1 /* SPDX-License-Identifier: (GPL-2.0 or LGPL-2.1)
5 * LTTng syscall probes.
7 * Copyright (C) 2010-2012 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
10 #include <linux/module.h>
11 #include <linux/slab.h>
12 #include <linux/compat.h>
13 #include <linux/err.h>
14 #include <linux/bitmap.h>
16 #include <linux/in6.h>
17 #include <linux/seq_file.h>
18 #include <linux/stringify.h>
19 #include <linux/file.h>
20 #include <linux/anon_inodes.h>
21 #include <asm/ptrace.h>
22 #include <asm/syscall.h>
24 #include <lib/bitfield.h>
25 #include <wrapper/tracepoint.h>
26 #include <wrapper/file.h>
27 #include <wrapper/rcu.h>
28 #include <wrapper/syscall.h>
29 #include <lttng-events.h>
32 # ifndef is_compat_task
33 # define is_compat_task() (0)
37 /* in_compat_syscall appears in kernel 4.6. */
38 #ifndef in_compat_syscall
39 #define in_compat_syscall() is_compat_task()
49 #define SYSCALL_ENTRY_TOK syscall_entry_
50 #define COMPAT_SYSCALL_ENTRY_TOK compat_syscall_entry_
51 #define SYSCALL_EXIT_TOK syscall_exit_
52 #define COMPAT_SYSCALL_EXIT_TOK compat_syscall_exit_
54 #define SYSCALL_ENTRY_STR __stringify(SYSCALL_ENTRY_TOK)
55 #define COMPAT_SYSCALL_ENTRY_STR __stringify(COMPAT_SYSCALL_ENTRY_TOK)
56 #define SYSCALL_EXIT_STR __stringify(SYSCALL_EXIT_TOK)
57 #define COMPAT_SYSCALL_EXIT_STR __stringify(COMPAT_SYSCALL_EXIT_TOK)
60 void syscall_entry_probe(void *__data
, struct pt_regs
*regs
, long id
);
62 void syscall_exit_probe(void *__data
, struct pt_regs
*regs
, long ret
);
65 * Forward declarations for old kernels.
69 struct oldold_utsname
;
71 struct sel_arg_struct
;
72 struct mmap_arg_struct
;
77 * Forward declaration for kernels >= 5.6
84 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,6,0))
85 typedef __kernel_old_time_t
time_t;
88 #ifdef IA32_NR_syscalls
89 #define NR_compat_syscalls IA32_NR_syscalls
91 #define NR_compat_syscalls NR_syscalls
95 * Create LTTng tracepoint probes.
97 #define LTTNG_PACKAGE_BUILD
98 #define CREATE_TRACE_POINTS
99 #define TP_MODULE_NOINIT
100 #define TRACE_INCLUDE_PATH instrumentation/syscalls/headers
102 #define PARAMS(args...) args
104 /* Handle unknown syscalls */
106 #define TRACE_SYSTEM syscalls_unknown
107 #include <instrumentation/syscalls/headers/syscalls_unknown.h>
115 #define sc_in(...) __VA_ARGS__
119 #define sc_inout(...) __VA_ARGS__
121 /* Hijack probe callback for system call enter */
123 #define TP_PROBE_CB(_template) &syscall_entry_probe
124 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
125 LTTNG_TRACEPOINT_EVENT(syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
127 #define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
128 LTTNG_TRACEPOINT_EVENT_CODE(syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
129 PARAMS(_locvar), PARAMS(_code_pre), \
130 PARAMS(_fields), PARAMS(_code_post))
131 #define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
132 LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(syscall_entry_##_name, PARAMS(_fields))
133 #define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name) \
134 LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(syscall_entry_##_template, syscall_entry_##_name)
135 /* Enumerations only defined at first inclusion. */
136 #define SC_LTTNG_TRACEPOINT_ENUM(_name, _values) \
137 LTTNG_TRACEPOINT_ENUM(_name, PARAMS(_values))
139 #define TRACE_SYSTEM syscall_entry_integers
140 #define TRACE_INCLUDE_FILE syscalls_integers
141 #include <instrumentation/syscalls/headers/syscalls_integers.h>
142 #undef TRACE_INCLUDE_FILE
144 #define TRACE_SYSTEM syscall_entry_pointers
145 #define TRACE_INCLUDE_FILE syscalls_pointers
146 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
147 #undef TRACE_INCLUDE_FILE
149 #undef SC_LTTNG_TRACEPOINT_ENUM
150 #undef SC_LTTNG_TRACEPOINT_EVENT_CODE
151 #undef SC_LTTNG_TRACEPOINT_EVENT
152 #undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
153 #undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
155 #undef _TRACE_SYSCALLS_INTEGERS_H
156 #undef _TRACE_SYSCALLS_POINTERS_H
158 /* Hijack probe callback for compat system call enter */
159 #define TP_PROBE_CB(_template) &syscall_entry_probe
160 #define LTTNG_SC_COMPAT
161 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
162 LTTNG_TRACEPOINT_EVENT(compat_syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
164 #define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
165 LTTNG_TRACEPOINT_EVENT_CODE(compat_syscall_entry_##_name, PARAMS(_proto), PARAMS(_args), \
166 PARAMS(_locvar), PARAMS(_code_pre), PARAMS(_fields), PARAMS(_code_post))
167 #define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
168 LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(compat_syscall_entry_##_name, PARAMS(_fields))
169 #define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name) \
170 LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(compat_syscall_entry_##_template, \
171 compat_syscall_entry_##_name)
172 /* Enumerations only defined at inital inclusion (not here). */
173 #define SC_LTTNG_TRACEPOINT_ENUM(_name, _values)
174 #define TRACE_SYSTEM compat_syscall_entry_integers
175 #define TRACE_INCLUDE_FILE compat_syscalls_integers
176 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
177 #undef TRACE_INCLUDE_FILE
179 #define TRACE_SYSTEM compat_syscall_entry_pointers
180 #define TRACE_INCLUDE_FILE compat_syscalls_pointers
181 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
182 #undef TRACE_INCLUDE_FILE
184 #undef SC_LTTNG_TRACEPOINT_ENUM
185 #undef SC_LTTNG_TRACEPOINT_EVENT_CODE
186 #undef SC_LTTNG_TRACEPOINT_EVENT
187 #undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
188 #undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
190 #undef _TRACE_SYSCALLS_INTEGERS_H
191 #undef _TRACE_SYSCALLS_POINTERS_H
192 #undef LTTNG_SC_COMPAT
199 #define sc_exit(...) __VA_ARGS__
203 #define sc_out(...) __VA_ARGS__
205 #define sc_inout(...) __VA_ARGS__
207 /* Hijack probe callback for system call exit */
208 #define TP_PROBE_CB(_template) &syscall_exit_probe
209 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
210 LTTNG_TRACEPOINT_EVENT(syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
212 #define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
213 LTTNG_TRACEPOINT_EVENT_CODE(syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
214 PARAMS(_locvar), PARAMS(_code_pre), PARAMS(_fields), PARAMS(_code_post))
215 #define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
216 LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(syscall_exit_##_name, PARAMS(_fields))
217 #define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name) \
218 LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(syscall_exit_##_template, \
219 syscall_exit_##_name)
220 /* Enumerations only defined at inital inclusion (not here). */
221 #define SC_LTTNG_TRACEPOINT_ENUM(_name, _values)
222 #define TRACE_SYSTEM syscall_exit_integers
223 #define TRACE_INCLUDE_FILE syscalls_integers
224 #include <instrumentation/syscalls/headers/syscalls_integers.h>
225 #undef TRACE_INCLUDE_FILE
227 #define TRACE_SYSTEM syscall_exit_pointers
228 #define TRACE_INCLUDE_FILE syscalls_pointers
229 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
230 #undef TRACE_INCLUDE_FILE
232 #undef SC_LTTNG_TRACEPOINT_ENUM
233 #undef SC_LTTNG_TRACEPOINT_EVENT_CODE
234 #undef SC_LTTNG_TRACEPOINT_EVENT
235 #undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
236 #undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
238 #undef _TRACE_SYSCALLS_INTEGERS_H
239 #undef _TRACE_SYSCALLS_POINTERS_H
242 /* Hijack probe callback for compat system call exit */
243 #define TP_PROBE_CB(_template) &syscall_exit_probe
244 #define LTTNG_SC_COMPAT
245 #define SC_LTTNG_TRACEPOINT_EVENT(_name, _proto, _args, _fields) \
246 LTTNG_TRACEPOINT_EVENT(compat_syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
248 #define SC_LTTNG_TRACEPOINT_EVENT_CODE(_name, _proto, _args, _locvar, _code_pre, _fields, _code_post) \
249 LTTNG_TRACEPOINT_EVENT_CODE(compat_syscall_exit_##_name, PARAMS(_proto), PARAMS(_args), \
250 PARAMS(_locvar), PARAMS(_code_pre), PARAMS(_fields), PARAMS(_code_post))
251 #define SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(_name, _fields) \
252 LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS(compat_syscall_exit_##_name, PARAMS(_fields))
253 #define SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(_template, _name) \
254 LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS(compat_syscall_exit_##_template, \
255 compat_syscall_exit_##_name)
256 /* Enumerations only defined at inital inclusion (not here). */
257 #define SC_LTTNG_TRACEPOINT_ENUM(_name, _values)
258 #define TRACE_SYSTEM compat_syscall_exit_integers
259 #define TRACE_INCLUDE_FILE compat_syscalls_integers
260 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
261 #undef TRACE_INCLUDE_FILE
263 #define TRACE_SYSTEM compat_syscall_exit_pointers
264 #define TRACE_INCLUDE_FILE compat_syscalls_pointers
265 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
266 #undef TRACE_INCLUDE_FILE
268 #undef SC_LTTNG_TRACEPOINT_ENUM
269 #undef SC_LTTNG_TRACEPOINT_EVENT_CODE
270 #undef SC_LTTNG_TRACEPOINT_EVENT
271 #undef SC_LTTNG_TRACEPOINT_EVENT_CLASS_NOARGS
272 #undef SC_LTTNG_TRACEPOINT_EVENT_INSTANCE_NOARGS
274 #undef _TRACE_SYSCALLS_INTEGERS_H
275 #undef _TRACE_SYSCALLS_POINTERS_H
276 #undef LTTNG_SC_COMPAT
280 #undef TP_MODULE_NOINIT
281 #undef LTTNG_PACKAGE_BUILD
282 #undef CREATE_TRACE_POINTS
284 struct trace_syscall_entry
{
286 const struct lttng_event_desc
*desc
;
287 const struct lttng_event_field
*fields
;
291 #define CREATE_SYSCALL_TABLE
298 #undef TRACE_SYSCALL_TABLE
299 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs) \
301 .func = __event_probe__syscall_entry_##_template, \
302 .nrargs = (_nrargs), \
303 .fields = __event_fields___syscall_entry_##_template, \
304 .desc = &__event_desc___syscall_entry_##_name, \
307 /* Syscall enter tracing table */
308 static const struct trace_syscall_entry sc_table
[] = {
309 #include <instrumentation/syscalls/headers/syscalls_integers.h>
310 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
313 #undef TRACE_SYSCALL_TABLE
314 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs) \
316 .func = __event_probe__compat_syscall_entry_##_template, \
317 .nrargs = (_nrargs), \
318 .fields = __event_fields___compat_syscall_entry_##_template, \
319 .desc = &__event_desc___compat_syscall_entry_##_name, \
322 /* Compat syscall enter table */
323 const struct trace_syscall_entry compat_sc_table
[] = {
324 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
325 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
333 #define sc_exit(...) __VA_ARGS__
335 #undef TRACE_SYSCALL_TABLE
336 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs) \
338 .func = __event_probe__syscall_exit_##_template, \
339 .nrargs = (_nrargs), \
340 .fields = __event_fields___syscall_exit_##_template, \
341 .desc = &__event_desc___syscall_exit_##_name, \
344 /* Syscall exit table */
345 static const struct trace_syscall_entry sc_exit_table
[] = {
346 #include <instrumentation/syscalls/headers/syscalls_integers.h>
347 #include <instrumentation/syscalls/headers/syscalls_pointers.h>
350 #undef TRACE_SYSCALL_TABLE
351 #define TRACE_SYSCALL_TABLE(_template, _name, _nr, _nrargs) \
353 .func = __event_probe__compat_syscall_exit_##_template, \
354 .nrargs = (_nrargs), \
355 .fields = __event_fields___compat_syscall_exit_##_template, \
356 .desc = &__event_desc___compat_syscall_exit_##_name, \
359 /* Compat syscall exit table */
360 const struct trace_syscall_entry compat_sc_exit_table
[] = {
361 #include <instrumentation/syscalls/headers/compat_syscalls_integers.h>
362 #include <instrumentation/syscalls/headers/compat_syscalls_pointers.h>
367 #undef CREATE_SYSCALL_TABLE
369 struct lttng_syscall_filter
{
370 DECLARE_BITMAP(sc_entry
, NR_syscalls
);
371 DECLARE_BITMAP(sc_exit
, NR_syscalls
);
372 DECLARE_BITMAP(sc_compat_entry
, NR_compat_syscalls
);
373 DECLARE_BITMAP(sc_compat_exit
, NR_compat_syscalls
);
376 static void syscall_entry_unknown(struct lttng_event
*event
,
377 struct pt_regs
*regs
, unsigned int id
)
379 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
381 lttng_syscall_get_arguments(current
, regs
, args
);
382 if (unlikely(in_compat_syscall()))
383 __event_probe__compat_syscall_entry_unknown(event
, id
, args
);
385 __event_probe__syscall_entry_unknown(event
, id
, args
);
388 void syscall_entry_probe(void *__data
, struct pt_regs
*regs
, long id
)
390 struct lttng_channel
*chan
= __data
;
391 struct lttng_event
*event
, *unknown_event
;
392 const struct trace_syscall_entry
*table
, *entry
;
395 if (unlikely(in_compat_syscall())) {
396 struct lttng_syscall_filter
*filter
= chan
->sc_filter
;
398 if (id
< 0 || id
>= NR_compat_syscalls
399 || (!READ_ONCE(chan
->syscall_all
) && !test_bit(id
, filter
->sc_compat_entry
))) {
400 /* System call filtered out. */
403 table
= compat_sc_table
;
404 table_len
= ARRAY_SIZE(compat_sc_table
);
405 unknown_event
= chan
->sc_compat_unknown
;
407 struct lttng_syscall_filter
*filter
= chan
->sc_filter
;
409 if (id
< 0 || id
>= NR_syscalls
410 || (!READ_ONCE(chan
->syscall_all
) && !test_bit(id
, filter
->sc_entry
))) {
411 /* System call filtered out. */
415 table_len
= ARRAY_SIZE(sc_table
);
416 unknown_event
= chan
->sc_unknown
;
418 if (unlikely(id
< 0 || id
>= table_len
)) {
419 syscall_entry_unknown(unknown_event
, regs
, id
);
422 if (unlikely(in_compat_syscall()))
423 event
= chan
->compat_sc_table
[id
];
425 event
= chan
->sc_table
[id
];
426 if (unlikely(!event
)) {
427 syscall_entry_unknown(unknown_event
, regs
, id
);
431 WARN_ON_ONCE(!entry
);
433 switch (entry
->nrargs
) {
436 void (*fptr
)(void *__data
) = entry
->func
;
443 void (*fptr
)(void *__data
, unsigned long arg0
) = entry
->func
;
444 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
446 lttng_syscall_get_arguments(current
, regs
, args
);
447 fptr(event
, args
[0]);
452 void (*fptr
)(void *__data
,
454 unsigned long arg1
) = entry
->func
;
455 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
457 lttng_syscall_get_arguments(current
, regs
, args
);
458 fptr(event
, args
[0], args
[1]);
463 void (*fptr
)(void *__data
,
466 unsigned long arg2
) = entry
->func
;
467 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
469 lttng_syscall_get_arguments(current
, regs
, args
);
470 fptr(event
, args
[0], args
[1], args
[2]);
475 void (*fptr
)(void *__data
,
479 unsigned long arg3
) = entry
->func
;
480 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
482 lttng_syscall_get_arguments(current
, regs
, args
);
483 fptr(event
, args
[0], args
[1], args
[2], args
[3]);
488 void (*fptr
)(void *__data
,
493 unsigned long arg4
) = entry
->func
;
494 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
496 lttng_syscall_get_arguments(current
, regs
, args
);
497 fptr(event
, args
[0], args
[1], args
[2], args
[3], args
[4]);
502 void (*fptr
)(void *__data
,
508 unsigned long arg5
) = entry
->func
;
509 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
511 lttng_syscall_get_arguments(current
, regs
, args
);
512 fptr(event
, args
[0], args
[1], args
[2],
513 args
[3], args
[4], args
[5]);
521 static void syscall_exit_unknown(struct lttng_event
*event
,
522 struct pt_regs
*regs
, int id
, long ret
)
524 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
526 lttng_syscall_get_arguments(current
, regs
, args
);
527 if (unlikely(in_compat_syscall()))
528 __event_probe__compat_syscall_exit_unknown(event
, id
, ret
,
531 __event_probe__syscall_exit_unknown(event
, id
, ret
, args
);
534 void syscall_exit_probe(void *__data
, struct pt_regs
*regs
, long ret
)
536 struct lttng_channel
*chan
= __data
;
537 struct lttng_event
*event
, *unknown_event
;
538 const struct trace_syscall_entry
*table
, *entry
;
542 id
= syscall_get_nr(current
, regs
);
543 if (unlikely(in_compat_syscall())) {
544 struct lttng_syscall_filter
*filter
= chan
->sc_filter
;
546 if (id
< 0 || id
>= NR_compat_syscalls
547 || (!READ_ONCE(chan
->syscall_all
) && !test_bit(id
, filter
->sc_compat_exit
))) {
548 /* System call filtered out. */
551 table
= compat_sc_exit_table
;
552 table_len
= ARRAY_SIZE(compat_sc_exit_table
);
553 unknown_event
= chan
->compat_sc_exit_unknown
;
555 struct lttng_syscall_filter
*filter
= chan
->sc_filter
;
557 if (id
< 0 || id
>= NR_syscalls
558 || (!READ_ONCE(chan
->syscall_all
) && !test_bit(id
, filter
->sc_exit
))) {
559 /* System call filtered out. */
562 table
= sc_exit_table
;
563 table_len
= ARRAY_SIZE(sc_exit_table
);
564 unknown_event
= chan
->sc_exit_unknown
;
566 if (unlikely(id
< 0 || id
>= table_len
)) {
567 syscall_exit_unknown(unknown_event
, regs
, id
, ret
);
570 if (unlikely(in_compat_syscall()))
571 event
= chan
->compat_sc_exit_table
[id
];
573 event
= chan
->sc_exit_table
[id
];
574 if (unlikely(!event
)) {
575 syscall_exit_unknown(unknown_event
, regs
, id
, ret
);
579 WARN_ON_ONCE(!entry
);
581 switch (entry
->nrargs
) {
584 void (*fptr
)(void *__data
, long ret
) = entry
->func
;
591 void (*fptr
)(void *__data
,
593 unsigned long arg0
) = entry
->func
;
594 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
596 lttng_syscall_get_arguments(current
, regs
, args
);
597 fptr(event
, ret
, args
[0]);
602 void (*fptr
)(void *__data
,
605 unsigned long arg1
) = entry
->func
;
606 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
608 lttng_syscall_get_arguments(current
, regs
, args
);
609 fptr(event
, ret
, args
[0], args
[1]);
614 void (*fptr
)(void *__data
,
618 unsigned long arg2
) = entry
->func
;
619 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
621 lttng_syscall_get_arguments(current
, regs
, args
);
622 fptr(event
, ret
, args
[0], args
[1], args
[2]);
627 void (*fptr
)(void *__data
,
632 unsigned long arg3
) = entry
->func
;
633 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
635 lttng_syscall_get_arguments(current
, regs
, args
);
636 fptr(event
, ret
, args
[0], args
[1], args
[2], args
[3]);
641 void (*fptr
)(void *__data
,
647 unsigned long arg4
) = entry
->func
;
648 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
650 lttng_syscall_get_arguments(current
, regs
, args
);
651 fptr(event
, ret
, args
[0], args
[1], args
[2], args
[3], args
[4]);
656 void (*fptr
)(void *__data
,
663 unsigned long arg5
) = entry
->func
;
664 unsigned long args
[LTTNG_SYSCALL_NR_ARGS
];
666 lttng_syscall_get_arguments(current
, regs
, args
);
667 fptr(event
, ret
, args
[0], args
[1], args
[2],
668 args
[3], args
[4], args
[5]);
677 * noinline to diminish caller stack size.
678 * Should be called with sessions lock held.
681 int fill_table(const struct trace_syscall_entry
*table
, size_t table_len
,
682 struct lttng_event
**chan_table
, struct lttng_channel
*chan
,
683 void *filter
, enum sc_type type
)
685 const struct lttng_event_desc
*desc
;
688 /* Allocate events for each syscall, insert into table */
689 for (i
= 0; i
< table_len
; i
++) {
690 struct lttng_kernel_event ev
;
691 desc
= table
[i
].desc
;
694 /* Unknown syscall */
698 * Skip those already populated by previous failed
699 * register for this channel.
703 memset(&ev
, 0, sizeof(ev
));
706 ev
.u
.syscall
.entryexit
= LTTNG_KERNEL_SYSCALL_ENTRY
;
707 ev
.u
.syscall
.abi
= LTTNG_KERNEL_SYSCALL_ABI_NATIVE
;
710 ev
.u
.syscall
.entryexit
= LTTNG_KERNEL_SYSCALL_EXIT
;
711 ev
.u
.syscall
.abi
= LTTNG_KERNEL_SYSCALL_ABI_NATIVE
;
713 case SC_TYPE_COMPAT_ENTRY
:
714 ev
.u
.syscall
.entryexit
= LTTNG_KERNEL_SYSCALL_ENTRY
;
715 ev
.u
.syscall
.abi
= LTTNG_KERNEL_SYSCALL_ABI_COMPAT
;
717 case SC_TYPE_COMPAT_EXIT
:
718 ev
.u
.syscall
.entryexit
= LTTNG_KERNEL_SYSCALL_EXIT
;
719 ev
.u
.syscall
.abi
= LTTNG_KERNEL_SYSCALL_ABI_COMPAT
;
722 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
723 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
724 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
725 chan_table
[i
] = _lttng_event_create(chan
, &ev
, filter
,
726 desc
, ev
.instrumentation
);
727 WARN_ON_ONCE(!chan_table
[i
]);
728 if (IS_ERR(chan_table
[i
])) {
730 * If something goes wrong in event registration
731 * after the first one, we have no choice but to
732 * leave the previous events in there, until
733 * deleted by session teardown.
735 return PTR_ERR(chan_table
[i
]);
742 * Should be called with sessions lock held.
744 int lttng_syscalls_register(struct lttng_channel
*chan
, void *filter
)
746 struct lttng_kernel_event ev
;
749 wrapper_vmalloc_sync_mappings();
751 if (!chan
->sc_table
) {
752 /* create syscall table mapping syscall to events */
753 chan
->sc_table
= kzalloc(sizeof(struct lttng_event
*)
754 * ARRAY_SIZE(sc_table
), GFP_KERNEL
);
758 if (!chan
->sc_exit_table
) {
759 /* create syscall table mapping syscall to events */
760 chan
->sc_exit_table
= kzalloc(sizeof(struct lttng_event
*)
761 * ARRAY_SIZE(sc_exit_table
), GFP_KERNEL
);
762 if (!chan
->sc_exit_table
)
768 if (!chan
->compat_sc_table
) {
769 /* create syscall table mapping compat syscall to events */
770 chan
->compat_sc_table
= kzalloc(sizeof(struct lttng_event
*)
771 * ARRAY_SIZE(compat_sc_table
), GFP_KERNEL
);
772 if (!chan
->compat_sc_table
)
776 if (!chan
->compat_sc_exit_table
) {
777 /* create syscall table mapping compat syscall to events */
778 chan
->compat_sc_exit_table
= kzalloc(sizeof(struct lttng_event
*)
779 * ARRAY_SIZE(compat_sc_exit_table
), GFP_KERNEL
);
780 if (!chan
->compat_sc_exit_table
)
784 if (!chan
->sc_unknown
) {
785 const struct lttng_event_desc
*desc
=
786 &__event_desc___syscall_entry_unknown
;
788 memset(&ev
, 0, sizeof(ev
));
789 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
790 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
791 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
792 ev
.u
.syscall
.entryexit
= LTTNG_KERNEL_SYSCALL_ENTRY
;
793 ev
.u
.syscall
.abi
= LTTNG_KERNEL_SYSCALL_ABI_NATIVE
;
794 chan
->sc_unknown
= _lttng_event_create(chan
, &ev
, filter
,
797 WARN_ON_ONCE(!chan
->sc_unknown
);
798 if (IS_ERR(chan
->sc_unknown
)) {
799 return PTR_ERR(chan
->sc_unknown
);
803 if (!chan
->sc_compat_unknown
) {
804 const struct lttng_event_desc
*desc
=
805 &__event_desc___compat_syscall_entry_unknown
;
807 memset(&ev
, 0, sizeof(ev
));
808 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
809 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
810 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
811 ev
.u
.syscall
.entryexit
= LTTNG_KERNEL_SYSCALL_ENTRY
;
812 ev
.u
.syscall
.abi
= LTTNG_KERNEL_SYSCALL_ABI_COMPAT
;
813 chan
->sc_compat_unknown
= _lttng_event_create(chan
, &ev
, filter
,
816 WARN_ON_ONCE(!chan
->sc_unknown
);
817 if (IS_ERR(chan
->sc_compat_unknown
)) {
818 return PTR_ERR(chan
->sc_compat_unknown
);
822 if (!chan
->compat_sc_exit_unknown
) {
823 const struct lttng_event_desc
*desc
=
824 &__event_desc___compat_syscall_exit_unknown
;
826 memset(&ev
, 0, sizeof(ev
));
827 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
828 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
829 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
830 ev
.u
.syscall
.entryexit
= LTTNG_KERNEL_SYSCALL_EXIT
;
831 ev
.u
.syscall
.abi
= LTTNG_KERNEL_SYSCALL_ABI_COMPAT
;
832 chan
->compat_sc_exit_unknown
= _lttng_event_create(chan
, &ev
,
835 WARN_ON_ONCE(!chan
->compat_sc_exit_unknown
);
836 if (IS_ERR(chan
->compat_sc_exit_unknown
)) {
837 return PTR_ERR(chan
->compat_sc_exit_unknown
);
841 if (!chan
->sc_exit_unknown
) {
842 const struct lttng_event_desc
*desc
=
843 &__event_desc___syscall_exit_unknown
;
845 memset(&ev
, 0, sizeof(ev
));
846 strncpy(ev
.name
, desc
->name
, LTTNG_KERNEL_SYM_NAME_LEN
);
847 ev
.name
[LTTNG_KERNEL_SYM_NAME_LEN
- 1] = '\0';
848 ev
.instrumentation
= LTTNG_KERNEL_SYSCALL
;
849 ev
.u
.syscall
.entryexit
= LTTNG_KERNEL_SYSCALL_EXIT
;
850 ev
.u
.syscall
.abi
= LTTNG_KERNEL_SYSCALL_ABI_NATIVE
;
851 chan
->sc_exit_unknown
= _lttng_event_create(chan
, &ev
, filter
,
852 desc
, ev
.instrumentation
);
853 WARN_ON_ONCE(!chan
->sc_exit_unknown
);
854 if (IS_ERR(chan
->sc_exit_unknown
)) {
855 return PTR_ERR(chan
->sc_exit_unknown
);
859 ret
= fill_table(sc_table
, ARRAY_SIZE(sc_table
),
860 chan
->sc_table
, chan
, filter
, SC_TYPE_ENTRY
);
863 ret
= fill_table(sc_exit_table
, ARRAY_SIZE(sc_exit_table
),
864 chan
->sc_exit_table
, chan
, filter
, SC_TYPE_EXIT
);
869 ret
= fill_table(compat_sc_table
, ARRAY_SIZE(compat_sc_table
),
870 chan
->compat_sc_table
, chan
, filter
,
871 SC_TYPE_COMPAT_ENTRY
);
874 ret
= fill_table(compat_sc_exit_table
, ARRAY_SIZE(compat_sc_exit_table
),
875 chan
->compat_sc_exit_table
, chan
, filter
,
876 SC_TYPE_COMPAT_EXIT
);
881 if (!chan
->sc_filter
) {
882 chan
->sc_filter
= kzalloc(sizeof(struct lttng_syscall_filter
),
884 if (!chan
->sc_filter
)
888 if (!chan
->sys_enter_registered
) {
889 ret
= lttng_wrapper_tracepoint_probe_register("sys_enter",
890 (void *) syscall_entry_probe
, chan
);
893 chan
->sys_enter_registered
= 1;
896 * We change the name of sys_exit tracepoint due to namespace
897 * conflict with sys_exit syscall entry.
899 if (!chan
->sys_exit_registered
) {
900 ret
= lttng_wrapper_tracepoint_probe_register("sys_exit",
901 (void *) syscall_exit_probe
, chan
);
903 WARN_ON_ONCE(lttng_wrapper_tracepoint_probe_unregister("sys_enter",
904 (void *) syscall_entry_probe
, chan
));
907 chan
->sys_exit_registered
= 1;
913 * Only called at session destruction.
915 int lttng_syscalls_unregister(struct lttng_channel
*chan
)
921 if (chan
->sys_enter_registered
) {
922 ret
= lttng_wrapper_tracepoint_probe_unregister("sys_enter",
923 (void *) syscall_entry_probe
, chan
);
926 chan
->sys_enter_registered
= 0;
928 if (chan
->sys_exit_registered
) {
929 ret
= lttng_wrapper_tracepoint_probe_unregister("sys_exit",
930 (void *) syscall_exit_probe
, chan
);
933 chan
->sys_exit_registered
= 0;
938 int lttng_syscalls_destroy(struct lttng_channel
*chan
)
940 kfree(chan
->sc_table
);
941 kfree(chan
->sc_exit_table
);
943 kfree(chan
->compat_sc_table
);
944 kfree(chan
->compat_sc_exit_table
);
946 kfree(chan
->sc_filter
);
951 int get_syscall_nr(const char *syscall_name
)
956 for (i
= 0; i
< ARRAY_SIZE(sc_table
); i
++) {
957 const struct trace_syscall_entry
*entry
;
960 entry
= &sc_table
[i
];
963 it_name
= entry
->desc
->name
;
964 it_name
+= strlen(SYSCALL_ENTRY_STR
);
965 if (!strcmp(syscall_name
, it_name
)) {
974 int get_compat_syscall_nr(const char *syscall_name
)
979 for (i
= 0; i
< ARRAY_SIZE(compat_sc_table
); i
++) {
980 const struct trace_syscall_entry
*entry
;
983 entry
= &compat_sc_table
[i
];
986 it_name
= entry
->desc
->name
;
987 it_name
+= strlen(COMPAT_SYSCALL_ENTRY_STR
);
988 if (!strcmp(syscall_name
, it_name
)) {
997 uint32_t get_sc_tables_len(void)
999 return ARRAY_SIZE(sc_table
) + ARRAY_SIZE(compat_sc_table
);
1003 const char *get_syscall_name(struct lttng_event
*event
)
1005 size_t prefix_len
= 0;
1007 WARN_ON_ONCE(event
->instrumentation
!= LTTNG_KERNEL_SYSCALL
);
1009 switch (event
->u
.syscall
.entryexit
) {
1010 case LTTNG_SYSCALL_ENTRY
:
1011 switch (event
->u
.syscall
.abi
) {
1012 case LTTNG_SYSCALL_ABI_NATIVE
:
1013 prefix_len
= strlen(SYSCALL_ENTRY_STR
);
1015 case LTTNG_SYSCALL_ABI_COMPAT
:
1016 prefix_len
= strlen(COMPAT_SYSCALL_ENTRY_STR
);
1020 case LTTNG_SYSCALL_EXIT
:
1021 switch (event
->u
.syscall
.abi
) {
1022 case LTTNG_SYSCALL_ABI_NATIVE
:
1023 prefix_len
= strlen(SYSCALL_EXIT_STR
);
1025 case LTTNG_SYSCALL_ABI_COMPAT
:
1026 prefix_len
= strlen(COMPAT_SYSCALL_EXIT_STR
);
1031 WARN_ON_ONCE(prefix_len
== 0);
1032 return event
->desc
->name
+ prefix_len
;
1035 int lttng_syscall_filter_enable(struct lttng_channel
*chan
,
1036 struct lttng_event
*event
)
1038 struct lttng_syscall_filter
*filter
= chan
->sc_filter
;
1039 const char *syscall_name
;
1040 unsigned long *bitmap
;
1043 WARN_ON_ONCE(!chan
->sc_table
);
1045 syscall_name
= get_syscall_name(event
);
1047 switch (event
->u
.syscall
.abi
) {
1048 case LTTNG_SYSCALL_ABI_NATIVE
:
1049 syscall_nr
= get_syscall_nr(syscall_name
);
1051 case LTTNG_SYSCALL_ABI_COMPAT
:
1052 syscall_nr
= get_compat_syscall_nr(syscall_name
);
1061 switch (event
->u
.syscall
.entryexit
) {
1062 case LTTNG_SYSCALL_ENTRY
:
1063 switch (event
->u
.syscall
.abi
) {
1064 case LTTNG_SYSCALL_ABI_NATIVE
:
1065 bitmap
= filter
->sc_entry
;
1067 case LTTNG_SYSCALL_ABI_COMPAT
:
1068 bitmap
= filter
->sc_compat_entry
;
1072 case LTTNG_SYSCALL_EXIT
:
1073 switch (event
->u
.syscall
.abi
) {
1074 case LTTNG_SYSCALL_ABI_NATIVE
:
1075 bitmap
= filter
->sc_exit
;
1077 case LTTNG_SYSCALL_ABI_COMPAT
:
1078 bitmap
= filter
->sc_compat_exit
;
1085 if (test_bit(syscall_nr
, bitmap
))
1087 bitmap_set(bitmap
, syscall_nr
, 1);
1091 int lttng_syscall_filter_disable(struct lttng_channel
*chan
,
1092 struct lttng_event
*event
)
1094 struct lttng_syscall_filter
*filter
= chan
->sc_filter
;
1095 const char *syscall_name
;
1096 unsigned long *bitmap
;
1099 WARN_ON_ONCE(!chan
->sc_table
);
1101 syscall_name
= get_syscall_name(event
);
1103 switch (event
->u
.syscall
.abi
) {
1104 case LTTNG_SYSCALL_ABI_NATIVE
:
1105 syscall_nr
= get_syscall_nr(syscall_name
);
1107 case LTTNG_SYSCALL_ABI_COMPAT
:
1108 syscall_nr
= get_compat_syscall_nr(syscall_name
);
1117 switch (event
->u
.syscall
.entryexit
) {
1118 case LTTNG_SYSCALL_ENTRY
:
1119 switch (event
->u
.syscall
.abi
) {
1120 case LTTNG_SYSCALL_ABI_NATIVE
:
1121 bitmap
= filter
->sc_entry
;
1123 case LTTNG_SYSCALL_ABI_COMPAT
:
1124 bitmap
= filter
->sc_compat_entry
;
1128 case LTTNG_SYSCALL_EXIT
:
1129 switch (event
->u
.syscall
.abi
) {
1130 case LTTNG_SYSCALL_ABI_NATIVE
:
1131 bitmap
= filter
->sc_exit
;
1133 case LTTNG_SYSCALL_ABI_COMPAT
:
1134 bitmap
= filter
->sc_compat_exit
;
1141 if (!test_bit(syscall_nr
, bitmap
))
1143 bitmap_clear(bitmap
, syscall_nr
, 1);
1149 const struct trace_syscall_entry
*syscall_list_get_entry(loff_t
*pos
)
1151 const struct trace_syscall_entry
*entry
;
1154 for (entry
= sc_table
;
1155 entry
< sc_table
+ ARRAY_SIZE(sc_table
);
1160 for (entry
= compat_sc_table
;
1161 entry
< compat_sc_table
+ ARRAY_SIZE(compat_sc_table
);
1171 void *syscall_list_start(struct seq_file
*m
, loff_t
*pos
)
1173 return (void *) syscall_list_get_entry(pos
);
1177 void *syscall_list_next(struct seq_file
*m
, void *p
, loff_t
*ppos
)
1180 return (void *) syscall_list_get_entry(ppos
);
1184 void syscall_list_stop(struct seq_file
*m
, void *p
)
1189 int get_sc_table(const struct trace_syscall_entry
*entry
,
1190 const struct trace_syscall_entry
**table
,
1191 unsigned int *bitness
)
1193 if (entry
>= sc_table
&& entry
< sc_table
+ ARRAY_SIZE(sc_table
)) {
1195 *bitness
= BITS_PER_LONG
;
1200 if (!(entry
>= compat_sc_table
1201 && entry
< compat_sc_table
+ ARRAY_SIZE(compat_sc_table
))) {
1207 *table
= compat_sc_table
;
1212 int syscall_list_show(struct seq_file
*m
, void *p
)
1214 const struct trace_syscall_entry
*table
, *entry
= p
;
1215 unsigned int bitness
;
1216 unsigned long index
;
1220 ret
= get_sc_table(entry
, &table
, &bitness
);
1225 if (table
== sc_table
) {
1226 index
= entry
- table
;
1227 name
= &entry
->desc
->name
[strlen(SYSCALL_ENTRY_STR
)];
1229 index
= (entry
- table
) + ARRAY_SIZE(sc_table
);
1230 name
= &entry
->desc
->name
[strlen(COMPAT_SYSCALL_ENTRY_STR
)];
1232 seq_printf(m
, "syscall { index = %lu; name = %s; bitness = %u; };\n",
1233 index
, name
, bitness
);
1238 const struct seq_operations lttng_syscall_list_seq_ops
= {
1239 .start
= syscall_list_start
,
1240 .next
= syscall_list_next
,
1241 .stop
= syscall_list_stop
,
1242 .show
= syscall_list_show
,
1246 int lttng_syscall_list_open(struct inode
*inode
, struct file
*file
)
1248 return seq_open(file
, <tng_syscall_list_seq_ops
);
1251 const struct file_operations lttng_syscall_list_fops
= {
1252 .owner
= THIS_MODULE
,
1253 .open
= lttng_syscall_list_open
,
1255 .llseek
= seq_lseek
,
1256 .release
= seq_release
,
1260 * A syscall is enabled if it is traced for either entry or exit.
1262 long lttng_channel_syscall_mask(struct lttng_channel
*channel
,
1263 struct lttng_kernel_syscall_mask __user
*usyscall_mask
)
1265 uint32_t len
, sc_tables_len
, bitmask_len
;
1268 struct lttng_syscall_filter
*filter
;
1270 ret
= get_user(len
, &usyscall_mask
->len
);
1273 sc_tables_len
= get_sc_tables_len();
1274 bitmask_len
= ALIGN(sc_tables_len
, 8) >> 3;
1275 if (len
< sc_tables_len
) {
1276 return put_user(sc_tables_len
, &usyscall_mask
->len
);
1278 /* Array is large enough, we can copy array to user-space. */
1279 tmp_mask
= kzalloc(bitmask_len
, GFP_KERNEL
);
1282 filter
= channel
->sc_filter
;
1284 for (bit
= 0; bit
< ARRAY_SIZE(sc_table
); bit
++) {
1287 if (channel
->sc_table
) {
1288 if (!READ_ONCE(channel
->syscall_all
) && filter
)
1289 state
= test_bit(bit
, filter
->sc_entry
)
1290 || test_bit(bit
, filter
->sc_exit
);
1296 bt_bitfield_write_be(tmp_mask
, char, bit
, 1, state
);
1298 for (; bit
< sc_tables_len
; bit
++) {
1301 if (channel
->compat_sc_table
) {
1302 if (!READ_ONCE(channel
->syscall_all
) && filter
)
1303 state
= test_bit(bit
- ARRAY_SIZE(sc_table
),
1304 filter
->sc_compat_entry
)
1305 || test_bit(bit
- ARRAY_SIZE(sc_table
),
1306 filter
->sc_compat_exit
);
1312 bt_bitfield_write_be(tmp_mask
, char, bit
, 1, state
);
1314 if (copy_to_user(usyscall_mask
->mask
, tmp_mask
, bitmask_len
))
1320 int lttng_abi_syscall_list(void)
1322 struct file
*syscall_list_file
;
1325 file_fd
= lttng_get_unused_fd();
1331 syscall_list_file
= anon_inode_getfile("[lttng_syscall_list]",
1332 <tng_syscall_list_fops
,
1334 if (IS_ERR(syscall_list_file
)) {
1335 ret
= PTR_ERR(syscall_list_file
);
1338 ret
= lttng_syscall_list_fops
.open(NULL
, syscall_list_file
);
1341 fd_install(file_fd
, syscall_list_file
);
1345 fput(syscall_list_file
);
1347 put_unused_fd(file_fd
);