, enum sc_type type
)
695 const struct lttng_event_desc
*desc
;
698 /* Allocate events for each syscall, insert into table */
699 for (i
= 0; i
< table_len
; i
++) {
700 struct lttng_kernel_event ev
;
701 desc
= table
[i
].desc
;
704 /* Unknown syscall */
708 * Skip those already populated by previous failed
709 * register for this channel.
713 memset(&ev
, 0, sizeof(ev
));
716 strncpy(ev
.name
, SYSCALL_ENTRY_STR
,
717 LTTNG_KERNEL_SYM_NAME_LEN
);
720 strncpy(ev
.name
, SYSCALL_EXIT_STR
,
721 LTTNG_KERNEL_SYM_NAME_LEN
);
723 case SC_TYPE_COMPAT_ENTRY
:
724 strncpy(ev
.name
, COMPAT_SYSCALL_ENTRY_STR
,
725 LTTNG_KERNEL_SYM_NAME_LEN
);
727 case SC_TYPE_COMPAT_EXIT
:
728 strncpy(ev
.name
, COMPAT_SYSCALL_EXIT_STR
,
729 LTTNG_KERNEL_SYM_NAME_LEN
);
735 strncat(ev
.name
, desc
->name
,
736 LTTNG_KERNEL_SYM_NAME_LEN
- strlen(ev
.name
) - 1);
737 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
738 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
739 chan_table
[i
] = _lttng_event_create(chan
, &ev
, filter
,
740 desc
, ev
.instrumentation
);
741 WARN_ON_ONCE(!chan_table
[i
]);
742 if (IS_ERR(chan_table
[i
])) {
744 * If something goes wrong in event registration
745 * after the first one, we have no choice but to
746 * leave the previous events in there, until
747 * deleted by session teardown.
749 return PTR_ERR(chan_table
[i
]);
756 * Should be called with sessions lock held.
758 int lttng_syscalls_register(struct lttng_channel
*chan
, void *filter
)
760 struct lttng_kernel_event ev
;
763 wrapper_vmalloc_sync_all();
765 if (!chan
->sc_table
) {
766 /* create syscall table mapping syscall to events */
767 chan
->sc_table
= kzalloc(sizeof(struct lttng_event
*)
768 * ARRAY_SIZE(sc_table
), GFP_KERNEL
);
772 if (!chan
->sc_exit_table
) {
773 /* create syscall table mapping syscall to events */
774 chan
->sc_exit_table
= kzalloc(sizeof(struct lttng_event
*)
775 * ARRAY_SIZE(sc_exit_table
), GFP_KERNEL
);
776 if (!chan
->sc_exit_table
)
782 if (!chan
->compat_sc_table
) {
783 /* create syscall table mapping compat syscall to events */
784 chan
->compat_sc_table
= kzalloc(sizeof(struct lttng_event
*)
785 * ARRAY_SIZE(compat_sc_table
), GFP_KERNEL
);
786 if (!chan
->compat_sc_table
)
790 if (!chan
->compat_sc_exit_table
) {
791 /* create syscall table mapping compat syscall to events */
792 chan
->compat_sc_exit_table
= kzalloc(sizeof(struct lttng_event
*)
793 * ARRAY_SIZE(compat_sc_exit_table
), GFP_KERNEL
);
794 if (!chan
->compat_sc_exit_table
)
798 if (!chan
->sc_unknown
) {
799 const struct lttng_event_desc
*desc
=
800 &__event_desc___syscall_entry_unknown
;
802 memset(&ev
, 0, sizeof(ev
));
803 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
804 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
805 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
806 chan
->sc_unknown
= _lttng_event_create(chan
, &ev
, filter
,
809 WARN_ON_ONCE(!chan
->sc_unknown
);
810 if (IS_ERR(chan
->sc_unknown
)) {
811 return PTR_ERR(chan
->sc_unknown
);
815 if (!chan
->sc_compat_unknown
) {
816 const struct lttng_event_desc
*desc
=
817 &__event_desc___compat_syscall_entry_unknown
;
819 memset(&ev
, 0, sizeof(ev
));
820 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
821 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
822 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
823 chan
->sc_compat_unknown
= _lttng_event_create(chan
, &ev
, filter
,
826 WARN_ON_ONCE(!chan
->sc_unknown
);
827 if (IS_ERR(chan
->sc_compat_unknown
)) {
828 return PTR_ERR(chan
->sc_compat_unknown
);
832 if (!chan
->compat_sc_exit_unknown
) {
833 const struct lttng_event_desc
*desc
=
834 &__event_desc___compat_syscall_exit_unknown
;
836 memset(&ev
, 0, sizeof(ev
));
837 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
838 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
839 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
840 chan
->compat_sc_exit_unknown
= _lttng_event_create(chan
, &ev
,
843 WARN_ON_ONCE(!chan
->compat_sc_exit_unknown
);
844 if (IS_ERR(chan
->compat_sc_exit_unknown
)) {
845 return PTR_ERR(chan
->compat_sc_exit_unknown
);
849 if (!chan
->sc_exit_unknown
) {
850 const struct lttng_event_desc
*desc
=
851 &__event_desc___syscall_exit_unknown
;
853 memset(&ev
, 0, sizeof(ev
));
854 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
855 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
856 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
857 chan
->sc_exit_unknown
= _lttng_event_create(chan
, &ev
, filter
,
858 desc
, ev
.instrumentation
);
859 WARN_ON_ONCE(!chan
->sc_exit_unknown
);
860 if (IS_ERR(chan
->sc_exit_unknown
)) {
861 return PTR_ERR(chan
->sc_exit_unknown
);
865 ret
= fill_table(sc_table
, ARRAY_SIZE(sc_table
),
866 chan
->sc_table
, chan
, filter
, SC_TYPE_ENTRY
);
869 ret
= fill_table(sc_exit_table
, ARRAY_SIZE(sc_exit_table
),
870 chan
->sc_exit_table
, chan
, filter
, SC_TYPE_EXIT
);
875 ret
= fill_table(compat_sc_table
, ARRAY_SIZE(compat_sc_table
),
876 chan
->compat_sc_table
, chan
, filter
,
877 SC_TYPE_COMPAT_ENTRY
);
880 ret
= fill_table(compat_sc_exit_table
, ARRAY_SIZE(compat_sc_exit_table
),
881 chan
->compat_sc_exit_table
, chan
, filter
,
882 SC_TYPE_COMPAT_EXIT
);
886 if (!chan
->sys_enter_registered
) {
887 ret
= lttng_wrapper_tracepoint_probe_register("sys_enter",
888 (void *) syscall_entry_probe
, chan
);
891 chan
->sys_enter_registered
= 1;
894 * We change the name of sys_exit tracepoint due to namespace
895 * conflict with sys_exit syscall entry.
897 if (!chan
->sys_exit_registered
) {
898 ret
= lttng_wrapper_tracepoint_probe_register("sys_exit",
899 (void *) syscall_exit_probe
, chan
);
901 WARN_ON_ONCE(lttng_wrapper_tracepoint_probe_unregister("sys_enter",
902 (void *) syscall_entry_probe
, chan
));
905 chan
->sys_exit_registered
= 1;
911 * Only called at session destruction.
913 int lttng_syscalls_unregister(struct lttng_channel
*chan
)
919 if (chan
->sys_enter_registered
) {
920 ret
= lttng_wrapper_tracepoint_probe_unregister("sys_exit",
921 (void *) syscall_exit_probe
, chan
);
924 chan
->sys_enter_registered
= 0;
926 if (chan
->sys_exit_registered
) {
927 ret
= lttng_wrapper_tracepoint_probe_unregister("sys_enter",
928 (void *) syscall_entry_probe
, chan
);
931 chan
->sys_exit_registered
= 0;
933 /* lttng_event destroy will be performed by lttng_session_destroy() */
934 kfree(chan
->sc_table
);
935 kfree(chan
->sc_exit_table
);
937 kfree(chan
->compat_sc_table
);
938 kfree(chan
->compat_sc_exit_table
);
940 kfree(chan
->sc_filter
);
945 int get_syscall_nr(const char *syscall_name
)
950 for (i
= 0; i
< ARRAY_SIZE(sc_table
); i
++) {
951 const struct trace_syscall_entry
*entry
;
954 entry
= &sc_table
[i
];
957 it_name
= entry
->desc
->name
;
958 it_name
+= strlen(SYSCALL_ENTRY_STR
);
959 if (!strcmp(syscall_name
, it_name
)) {
968 int get_compat_syscall_nr(const char *syscall_name
)
973 for (i
= 0; i
< ARRAY_SIZE(compat_sc_table
); i
++) {
974 const struct trace_syscall_entry
*entry
;
977 entry
= &compat_sc_table
[i
];
980 it_name
= entry
->desc
->name
;
981 it_name
+= strlen(COMPAT_SYSCALL_ENTRY_STR
);
982 if (!strcmp(syscall_name
, it_name
)) {
991 uint32_t get_sc_tables_len(void)
993 return ARRAY_SIZE(sc_table
) + ARRAY_SIZE(compat_sc_table
);
996 int lttng_syscall_filter_enable(struct lttng_channel
*chan
,
999 int syscall_nr
, compat_syscall_nr
, ret
;
1000 struct lttng_syscall_filter
*filter
;
1002 WARN_ON_ONCE(!chan
->sc_table
);
1005 /* Enable all system calls by removing filter */
1006 if (chan
->sc_filter
) {
1007 filter
= chan
->sc_filter
;
1008 rcu_assign_pointer(chan
->sc_filter
, NULL
);
1009 synchronize_trace();
1012 chan
->syscall_all
= 1;
1016 if (!chan
->sc_filter
) {
1017 if (chan
->syscall_all
) {
1019 * All syscalls are already enabled.
1023 filter
= kzalloc(sizeof(struct lttng_syscall_filter
),
1028 filter
= chan
->sc_filter
;
1030 syscall_nr
= get_syscall_nr(name
);
1031 compat_syscall_nr
= get_compat_syscall_nr(name
);
1032 if (syscall_nr
< 0 && compat_syscall_nr
< 0) {
1036 if (syscall_nr
>= 0) {
1037 if (test_bit(syscall_nr
, filter
->sc
)) {
1041 bitmap_set(filter
->sc
, syscall_nr
, 1);
1043 if (compat_syscall_nr
>= 0) {
1044 if (test_bit(compat_syscall_nr
, filter
->sc_compat
)) {
1048 bitmap_set(filter
->sc_compat
, compat_syscall_nr
, 1);
1050 if (!chan
->sc_filter
)
1051 rcu_assign_pointer(chan
->sc_filter
, filter
);
1055 if (!chan
->sc_filter
)
1060 int lttng_syscall_filter_disable(struct lttng_channel
*chan
,
1063 int syscall_nr
, compat_syscall_nr
, ret
;
1064 struct lttng_syscall_filter
*filter
;
1066 WARN_ON_ONCE(!chan
->sc_table
);
1068 if (!chan
->sc_filter
) {
1069 if (!chan
->syscall_all
)
1071 filter
= kzalloc(sizeof(struct lttng_syscall_filter
),
1075 /* Trace all system calls, then apply disable. */
1076 bitmap_set(filter
->sc
, 0, NR_syscalls
);
1077 bitmap_set(filter
->sc_compat
, 0, NR_compat_syscalls
);
1079 filter
= chan
->sc_filter
;
1083 /* Fail if all syscalls are already disabled. */
1084 if (bitmap_empty(filter
->sc
, NR_syscalls
)
1085 && bitmap_empty(filter
->sc_compat
,
1086 NR_compat_syscalls
)) {
1091 /* Disable all system calls */
1092 bitmap_clear(filter
->sc
, 0, NR_syscalls
);
1093 bitmap_clear(filter
->sc_compat
, 0, NR_compat_syscalls
);
1096 syscall_nr
= get_syscall_nr(name
);
1097 compat_syscall_nr
= get_compat_syscall_nr(name
);
1098 if (syscall_nr
< 0 && compat_syscall_nr
< 0) {
1102 if (syscall_nr
>= 0) {
1103 if (!test_bit(syscall_nr
, filter
->sc
)) {
1107 bitmap_clear(filter
->sc
, syscall_nr
, 1);
1109 if (compat_syscall_nr
>= 0) {
1110 if (!test_bit(compat_syscall_nr
, filter
->sc_compat
)) {
1114 bitmap_clear(filter
->sc_compat
, compat_syscall_nr
, 1);
1117 if (!chan
->sc_filter
)
1118 rcu_assign_pointer(chan
->sc_filter
, filter
);
1119 chan
->syscall_all
= 0;
1123 if (!chan
->sc_filter
)
1129 const struct trace_syscall_entry
*syscall_list_get_entry(loff_t
*pos
)
1131 const struct trace_syscall_entry
*entry
;
1134 for (entry
= sc_table
;
1135 entry
< sc_table
+ ARRAY_SIZE(sc_table
);
1140 for (entry
= compat_sc_table
;
1141 entry
< compat_sc_table
+ ARRAY_SIZE(compat_sc_table
);
1151 void *syscall_list_start(struct seq_file
*m
, loff_t
*pos
)
1153 return (void *) syscall_list_get_entry(pos
);
1157 void *syscall_list_next(struct seq_file
*m
, void *p
, loff_t
*ppos
)
1160 return (void *) syscall_list_get_entry(ppos
);
1164 void syscall_list_stop(struct seq_file
*m
, void *p
)
1169 int get_sc_table(const struct trace_syscall_entry
*entry
,
1170 const struct trace_syscall_entry
**table
,
1171 unsigned int *bitness
)
1173 if (entry
>= sc_table
&& entry
< sc_table
+ ARRAY_SIZE(sc_table
)) {
1175 *bitness
= BITS_PER_LONG
;
1180 if (!(entry
>= compat_sc_table
1181 && entry
< compat_sc_table
+ ARRAY_SIZE(compat_sc_table
))) {
1187 *table
= compat_sc_table
;
1192 int syscall_list_show(struct seq_file
*m
, void *p
)
1194 const struct trace_syscall_entry
*table
, *entry
= p
;
1195 unsigned int bitness
;
1196 unsigned long index
;
1200 ret
= get_sc_table(entry
, &table
, &bitness
);
1205 if (table
== sc_table
) {
1206 index
= entry
- table
;
1207 name
= &entry
->desc
->name
[strlen(SYSCALL_ENTRY_STR
)];
1209 index
= (entry
- table
) + ARRAY_SIZE(sc_table
);
1210 name
= &entry
->desc
->name
[strlen(COMPAT_SYSCALL_ENTRY_STR
)];
1212 seq_printf(m
, "syscall { index = %lu; name = %s; bitness = %u; };\n",
1213 index
, name
, bitness
);
1218 const struct seq_operations lttng_syscall_list_seq_ops
= {
1219 .start
= syscall_list_start
,
1220 .next
= syscall_list_next
,
1221 .stop
= syscall_list_stop
,
1222 .show
= syscall_list_show
,
1226 int lttng_syscall_list_open(struct inode
*inode
, struct file
*file
)
1228 return seq_open(file
, <tng_syscall_list_seq_ops
);
1231 const struct file_operations lttng_syscall_list_fops
= {
1232 .owner
= THIS_MODULE
,
1233 .open
= lttng_syscall_list_open
,
1235 .llseek
= seq_lseek
,
1236 .release
= seq_release
,
1239 long lttng_channel_syscall_mask(struct lttng_channel
*channel
,
1240 struct lttng_kernel_syscall_mask __user
*usyscall_mask
)
1242 uint32_t len
, sc_tables_len
, bitmask_len
;
1245 struct lttng_syscall_filter
*filter
;
1247 ret
= get_user(len
, &usyscall_mask
->len
);
1250 sc_tables_len
= get_sc_tables_len();
1251 bitmask_len
= ALIGN(sc_tables_len
, 8) >> 3;
1252 if (len
< sc_tables_len
) {
1253 return put_user(sc_tables_len
, &usyscall_mask
->len
);
1255 /* Array is large enough, we can copy array to user-space. */
1256 tmp_mask
= kzalloc(bitmask_len
, GFP_KERNEL
);
1259 filter
= channel
->sc_filter
;
1261 for (bit
= 0; bit
< ARRAY_SIZE(sc_table
); bit
++) {
1264 if (channel
->sc_table
) {
1266 state
= test_bit(bit
, filter
->sc
);
1272 bt_bitfield_write_be(tmp_mask
, char, bit
, 1, state
);
1274 for (; bit
< sc_tables_len
; bit
++) {
1277 if (channel
->compat_sc_table
) {
1279 state
= test_bit(bit
- ARRAY_SIZE(sc_table
),
1286 bt_bitfield_write_be(tmp_mask
, char, bit
, 1, state
);
1288 if (copy_to_user(usyscall_mask
->mask
, tmp_mask
, bitmask_len
))
1294 int lttng_abi_syscall_list(void)
1296 struct file
*syscall_list_file
;
1299 file_fd
= lttng_get_unused_fd();
1305 syscall_list_file
= anon_inode_getfile("[lttng_syscall_list]",
1306 <tng_syscall_list_fops
,
1308 if (IS_ERR(syscall_list_file
)) {
1309 ret
= PTR_ERR(syscall_list_file
);
1312 ret
= lttng_syscall_list_fops
.open(NULL
, syscall_list_file
);
1315 fd_install(file_fd
, syscall_list_file
);
1319 fput(syscall_list_file
);
1321 put_unused_fd(file_fd
);