1 // SPDX-License-Identifier: GPL-2.0
3 * Kprobes-based tracing events
5 * Created by Masami Hiramatsu <mhiramat@redhat.com>
8 #define pr_fmt(fmt) "trace_kprobe: " fmt
10 #include <linux/security.h>
11 #include <linux/module.h>
12 #include <linux/uaccess.h>
13 #include <linux/rculist.h>
14 #include <linux/error-injection.h>
16 #include <asm/setup.h> /* for COMMAND_LINE_SIZE */
18 #include "trace_dynevent.h"
19 #include "trace_kprobe_selftest.h"
20 #include "trace_probe.h"
21 #include "trace_probe_tmpl.h"
23 #define KPROBE_EVENT_SYSTEM "kprobes"
24 #define KRETPROBE_MAXACTIVE_MAX 4096
26 /* Kprobe early definition from command line */
27 static char kprobe_boot_events_buf
[COMMAND_LINE_SIZE
] __initdata
;
29 static int __init
set_kprobe_boot_events(char *str
)
31 strlcpy(kprobe_boot_events_buf
, str
, COMMAND_LINE_SIZE
);
32 disable_tracing_selftest("running kprobe events");
36 __setup("kprobe_event=", set_kprobe_boot_events
);
38 static int trace_kprobe_create(int argc
, const char **argv
);
39 static int trace_kprobe_show(struct seq_file
*m
, struct dyn_event
*ev
);
40 static int trace_kprobe_release(struct dyn_event
*ev
);
41 static bool trace_kprobe_is_busy(struct dyn_event
*ev
);
42 static bool trace_kprobe_match(const char *system
, const char *event
,
43 int argc
, const char **argv
, struct dyn_event
*ev
);
45 static struct dyn_event_operations trace_kprobe_ops
= {
46 .create
= trace_kprobe_create
,
47 .show
= trace_kprobe_show
,
48 .is_busy
= trace_kprobe_is_busy
,
49 .free
= trace_kprobe_release
,
50 .match
= trace_kprobe_match
,
54 * Kprobe event core functions
57 struct dyn_event devent
;
58 struct kretprobe rp
; /* Use rp.kp for kprobe use */
59 unsigned long __percpu
*nhit
;
60 const char *symbol
; /* symbol name */
61 struct trace_probe tp
;
64 static bool is_trace_kprobe(struct dyn_event
*ev
)
66 return ev
->ops
== &trace_kprobe_ops
;
69 static struct trace_kprobe
*to_trace_kprobe(struct dyn_event
*ev
)
71 return container_of(ev
, struct trace_kprobe
, devent
);
75 * for_each_trace_kprobe - iterate over the trace_kprobe list
76 * @pos: the struct trace_kprobe * for each entry
77 * @dpos: the struct dyn_event * to use as a loop cursor
79 #define for_each_trace_kprobe(pos, dpos) \
80 for_each_dyn_event(dpos) \
81 if (is_trace_kprobe(dpos) && (pos = to_trace_kprobe(dpos)))
83 #define SIZEOF_TRACE_KPROBE(n) \
84 (offsetof(struct trace_kprobe, tp.args) + \
85 (sizeof(struct probe_arg) * (n)))
87 static nokprobe_inline
bool trace_kprobe_is_return(struct trace_kprobe
*tk
)
89 return tk
->rp
.handler
!= NULL
;
92 static nokprobe_inline
const char *trace_kprobe_symbol(struct trace_kprobe
*tk
)
94 return tk
->symbol
? tk
->symbol
: "unknown";
97 static nokprobe_inline
unsigned long trace_kprobe_offset(struct trace_kprobe
*tk
)
99 return tk
->rp
.kp
.offset
;
102 static nokprobe_inline
bool trace_kprobe_has_gone(struct trace_kprobe
*tk
)
104 return !!(kprobe_gone(&tk
->rp
.kp
));
107 static nokprobe_inline
bool trace_kprobe_within_module(struct trace_kprobe
*tk
,
110 int len
= strlen(module_name(mod
));
111 const char *name
= trace_kprobe_symbol(tk
);
113 return strncmp(module_name(mod
), name
, len
) == 0 && name
[len
] == ':';
116 static nokprobe_inline
bool trace_kprobe_module_exist(struct trace_kprobe
*tk
)
123 p
= strchr(tk
->symbol
, ':');
127 mutex_lock(&module_mutex
);
128 ret
= !!find_module(tk
->symbol
);
129 mutex_unlock(&module_mutex
);
135 static bool trace_kprobe_is_busy(struct dyn_event
*ev
)
137 struct trace_kprobe
*tk
= to_trace_kprobe(ev
);
139 return trace_probe_is_enabled(&tk
->tp
);
142 static bool trace_kprobe_match_command_head(struct trace_kprobe
*tk
,
143 int argc
, const char **argv
)
145 char buf
[MAX_ARGSTR_LEN
+ 1];
151 snprintf(buf
, sizeof(buf
), "0x%p", tk
->rp
.kp
.addr
);
152 else if (tk
->rp
.kp
.offset
)
153 snprintf(buf
, sizeof(buf
), "%s+%u",
154 trace_kprobe_symbol(tk
), tk
->rp
.kp
.offset
);
156 snprintf(buf
, sizeof(buf
), "%s", trace_kprobe_symbol(tk
));
157 if (strcmp(buf
, argv
[0]))
161 return trace_probe_match_command_args(&tk
->tp
, argc
, argv
);
164 static bool trace_kprobe_match(const char *system
, const char *event
,
165 int argc
, const char **argv
, struct dyn_event
*ev
)
167 struct trace_kprobe
*tk
= to_trace_kprobe(ev
);
169 return strcmp(trace_probe_name(&tk
->tp
), event
) == 0 &&
170 (!system
|| strcmp(trace_probe_group_name(&tk
->tp
), system
) == 0) &&
171 trace_kprobe_match_command_head(tk
, argc
, argv
);
174 static nokprobe_inline
unsigned long trace_kprobe_nhit(struct trace_kprobe
*tk
)
176 unsigned long nhit
= 0;
179 for_each_possible_cpu(cpu
)
180 nhit
+= *per_cpu_ptr(tk
->nhit
, cpu
);
185 static nokprobe_inline
bool trace_kprobe_is_registered(struct trace_kprobe
*tk
)
187 return !(list_empty(&tk
->rp
.kp
.list
) &&
188 hlist_unhashed(&tk
->rp
.kp
.hlist
));
191 /* Return 0 if it fails to find the symbol address */
192 static nokprobe_inline
193 unsigned long trace_kprobe_address(struct trace_kprobe
*tk
)
198 addr
= (unsigned long)
199 kallsyms_lookup_name(trace_kprobe_symbol(tk
));
201 addr
+= tk
->rp
.kp
.offset
;
203 addr
= (unsigned long)tk
->rp
.kp
.addr
;
208 static nokprobe_inline
struct trace_kprobe
*
209 trace_kprobe_primary_from_call(struct trace_event_call
*call
)
211 struct trace_probe
*tp
;
213 tp
= trace_probe_primary_from_call(call
);
214 if (WARN_ON_ONCE(!tp
))
217 return container_of(tp
, struct trace_kprobe
, tp
);
220 bool trace_kprobe_on_func_entry(struct trace_event_call
*call
)
222 struct trace_kprobe
*tk
= trace_kprobe_primary_from_call(call
);
224 return tk
? kprobe_on_func_entry(tk
->rp
.kp
.addr
,
225 tk
->rp
.kp
.addr
? NULL
: tk
->rp
.kp
.symbol_name
,
226 tk
->rp
.kp
.addr
? 0 : tk
->rp
.kp
.offset
) : false;
229 bool trace_kprobe_error_injectable(struct trace_event_call
*call
)
231 struct trace_kprobe
*tk
= trace_kprobe_primary_from_call(call
);
233 return tk
? within_error_injection_list(trace_kprobe_address(tk
)) :
237 static int register_kprobe_event(struct trace_kprobe
*tk
);
238 static int unregister_kprobe_event(struct trace_kprobe
*tk
);
240 static int kprobe_dispatcher(struct kprobe
*kp
, struct pt_regs
*regs
);
241 static int kretprobe_dispatcher(struct kretprobe_instance
*ri
,
242 struct pt_regs
*regs
);
244 static void free_trace_kprobe(struct trace_kprobe
*tk
)
247 trace_probe_cleanup(&tk
->tp
);
249 free_percpu(tk
->nhit
);
255 * Allocate new trace_probe and initialize it (including kprobes).
257 static struct trace_kprobe
*alloc_trace_kprobe(const char *group
,
263 int nargs
, bool is_return
)
265 struct trace_kprobe
*tk
;
268 tk
= kzalloc(SIZEOF_TRACE_KPROBE(nargs
), GFP_KERNEL
);
272 tk
->nhit
= alloc_percpu(unsigned long);
277 tk
->symbol
= kstrdup(symbol
, GFP_KERNEL
);
280 tk
->rp
.kp
.symbol_name
= tk
->symbol
;
281 tk
->rp
.kp
.offset
= offs
;
283 tk
->rp
.kp
.addr
= addr
;
286 tk
->rp
.handler
= kretprobe_dispatcher
;
288 tk
->rp
.kp
.pre_handler
= kprobe_dispatcher
;
290 tk
->rp
.maxactive
= maxactive
;
291 INIT_HLIST_NODE(&tk
->rp
.kp
.hlist
);
292 INIT_LIST_HEAD(&tk
->rp
.kp
.list
);
294 ret
= trace_probe_init(&tk
->tp
, event
, group
, false);
298 dyn_event_init(&tk
->devent
, &trace_kprobe_ops
);
301 free_trace_kprobe(tk
);
305 static struct trace_kprobe
*find_trace_kprobe(const char *event
,
308 struct dyn_event
*pos
;
309 struct trace_kprobe
*tk
;
311 for_each_trace_kprobe(tk
, pos
)
312 if (strcmp(trace_probe_name(&tk
->tp
), event
) == 0 &&
313 strcmp(trace_probe_group_name(&tk
->tp
), group
) == 0)
318 static inline int __enable_trace_kprobe(struct trace_kprobe
*tk
)
322 if (trace_kprobe_is_registered(tk
) && !trace_kprobe_has_gone(tk
)) {
323 if (trace_kprobe_is_return(tk
))
324 ret
= enable_kretprobe(&tk
->rp
);
326 ret
= enable_kprobe(&tk
->rp
.kp
);
332 static void __disable_trace_kprobe(struct trace_probe
*tp
)
334 struct trace_probe
*pos
;
335 struct trace_kprobe
*tk
;
337 list_for_each_entry(pos
, trace_probe_probe_list(tp
), list
) {
338 tk
= container_of(pos
, struct trace_kprobe
, tp
);
339 if (!trace_kprobe_is_registered(tk
))
341 if (trace_kprobe_is_return(tk
))
342 disable_kretprobe(&tk
->rp
);
344 disable_kprobe(&tk
->rp
.kp
);
350 * if the file is NULL, enable "perf" handler, or enable "trace" handler.
352 static int enable_trace_kprobe(struct trace_event_call
*call
,
353 struct trace_event_file
*file
)
355 struct trace_probe
*pos
, *tp
;
356 struct trace_kprobe
*tk
;
360 tp
= trace_probe_primary_from_call(call
);
361 if (WARN_ON_ONCE(!tp
))
363 enabled
= trace_probe_is_enabled(tp
);
365 /* This also changes "enabled" state */
367 ret
= trace_probe_add_file(tp
, file
);
371 trace_probe_set_flag(tp
, TP_FLAG_PROFILE
);
376 list_for_each_entry(pos
, trace_probe_probe_list(tp
), list
) {
377 tk
= container_of(pos
, struct trace_kprobe
, tp
);
378 if (trace_kprobe_has_gone(tk
))
380 ret
= __enable_trace_kprobe(tk
);
387 /* Failed to enable one of them. Roll back all */
389 __disable_trace_kprobe(tp
);
391 trace_probe_remove_file(tp
, file
);
393 trace_probe_clear_flag(tp
, TP_FLAG_PROFILE
);
400 * Disable trace_probe
401 * if the file is NULL, disable "perf" handler, or disable "trace" handler.
403 static int disable_trace_kprobe(struct trace_event_call
*call
,
404 struct trace_event_file
*file
)
406 struct trace_probe
*tp
;
408 tp
= trace_probe_primary_from_call(call
);
409 if (WARN_ON_ONCE(!tp
))
413 if (!trace_probe_get_file_link(tp
, file
))
415 if (!trace_probe_has_single_file(tp
))
417 trace_probe_clear_flag(tp
, TP_FLAG_TRACE
);
419 trace_probe_clear_flag(tp
, TP_FLAG_PROFILE
);
421 if (!trace_probe_is_enabled(tp
))
422 __disable_trace_kprobe(tp
);
427 * Synchronization is done in below function. For perf event,
428 * file == NULL and perf_trace_event_unreg() calls
429 * tracepoint_synchronize_unregister() to ensure synchronize
430 * event. We don't need to care about it.
432 trace_probe_remove_file(tp
, file
);
437 #if defined(CONFIG_KPROBES_ON_FTRACE) && \
438 !defined(CONFIG_KPROBE_EVENTS_ON_NOTRACE)
439 static bool __within_notrace_func(unsigned long addr
)
441 unsigned long offset
, size
;
443 if (!addr
|| !kallsyms_lookup_size_offset(addr
, &size
, &offset
))
446 /* Get the entry address of the target function */
450 * Since ftrace_location_range() does inclusive range check, we need
451 * to subtract 1 byte from the end address.
453 return !ftrace_location_range(addr
, addr
+ size
- 1);
456 static bool within_notrace_func(struct trace_kprobe
*tk
)
458 unsigned long addr
= trace_kprobe_address(tk
);
459 char symname
[KSYM_NAME_LEN
], *p
;
461 if (!__within_notrace_func(addr
))
464 /* Check if the address is on a suffixed-symbol */
465 if (!lookup_symbol_name(addr
, symname
)) {
466 p
= strchr(symname
, '.');
470 addr
= (unsigned long)kprobe_lookup_name(symname
, 0);
472 return __within_notrace_func(addr
);
478 #define within_notrace_func(tk) (false)
481 /* Internal register function - just handle k*probes and flags */
482 static int __register_trace_kprobe(struct trace_kprobe
*tk
)
486 ret
= security_locked_down(LOCKDOWN_KPROBES
);
490 if (trace_kprobe_is_registered(tk
))
493 if (within_notrace_func(tk
)) {
494 pr_warn("Could not probe notrace function %s\n",
495 trace_kprobe_symbol(tk
));
499 for (i
= 0; i
< tk
->tp
.nr_args
; i
++) {
500 ret
= traceprobe_update_arg(&tk
->tp
.args
[i
]);
505 /* Set/clear disabled flag according to tp->flag */
506 if (trace_probe_is_enabled(&tk
->tp
))
507 tk
->rp
.kp
.flags
&= ~KPROBE_FLAG_DISABLED
;
509 tk
->rp
.kp
.flags
|= KPROBE_FLAG_DISABLED
;
511 if (trace_kprobe_is_return(tk
))
512 ret
= register_kretprobe(&tk
->rp
);
514 ret
= register_kprobe(&tk
->rp
.kp
);
519 /* Internal unregister function - just handle k*probes and flags */
520 static void __unregister_trace_kprobe(struct trace_kprobe
*tk
)
522 if (trace_kprobe_is_registered(tk
)) {
523 if (trace_kprobe_is_return(tk
))
524 unregister_kretprobe(&tk
->rp
);
526 unregister_kprobe(&tk
->rp
.kp
);
527 /* Cleanup kprobe for reuse and mark it unregistered */
528 INIT_HLIST_NODE(&tk
->rp
.kp
.hlist
);
529 INIT_LIST_HEAD(&tk
->rp
.kp
.list
);
530 if (tk
->rp
.kp
.symbol_name
)
531 tk
->rp
.kp
.addr
= NULL
;
535 /* Unregister a trace_probe and probe_event */
536 static int unregister_trace_kprobe(struct trace_kprobe
*tk
)
538 /* If other probes are on the event, just unregister kprobe */
539 if (trace_probe_has_sibling(&tk
->tp
))
542 /* Enabled event can not be unregistered */
543 if (trace_probe_is_enabled(&tk
->tp
))
546 /* Will fail if probe is being used by ftrace or perf */
547 if (unregister_kprobe_event(tk
))
551 __unregister_trace_kprobe(tk
);
552 dyn_event_remove(&tk
->devent
);
553 trace_probe_unlink(&tk
->tp
);
558 static bool trace_kprobe_has_same_kprobe(struct trace_kprobe
*orig
,
559 struct trace_kprobe
*comp
)
561 struct trace_probe_event
*tpe
= orig
->tp
.event
;
562 struct trace_probe
*pos
;
565 list_for_each_entry(pos
, &tpe
->probes
, list
) {
566 orig
= container_of(pos
, struct trace_kprobe
, tp
);
567 if (strcmp(trace_kprobe_symbol(orig
),
568 trace_kprobe_symbol(comp
)) ||
569 trace_kprobe_offset(orig
) != trace_kprobe_offset(comp
))
573 * trace_probe_compare_arg_type() ensured that nr_args and
574 * each argument name and type are same. Let's compare comm.
576 for (i
= 0; i
< orig
->tp
.nr_args
; i
++) {
577 if (strcmp(orig
->tp
.args
[i
].comm
,
578 comp
->tp
.args
[i
].comm
))
582 if (i
== orig
->tp
.nr_args
)
589 static int append_trace_kprobe(struct trace_kprobe
*tk
, struct trace_kprobe
*to
)
593 ret
= trace_probe_compare_arg_type(&tk
->tp
, &to
->tp
);
595 /* Note that argument starts index = 2 */
596 trace_probe_log_set_index(ret
+ 1);
597 trace_probe_log_err(0, DIFF_ARG_TYPE
);
600 if (trace_kprobe_has_same_kprobe(to
, tk
)) {
601 trace_probe_log_set_index(0);
602 trace_probe_log_err(0, SAME_PROBE
);
606 /* Append to existing event */
607 ret
= trace_probe_append(&tk
->tp
, &to
->tp
);
611 /* Register k*probe */
612 ret
= __register_trace_kprobe(tk
);
613 if (ret
== -ENOENT
&& !trace_kprobe_module_exist(tk
)) {
614 pr_warn("This probe might be able to register after target module is loaded. Continue.\n");
619 trace_probe_unlink(&tk
->tp
);
621 dyn_event_add(&tk
->devent
);
626 /* Register a trace_probe and probe_event */
627 static int register_trace_kprobe(struct trace_kprobe
*tk
)
629 struct trace_kprobe
*old_tk
;
632 mutex_lock(&event_mutex
);
634 old_tk
= find_trace_kprobe(trace_probe_name(&tk
->tp
),
635 trace_probe_group_name(&tk
->tp
));
637 if (trace_kprobe_is_return(tk
) != trace_kprobe_is_return(old_tk
)) {
638 trace_probe_log_set_index(0);
639 trace_probe_log_err(0, DIFF_PROBE_TYPE
);
642 ret
= append_trace_kprobe(tk
, old_tk
);
647 /* Register new event */
648 ret
= register_kprobe_event(tk
);
650 pr_warn("Failed to register probe event(%d)\n", ret
);
654 /* Register k*probe */
655 ret
= __register_trace_kprobe(tk
);
656 if (ret
== -ENOENT
&& !trace_kprobe_module_exist(tk
)) {
657 pr_warn("This probe might be able to register after target module is loaded. Continue.\n");
662 unregister_kprobe_event(tk
);
664 dyn_event_add(&tk
->devent
);
667 mutex_unlock(&event_mutex
);
671 /* Module notifier call back, checking event on the module */
672 static int trace_kprobe_module_callback(struct notifier_block
*nb
,
673 unsigned long val
, void *data
)
675 struct module
*mod
= data
;
676 struct dyn_event
*pos
;
677 struct trace_kprobe
*tk
;
680 if (val
!= MODULE_STATE_COMING
)
683 /* Update probes on coming module */
684 mutex_lock(&event_mutex
);
685 for_each_trace_kprobe(tk
, pos
) {
686 if (trace_kprobe_within_module(tk
, mod
)) {
687 /* Don't need to check busy - this should have gone. */
688 __unregister_trace_kprobe(tk
);
689 ret
= __register_trace_kprobe(tk
);
691 pr_warn("Failed to re-register probe %s on %s: %d\n",
692 trace_probe_name(&tk
->tp
),
693 module_name(mod
), ret
);
696 mutex_unlock(&event_mutex
);
701 static struct notifier_block trace_kprobe_module_nb
= {
702 .notifier_call
= trace_kprobe_module_callback
,
703 .priority
= 1 /* Invoked after kprobe module callback */
706 /* Convert certain expected symbols into '_' when generating event names */
707 static inline void sanitize_event_name(char *name
)
709 while (*name
++ != '\0')
710 if (*name
== ':' || *name
== '.')
714 static int trace_kprobe_create(int argc
, const char *argv
[])
719 * p[:[GRP/]EVENT] [MOD:]KSYM[+OFFS]|KADDR [FETCHARGS]
721 * r[MAXACTIVE][:[GRP/]EVENT] [MOD:]KSYM[+0] [FETCHARGS]
723 * p:[GRP/]EVENT] [MOD:]KSYM[+0]%return [FETCHARGS]
726 * $retval : fetch return value
727 * $stack : fetch stack address
728 * $stackN : fetch Nth of stack (N:0-)
729 * $comm : fetch current task comm
730 * @ADDR : fetch memory at ADDR (ADDR should be in kernel)
731 * @SYM[+|-offs] : fetch memory at SYM +|- offs (SYM is a data symbol)
732 * %REG : fetch register REG
733 * Dereferencing memory fetch:
734 * +|-offs(ARG) : fetch memory at ARG +|- offs address.
735 * Alias name of args:
736 * NAME=FETCHARG : set NAME as alias of FETCHARG.
738 * FETCHARG:TYPE : use TYPE instead of unsigned long.
740 struct trace_kprobe
*tk
= NULL
;
742 bool is_return
= false;
743 char *symbol
= NULL
, *tmp
= NULL
;
744 const char *event
= NULL
, *group
= KPROBE_EVENT_SYSTEM
;
748 char buf
[MAX_EVENT_NAME_LEN
];
749 unsigned int flags
= TPARG_FL_KERNEL
;
751 switch (argv
[0][0]) {
763 trace_probe_log_init("trace_kprobe", argc
, argv
);
765 event
= strchr(&argv
[0][1], ':');
769 if (isdigit(argv
[0][1])) {
771 trace_probe_log_err(1, MAXACT_NO_KPROBE
);
775 len
= event
- &argv
[0][1] - 1;
777 len
= strlen(&argv
[0][1]);
778 if (len
> MAX_EVENT_NAME_LEN
- 1) {
779 trace_probe_log_err(1, BAD_MAXACT
);
782 memcpy(buf
, &argv
[0][1], len
);
784 ret
= kstrtouint(buf
, 0, &maxactive
);
785 if (ret
|| !maxactive
) {
786 trace_probe_log_err(1, BAD_MAXACT
);
789 /* kretprobes instances are iterated over via a list. The
790 * maximum should stay reasonable.
792 if (maxactive
> KRETPROBE_MAXACTIVE_MAX
) {
793 trace_probe_log_err(1, MAXACT_TOO_BIG
);
798 /* try to parse an address. if that fails, try to read the
799 * input as a symbol. */
800 if (kstrtoul(argv
[1], 0, (unsigned long *)&addr
)) {
801 trace_probe_log_set_index(1);
802 /* Check whether uprobe event specified */
803 if (strchr(argv
[1], '/') && strchr(argv
[1], ':')) {
807 /* a symbol specified */
808 symbol
= kstrdup(argv
[1], GFP_KERNEL
);
812 tmp
= strchr(symbol
, '%');
814 if (!strcmp(tmp
, "%return")) {
818 trace_probe_log_err(tmp
- symbol
, BAD_ADDR_SUFFIX
);
823 /* TODO: support .init module functions */
824 ret
= traceprobe_split_symbol_offset(symbol
, &offset
);
825 if (ret
|| offset
< 0 || offset
> UINT_MAX
) {
826 trace_probe_log_err(0, BAD_PROBE_ADDR
);
830 flags
|= TPARG_FL_RETURN
;
831 if (kprobe_on_func_entry(NULL
, symbol
, offset
))
832 flags
|= TPARG_FL_FENTRY
;
833 if (offset
&& is_return
&& !(flags
& TPARG_FL_FENTRY
)) {
834 trace_probe_log_err(0, BAD_RETPROBE
);
839 trace_probe_log_set_index(0);
841 ret
= traceprobe_parse_event_name(&event
, &group
, buf
,
846 /* Make a new event name */
848 snprintf(buf
, MAX_EVENT_NAME_LEN
, "%c_%s_%ld",
849 is_return
? 'r' : 'p', symbol
, offset
);
851 snprintf(buf
, MAX_EVENT_NAME_LEN
, "%c_0x%p",
852 is_return
? 'r' : 'p', addr
);
853 sanitize_event_name(buf
);
858 tk
= alloc_trace_kprobe(group
, event
, addr
, symbol
, offset
, maxactive
,
859 argc
- 2, is_return
);
862 /* This must return -ENOMEM, else there is a bug */
863 WARN_ON_ONCE(ret
!= -ENOMEM
);
864 goto out
; /* We know tk is not allocated */
866 argc
-= 2; argv
+= 2;
868 /* parse arguments */
869 for (i
= 0; i
< argc
&& i
< MAX_TRACE_ARGS
; i
++) {
870 tmp
= kstrdup(argv
[i
], GFP_KERNEL
);
876 trace_probe_log_set_index(i
+ 2);
877 ret
= traceprobe_parse_probe_arg(&tk
->tp
, i
, tmp
, flags
);
880 goto error
; /* This can be -ENOMEM */
883 ret
= traceprobe_set_print_fmt(&tk
->tp
, is_return
);
887 ret
= register_trace_kprobe(tk
);
889 trace_probe_log_set_index(1);
891 trace_probe_log_err(0, BAD_INSN_BNDRY
);
892 else if (ret
== -ENOENT
)
893 trace_probe_log_err(0, BAD_PROBE_ADDR
);
894 else if (ret
!= -ENOMEM
&& ret
!= -EEXIST
)
895 trace_probe_log_err(0, FAIL_REG_PROBE
);
900 trace_probe_log_clear();
907 free_trace_kprobe(tk
);
911 static int create_or_delete_trace_kprobe(int argc
, char **argv
)
915 if (argv
[0][0] == '-')
916 return dyn_event_release(argc
, argv
, &trace_kprobe_ops
);
918 ret
= trace_kprobe_create(argc
, (const char **)argv
);
919 return ret
== -ECANCELED
? -EINVAL
: ret
;
922 static int trace_kprobe_run_command(struct dynevent_cmd
*cmd
)
924 return trace_run_command(cmd
->seq
.buffer
, create_or_delete_trace_kprobe
);
928 * kprobe_event_cmd_init - Initialize a kprobe event command object
929 * @cmd: A pointer to the dynevent_cmd struct representing the new event
930 * @buf: A pointer to the buffer used to build the command
931 * @maxlen: The length of the buffer passed in @buf
933 * Initialize a synthetic event command object. Use this before
934 * calling any of the other kprobe_event functions.
936 void kprobe_event_cmd_init(struct dynevent_cmd
*cmd
, char *buf
, int maxlen
)
938 dynevent_cmd_init(cmd
, buf
, maxlen
, DYNEVENT_TYPE_KPROBE
,
939 trace_kprobe_run_command
);
941 EXPORT_SYMBOL_GPL(kprobe_event_cmd_init
);
944 * __kprobe_event_gen_cmd_start - Generate a kprobe event command from arg list
945 * @cmd: A pointer to the dynevent_cmd struct representing the new event
946 * @name: The name of the kprobe event
947 * @loc: The location of the kprobe event
948 * @kretprobe: Is this a return probe?
949 * @args: Variable number of arg (pairs), one pair for each field
951 * NOTE: Users normally won't want to call this function directly, but
952 * rather use the kprobe_event_gen_cmd_start() wrapper, which automatically
953 * adds a NULL to the end of the arg list. If this function is used
954 * directly, make sure the last arg in the variable arg list is NULL.
956 * Generate a kprobe event command to be executed by
957 * kprobe_event_gen_cmd_end(). This function can be used to generate the
958 * complete command or only the first part of it; in the latter case,
959 * kprobe_event_add_fields() can be used to add more fields following this.
961 * Unlikely the synth_event_gen_cmd_start(), @loc must be specified. This
962 * returns -EINVAL if @loc == NULL.
964 * Return: 0 if successful, error otherwise.
966 int __kprobe_event_gen_cmd_start(struct dynevent_cmd
*cmd
, bool kretprobe
,
967 const char *name
, const char *loc
, ...)
969 char buf
[MAX_EVENT_NAME_LEN
];
970 struct dynevent_arg arg
;
974 if (cmd
->type
!= DYNEVENT_TYPE_KPROBE
)
981 snprintf(buf
, MAX_EVENT_NAME_LEN
, "r:kprobes/%s", name
);
983 snprintf(buf
, MAX_EVENT_NAME_LEN
, "p:kprobes/%s", name
);
985 ret
= dynevent_str_add(cmd
, buf
);
989 dynevent_arg_init(&arg
, 0);
991 ret
= dynevent_arg_add(cmd
, &arg
, NULL
);
999 field
= va_arg(args
, const char *);
1003 if (++cmd
->n_fields
> MAX_TRACE_ARGS
) {
1009 ret
= dynevent_arg_add(cmd
, &arg
, NULL
);
1017 EXPORT_SYMBOL_GPL(__kprobe_event_gen_cmd_start
);
1020 * __kprobe_event_add_fields - Add probe fields to a kprobe command from arg list
1021 * @cmd: A pointer to the dynevent_cmd struct representing the new event
1022 * @args: Variable number of arg (pairs), one pair for each field
1024 * NOTE: Users normally won't want to call this function directly, but
1025 * rather use the kprobe_event_add_fields() wrapper, which
1026 * automatically adds a NULL to the end of the arg list. If this
1027 * function is used directly, make sure the last arg in the variable
1030 * Add probe fields to an existing kprobe command using a variable
1031 * list of args. Fields are added in the same order they're listed.
1033 * Return: 0 if successful, error otherwise.
1035 int __kprobe_event_add_fields(struct dynevent_cmd
*cmd
, ...)
1037 struct dynevent_arg arg
;
1041 if (cmd
->type
!= DYNEVENT_TYPE_KPROBE
)
1044 dynevent_arg_init(&arg
, 0);
1046 va_start(args
, cmd
);
1050 field
= va_arg(args
, const char *);
1054 if (++cmd
->n_fields
> MAX_TRACE_ARGS
) {
1060 ret
= dynevent_arg_add(cmd
, &arg
, NULL
);
1068 EXPORT_SYMBOL_GPL(__kprobe_event_add_fields
);
1071 * kprobe_event_delete - Delete a kprobe event
1072 * @name: The name of the kprobe event to delete
1074 * Delete a kprobe event with the give @name from kernel code rather
1075 * than directly from the command line.
1077 * Return: 0 if successful, error otherwise.
1079 int kprobe_event_delete(const char *name
)
1081 char buf
[MAX_EVENT_NAME_LEN
];
1083 snprintf(buf
, MAX_EVENT_NAME_LEN
, "-:%s", name
);
1085 return trace_run_command(buf
, create_or_delete_trace_kprobe
);
1087 EXPORT_SYMBOL_GPL(kprobe_event_delete
);
1089 static int trace_kprobe_release(struct dyn_event
*ev
)
1091 struct trace_kprobe
*tk
= to_trace_kprobe(ev
);
1092 int ret
= unregister_trace_kprobe(tk
);
1095 free_trace_kprobe(tk
);
1099 static int trace_kprobe_show(struct seq_file
*m
, struct dyn_event
*ev
)
1101 struct trace_kprobe
*tk
= to_trace_kprobe(ev
);
1104 seq_putc(m
, trace_kprobe_is_return(tk
) ? 'r' : 'p');
1105 if (trace_kprobe_is_return(tk
) && tk
->rp
.maxactive
)
1106 seq_printf(m
, "%d", tk
->rp
.maxactive
);
1107 seq_printf(m
, ":%s/%s", trace_probe_group_name(&tk
->tp
),
1108 trace_probe_name(&tk
->tp
));
1111 seq_printf(m
, " 0x%p", tk
->rp
.kp
.addr
);
1112 else if (tk
->rp
.kp
.offset
)
1113 seq_printf(m
, " %s+%u", trace_kprobe_symbol(tk
),
1116 seq_printf(m
, " %s", trace_kprobe_symbol(tk
));
1118 for (i
= 0; i
< tk
->tp
.nr_args
; i
++)
1119 seq_printf(m
, " %s=%s", tk
->tp
.args
[i
].name
, tk
->tp
.args
[i
].comm
);
1125 static int probes_seq_show(struct seq_file
*m
, void *v
)
1127 struct dyn_event
*ev
= v
;
1129 if (!is_trace_kprobe(ev
))
1132 return trace_kprobe_show(m
, ev
);
1135 static const struct seq_operations probes_seq_op
= {
1136 .start
= dyn_event_seq_start
,
1137 .next
= dyn_event_seq_next
,
1138 .stop
= dyn_event_seq_stop
,
1139 .show
= probes_seq_show
1142 static int probes_open(struct inode
*inode
, struct file
*file
)
1146 ret
= security_locked_down(LOCKDOWN_TRACEFS
);
1150 if ((file
->f_mode
& FMODE_WRITE
) && (file
->f_flags
& O_TRUNC
)) {
1151 ret
= dyn_events_release_all(&trace_kprobe_ops
);
1156 return seq_open(file
, &probes_seq_op
);
1159 static ssize_t
probes_write(struct file
*file
, const char __user
*buffer
,
1160 size_t count
, loff_t
*ppos
)
1162 return trace_parse_run_command(file
, buffer
, count
, ppos
,
1163 create_or_delete_trace_kprobe
);
1166 static const struct file_operations kprobe_events_ops
= {
1167 .owner
= THIS_MODULE
,
1168 .open
= probes_open
,
1170 .llseek
= seq_lseek
,
1171 .release
= seq_release
,
1172 .write
= probes_write
,
1175 /* Probes profiling interfaces */
1176 static int probes_profile_seq_show(struct seq_file
*m
, void *v
)
1178 struct dyn_event
*ev
= v
;
1179 struct trace_kprobe
*tk
;
1181 if (!is_trace_kprobe(ev
))
1184 tk
= to_trace_kprobe(ev
);
1185 seq_printf(m
, " %-44s %15lu %15lu\n",
1186 trace_probe_name(&tk
->tp
),
1187 trace_kprobe_nhit(tk
),
1193 static const struct seq_operations profile_seq_op
= {
1194 .start
= dyn_event_seq_start
,
1195 .next
= dyn_event_seq_next
,
1196 .stop
= dyn_event_seq_stop
,
1197 .show
= probes_profile_seq_show
1200 static int profile_open(struct inode
*inode
, struct file
*file
)
1204 ret
= security_locked_down(LOCKDOWN_TRACEFS
);
1208 return seq_open(file
, &profile_seq_op
);
1211 static const struct file_operations kprobe_profile_ops
= {
1212 .owner
= THIS_MODULE
,
1213 .open
= profile_open
,
1215 .llseek
= seq_lseek
,
1216 .release
= seq_release
,
1219 /* Kprobe specific fetch functions */
1221 /* Return the length of string -- including null terminal byte */
1222 static nokprobe_inline
int
1223 fetch_store_strlen_user(unsigned long addr
)
1225 const void __user
*uaddr
= (__force
const void __user
*)addr
;
1227 return strnlen_user_nofault(uaddr
, MAX_STRING_SIZE
);
1230 /* Return the length of string -- including null terminal byte */
1231 static nokprobe_inline
int
1232 fetch_store_strlen(unsigned long addr
)
1237 #ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
1238 if (addr
< TASK_SIZE
)
1239 return fetch_store_strlen_user(addr
);
1243 ret
= copy_from_kernel_nofault(&c
, (u8
*)addr
+ len
, 1);
1245 } while (c
&& ret
== 0 && len
< MAX_STRING_SIZE
);
1247 return (ret
< 0) ? ret
: len
;
1251 * Fetch a null-terminated string from user. Caller MUST set *(u32 *)buf
1252 * with max length and relative data location.
1254 static nokprobe_inline
int
1255 fetch_store_string_user(unsigned long addr
, void *dest
, void *base
)
1257 const void __user
*uaddr
= (__force
const void __user
*)addr
;
1258 int maxlen
= get_loc_len(*(u32
*)dest
);
1262 if (unlikely(!maxlen
))
1265 __dest
= get_loc_data(dest
, base
);
1267 ret
= strncpy_from_user_nofault(__dest
, uaddr
, maxlen
);
1269 *(u32
*)dest
= make_data_loc(ret
, __dest
- base
);
1275 * Fetch a null-terminated string. Caller MUST set *(u32 *)buf with max
1276 * length and relative data location.
1278 static nokprobe_inline
int
1279 fetch_store_string(unsigned long addr
, void *dest
, void *base
)
1281 int maxlen
= get_loc_len(*(u32
*)dest
);
1285 #ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
1286 if ((unsigned long)addr
< TASK_SIZE
)
1287 return fetch_store_string_user(addr
, dest
, base
);
1290 if (unlikely(!maxlen
))
1293 __dest
= get_loc_data(dest
, base
);
1296 * Try to get string again, since the string can be changed while
1299 ret
= strncpy_from_kernel_nofault(__dest
, (void *)addr
, maxlen
);
1301 *(u32
*)dest
= make_data_loc(ret
, __dest
- base
);
1306 static nokprobe_inline
int
1307 probe_mem_read_user(void *dest
, void *src
, size_t size
)
1309 const void __user
*uaddr
= (__force
const void __user
*)src
;
1311 return copy_from_user_nofault(dest
, uaddr
, size
);
1314 static nokprobe_inline
int
1315 probe_mem_read(void *dest
, void *src
, size_t size
)
1317 #ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
1318 if ((unsigned long)src
< TASK_SIZE
)
1319 return probe_mem_read_user(dest
, src
, size
);
1321 return copy_from_kernel_nofault(dest
, src
, size
);
1324 /* Note that we don't verify it, since the code does not come from user space */
1326 process_fetch_insn(struct fetch_insn
*code
, struct pt_regs
*regs
, void *dest
,
1332 /* 1st stage: get value from context */
1335 val
= regs_get_register(regs
, code
->param
);
1337 case FETCH_OP_STACK
:
1338 val
= regs_get_kernel_stack_nth(regs
, code
->param
);
1340 case FETCH_OP_STACKP
:
1341 val
= kernel_stack_pointer(regs
);
1343 case FETCH_OP_RETVAL
:
1344 val
= regs_return_value(regs
);
1347 val
= code
->immediate
;
1350 val
= (unsigned long)current
->comm
;
1353 val
= (unsigned long)code
->data
;
1355 #ifdef CONFIG_HAVE_FUNCTION_ARG_ACCESS_API
1357 val
= regs_get_kernel_argument(regs
, code
->param
);
1360 case FETCH_NOP_SYMBOL
: /* Ignore a place holder */
1368 return process_fetch_insn_bottom(code
, val
, dest
, base
);
1370 NOKPROBE_SYMBOL(process_fetch_insn
)
1372 /* Kprobe handler */
1373 static nokprobe_inline
void
1374 __kprobe_trace_func(struct trace_kprobe
*tk
, struct pt_regs
*regs
,
1375 struct trace_event_file
*trace_file
)
1377 struct kprobe_trace_entry_head
*entry
;
1378 struct trace_event_call
*call
= trace_probe_event_call(&tk
->tp
);
1379 struct trace_event_buffer fbuffer
;
1382 WARN_ON(call
!= trace_file
->event_call
);
1384 if (trace_trigger_soft_disabled(trace_file
))
1387 local_save_flags(fbuffer
.flags
);
1388 fbuffer
.pc
= preempt_count();
1389 fbuffer
.trace_file
= trace_file
;
1391 dsize
= __get_data_size(&tk
->tp
, regs
);
1394 trace_event_buffer_lock_reserve(&fbuffer
.buffer
, trace_file
,
1396 sizeof(*entry
) + tk
->tp
.size
+ dsize
,
1397 fbuffer
.flags
, fbuffer
.pc
);
1401 fbuffer
.regs
= regs
;
1402 entry
= fbuffer
.entry
= ring_buffer_event_data(fbuffer
.event
);
1403 entry
->ip
= (unsigned long)tk
->rp
.kp
.addr
;
1404 store_trace_args(&entry
[1], &tk
->tp
, regs
, sizeof(*entry
), dsize
);
1406 trace_event_buffer_commit(&fbuffer
);
1410 kprobe_trace_func(struct trace_kprobe
*tk
, struct pt_regs
*regs
)
1412 struct event_file_link
*link
;
1414 trace_probe_for_each_link_rcu(link
, &tk
->tp
)
1415 __kprobe_trace_func(tk
, regs
, link
->file
);
1417 NOKPROBE_SYMBOL(kprobe_trace_func
);
1419 /* Kretprobe handler */
1420 static nokprobe_inline
void
1421 __kretprobe_trace_func(struct trace_kprobe
*tk
, struct kretprobe_instance
*ri
,
1422 struct pt_regs
*regs
,
1423 struct trace_event_file
*trace_file
)
1425 struct kretprobe_trace_entry_head
*entry
;
1426 struct trace_event_buffer fbuffer
;
1427 struct trace_event_call
*call
= trace_probe_event_call(&tk
->tp
);
1430 WARN_ON(call
!= trace_file
->event_call
);
1432 if (trace_trigger_soft_disabled(trace_file
))
1435 local_save_flags(fbuffer
.flags
);
1436 fbuffer
.pc
= preempt_count();
1437 fbuffer
.trace_file
= trace_file
;
1439 dsize
= __get_data_size(&tk
->tp
, regs
);
1441 trace_event_buffer_lock_reserve(&fbuffer
.buffer
, trace_file
,
1443 sizeof(*entry
) + tk
->tp
.size
+ dsize
,
1444 fbuffer
.flags
, fbuffer
.pc
);
1448 fbuffer
.regs
= regs
;
1449 entry
= fbuffer
.entry
= ring_buffer_event_data(fbuffer
.event
);
1450 entry
->func
= (unsigned long)tk
->rp
.kp
.addr
;
1451 entry
->ret_ip
= (unsigned long)ri
->ret_addr
;
1452 store_trace_args(&entry
[1], &tk
->tp
, regs
, sizeof(*entry
), dsize
);
1454 trace_event_buffer_commit(&fbuffer
);
1458 kretprobe_trace_func(struct trace_kprobe
*tk
, struct kretprobe_instance
*ri
,
1459 struct pt_regs
*regs
)
1461 struct event_file_link
*link
;
1463 trace_probe_for_each_link_rcu(link
, &tk
->tp
)
1464 __kretprobe_trace_func(tk
, ri
, regs
, link
->file
);
1466 NOKPROBE_SYMBOL(kretprobe_trace_func
);
1468 /* Event entry printers */
1469 static enum print_line_t
1470 print_kprobe_event(struct trace_iterator
*iter
, int flags
,
1471 struct trace_event
*event
)
1473 struct kprobe_trace_entry_head
*field
;
1474 struct trace_seq
*s
= &iter
->seq
;
1475 struct trace_probe
*tp
;
1477 field
= (struct kprobe_trace_entry_head
*)iter
->ent
;
1478 tp
= trace_probe_primary_from_call(
1479 container_of(event
, struct trace_event_call
, event
));
1480 if (WARN_ON_ONCE(!tp
))
1483 trace_seq_printf(s
, "%s: (", trace_probe_name(tp
));
1485 if (!seq_print_ip_sym(s
, field
->ip
, flags
| TRACE_ITER_SYM_OFFSET
))
1488 trace_seq_putc(s
, ')');
1490 if (print_probe_args(s
, tp
->args
, tp
->nr_args
,
1491 (u8
*)&field
[1], field
) < 0)
1494 trace_seq_putc(s
, '\n');
1496 return trace_handle_return(s
);
1499 static enum print_line_t
1500 print_kretprobe_event(struct trace_iterator
*iter
, int flags
,
1501 struct trace_event
*event
)
1503 struct kretprobe_trace_entry_head
*field
;
1504 struct trace_seq
*s
= &iter
->seq
;
1505 struct trace_probe
*tp
;
1507 field
= (struct kretprobe_trace_entry_head
*)iter
->ent
;
1508 tp
= trace_probe_primary_from_call(
1509 container_of(event
, struct trace_event_call
, event
));
1510 if (WARN_ON_ONCE(!tp
))
1513 trace_seq_printf(s
, "%s: (", trace_probe_name(tp
));
1515 if (!seq_print_ip_sym(s
, field
->ret_ip
, flags
| TRACE_ITER_SYM_OFFSET
))
1518 trace_seq_puts(s
, " <- ");
1520 if (!seq_print_ip_sym(s
, field
->func
, flags
& ~TRACE_ITER_SYM_OFFSET
))
1523 trace_seq_putc(s
, ')');
1525 if (print_probe_args(s
, tp
->args
, tp
->nr_args
,
1526 (u8
*)&field
[1], field
) < 0)
1529 trace_seq_putc(s
, '\n');
1532 return trace_handle_return(s
);
1536 static int kprobe_event_define_fields(struct trace_event_call
*event_call
)
1539 struct kprobe_trace_entry_head field
;
1540 struct trace_probe
*tp
;
1542 tp
= trace_probe_primary_from_call(event_call
);
1543 if (WARN_ON_ONCE(!tp
))
1546 DEFINE_FIELD(unsigned long, ip
, FIELD_STRING_IP
, 0);
1548 return traceprobe_define_arg_fields(event_call
, sizeof(field
), tp
);
1551 static int kretprobe_event_define_fields(struct trace_event_call
*event_call
)
1554 struct kretprobe_trace_entry_head field
;
1555 struct trace_probe
*tp
;
1557 tp
= trace_probe_primary_from_call(event_call
);
1558 if (WARN_ON_ONCE(!tp
))
1561 DEFINE_FIELD(unsigned long, func
, FIELD_STRING_FUNC
, 0);
1562 DEFINE_FIELD(unsigned long, ret_ip
, FIELD_STRING_RETIP
, 0);
1564 return traceprobe_define_arg_fields(event_call
, sizeof(field
), tp
);
1567 #ifdef CONFIG_PERF_EVENTS
1569 /* Kprobe profile handler */
1571 kprobe_perf_func(struct trace_kprobe
*tk
, struct pt_regs
*regs
)
1573 struct trace_event_call
*call
= trace_probe_event_call(&tk
->tp
);
1574 struct kprobe_trace_entry_head
*entry
;
1575 struct hlist_head
*head
;
1576 int size
, __size
, dsize
;
1579 if (bpf_prog_array_valid(call
)) {
1580 unsigned long orig_ip
= instruction_pointer(regs
);
1583 ret
= trace_call_bpf(call
, regs
);
1586 * We need to check and see if we modified the pc of the
1587 * pt_regs, and if so return 1 so that we don't do the
1590 if (orig_ip
!= instruction_pointer(regs
))
1596 head
= this_cpu_ptr(call
->perf_events
);
1597 if (hlist_empty(head
))
1600 dsize
= __get_data_size(&tk
->tp
, regs
);
1601 __size
= sizeof(*entry
) + tk
->tp
.size
+ dsize
;
1602 size
= ALIGN(__size
+ sizeof(u32
), sizeof(u64
));
1603 size
-= sizeof(u32
);
1605 entry
= perf_trace_buf_alloc(size
, NULL
, &rctx
);
1609 entry
->ip
= (unsigned long)tk
->rp
.kp
.addr
;
1610 memset(&entry
[1], 0, dsize
);
1611 store_trace_args(&entry
[1], &tk
->tp
, regs
, sizeof(*entry
), dsize
);
1612 perf_trace_buf_submit(entry
, size
, rctx
, call
->event
.type
, 1, regs
,
1616 NOKPROBE_SYMBOL(kprobe_perf_func
);
1618 /* Kretprobe profile handler */
1620 kretprobe_perf_func(struct trace_kprobe
*tk
, struct kretprobe_instance
*ri
,
1621 struct pt_regs
*regs
)
1623 struct trace_event_call
*call
= trace_probe_event_call(&tk
->tp
);
1624 struct kretprobe_trace_entry_head
*entry
;
1625 struct hlist_head
*head
;
1626 int size
, __size
, dsize
;
1629 if (bpf_prog_array_valid(call
) && !trace_call_bpf(call
, regs
))
1632 head
= this_cpu_ptr(call
->perf_events
);
1633 if (hlist_empty(head
))
1636 dsize
= __get_data_size(&tk
->tp
, regs
);
1637 __size
= sizeof(*entry
) + tk
->tp
.size
+ dsize
;
1638 size
= ALIGN(__size
+ sizeof(u32
), sizeof(u64
));
1639 size
-= sizeof(u32
);
1641 entry
= perf_trace_buf_alloc(size
, NULL
, &rctx
);
1645 entry
->func
= (unsigned long)tk
->rp
.kp
.addr
;
1646 entry
->ret_ip
= (unsigned long)ri
->ret_addr
;
1647 store_trace_args(&entry
[1], &tk
->tp
, regs
, sizeof(*entry
), dsize
);
1648 perf_trace_buf_submit(entry
, size
, rctx
, call
->event
.type
, 1, regs
,
1651 NOKPROBE_SYMBOL(kretprobe_perf_func
);
1653 int bpf_get_kprobe_info(const struct perf_event
*event
, u32
*fd_type
,
1654 const char **symbol
, u64
*probe_offset
,
1655 u64
*probe_addr
, bool perf_type_tracepoint
)
1657 const char *pevent
= trace_event_name(event
->tp_event
);
1658 const char *group
= event
->tp_event
->class->system
;
1659 struct trace_kprobe
*tk
;
1661 if (perf_type_tracepoint
)
1662 tk
= find_trace_kprobe(pevent
, group
);
1664 tk
= trace_kprobe_primary_from_call(event
->tp_event
);
1668 *fd_type
= trace_kprobe_is_return(tk
) ? BPF_FD_TYPE_KRETPROBE
1669 : BPF_FD_TYPE_KPROBE
;
1671 *symbol
= tk
->symbol
;
1672 *probe_offset
= tk
->rp
.kp
.offset
;
1677 *probe_addr
= (unsigned long)tk
->rp
.kp
.addr
;
1681 #endif /* CONFIG_PERF_EVENTS */
1684 * called by perf_trace_init() or __ftrace_set_clr_event() under event_mutex.
1686 * kprobe_trace_self_tests_init() does enable_trace_probe/disable_trace_probe
1687 * lockless, but we can't race with this __init function.
1689 static int kprobe_register(struct trace_event_call
*event
,
1690 enum trace_reg type
, void *data
)
1692 struct trace_event_file
*file
= data
;
1695 case TRACE_REG_REGISTER
:
1696 return enable_trace_kprobe(event
, file
);
1697 case TRACE_REG_UNREGISTER
:
1698 return disable_trace_kprobe(event
, file
);
1700 #ifdef CONFIG_PERF_EVENTS
1701 case TRACE_REG_PERF_REGISTER
:
1702 return enable_trace_kprobe(event
, NULL
);
1703 case TRACE_REG_PERF_UNREGISTER
:
1704 return disable_trace_kprobe(event
, NULL
);
1705 case TRACE_REG_PERF_OPEN
:
1706 case TRACE_REG_PERF_CLOSE
:
1707 case TRACE_REG_PERF_ADD
:
1708 case TRACE_REG_PERF_DEL
:
1715 static int kprobe_dispatcher(struct kprobe
*kp
, struct pt_regs
*regs
)
1717 struct trace_kprobe
*tk
= container_of(kp
, struct trace_kprobe
, rp
.kp
);
1720 raw_cpu_inc(*tk
->nhit
);
1722 if (trace_probe_test_flag(&tk
->tp
, TP_FLAG_TRACE
))
1723 kprobe_trace_func(tk
, regs
);
1724 #ifdef CONFIG_PERF_EVENTS
1725 if (trace_probe_test_flag(&tk
->tp
, TP_FLAG_PROFILE
))
1726 ret
= kprobe_perf_func(tk
, regs
);
1730 NOKPROBE_SYMBOL(kprobe_dispatcher
);
1733 kretprobe_dispatcher(struct kretprobe_instance
*ri
, struct pt_regs
*regs
)
1735 struct kretprobe
*rp
= get_kretprobe(ri
);
1736 struct trace_kprobe
*tk
= container_of(rp
, struct trace_kprobe
, rp
);
1738 raw_cpu_inc(*tk
->nhit
);
1740 if (trace_probe_test_flag(&tk
->tp
, TP_FLAG_TRACE
))
1741 kretprobe_trace_func(tk
, ri
, regs
);
1742 #ifdef CONFIG_PERF_EVENTS
1743 if (trace_probe_test_flag(&tk
->tp
, TP_FLAG_PROFILE
))
1744 kretprobe_perf_func(tk
, ri
, regs
);
1746 return 0; /* We don't tweek kernel, so just return 0 */
1748 NOKPROBE_SYMBOL(kretprobe_dispatcher
);
1750 static struct trace_event_functions kretprobe_funcs
= {
1751 .trace
= print_kretprobe_event
1754 static struct trace_event_functions kprobe_funcs
= {
1755 .trace
= print_kprobe_event
1758 static struct trace_event_fields kretprobe_fields_array
[] = {
1759 { .type
= TRACE_FUNCTION_TYPE
,
1760 .define_fields
= kretprobe_event_define_fields
},
1764 static struct trace_event_fields kprobe_fields_array
[] = {
1765 { .type
= TRACE_FUNCTION_TYPE
,
1766 .define_fields
= kprobe_event_define_fields
},
1770 static inline void init_trace_event_call(struct trace_kprobe
*tk
)
1772 struct trace_event_call
*call
= trace_probe_event_call(&tk
->tp
);
1774 if (trace_kprobe_is_return(tk
)) {
1775 call
->event
.funcs
= &kretprobe_funcs
;
1776 call
->class->fields_array
= kretprobe_fields_array
;
1778 call
->event
.funcs
= &kprobe_funcs
;
1779 call
->class->fields_array
= kprobe_fields_array
;
1782 call
->flags
= TRACE_EVENT_FL_KPROBE
;
1783 call
->class->reg
= kprobe_register
;
1786 static int register_kprobe_event(struct trace_kprobe
*tk
)
1788 init_trace_event_call(tk
);
1790 return trace_probe_register_event_call(&tk
->tp
);
1793 static int unregister_kprobe_event(struct trace_kprobe
*tk
)
1795 return trace_probe_unregister_event_call(&tk
->tp
);
1798 #ifdef CONFIG_PERF_EVENTS
1799 /* create a trace_kprobe, but don't add it to global lists */
1800 struct trace_event_call
*
1801 create_local_trace_kprobe(char *func
, void *addr
, unsigned long offs
,
1804 struct trace_kprobe
*tk
;
1809 * local trace_kprobes are not added to dyn_event, so they are never
1810 * searched in find_trace_kprobe(). Therefore, there is no concern of
1811 * duplicated name here.
1813 event
= func
? func
: "DUMMY_EVENT";
1815 tk
= alloc_trace_kprobe(KPROBE_EVENT_SYSTEM
, event
, (void *)addr
, func
,
1816 offs
, 0 /* maxactive */, 0 /* nargs */,
1820 pr_info("Failed to allocate trace_probe.(%d)\n",
1822 return ERR_CAST(tk
);
1825 init_trace_event_call(tk
);
1827 if (traceprobe_set_print_fmt(&tk
->tp
, trace_kprobe_is_return(tk
)) < 0) {
1832 ret
= __register_trace_kprobe(tk
);
1836 return trace_probe_event_call(&tk
->tp
);
1838 free_trace_kprobe(tk
);
1839 return ERR_PTR(ret
);
1842 void destroy_local_trace_kprobe(struct trace_event_call
*event_call
)
1844 struct trace_kprobe
*tk
;
1846 tk
= trace_kprobe_primary_from_call(event_call
);
1850 if (trace_probe_is_enabled(&tk
->tp
)) {
1855 __unregister_trace_kprobe(tk
);
1857 free_trace_kprobe(tk
);
1859 #endif /* CONFIG_PERF_EVENTS */
1861 static __init
void enable_boot_kprobe_events(void)
1863 struct trace_array
*tr
= top_trace_array();
1864 struct trace_event_file
*file
;
1865 struct trace_kprobe
*tk
;
1866 struct dyn_event
*pos
;
1868 mutex_lock(&event_mutex
);
1869 for_each_trace_kprobe(tk
, pos
) {
1870 list_for_each_entry(file
, &tr
->events
, list
)
1871 if (file
->event_call
== trace_probe_event_call(&tk
->tp
))
1872 trace_event_enable_disable(file
, 1, 0);
1874 mutex_unlock(&event_mutex
);
1877 static __init
void setup_boot_kprobe_events(void)
1879 char *p
, *cmd
= kprobe_boot_events_buf
;
1882 strreplace(kprobe_boot_events_buf
, ',', ' ');
1884 while (cmd
&& *cmd
!= '\0') {
1885 p
= strchr(cmd
, ';');
1889 ret
= trace_run_command(cmd
, create_or_delete_trace_kprobe
);
1891 pr_warn("Failed to add event(%d): %s\n", ret
, cmd
);
1896 enable_boot_kprobe_events();
1900 * Register dynevent at core_initcall. This allows kernel to setup kprobe
1901 * events in postcore_initcall without tracefs.
1903 static __init
int init_kprobe_trace_early(void)
1907 ret
= dyn_event_register(&trace_kprobe_ops
);
1911 if (register_module_notifier(&trace_kprobe_module_nb
))
1916 core_initcall(init_kprobe_trace_early
);
1918 /* Make a tracefs interface for controlling probe points */
1919 static __init
int init_kprobe_trace(void)
1922 struct dentry
*entry
;
1924 ret
= tracing_init_dentry();
1928 entry
= tracefs_create_file("kprobe_events", 0644, NULL
,
1929 NULL
, &kprobe_events_ops
);
1931 /* Event list interface */
1933 pr_warn("Could not create tracefs 'kprobe_events' entry\n");
1935 /* Profile interface */
1936 entry
= tracefs_create_file("kprobe_profile", 0444, NULL
,
1937 NULL
, &kprobe_profile_ops
);
1940 pr_warn("Could not create tracefs 'kprobe_profile' entry\n");
1942 setup_boot_kprobe_events();
1946 fs_initcall(init_kprobe_trace
);
1949 #ifdef CONFIG_FTRACE_STARTUP_TEST
1950 static __init
struct trace_event_file
*
1951 find_trace_probe_file(struct trace_kprobe
*tk
, struct trace_array
*tr
)
1953 struct trace_event_file
*file
;
1955 list_for_each_entry(file
, &tr
->events
, list
)
1956 if (file
->event_call
== trace_probe_event_call(&tk
->tp
))
1963 * Nobody but us can call enable_trace_kprobe/disable_trace_kprobe at this
1964 * stage, we can do this lockless.
1966 static __init
int kprobe_trace_self_tests_init(void)
1969 int (*target
)(int, int, int, int, int, int);
1970 struct trace_kprobe
*tk
;
1971 struct trace_event_file
*file
;
1973 if (tracing_is_disabled())
1976 if (tracing_selftest_disabled
)
1979 target
= kprobe_trace_selftest_target
;
1981 pr_info("Testing kprobe tracing: ");
1983 ret
= trace_run_command("p:testprobe kprobe_trace_selftest_target $stack $stack0 +0($stack)",
1984 create_or_delete_trace_kprobe
);
1985 if (WARN_ON_ONCE(ret
)) {
1986 pr_warn("error on probing function entry.\n");
1989 /* Enable trace point */
1990 tk
= find_trace_kprobe("testprobe", KPROBE_EVENT_SYSTEM
);
1991 if (WARN_ON_ONCE(tk
== NULL
)) {
1992 pr_warn("error on getting new probe.\n");
1995 file
= find_trace_probe_file(tk
, top_trace_array());
1996 if (WARN_ON_ONCE(file
== NULL
)) {
1997 pr_warn("error on getting probe file.\n");
2000 enable_trace_kprobe(
2001 trace_probe_event_call(&tk
->tp
), file
);
2005 ret
= trace_run_command("r:testprobe2 kprobe_trace_selftest_target $retval",
2006 create_or_delete_trace_kprobe
);
2007 if (WARN_ON_ONCE(ret
)) {
2008 pr_warn("error on probing function return.\n");
2011 /* Enable trace point */
2012 tk
= find_trace_kprobe("testprobe2", KPROBE_EVENT_SYSTEM
);
2013 if (WARN_ON_ONCE(tk
== NULL
)) {
2014 pr_warn("error on getting 2nd new probe.\n");
2017 file
= find_trace_probe_file(tk
, top_trace_array());
2018 if (WARN_ON_ONCE(file
== NULL
)) {
2019 pr_warn("error on getting probe file.\n");
2022 enable_trace_kprobe(
2023 trace_probe_event_call(&tk
->tp
), file
);
2030 ret
= target(1, 2, 3, 4, 5, 6);
2033 * Not expecting an error here, the check is only to prevent the
2034 * optimizer from removing the call to target() as otherwise there
2035 * are no side-effects and the call is never performed.
2040 /* Disable trace points before removing it */
2041 tk
= find_trace_kprobe("testprobe", KPROBE_EVENT_SYSTEM
);
2042 if (WARN_ON_ONCE(tk
== NULL
)) {
2043 pr_warn("error on getting test probe.\n");
2046 if (trace_kprobe_nhit(tk
) != 1) {
2047 pr_warn("incorrect number of testprobe hits\n");
2051 file
= find_trace_probe_file(tk
, top_trace_array());
2052 if (WARN_ON_ONCE(file
== NULL
)) {
2053 pr_warn("error on getting probe file.\n");
2056 disable_trace_kprobe(
2057 trace_probe_event_call(&tk
->tp
), file
);
2060 tk
= find_trace_kprobe("testprobe2", KPROBE_EVENT_SYSTEM
);
2061 if (WARN_ON_ONCE(tk
== NULL
)) {
2062 pr_warn("error on getting 2nd test probe.\n");
2065 if (trace_kprobe_nhit(tk
) != 1) {
2066 pr_warn("incorrect number of testprobe2 hits\n");
2070 file
= find_trace_probe_file(tk
, top_trace_array());
2071 if (WARN_ON_ONCE(file
== NULL
)) {
2072 pr_warn("error on getting probe file.\n");
2075 disable_trace_kprobe(
2076 trace_probe_event_call(&tk
->tp
), file
);
2079 ret
= trace_run_command("-:testprobe", create_or_delete_trace_kprobe
);
2080 if (WARN_ON_ONCE(ret
)) {
2081 pr_warn("error on deleting a probe.\n");
2085 ret
= trace_run_command("-:testprobe2", create_or_delete_trace_kprobe
);
2086 if (WARN_ON_ONCE(ret
)) {
2087 pr_warn("error on deleting a probe.\n");
2092 ret
= dyn_events_release_all(&trace_kprobe_ops
);
2093 if (WARN_ON_ONCE(ret
)) {
2094 pr_warn("error on cleaning up probes.\n");
2098 * Wait for the optimizer work to finish. Otherwise it might fiddle
2099 * with probes in already freed __init text.
2101 wait_for_kprobe_optimizer();
2103 pr_cont("NG: Some tests are failed. Please check them.\n");
2109 late_initcall(kprobe_trace_self_tests_init
);