1 #include <trace/syscall.h>
2 #include <trace/events/syscalls.h>
3 #include <linux/syscalls.h>
4 #include <linux/slab.h>
5 #include <linux/kernel.h>
6 #include <linux/module.h> /* for MODULE_NAME_LEN via KSYM_SYMBOL_LEN */
7 #include <linux/ftrace.h>
8 #include <linux/perf_event.h>
9 #include <asm/syscall.h>
11 #include "trace_output.h"
14 static DEFINE_MUTEX(syscall_trace_lock
);
16 static int syscall_enter_register(struct trace_event_call
*event
,
17 enum trace_reg type
, void *data
);
18 static int syscall_exit_register(struct trace_event_call
*event
,
19 enum trace_reg type
, void *data
);
21 static struct list_head
*
22 syscall_get_enter_fields(struct trace_event_call
*call
)
24 struct syscall_metadata
*entry
= call
->data
;
26 return &entry
->enter_fields
;
29 extern struct syscall_metadata
*__start_syscalls_metadata
[];
30 extern struct syscall_metadata
*__stop_syscalls_metadata
[];
32 static struct syscall_metadata
**syscalls_metadata
;
34 #ifndef ARCH_HAS_SYSCALL_MATCH_SYM_NAME
35 static inline bool arch_syscall_match_sym_name(const char *sym
, const char *name
)
38 * Only compare after the "sys" prefix. Archs that use
39 * syscall wrappers may have syscalls symbols aliases prefixed
40 * with ".SyS" or ".sys" instead of "sys", leading to an unwanted
43 return !strcmp(sym
+ 3, name
+ 3);
47 #ifdef ARCH_TRACE_IGNORE_COMPAT_SYSCALLS
49 * Some architectures that allow for 32bit applications
50 * to run on a 64bit kernel, do not map the syscalls for
51 * the 32bit tasks the same as they do for 64bit tasks.
55 * In such a case, instead of reporting the wrong syscalls,
58 * For an arch to ignore the compat syscalls it needs to
59 * define ARCH_TRACE_IGNORE_COMPAT_SYSCALLS as well as
60 * define the function arch_trace_is_compat_syscall() to let
61 * the tracing system know that it should ignore it.
64 trace_get_syscall_nr(struct task_struct
*task
, struct pt_regs
*regs
)
66 if (unlikely(arch_trace_is_compat_syscall(regs
)))
69 return syscall_get_nr(task
, regs
);
73 trace_get_syscall_nr(struct task_struct
*task
, struct pt_regs
*regs
)
75 return syscall_get_nr(task
, regs
);
77 #endif /* ARCH_TRACE_IGNORE_COMPAT_SYSCALLS */
79 static __init
struct syscall_metadata
*
80 find_syscall_meta(unsigned long syscall
)
82 struct syscall_metadata
**start
;
83 struct syscall_metadata
**stop
;
84 char str
[KSYM_SYMBOL_LEN
];
87 start
= __start_syscalls_metadata
;
88 stop
= __stop_syscalls_metadata
;
89 kallsyms_lookup(syscall
, NULL
, NULL
, NULL
, str
);
91 if (arch_syscall_match_sym_name(str
, "sys_ni_syscall"))
94 for ( ; start
< stop
; start
++) {
95 if ((*start
)->name
&& arch_syscall_match_sym_name(str
, (*start
)->name
))
101 static struct syscall_metadata
*syscall_nr_to_meta(int nr
)
103 if (!syscalls_metadata
|| nr
>= NR_syscalls
|| nr
< 0)
106 return syscalls_metadata
[nr
];
109 const char *get_syscall_name(int syscall
)
111 struct syscall_metadata
*entry
;
113 entry
= syscall_nr_to_meta(syscall
);
120 static enum print_line_t
121 print_syscall_enter(struct trace_iterator
*iter
, int flags
,
122 struct trace_event
*event
)
124 struct trace_array
*tr
= iter
->tr
;
125 struct trace_seq
*s
= &iter
->seq
;
126 struct trace_entry
*ent
= iter
->ent
;
127 struct syscall_trace_enter
*trace
;
128 struct syscall_metadata
*entry
;
131 trace
= (typeof(trace
))ent
;
133 entry
= syscall_nr_to_meta(syscall
);
138 if (entry
->enter_event
->event
.type
!= ent
->type
) {
143 trace_seq_printf(s
, "%s(", entry
->name
);
145 for (i
= 0; i
< entry
->nb_args
; i
++) {
147 if (trace_seq_has_overflowed(s
))
150 /* parameter types */
151 if (tr
->trace_flags
& TRACE_ITER_VERBOSE
)
152 trace_seq_printf(s
, "%s ", entry
->types
[i
]);
154 /* parameter values */
155 trace_seq_printf(s
, "%s: %lx%s", entry
->args
[i
],
157 i
== entry
->nb_args
- 1 ? "" : ", ");
160 trace_seq_putc(s
, ')');
162 trace_seq_putc(s
, '\n');
164 return trace_handle_return(s
);
167 static enum print_line_t
168 print_syscall_exit(struct trace_iterator
*iter
, int flags
,
169 struct trace_event
*event
)
171 struct trace_seq
*s
= &iter
->seq
;
172 struct trace_entry
*ent
= iter
->ent
;
173 struct syscall_trace_exit
*trace
;
175 struct syscall_metadata
*entry
;
177 trace
= (typeof(trace
))ent
;
179 entry
= syscall_nr_to_meta(syscall
);
182 trace_seq_putc(s
, '\n');
186 if (entry
->exit_event
->event
.type
!= ent
->type
) {
188 return TRACE_TYPE_UNHANDLED
;
191 trace_seq_printf(s
, "%s -> 0x%lx\n", entry
->name
,
195 return trace_handle_return(s
);
198 extern char *__bad_type_size(void);
200 #define SYSCALL_FIELD(type, field, name) \
201 sizeof(type) != sizeof(trace.field) ? \
202 __bad_type_size() : \
203 #type, #name, offsetof(typeof(trace), field), \
204 sizeof(trace.field), is_signed_type(type)
207 __set_enter_print_fmt(struct syscall_metadata
*entry
, char *buf
, int len
)
212 /* When len=0, we just calculate the needed length */
213 #define LEN_OR_ZERO (len ? len - pos : 0)
215 pos
+= snprintf(buf
+ pos
, LEN_OR_ZERO
, "\"");
216 for (i
= 0; i
< entry
->nb_args
; i
++) {
217 pos
+= snprintf(buf
+ pos
, LEN_OR_ZERO
, "%s: 0x%%0%zulx%s",
218 entry
->args
[i
], sizeof(unsigned long),
219 i
== entry
->nb_args
- 1 ? "" : ", ");
221 pos
+= snprintf(buf
+ pos
, LEN_OR_ZERO
, "\"");
223 for (i
= 0; i
< entry
->nb_args
; i
++) {
224 pos
+= snprintf(buf
+ pos
, LEN_OR_ZERO
,
225 ", ((unsigned long)(REC->%s))", entry
->args
[i
]);
230 /* return the length of print_fmt */
234 static int __init
set_syscall_print_fmt(struct trace_event_call
*call
)
238 struct syscall_metadata
*entry
= call
->data
;
240 if (entry
->enter_event
!= call
) {
241 call
->print_fmt
= "\"0x%lx\", REC->ret";
245 /* First: called with 0 length to calculate the needed length */
246 len
= __set_enter_print_fmt(entry
, NULL
, 0);
248 print_fmt
= kmalloc(len
+ 1, GFP_KERNEL
);
252 /* Second: actually write the @print_fmt */
253 __set_enter_print_fmt(entry
, print_fmt
, len
+ 1);
254 call
->print_fmt
= print_fmt
;
259 static void __init
free_syscall_print_fmt(struct trace_event_call
*call
)
261 struct syscall_metadata
*entry
= call
->data
;
263 if (entry
->enter_event
== call
)
264 kfree(call
->print_fmt
);
267 static int __init
syscall_enter_define_fields(struct trace_event_call
*call
)
269 struct syscall_trace_enter trace
;
270 struct syscall_metadata
*meta
= call
->data
;
273 int offset
= offsetof(typeof(trace
), args
);
275 ret
= trace_define_field(call
, SYSCALL_FIELD(int, nr
, __syscall_nr
),
280 for (i
= 0; i
< meta
->nb_args
; i
++) {
281 ret
= trace_define_field(call
, meta
->types
[i
],
282 meta
->args
[i
], offset
,
283 sizeof(unsigned long), 0,
285 offset
+= sizeof(unsigned long);
291 static int __init
syscall_exit_define_fields(struct trace_event_call
*call
)
293 struct syscall_trace_exit trace
;
296 ret
= trace_define_field(call
, SYSCALL_FIELD(int, nr
, __syscall_nr
),
301 ret
= trace_define_field(call
, SYSCALL_FIELD(long, ret
, ret
),
307 static void ftrace_syscall_enter(void *data
, struct pt_regs
*regs
, long id
)
309 struct trace_array
*tr
= data
;
310 struct trace_event_file
*trace_file
;
311 struct syscall_trace_enter
*entry
;
312 struct syscall_metadata
*sys_data
;
313 struct ring_buffer_event
*event
;
314 struct ring_buffer
*buffer
;
315 unsigned long irq_flags
;
320 syscall_nr
= trace_get_syscall_nr(current
, regs
);
321 if (syscall_nr
< 0 || syscall_nr
>= NR_syscalls
)
324 /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */
325 trace_file
= rcu_dereference_sched(tr
->enter_syscall_files
[syscall_nr
]);
329 if (trace_trigger_soft_disabled(trace_file
))
332 sys_data
= syscall_nr_to_meta(syscall_nr
);
336 size
= sizeof(*entry
) + sizeof(unsigned long) * sys_data
->nb_args
;
338 local_save_flags(irq_flags
);
339 pc
= preempt_count();
341 buffer
= tr
->trace_buffer
.buffer
;
342 event
= trace_buffer_lock_reserve(buffer
,
343 sys_data
->enter_event
->event
.type
, size
, irq_flags
, pc
);
347 entry
= ring_buffer_event_data(event
);
348 entry
->nr
= syscall_nr
;
349 syscall_get_arguments(current
, regs
, 0, sys_data
->nb_args
, entry
->args
);
351 event_trigger_unlock_commit(trace_file
, buffer
, event
, entry
,
355 static void ftrace_syscall_exit(void *data
, struct pt_regs
*regs
, long ret
)
357 struct trace_array
*tr
= data
;
358 struct trace_event_file
*trace_file
;
359 struct syscall_trace_exit
*entry
;
360 struct syscall_metadata
*sys_data
;
361 struct ring_buffer_event
*event
;
362 struct ring_buffer
*buffer
;
363 unsigned long irq_flags
;
367 syscall_nr
= trace_get_syscall_nr(current
, regs
);
368 if (syscall_nr
< 0 || syscall_nr
>= NR_syscalls
)
371 /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */
372 trace_file
= rcu_dereference_sched(tr
->exit_syscall_files
[syscall_nr
]);
376 if (trace_trigger_soft_disabled(trace_file
))
379 sys_data
= syscall_nr_to_meta(syscall_nr
);
383 local_save_flags(irq_flags
);
384 pc
= preempt_count();
386 buffer
= tr
->trace_buffer
.buffer
;
387 event
= trace_buffer_lock_reserve(buffer
,
388 sys_data
->exit_event
->event
.type
, sizeof(*entry
),
393 entry
= ring_buffer_event_data(event
);
394 entry
->nr
= syscall_nr
;
395 entry
->ret
= syscall_get_return_value(current
, regs
);
397 event_trigger_unlock_commit(trace_file
, buffer
, event
, entry
,
401 static int reg_event_syscall_enter(struct trace_event_file
*file
,
402 struct trace_event_call
*call
)
404 struct trace_array
*tr
= file
->tr
;
408 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
409 if (WARN_ON_ONCE(num
< 0 || num
>= NR_syscalls
))
411 mutex_lock(&syscall_trace_lock
);
412 if (!tr
->sys_refcount_enter
)
413 ret
= register_trace_sys_enter(ftrace_syscall_enter
, tr
);
415 rcu_assign_pointer(tr
->enter_syscall_files
[num
], file
);
416 tr
->sys_refcount_enter
++;
418 mutex_unlock(&syscall_trace_lock
);
422 static void unreg_event_syscall_enter(struct trace_event_file
*file
,
423 struct trace_event_call
*call
)
425 struct trace_array
*tr
= file
->tr
;
428 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
429 if (WARN_ON_ONCE(num
< 0 || num
>= NR_syscalls
))
431 mutex_lock(&syscall_trace_lock
);
432 tr
->sys_refcount_enter
--;
433 RCU_INIT_POINTER(tr
->enter_syscall_files
[num
], NULL
);
434 if (!tr
->sys_refcount_enter
)
435 unregister_trace_sys_enter(ftrace_syscall_enter
, tr
);
436 mutex_unlock(&syscall_trace_lock
);
439 static int reg_event_syscall_exit(struct trace_event_file
*file
,
440 struct trace_event_call
*call
)
442 struct trace_array
*tr
= file
->tr
;
446 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
447 if (WARN_ON_ONCE(num
< 0 || num
>= NR_syscalls
))
449 mutex_lock(&syscall_trace_lock
);
450 if (!tr
->sys_refcount_exit
)
451 ret
= register_trace_sys_exit(ftrace_syscall_exit
, tr
);
453 rcu_assign_pointer(tr
->exit_syscall_files
[num
], file
);
454 tr
->sys_refcount_exit
++;
456 mutex_unlock(&syscall_trace_lock
);
460 static void unreg_event_syscall_exit(struct trace_event_file
*file
,
461 struct trace_event_call
*call
)
463 struct trace_array
*tr
= file
->tr
;
466 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
467 if (WARN_ON_ONCE(num
< 0 || num
>= NR_syscalls
))
469 mutex_lock(&syscall_trace_lock
);
470 tr
->sys_refcount_exit
--;
471 RCU_INIT_POINTER(tr
->exit_syscall_files
[num
], NULL
);
472 if (!tr
->sys_refcount_exit
)
473 unregister_trace_sys_exit(ftrace_syscall_exit
, tr
);
474 mutex_unlock(&syscall_trace_lock
);
477 static int __init
init_syscall_trace(struct trace_event_call
*call
)
482 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
483 if (num
< 0 || num
>= NR_syscalls
) {
484 pr_debug("syscall %s metadata not mapped, disabling ftrace event\n",
485 ((struct syscall_metadata
*)call
->data
)->name
);
489 if (set_syscall_print_fmt(call
) < 0)
492 id
= trace_event_raw_init(call
);
495 free_syscall_print_fmt(call
);
502 struct trace_event_functions enter_syscall_print_funcs
= {
503 .trace
= print_syscall_enter
,
506 struct trace_event_functions exit_syscall_print_funcs
= {
507 .trace
= print_syscall_exit
,
510 struct trace_event_class __refdata event_class_syscall_enter
= {
511 .system
= "syscalls",
512 .reg
= syscall_enter_register
,
513 .define_fields
= syscall_enter_define_fields
,
514 .get_fields
= syscall_get_enter_fields
,
515 .raw_init
= init_syscall_trace
,
518 struct trace_event_class __refdata event_class_syscall_exit
= {
519 .system
= "syscalls",
520 .reg
= syscall_exit_register
,
521 .define_fields
= syscall_exit_define_fields
,
522 .fields
= LIST_HEAD_INIT(event_class_syscall_exit
.fields
),
523 .raw_init
= init_syscall_trace
,
526 unsigned long __init __weak
arch_syscall_addr(int nr
)
528 return (unsigned long)sys_call_table
[nr
];
531 void __init
init_ftrace_syscalls(void)
533 struct syscall_metadata
*meta
;
537 syscalls_metadata
= kcalloc(NR_syscalls
, sizeof(*syscalls_metadata
),
539 if (!syscalls_metadata
) {
544 for (i
= 0; i
< NR_syscalls
; i
++) {
545 addr
= arch_syscall_addr(i
);
546 meta
= find_syscall_meta(addr
);
550 meta
->syscall_nr
= i
;
551 syscalls_metadata
[i
] = meta
;
555 #ifdef CONFIG_PERF_EVENTS
557 static DECLARE_BITMAP(enabled_perf_enter_syscalls
, NR_syscalls
);
558 static DECLARE_BITMAP(enabled_perf_exit_syscalls
, NR_syscalls
);
559 static int sys_perf_refcount_enter
;
560 static int sys_perf_refcount_exit
;
562 static void perf_syscall_enter(void *ignore
, struct pt_regs
*regs
, long id
)
564 struct syscall_metadata
*sys_data
;
565 struct syscall_trace_enter
*rec
;
566 struct hlist_head
*head
;
571 syscall_nr
= trace_get_syscall_nr(current
, regs
);
572 if (syscall_nr
< 0 || syscall_nr
>= NR_syscalls
)
574 if (!test_bit(syscall_nr
, enabled_perf_enter_syscalls
))
577 sys_data
= syscall_nr_to_meta(syscall_nr
);
581 head
= this_cpu_ptr(sys_data
->enter_event
->perf_events
);
582 if (hlist_empty(head
))
585 /* get the size after alignment with the u32 buffer size field */
586 size
= sizeof(unsigned long) * sys_data
->nb_args
+ sizeof(*rec
);
587 size
= ALIGN(size
+ sizeof(u32
), sizeof(u64
));
590 rec
= perf_trace_buf_alloc(size
, NULL
, &rctx
);
594 rec
->nr
= syscall_nr
;
595 syscall_get_arguments(current
, regs
, 0, sys_data
->nb_args
,
596 (unsigned long *)&rec
->args
);
597 perf_trace_buf_submit(rec
, size
, rctx
,
598 sys_data
->enter_event
->event
.type
, 1, regs
,
602 static int perf_sysenter_enable(struct trace_event_call
*call
)
607 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
609 mutex_lock(&syscall_trace_lock
);
610 if (!sys_perf_refcount_enter
)
611 ret
= register_trace_sys_enter(perf_syscall_enter
, NULL
);
613 pr_info("event trace: Could not activate"
614 "syscall entry trace point");
616 set_bit(num
, enabled_perf_enter_syscalls
);
617 sys_perf_refcount_enter
++;
619 mutex_unlock(&syscall_trace_lock
);
623 static void perf_sysenter_disable(struct trace_event_call
*call
)
627 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
629 mutex_lock(&syscall_trace_lock
);
630 sys_perf_refcount_enter
--;
631 clear_bit(num
, enabled_perf_enter_syscalls
);
632 if (!sys_perf_refcount_enter
)
633 unregister_trace_sys_enter(perf_syscall_enter
, NULL
);
634 mutex_unlock(&syscall_trace_lock
);
637 static void perf_syscall_exit(void *ignore
, struct pt_regs
*regs
, long ret
)
639 struct syscall_metadata
*sys_data
;
640 struct syscall_trace_exit
*rec
;
641 struct hlist_head
*head
;
646 syscall_nr
= trace_get_syscall_nr(current
, regs
);
647 if (syscall_nr
< 0 || syscall_nr
>= NR_syscalls
)
649 if (!test_bit(syscall_nr
, enabled_perf_exit_syscalls
))
652 sys_data
= syscall_nr_to_meta(syscall_nr
);
656 head
= this_cpu_ptr(sys_data
->exit_event
->perf_events
);
657 if (hlist_empty(head
))
660 /* We can probably do that at build time */
661 size
= ALIGN(sizeof(*rec
) + sizeof(u32
), sizeof(u64
));
664 rec
= perf_trace_buf_alloc(size
, NULL
, &rctx
);
668 rec
->nr
= syscall_nr
;
669 rec
->ret
= syscall_get_return_value(current
, regs
);
670 perf_trace_buf_submit(rec
, size
, rctx
, sys_data
->exit_event
->event
.type
,
671 1, regs
, head
, NULL
);
674 static int perf_sysexit_enable(struct trace_event_call
*call
)
679 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
681 mutex_lock(&syscall_trace_lock
);
682 if (!sys_perf_refcount_exit
)
683 ret
= register_trace_sys_exit(perf_syscall_exit
, NULL
);
685 pr_info("event trace: Could not activate"
686 "syscall exit trace point");
688 set_bit(num
, enabled_perf_exit_syscalls
);
689 sys_perf_refcount_exit
++;
691 mutex_unlock(&syscall_trace_lock
);
695 static void perf_sysexit_disable(struct trace_event_call
*call
)
699 num
= ((struct syscall_metadata
*)call
->data
)->syscall_nr
;
701 mutex_lock(&syscall_trace_lock
);
702 sys_perf_refcount_exit
--;
703 clear_bit(num
, enabled_perf_exit_syscalls
);
704 if (!sys_perf_refcount_exit
)
705 unregister_trace_sys_exit(perf_syscall_exit
, NULL
);
706 mutex_unlock(&syscall_trace_lock
);
709 #endif /* CONFIG_PERF_EVENTS */
711 static int syscall_enter_register(struct trace_event_call
*event
,
712 enum trace_reg type
, void *data
)
714 struct trace_event_file
*file
= data
;
717 case TRACE_REG_REGISTER
:
718 return reg_event_syscall_enter(file
, event
);
719 case TRACE_REG_UNREGISTER
:
720 unreg_event_syscall_enter(file
, event
);
723 #ifdef CONFIG_PERF_EVENTS
724 case TRACE_REG_PERF_REGISTER
:
725 return perf_sysenter_enable(event
);
726 case TRACE_REG_PERF_UNREGISTER
:
727 perf_sysenter_disable(event
);
729 case TRACE_REG_PERF_OPEN
:
730 case TRACE_REG_PERF_CLOSE
:
731 case TRACE_REG_PERF_ADD
:
732 case TRACE_REG_PERF_DEL
:
739 static int syscall_exit_register(struct trace_event_call
*event
,
740 enum trace_reg type
, void *data
)
742 struct trace_event_file
*file
= data
;
745 case TRACE_REG_REGISTER
:
746 return reg_event_syscall_exit(file
, event
);
747 case TRACE_REG_UNREGISTER
:
748 unreg_event_syscall_exit(file
, event
);
751 #ifdef CONFIG_PERF_EVENTS
752 case TRACE_REG_PERF_REGISTER
:
753 return perf_sysexit_enable(event
);
754 case TRACE_REG_PERF_UNREGISTER
:
755 perf_sysexit_disable(event
);
757 case TRACE_REG_PERF_OPEN
:
758 case TRACE_REG_PERF_CLOSE
:
759 case TRACE_REG_PERF_ADD
:
760 case TRACE_REG_PERF_DEL
: