1 #include <trace/syscall.h>
2 #include <trace/events/syscalls.h>
3 #include <linux/slab.h>
4 #include <linux/kernel.h>
5 #include <linux/ftrace.h>
6 #include <linux/perf_event.h>
7 #include <asm/syscall.h>
9 #include "trace_output.h"
12 static DEFINE_MUTEX(syscall_trace_lock
);
13 static int sys_refcount_enter
;
14 static int sys_refcount_exit
;
15 static DECLARE_BITMAP(enabled_enter_syscalls
, NR_syscalls
);
16 static DECLARE_BITMAP(enabled_exit_syscalls
, NR_syscalls
);
18 static int syscall_enter_register(struct ftrace_event_call
*event
,
20 static int syscall_exit_register(struct ftrace_event_call
*event
,
23 static int syscall_enter_define_fields(struct ftrace_event_call
*call
);
24 static int syscall_exit_define_fields(struct ftrace_event_call
*call
);
26 static struct list_head
*
27 syscall_get_enter_fields(struct ftrace_event_call
*call
)
29 struct syscall_metadata
*entry
= call
->data
;
31 return &entry
->enter_fields
;
34 static struct list_head
*
35 syscall_get_exit_fields(struct ftrace_event_call
*call
)
37 struct syscall_metadata
*entry
= call
->data
;
39 return &entry
->exit_fields
;
42 struct ftrace_event_class event_class_syscall_enter
= {
44 .reg
= syscall_enter_register
,
45 .define_fields
= syscall_enter_define_fields
,
46 .get_fields
= syscall_get_enter_fields
,
49 struct ftrace_event_class event_class_syscall_exit
= {
51 .reg
= syscall_exit_register
,
52 .define_fields
= syscall_exit_define_fields
,
53 .get_fields
= syscall_get_exit_fields
,
56 extern unsigned long __start_syscalls_metadata
[];
57 extern unsigned long __stop_syscalls_metadata
[];
59 static struct syscall_metadata
**syscalls_metadata
;
61 static struct syscall_metadata
*find_syscall_meta(unsigned long syscall
)
63 struct syscall_metadata
*start
;
64 struct syscall_metadata
*stop
;
65 char str
[KSYM_SYMBOL_LEN
];
68 start
= (struct syscall_metadata
*)__start_syscalls_metadata
;
69 stop
= (struct syscall_metadata
*)__stop_syscalls_metadata
;
70 kallsyms_lookup(syscall
, NULL
, NULL
, NULL
, str
);
72 for ( ; start
< stop
; start
++) {
74 * Only compare after the "sys" prefix. Archs that use
75 * syscall wrappers may have syscalls symbols aliases prefixed
76 * with "SyS" instead of "sys", leading to an unwanted
79 if (start
->name
&& !strcmp(start
->name
+ 3, str
+ 3))
85 static struct syscall_metadata
*syscall_nr_to_meta(int nr
)
87 if (!syscalls_metadata
|| nr
>= NR_syscalls
|| nr
< 0)
90 return syscalls_metadata
[nr
];
94 print_syscall_enter(struct trace_iterator
*iter
, int flags
)
96 struct trace_seq
*s
= &iter
->seq
;
97 struct trace_entry
*ent
= iter
->ent
;
98 struct syscall_trace_enter
*trace
;
99 struct syscall_metadata
*entry
;
102 trace
= (typeof(trace
))ent
;
104 entry
= syscall_nr_to_meta(syscall
);
109 if (entry
->enter_event
->id
!= ent
->type
) {
114 ret
= trace_seq_printf(s
, "%s(", entry
->name
);
116 return TRACE_TYPE_PARTIAL_LINE
;
118 for (i
= 0; i
< entry
->nb_args
; i
++) {
119 /* parameter types */
120 if (trace_flags
& TRACE_ITER_VERBOSE
) {
121 ret
= trace_seq_printf(s
, "%s ", entry
->types
[i
]);
123 return TRACE_TYPE_PARTIAL_LINE
;
125 /* parameter values */
126 ret
= trace_seq_printf(s
, "%s: %lx%s", entry
->args
[i
],
128 i
== entry
->nb_args
- 1 ? "" : ", ");
130 return TRACE_TYPE_PARTIAL_LINE
;
133 ret
= trace_seq_putc(s
, ')');
135 return TRACE_TYPE_PARTIAL_LINE
;
138 ret
= trace_seq_putc(s
, '\n');
140 return TRACE_TYPE_PARTIAL_LINE
;
142 return TRACE_TYPE_HANDLED
;
146 print_syscall_exit(struct trace_iterator
*iter
, int flags
)
148 struct trace_seq
*s
= &iter
->seq
;
149 struct trace_entry
*ent
= iter
->ent
;
150 struct syscall_trace_exit
*trace
;
152 struct syscall_metadata
*entry
;
155 trace
= (typeof(trace
))ent
;
157 entry
= syscall_nr_to_meta(syscall
);
160 trace_seq_printf(s
, "\n");
161 return TRACE_TYPE_HANDLED
;
164 if (entry
->exit_event
->id
!= ent
->type
) {
166 return TRACE_TYPE_UNHANDLED
;
169 ret
= trace_seq_printf(s
, "%s -> 0x%lx\n", entry
->name
,
172 return TRACE_TYPE_PARTIAL_LINE
;
174 return TRACE_TYPE_HANDLED
;
177 extern char *__bad_type_size(void);
179 #define SYSCALL_FIELD(type, name) \
180 sizeof(type) != sizeof(trace.name) ? \
181 __bad_type_size() : \
182 #type, #name, offsetof(typeof(trace), name), \
183 sizeof(trace.name), is_signed_type(type)
186 int __set_enter_print_fmt(struct syscall_metadata
*entry
, char *buf
, int len
)
191 /* When len=0, we just calculate the needed length */
192 #define LEN_OR_ZERO (len ? len - pos : 0)
194 pos
+= snprintf(buf
+ pos
, LEN_OR_ZERO
, "\"");
195 for (i
= 0; i
< entry
->nb_args
; i
++) {
196 pos
+= snprintf(buf
+ pos
, LEN_OR_ZERO
, "%s: 0x%%0%zulx%s",
197 entry
->args
[i
], sizeof(unsigned long),
198 i
== entry
->nb_args
- 1 ? "" : ", ");
200 pos
+= snprintf(buf
+ pos
, LEN_OR_ZERO
, "\"");
202 for (i
= 0; i
< entry
->nb_args
; i
++) {
203 pos
+= snprintf(buf
+ pos
, LEN_OR_ZERO
,
204 ", ((unsigned long)(REC->%s))", entry
->args
[i
]);
209 /* return the length of print_fmt */
213 static int set_syscall_print_fmt(struct ftrace_event_call
*call
)
217 struct syscall_metadata
*entry
= call
->data
;
219 if (entry
->enter_event
!= call
) {
220 call
->print_fmt
= "\"0x%lx\", REC->ret";
224 /* First: called with 0 length to calculate the needed length */
225 len
= __set_enter_print_fmt(entry
, NULL
, 0);
227 print_fmt
= kmalloc(len
+ 1, GFP_KERNEL
);
231 /* Second: actually write the @print_fmt */
232 __set_enter_print_fmt(entry
, print_fmt
, len
+ 1);
233 call
->print_fmt
= print_fmt
;
238 static void free_syscall_print_fmt(struct ftrace_event_call
*call
)
240 struct syscall_metadata
*entry
= call
->data
;
242 if (entry
->enter_event
== call
)
243 kfree(call
->print_fmt
);
246 static int syscall_enter_define_fields(struct ftrace_event_call
*call
)
248 struct syscall_trace_enter trace
;
249 struct syscall_metadata
*meta
= call
->data
;
252 int offset
= offsetof(typeof(trace
), args
);
254 ret
= trace_define_field(call
, SYSCALL_FIELD(int, nr
), FILTER_OTHER
);
258 for (i
= 0; i
< meta
->nb_args
; i
++) {
259 ret
= trace_define_field(call
, meta
->types
[i
],
260 meta
->args
[i
], offset
,
261 sizeof(unsigned long), 0,
263 offset
+= sizeof(unsigned long);
269 static int syscall_exit_define_fields(struct ftrace_event_call
*call
)
271 struct syscall_trace_exit trace
;
274 ret
= trace_define_field(call
, SYSCALL_FIELD(int, nr
), FILTER_OTHER
);
278 ret
= trace_define_field(call
, SYSCALL_FIELD(long, ret
),
284 void ftrace_syscall_enter(void *ignore
, struct pt_regs
*regs
, long id
)
286 struct syscall_trace_enter
*entry
;
287 struct syscall_metadata
*sys_data
;
288 struct ring_buffer_event
*event
;
289 struct ring_buffer
*buffer
;
293 syscall_nr
= syscall_get_nr(current
, regs
);
296 if (!test_bit(syscall_nr
, enabled_enter_syscalls
))
299 sys_data
= syscall_nr_to_meta(syscall_nr
);
303 size
= sizeof(*entry
) + sizeof(unsigned long) * sys_data
->nb_args
;
305 event
= trace_current_buffer_lock_reserve(&buffer
,
306 sys_data
->enter_event
->id
, size
, 0, 0);
310 entry
= ring_buffer_event_data(event
);
311 entry
->nr
= syscall_nr
;
312 syscall_get_arguments(current
, regs
, 0, sys_data
->nb_args
, entry
->args
);
314 if (!filter_current_check_discard(buffer
, sys_data
->enter_event
,
316 trace_current_buffer_unlock_commit(buffer
, event
, 0, 0);
319 void ftrace_syscall_exit(void *ignore
, struct pt_regs
*regs
, long ret
)
321 struct syscall_trace_exit
*entry
;
322 struct syscall_metadata
*sys_data
;
323 struct ring_buffer_event
*event
;
324 struct ring_buffer
*buffer
;
327 syscall_nr
= syscall_get_nr(current
, regs
);
330 if (!test_bit(syscall_nr
, enabled_exit_syscalls
))
333 sys_data
= syscall_nr_to_meta(syscall_nr
);
337 event
= trace_current_buffer_lock_reserve(&buffer
,
338 sys_data
->exit_event
->id
, sizeof(*entry
), 0, 0);
342 entry
= ring_buffer_event_data(event
);
343 entry
->nr
= syscall_nr
;
344 entry
->ret
= syscall_get_return_value(current
, regs
);
346 if (!filter_current_check_discard(buffer
, sys_data
->exit_event
,
348 trace_current_buffer_unlock_commit(buffer
, event
, 0, 0);
351 int reg_event_syscall_enter(struct ftrace_event_call
*call
)
356 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
357 if (num
< 0 || num
>= NR_syscalls
)
359 mutex_lock(&syscall_trace_lock
);
360 if (!sys_refcount_enter
)
361 ret
= register_trace_sys_enter(ftrace_syscall_enter
, NULL
);
363 set_bit(num
, enabled_enter_syscalls
);
364 sys_refcount_enter
++;
366 mutex_unlock(&syscall_trace_lock
);
370 void unreg_event_syscall_enter(struct ftrace_event_call
*call
)
374 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
375 if (num
< 0 || num
>= NR_syscalls
)
377 mutex_lock(&syscall_trace_lock
);
378 sys_refcount_enter
--;
379 clear_bit(num
, enabled_enter_syscalls
);
380 if (!sys_refcount_enter
)
381 unregister_trace_sys_enter(ftrace_syscall_enter
, NULL
);
382 mutex_unlock(&syscall_trace_lock
);
385 int reg_event_syscall_exit(struct ftrace_event_call
*call
)
390 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
391 if (num
< 0 || num
>= NR_syscalls
)
393 mutex_lock(&syscall_trace_lock
);
394 if (!sys_refcount_exit
)
395 ret
= register_trace_sys_exit(ftrace_syscall_exit
, NULL
);
397 set_bit(num
, enabled_exit_syscalls
);
400 mutex_unlock(&syscall_trace_lock
);
404 void unreg_event_syscall_exit(struct ftrace_event_call
*call
)
408 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
409 if (num
< 0 || num
>= NR_syscalls
)
411 mutex_lock(&syscall_trace_lock
);
413 clear_bit(num
, enabled_exit_syscalls
);
414 if (!sys_refcount_exit
)
415 unregister_trace_sys_exit(ftrace_syscall_exit
, NULL
);
416 mutex_unlock(&syscall_trace_lock
);
419 int init_syscall_trace(struct ftrace_event_call
*call
)
423 if (set_syscall_print_fmt(call
) < 0)
426 id
= trace_event_raw_init(call
);
429 free_syscall_print_fmt(call
);
436 unsigned long __init
arch_syscall_addr(int nr
)
438 return (unsigned long)sys_call_table
[nr
];
441 int __init
init_ftrace_syscalls(void)
443 struct syscall_metadata
*meta
;
447 syscalls_metadata
= kzalloc(sizeof(*syscalls_metadata
) *
448 NR_syscalls
, GFP_KERNEL
);
449 if (!syscalls_metadata
) {
454 for (i
= 0; i
< NR_syscalls
; i
++) {
455 addr
= arch_syscall_addr(i
);
456 meta
= find_syscall_meta(addr
);
460 meta
->syscall_nr
= i
;
461 syscalls_metadata
[i
] = meta
;
466 core_initcall(init_ftrace_syscalls
);
468 #ifdef CONFIG_PERF_EVENTS
470 static DECLARE_BITMAP(enabled_perf_enter_syscalls
, NR_syscalls
);
471 static DECLARE_BITMAP(enabled_perf_exit_syscalls
, NR_syscalls
);
472 static int sys_perf_refcount_enter
;
473 static int sys_perf_refcount_exit
;
475 static void perf_syscall_enter(void *ignore
, struct pt_regs
*regs
, long id
)
477 struct syscall_metadata
*sys_data
;
478 struct syscall_trace_enter
*rec
;
484 syscall_nr
= syscall_get_nr(current
, regs
);
485 if (!test_bit(syscall_nr
, enabled_perf_enter_syscalls
))
488 sys_data
= syscall_nr_to_meta(syscall_nr
);
492 /* get the size after alignment with the u32 buffer size field */
493 size
= sizeof(unsigned long) * sys_data
->nb_args
+ sizeof(*rec
);
494 size
= ALIGN(size
+ sizeof(u32
), sizeof(u64
));
497 if (WARN_ONCE(size
> PERF_MAX_TRACE_SIZE
,
498 "perf buffer not large enough"))
501 rec
= (struct syscall_trace_enter
*)perf_trace_buf_prepare(size
,
502 sys_data
->enter_event
->id
, &rctx
, &flags
);
506 rec
->nr
= syscall_nr
;
507 syscall_get_arguments(current
, regs
, 0, sys_data
->nb_args
,
508 (unsigned long *)&rec
->args
);
509 perf_trace_buf_submit(rec
, size
, rctx
, 0, 1, flags
, regs
);
512 int perf_sysenter_enable(struct ftrace_event_call
*call
)
517 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
519 mutex_lock(&syscall_trace_lock
);
520 if (!sys_perf_refcount_enter
)
521 ret
= register_trace_sys_enter(perf_syscall_enter
, NULL
);
523 pr_info("event trace: Could not activate"
524 "syscall entry trace point");
526 set_bit(num
, enabled_perf_enter_syscalls
);
527 sys_perf_refcount_enter
++;
529 mutex_unlock(&syscall_trace_lock
);
533 void perf_sysenter_disable(struct ftrace_event_call
*call
)
537 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
539 mutex_lock(&syscall_trace_lock
);
540 sys_perf_refcount_enter
--;
541 clear_bit(num
, enabled_perf_enter_syscalls
);
542 if (!sys_perf_refcount_enter
)
543 unregister_trace_sys_enter(perf_syscall_enter
, NULL
);
544 mutex_unlock(&syscall_trace_lock
);
547 static void perf_syscall_exit(void *ignore
, struct pt_regs
*regs
, long ret
)
549 struct syscall_metadata
*sys_data
;
550 struct syscall_trace_exit
*rec
;
556 syscall_nr
= syscall_get_nr(current
, regs
);
557 if (!test_bit(syscall_nr
, enabled_perf_exit_syscalls
))
560 sys_data
= syscall_nr_to_meta(syscall_nr
);
564 /* We can probably do that at build time */
565 size
= ALIGN(sizeof(*rec
) + sizeof(u32
), sizeof(u64
));
569 * Impossible, but be paranoid with the future
570 * How to put this check outside runtime?
572 if (WARN_ONCE(size
> PERF_MAX_TRACE_SIZE
,
573 "exit event has grown above perf buffer size"))
576 rec
= (struct syscall_trace_exit
*)perf_trace_buf_prepare(size
,
577 sys_data
->exit_event
->id
, &rctx
, &flags
);
581 rec
->nr
= syscall_nr
;
582 rec
->ret
= syscall_get_return_value(current
, regs
);
584 perf_trace_buf_submit(rec
, size
, rctx
, 0, 1, flags
, regs
);
587 int perf_sysexit_enable(struct ftrace_event_call
*call
)
592 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
594 mutex_lock(&syscall_trace_lock
);
595 if (!sys_perf_refcount_exit
)
596 ret
= register_trace_sys_exit(perf_syscall_exit
, NULL
);
598 pr_info("event trace: Could not activate"
599 "syscall exit trace point");
601 set_bit(num
, enabled_perf_exit_syscalls
);
602 sys_perf_refcount_exit
++;
604 mutex_unlock(&syscall_trace_lock
);
608 void perf_sysexit_disable(struct ftrace_event_call
*call
)
612 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
614 mutex_lock(&syscall_trace_lock
);
615 sys_perf_refcount_exit
--;
616 clear_bit(num
, enabled_perf_exit_syscalls
);
617 if (!sys_perf_refcount_exit
)
618 unregister_trace_sys_exit(perf_syscall_exit
, NULL
);
619 mutex_unlock(&syscall_trace_lock
);
622 #endif /* CONFIG_PERF_EVENTS */
624 static int syscall_enter_register(struct ftrace_event_call
*event
,
628 case TRACE_REG_REGISTER
:
629 return reg_event_syscall_enter(event
);
630 case TRACE_REG_UNREGISTER
:
631 unreg_event_syscall_enter(event
);
634 #ifdef CONFIG_PERF_EVENTS
635 case TRACE_REG_PERF_REGISTER
:
636 return perf_sysenter_enable(event
);
637 case TRACE_REG_PERF_UNREGISTER
:
638 perf_sysenter_disable(event
);
645 static int syscall_exit_register(struct ftrace_event_call
*event
,
649 case TRACE_REG_REGISTER
:
650 return reg_event_syscall_exit(event
);
651 case TRACE_REG_UNREGISTER
:
652 unreg_event_syscall_exit(event
);
655 #ifdef CONFIG_PERF_EVENTS
656 case TRACE_REG_PERF_REGISTER
:
657 return perf_sysexit_enable(event
);
658 case TRACE_REG_PERF_UNREGISTER
:
659 perf_sysexit_disable(event
);