1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * event probes 4 * 5 * Part of this code was copied from kernel/trace/trace_kprobe.c written by 6 * Masami Hiramatsu <mhiramat@kernel.org> 7 * 8 * Copyright (C) 2021, VMware Inc, Steven Rostedt <rostedt@goodmis.org> 9 * Copyright (C) 2021, VMware Inc, Tzvetomir Stoyanov tz.stoyanov@gmail.com> 10 * 11 */ 12 #include <linux/cleanup.h> 13 #include <linux/ftrace.h> 14 #include <linux/module.h> 15 #include <linux/mutex.h> 16 17 #include "trace_dynevent.h" 18 #include "trace_probe.h" 19 #include "trace_probe_kernel.h" 20 #include "trace_probe_tmpl.h" 21 22 #define EPROBE_EVENT_SYSTEM "eprobes" 23 24 struct trace_eprobe { 25 /* tracepoint system */ 26 const char *event_system; 27 28 /* tracepoint event */ 29 const char *event_name; 30 31 /* filter string for the tracepoint */ 32 char *filter_str; 33 34 struct trace_event_call *event; 35 36 struct dyn_event devent; 37 struct trace_probe tp; 38 }; 39 40 struct eprobe_data { 41 struct trace_event_file *file; 42 struct trace_eprobe *ep; 43 }; 44 45 46 #define for_each_trace_eprobe_tp(ep, _tp) \ 47 list_for_each_entry(ep, trace_probe_probe_list(_tp), tp.list) 48 49 static int __trace_eprobe_create(int argc, const char *argv[]); 50 51 static void trace_event_probe_cleanup(struct trace_eprobe *ep) 52 { 53 if (!ep) 54 return; 55 trace_probe_cleanup(&ep->tp); 56 kfree(ep->event_name); 57 kfree(ep->event_system); 58 if (ep->event) 59 trace_event_put_ref(ep->event); 60 kfree(ep->filter_str); 61 kfree(ep); 62 } 63 64 DEFINE_FREE(trace_event_probe_cleanup, struct trace_eprobe *, 65 if (!IS_ERR_OR_NULL(_T)) trace_event_probe_cleanup(_T)) 66 67 static struct trace_eprobe *to_trace_eprobe(struct dyn_event *ev) 68 { 69 return container_of(ev, struct trace_eprobe, devent); 70 } 71 72 static int eprobe_dyn_event_create(const char *raw_command) 73 { 74 return trace_probe_create(raw_command, __trace_eprobe_create); 75 } 76 77 static int eprobe_dyn_event_show(struct seq_file *m, struct dyn_event *ev) 78 { 79 struct trace_eprobe *ep = to_trace_eprobe(ev); 80 int i; 81 82 seq_printf(m, "e:%s/%s", trace_probe_group_name(&ep->tp), 83 trace_probe_name(&ep->tp)); 84 seq_printf(m, " %s.%s", ep->event_system, ep->event_name); 85 86 for (i = 0; i < ep->tp.nr_args; i++) 87 seq_printf(m, " %s=%s", ep->tp.args[i].name, ep->tp.args[i].comm); 88 seq_putc(m, '\n'); 89 90 trace_probe_dump_args(m, &ep->tp); 91 92 return 0; 93 } 94 95 static int unregister_trace_eprobe(struct trace_eprobe *ep) 96 { 97 /* If other probes are on the event, just unregister eprobe */ 98 if (trace_probe_has_sibling(&ep->tp)) 99 goto unreg; 100 101 /* Enabled event can not be unregistered */ 102 if (trace_probe_is_enabled(&ep->tp)) 103 return -EBUSY; 104 105 /* Will fail if probe is being used by ftrace or perf */ 106 if (trace_probe_unregister_event_call(&ep->tp)) 107 return -EBUSY; 108 109 unreg: 110 dyn_event_remove(&ep->devent); 111 trace_probe_unlink(&ep->tp); 112 113 return 0; 114 } 115 116 static int eprobe_dyn_event_release(struct dyn_event *ev) 117 { 118 struct trace_eprobe *ep = to_trace_eprobe(ev); 119 int ret = unregister_trace_eprobe(ep); 120 121 if (!ret) 122 trace_event_probe_cleanup(ep); 123 return ret; 124 } 125 126 static bool eprobe_dyn_event_is_busy(struct dyn_event *ev) 127 { 128 struct trace_eprobe *ep = to_trace_eprobe(ev); 129 130 return trace_probe_is_enabled(&ep->tp); 131 } 132 133 static bool eprobe_dyn_event_match(const char *system, const char *event, 134 int argc, const char **argv, struct dyn_event *ev) 135 { 136 struct trace_eprobe *ep = to_trace_eprobe(ev); 137 const char *slash; 138 139 /* 140 * We match the following: 141 * event only - match all eprobes with event name 142 * system and event only - match all system/event probes 143 * system only - match all system probes 144 * 145 * The below has the above satisfied with more arguments: 146 * 147 * attached system/event - If the arg has the system and event 148 * the probe is attached to, match 149 * probes with the attachment. 150 * 151 * If any more args are given, then it requires a full match. 152 */ 153 154 /* 155 * If system exists, but this probe is not part of that system 156 * do not match. 157 */ 158 if (system && strcmp(trace_probe_group_name(&ep->tp), system) != 0) 159 return false; 160 161 /* Must match the event name */ 162 if (event[0] != '\0' && strcmp(trace_probe_name(&ep->tp), event) != 0) 163 return false; 164 165 /* No arguments match all */ 166 if (argc < 1) 167 return true; 168 169 /* First argument is the system/event the probe is attached to */ 170 171 slash = strchr(argv[0], '/'); 172 if (!slash) 173 slash = strchr(argv[0], '.'); 174 if (!slash) 175 return false; 176 177 if (strncmp(ep->event_system, argv[0], slash - argv[0]) || 178 ep->event_system[slash - argv[0]] != '\0') 179 return false; 180 if (strcmp(ep->event_name, slash + 1)) 181 return false; 182 183 argc--; 184 argv++; 185 186 /* If there are no other args, then match */ 187 if (argc < 1) 188 return true; 189 190 return trace_probe_match_command_args(&ep->tp, argc, argv); 191 } 192 193 static struct dyn_event_operations eprobe_dyn_event_ops = { 194 .create = eprobe_dyn_event_create, 195 .show = eprobe_dyn_event_show, 196 .is_busy = eprobe_dyn_event_is_busy, 197 .free = eprobe_dyn_event_release, 198 .match = eprobe_dyn_event_match, 199 }; 200 201 static struct trace_eprobe *alloc_event_probe(const char *group, 202 const char *this_event, 203 struct trace_event_call *event, 204 int nargs) 205 { 206 struct trace_eprobe *ep __free(trace_event_probe_cleanup) = NULL; 207 const char *event_name; 208 const char *sys_name; 209 int ret; 210 211 if (!event) 212 return ERR_PTR(-ENODEV); 213 214 sys_name = event->class->system; 215 event_name = trace_event_name(event); 216 217 ep = kzalloc_flex(*ep, tp.args, nargs); 218 if (!ep) { 219 trace_event_put_ref(event); 220 return ERR_PTR(-ENOMEM); 221 } 222 ep->event = event; 223 ep->event_name = kstrdup(event_name, GFP_KERNEL); 224 if (!ep->event_name) 225 return ERR_PTR(-ENOMEM); 226 ep->event_system = kstrdup(sys_name, GFP_KERNEL); 227 if (!ep->event_system) 228 return ERR_PTR(-ENOMEM); 229 230 ret = trace_probe_init(&ep->tp, this_event, group, false, nargs); 231 if (ret < 0) 232 return ERR_PTR(ret); 233 234 dyn_event_init(&ep->devent, &eprobe_dyn_event_ops); 235 return_ptr(ep); 236 } 237 238 static int eprobe_event_define_fields(struct trace_event_call *event_call) 239 { 240 struct eprobe_trace_entry_head field; 241 struct trace_probe *tp; 242 243 tp = trace_probe_primary_from_call(event_call); 244 if (WARN_ON_ONCE(!tp)) 245 return -ENOENT; 246 247 return traceprobe_define_arg_fields(event_call, sizeof(field), tp); 248 } 249 250 static struct trace_event_fields eprobe_fields_array[] = { 251 { .type = TRACE_FUNCTION_TYPE, 252 .define_fields = eprobe_event_define_fields }, 253 {} 254 }; 255 256 /* Event entry printers */ 257 static enum print_line_t 258 print_eprobe_event(struct trace_iterator *iter, int flags, 259 struct trace_event *event) 260 { 261 struct eprobe_trace_entry_head *field; 262 struct trace_event_call *pevent; 263 struct trace_event *probed_event; 264 struct trace_seq *s = &iter->seq; 265 struct trace_eprobe *ep; 266 struct trace_probe *tp; 267 unsigned int type; 268 269 field = (struct eprobe_trace_entry_head *)iter->ent; 270 tp = trace_probe_primary_from_call( 271 container_of(event, struct trace_event_call, event)); 272 if (WARN_ON_ONCE(!tp)) 273 goto out; 274 275 ep = container_of(tp, struct trace_eprobe, tp); 276 type = ep->event->event.type; 277 278 trace_seq_printf(s, "%s: (", trace_probe_name(tp)); 279 280 probed_event = ftrace_find_event(type); 281 if (probed_event) { 282 pevent = container_of(probed_event, struct trace_event_call, event); 283 trace_seq_printf(s, "%s.%s", pevent->class->system, 284 trace_event_name(pevent)); 285 } else { 286 trace_seq_printf(s, "%u", type); 287 } 288 289 trace_seq_putc(s, ')'); 290 291 if (trace_probe_print_args(s, tp->args, tp->nr_args, 292 (u8 *)&field[1], field) < 0) 293 goto out; 294 295 trace_seq_putc(s, '\n'); 296 out: 297 return trace_handle_return(s); 298 } 299 300 static nokprobe_inline unsigned long 301 get_event_field(struct fetch_insn *code, void *rec) 302 { 303 struct ftrace_event_field *field = code->data; 304 unsigned long val; 305 void *addr; 306 307 addr = rec + field->offset; 308 309 if (is_string_field(field)) { 310 switch (field->filter_type) { 311 case FILTER_DYN_STRING: 312 val = (unsigned long)(rec + (*(unsigned int *)addr & 0xffff)); 313 break; 314 case FILTER_RDYN_STRING: 315 val = (unsigned long)(addr + (*(unsigned int *)addr & 0xffff)); 316 break; 317 case FILTER_STATIC_STRING: 318 val = (unsigned long)addr; 319 break; 320 case FILTER_PTR_STRING: 321 val = *(unsigned long *)addr; 322 break; 323 default: 324 WARN_ON_ONCE(1); 325 return 0; 326 } 327 return val; 328 } 329 330 switch (field->size) { 331 case 1: 332 if (field->is_signed) 333 val = *(char *)addr; 334 else 335 val = *(unsigned char *)addr; 336 break; 337 case 2: 338 if (field->is_signed) 339 val = *(short *)addr; 340 else 341 val = *(unsigned short *)addr; 342 break; 343 case 4: 344 if (field->is_signed) 345 val = *(int *)addr; 346 else 347 val = *(unsigned int *)addr; 348 break; 349 default: 350 if (field->size == sizeof(long)) { 351 if (field->is_signed) 352 val = *(long *)addr; 353 else 354 val = *(unsigned long *)addr; 355 break; 356 } 357 /* This is an array, point to the addr itself */ 358 val = (unsigned long)addr; 359 break; 360 } 361 return val; 362 } 363 364 static int get_eprobe_size(struct trace_probe *tp, void *rec) 365 { 366 struct fetch_insn *code; 367 struct probe_arg *arg; 368 int i, len, ret = 0; 369 370 for (i = 0; i < tp->nr_args; i++) { 371 arg = tp->args + i; 372 if (arg->dynamic) { 373 unsigned long val; 374 375 code = arg->code; 376 retry: 377 switch (code->op) { 378 case FETCH_OP_TP_ARG: 379 val = get_event_field(code, rec); 380 break; 381 case FETCH_NOP_SYMBOL: /* Ignore a place holder */ 382 code++; 383 goto retry; 384 default: 385 if (process_common_fetch_insn(code, &val) < 0) 386 continue; 387 } 388 code++; 389 len = process_fetch_insn_bottom(code, val, NULL, NULL); 390 if (len > 0) 391 ret += len; 392 } 393 } 394 395 return ret; 396 } 397 398 /* Kprobe specific fetch functions */ 399 400 /* Note that we don't verify it, since the code does not come from user space */ 401 static int 402 process_fetch_insn(struct fetch_insn *code, void *rec, void *edata, 403 void *dest, void *base) 404 { 405 unsigned long val; 406 int ret; 407 408 retry: 409 switch (code->op) { 410 case FETCH_OP_TP_ARG: 411 val = get_event_field(code, rec); 412 break; 413 case FETCH_NOP_SYMBOL: /* Ignore a place holder */ 414 code++; 415 goto retry; 416 default: 417 ret = process_common_fetch_insn(code, &val); 418 if (ret < 0) 419 return ret; 420 } 421 code++; 422 return process_fetch_insn_bottom(code, val, dest, base); 423 } 424 NOKPROBE_SYMBOL(process_fetch_insn) 425 426 /* eprobe handler */ 427 static inline void 428 __eprobe_trace_func(struct eprobe_data *edata, void *rec) 429 { 430 struct eprobe_trace_entry_head *entry; 431 struct trace_event_call *call = trace_probe_event_call(&edata->ep->tp); 432 struct trace_event_buffer fbuffer; 433 int dsize; 434 435 if (WARN_ON_ONCE(call != edata->file->event_call)) 436 return; 437 438 if (trace_trigger_soft_disabled(edata->file)) 439 return; 440 441 dsize = get_eprobe_size(&edata->ep->tp, rec); 442 443 entry = trace_event_buffer_reserve(&fbuffer, edata->file, 444 sizeof(*entry) + edata->ep->tp.size + dsize); 445 446 if (!entry) 447 return; 448 449 entry = fbuffer.entry = ring_buffer_event_data(fbuffer.event); 450 store_trace_args(&entry[1], &edata->ep->tp, rec, NULL, sizeof(*entry), dsize); 451 452 trace_event_buffer_commit(&fbuffer); 453 } 454 455 /* 456 * The event probe implementation uses event triggers to get access to 457 * the event it is attached to, but is not an actual trigger. The below 458 * functions are just stubs to fulfill what is needed to use the trigger 459 * infrastructure. 460 */ 461 static int eprobe_trigger_init(struct event_trigger_data *data) 462 { 463 return 0; 464 } 465 466 static void eprobe_trigger_free(struct event_trigger_data *data) 467 { 468 469 } 470 471 static int eprobe_trigger_print(struct seq_file *m, 472 struct event_trigger_data *data) 473 { 474 /* Do not print eprobe event triggers */ 475 return 0; 476 } 477 478 static void eprobe_trigger_func(struct event_trigger_data *data, 479 struct trace_buffer *buffer, void *rec, 480 struct ring_buffer_event *rbe) 481 { 482 struct eprobe_data *edata = data->private_data; 483 484 if (unlikely(!rec)) 485 return; 486 487 __eprobe_trace_func(edata, rec); 488 } 489 490 static int eprobe_trigger_cmd_parse(struct event_command *cmd_ops, 491 struct trace_event_file *file, 492 char *glob, char *cmd, 493 char *param_and_filter) 494 { 495 return -1; 496 } 497 498 static int eprobe_trigger_reg_func(char *glob, 499 struct event_trigger_data *data, 500 struct trace_event_file *file) 501 { 502 return -1; 503 } 504 505 static void eprobe_trigger_unreg_func(char *glob, 506 struct event_trigger_data *data, 507 struct trace_event_file *file) 508 { 509 510 } 511 512 static struct event_command event_trigger_cmd = { 513 .name = "eprobe", 514 .trigger_type = ETT_EVENT_EPROBE, 515 .flags = EVENT_CMD_FL_NEEDS_REC, 516 .parse = eprobe_trigger_cmd_parse, 517 .reg = eprobe_trigger_reg_func, 518 .unreg = eprobe_trigger_unreg_func, 519 .unreg_all = NULL, 520 .set_filter = NULL, 521 .trigger = eprobe_trigger_func, 522 .print = eprobe_trigger_print, 523 .init = eprobe_trigger_init, 524 .free = eprobe_trigger_free, 525 }; 526 527 static struct event_trigger_data * 528 new_eprobe_trigger(struct trace_eprobe *ep, struct trace_event_file *file) 529 { 530 struct event_trigger_data *trigger; 531 struct event_filter *filter = NULL; 532 struct eprobe_data *edata; 533 int ret; 534 535 edata = kzalloc_obj(*edata); 536 trigger = kzalloc_obj(*trigger); 537 if (!trigger || !edata) { 538 ret = -ENOMEM; 539 goto error; 540 } 541 542 trigger->flags = EVENT_TRIGGER_FL_PROBE; 543 trigger->count = -1; 544 545 /* 546 * EVENT PROBE triggers are not registered as commands with 547 * register_event_command(), as they are not controlled by the user 548 * from the trigger file 549 */ 550 trigger->cmd_ops = &event_trigger_cmd; 551 552 INIT_LIST_HEAD(&trigger->list); 553 554 if (ep->filter_str) { 555 ret = create_event_filter(file->tr, ep->event, 556 ep->filter_str, false, &filter); 557 if (ret) 558 goto error; 559 } 560 RCU_INIT_POINTER(trigger->filter, filter); 561 562 edata->file = file; 563 edata->ep = ep; 564 trigger->private_data = edata; 565 566 return trigger; 567 error: 568 free_event_filter(filter); 569 kfree(edata); 570 kfree(trigger); 571 return ERR_PTR(ret); 572 } 573 574 static int enable_eprobe(struct trace_eprobe *ep, 575 struct trace_event_file *eprobe_file) 576 { 577 struct event_trigger_data *trigger; 578 struct trace_event_file *file; 579 struct trace_array *tr = eprobe_file->tr; 580 581 file = find_event_file(tr, ep->event_system, ep->event_name); 582 if (!file) 583 return -ENOENT; 584 trigger = new_eprobe_trigger(ep, eprobe_file); 585 if (IS_ERR(trigger)) 586 return PTR_ERR(trigger); 587 588 list_add_tail_rcu(&trigger->list, &file->triggers); 589 590 trace_event_trigger_enable_disable(file, 1); 591 update_cond_flag(file); 592 593 return 0; 594 } 595 596 static struct trace_event_functions eprobe_funcs = { 597 .trace = print_eprobe_event 598 }; 599 600 static int disable_eprobe(struct trace_eprobe *ep, 601 struct trace_array *tr) 602 { 603 struct event_trigger_data *trigger = NULL, *iter; 604 struct trace_event_file *file; 605 struct event_filter *filter; 606 struct eprobe_data *edata; 607 608 file = find_event_file(tr, ep->event_system, ep->event_name); 609 if (!file) 610 return -ENOENT; 611 612 list_for_each_entry(iter, &file->triggers, list) { 613 if (!(iter->flags & EVENT_TRIGGER_FL_PROBE)) 614 continue; 615 edata = iter->private_data; 616 if (edata->ep == ep) { 617 trigger = iter; 618 break; 619 } 620 } 621 if (!trigger) 622 return -ENODEV; 623 624 list_del_rcu(&trigger->list); 625 626 trace_event_trigger_enable_disable(file, 0); 627 update_cond_flag(file); 628 629 /* Make sure nothing is using the edata or trigger */ 630 tracepoint_synchronize_unregister(); 631 632 filter = rcu_access_pointer(trigger->filter); 633 634 if (filter) 635 free_event_filter(filter); 636 kfree(edata); 637 kfree(trigger); 638 639 return 0; 640 } 641 642 static int enable_trace_eprobe(struct trace_event_call *call, 643 struct trace_event_file *file) 644 { 645 struct trace_probe *tp; 646 struct trace_eprobe *ep; 647 bool enabled; 648 int ret = 0; 649 int cnt = 0; 650 651 tp = trace_probe_primary_from_call(call); 652 if (WARN_ON_ONCE(!tp)) 653 return -ENODEV; 654 enabled = trace_probe_is_enabled(tp); 655 656 /* This also changes "enabled" state */ 657 if (file) { 658 ret = trace_probe_add_file(tp, file); 659 if (ret) 660 return ret; 661 } else 662 trace_probe_set_flag(tp, TP_FLAG_PROFILE); 663 664 if (enabled) 665 return 0; 666 667 for_each_trace_eprobe_tp(ep, tp) { 668 ret = enable_eprobe(ep, file); 669 if (ret) 670 break; 671 enabled = true; 672 cnt++; 673 } 674 675 if (ret) { 676 /* Failed to enable one of them. Roll back all */ 677 if (enabled) { 678 /* 679 * It's a bug if one failed for something other than memory 680 * not being available but another eprobe succeeded. 681 */ 682 WARN_ON_ONCE(ret != -ENOMEM); 683 684 for_each_trace_eprobe_tp(ep, tp) { 685 disable_eprobe(ep, file->tr); 686 if (!--cnt) 687 break; 688 } 689 } 690 if (file) 691 trace_probe_remove_file(tp, file); 692 else 693 trace_probe_clear_flag(tp, TP_FLAG_PROFILE); 694 } 695 696 return ret; 697 } 698 699 static int disable_trace_eprobe(struct trace_event_call *call, 700 struct trace_event_file *file) 701 { 702 struct trace_probe *tp; 703 struct trace_eprobe *ep; 704 705 tp = trace_probe_primary_from_call(call); 706 if (WARN_ON_ONCE(!tp)) 707 return -ENODEV; 708 709 if (file) { 710 if (!trace_probe_get_file_link(tp, file)) 711 return -ENOENT; 712 if (!trace_probe_has_single_file(tp)) 713 goto out; 714 trace_probe_clear_flag(tp, TP_FLAG_TRACE); 715 } else 716 trace_probe_clear_flag(tp, TP_FLAG_PROFILE); 717 718 if (!trace_probe_is_enabled(tp)) { 719 for_each_trace_eprobe_tp(ep, tp) 720 disable_eprobe(ep, file->tr); 721 } 722 723 out: 724 if (file) 725 /* 726 * Synchronization is done in below function. For perf event, 727 * file == NULL and perf_trace_event_unreg() calls 728 * tracepoint_synchronize_unregister() to ensure synchronize 729 * event. We don't need to care about it. 730 */ 731 trace_probe_remove_file(tp, file); 732 733 return 0; 734 } 735 736 static int eprobe_register(struct trace_event_call *event, 737 enum trace_reg type, void *data) 738 { 739 struct trace_event_file *file = data; 740 741 switch (type) { 742 case TRACE_REG_REGISTER: 743 return enable_trace_eprobe(event, file); 744 case TRACE_REG_UNREGISTER: 745 return disable_trace_eprobe(event, file); 746 #ifdef CONFIG_PERF_EVENTS 747 case TRACE_REG_PERF_REGISTER: 748 case TRACE_REG_PERF_UNREGISTER: 749 case TRACE_REG_PERF_OPEN: 750 case TRACE_REG_PERF_CLOSE: 751 case TRACE_REG_PERF_ADD: 752 case TRACE_REG_PERF_DEL: 753 return 0; 754 #endif 755 } 756 return 0; 757 } 758 759 static inline void init_trace_eprobe_call(struct trace_eprobe *ep) 760 { 761 struct trace_event_call *call = trace_probe_event_call(&ep->tp); 762 763 call->flags = TRACE_EVENT_FL_EPROBE; 764 call->event.funcs = &eprobe_funcs; 765 call->class->fields_array = eprobe_fields_array; 766 call->class->reg = eprobe_register; 767 } 768 769 static struct trace_event_call * 770 find_and_get_event(const char *system, const char *event_name) 771 { 772 struct trace_event_call *tp_event; 773 const char *name; 774 775 list_for_each_entry(tp_event, &ftrace_events, list) { 776 /* Skip other probes and ftrace events */ 777 if (tp_event->flags & 778 (TRACE_EVENT_FL_IGNORE_ENABLE | 779 TRACE_EVENT_FL_KPROBE | 780 TRACE_EVENT_FL_UPROBE | 781 TRACE_EVENT_FL_EPROBE)) 782 continue; 783 if (!tp_event->class->system || 784 strcmp(system, tp_event->class->system)) 785 continue; 786 name = trace_event_name(tp_event); 787 if (!name || strcmp(event_name, name)) 788 continue; 789 if (!trace_event_try_get_ref(tp_event)) 790 return NULL; 791 return tp_event; 792 } 793 return NULL; 794 } 795 796 static int trace_eprobe_parse_filter(struct trace_eprobe *ep, int argc, const char *argv[]) 797 { 798 struct event_filter *dummy = NULL; 799 int i, ret, len = 0; 800 char *p; 801 802 if (argc == 0) { 803 trace_probe_log_err(0, NO_EP_FILTER); 804 return -EINVAL; 805 } 806 807 /* Recover the filter string */ 808 for (i = 0; i < argc; i++) 809 len += strlen(argv[i]) + 1; 810 811 ep->filter_str = kzalloc(len, GFP_KERNEL); 812 if (!ep->filter_str) 813 return -ENOMEM; 814 815 p = ep->filter_str; 816 for (i = 0; i < argc; i++) { 817 if (i) 818 ret = snprintf(p, len, " %s", argv[i]); 819 else 820 ret = snprintf(p, len, "%s", argv[i]); 821 p += ret; 822 len -= ret; 823 } 824 825 /* 826 * Ensure the filter string can be parsed correctly. Note, this 827 * filter string is for the original event, not for the eprobe. 828 */ 829 ret = create_event_filter(top_trace_array(), ep->event, ep->filter_str, 830 true, &dummy); 831 free_event_filter(dummy); 832 if (ret) { 833 kfree(ep->filter_str); 834 ep->filter_str = NULL; 835 } 836 return ret; 837 } 838 839 static int __trace_eprobe_create(int argc, const char *argv[]) 840 { 841 /* 842 * Argument syntax: 843 * e[:[GRP/][ENAME]] SYSTEM.EVENT [FETCHARGS] [if FILTER] 844 * Fetch args (no space): 845 * <name>=$<field>[:TYPE] 846 */ 847 struct traceprobe_parse_context *ctx __free(traceprobe_parse_context) = NULL; 848 struct trace_eprobe *ep __free(trace_event_probe_cleanup) = NULL; 849 const char *trlog __free(trace_probe_log_clear) = NULL; 850 const char *event = NULL, *group = EPROBE_EVENT_SYSTEM; 851 const char *sys_event = NULL, *sys_name = NULL; 852 struct trace_event_call *event_call; 853 char *buf1 __free(kfree) = NULL; 854 char *buf2 __free(kfree) = NULL; 855 char *gbuf __free(kfree) = NULL; 856 int ret = 0, filter_idx = 0; 857 int i, filter_cnt; 858 859 if (argc < 2 || argv[0][0] != 'e') 860 return -ECANCELED; 861 862 trlog = trace_probe_log_init("event_probe", argc, argv); 863 864 event = strchr(&argv[0][1], ':'); 865 if (event) { 866 gbuf = kmalloc(MAX_EVENT_NAME_LEN, GFP_KERNEL); 867 if (!gbuf) 868 return -ENOMEM; 869 event++; 870 ret = traceprobe_parse_event_name(&event, &group, gbuf, 871 event - argv[0]); 872 if (ret) 873 return -EINVAL; 874 } 875 876 trace_probe_log_set_index(1); 877 sys_event = argv[1]; 878 879 buf2 = kmalloc(MAX_EVENT_NAME_LEN, GFP_KERNEL); 880 if (!buf2) 881 return -ENOMEM; 882 883 ret = traceprobe_parse_event_name(&sys_event, &sys_name, buf2, 0); 884 if (ret || !sys_event || !sys_name) { 885 trace_probe_log_err(0, NO_EVENT_INFO); 886 return -EINVAL; 887 } 888 889 if (!event) { 890 buf1 = kstrdup(sys_event, GFP_KERNEL); 891 if (!buf1) 892 return -ENOMEM; 893 event = buf1; 894 } 895 896 for (i = 2; i < argc; i++) { 897 if (!strcmp(argv[i], "if")) { 898 filter_idx = i + 1; 899 filter_cnt = argc - filter_idx; 900 argc = i; 901 break; 902 } 903 } 904 905 if (argc - 2 > MAX_TRACE_ARGS) { 906 trace_probe_log_set_index(2); 907 trace_probe_log_err(0, TOO_MANY_ARGS); 908 return -E2BIG; 909 } 910 911 scoped_guard(mutex, &event_mutex) { 912 event_call = find_and_get_event(sys_name, sys_event); 913 ep = alloc_event_probe(group, event, event_call, argc - 2); 914 } 915 916 if (IS_ERR(ep)) { 917 ret = PTR_ERR(ep); 918 if (ret == -ENODEV) 919 trace_probe_log_err(0, BAD_ATTACH_EVENT); 920 /* This must return -ENOMEM or missing event, else there is a bug */ 921 WARN_ON_ONCE(ret != -ENOMEM && ret != -ENODEV); 922 return ret; 923 } 924 925 if (filter_idx) { 926 trace_probe_log_set_index(filter_idx); 927 ret = trace_eprobe_parse_filter(ep, filter_cnt, argv + filter_idx); 928 if (ret) 929 return -EINVAL; 930 } else 931 ep->filter_str = NULL; 932 933 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 934 if (!ctx) 935 return -ENOMEM; 936 ctx->event = ep->event; 937 ctx->flags = TPARG_FL_KERNEL | TPARG_FL_TEVENT; 938 939 argc -= 2; argv += 2; 940 /* parse arguments */ 941 for (i = 0; i < argc; i++) { 942 trace_probe_log_set_index(i + 2); 943 944 ret = traceprobe_parse_probe_arg(&ep->tp, i, argv[i], ctx); 945 /* Handle symbols "@" */ 946 if (!ret) 947 ret = traceprobe_update_arg(&ep->tp.args[i]); 948 if (ret) 949 return ret; 950 } 951 ret = traceprobe_set_print_fmt(&ep->tp, PROBE_PRINT_EVENT); 952 if (ret < 0) 953 return ret; 954 955 init_trace_eprobe_call(ep); 956 scoped_guard(mutex, &event_mutex) { 957 ret = trace_probe_register_event_call(&ep->tp); 958 if (ret) { 959 if (ret == -EEXIST) { 960 trace_probe_log_set_index(0); 961 trace_probe_log_err(0, EVENT_EXIST); 962 } 963 return ret; 964 } 965 ret = dyn_event_add(&ep->devent, &ep->tp.event->call); 966 if (ret < 0) { 967 trace_probe_unregister_event_call(&ep->tp); 968 return ret; 969 } 970 /* To avoid freeing registered eprobe event, clear ep. */ 971 ep = NULL; 972 } 973 return ret; 974 } 975 976 /* 977 * Register dynevent at core_initcall. This allows kernel to setup eprobe 978 * events in postcore_initcall without tracefs. 979 */ 980 static __init int trace_events_eprobe_init_early(void) 981 { 982 int err = 0; 983 984 err = dyn_event_register(&eprobe_dyn_event_ops); 985 if (err) 986 pr_warn("Could not register eprobe_dyn_event_ops\n"); 987 988 return err; 989 } 990 core_initcall(trace_events_eprobe_init_early); 991