1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * event probes 4 * 5 * Part of this code was copied from kernel/trace/trace_kprobe.c written by 6 * Masami Hiramatsu <mhiramat@kernel.org> 7 * 8 * Copyright (C) 2021, VMware Inc, Steven Rostedt <rostedt@goodmis.org> 9 * Copyright (C) 2021, VMware Inc, Tzvetomir Stoyanov tz.stoyanov@gmail.com> 10 * 11 */ 12 #include <linux/cleanup.h> 13 #include <linux/ftrace.h> 14 #include <linux/module.h> 15 #include <linux/mutex.h> 16 17 #include "trace_dynevent.h" 18 #include "trace_probe.h" 19 #include "trace_probe_kernel.h" 20 #include "trace_probe_tmpl.h" 21 22 #define EPROBE_EVENT_SYSTEM "eprobes" 23 24 struct trace_eprobe { 25 /* tracepoint system */ 26 const char *event_system; 27 28 /* tracepoint event */ 29 const char *event_name; 30 31 /* filter string for the tracepoint */ 32 char *filter_str; 33 34 struct trace_event_call *event; 35 36 struct dyn_event devent; 37 struct trace_probe tp; 38 }; 39 40 struct eprobe_data { 41 struct trace_event_file *file; 42 struct trace_eprobe *ep; 43 }; 44 45 46 #define for_each_trace_eprobe_tp(ep, _tp) \ 47 list_for_each_entry(ep, trace_probe_probe_list(_tp), tp.list) 48 49 static int __trace_eprobe_create(int argc, const char *argv[]); 50 51 static void trace_event_probe_cleanup(struct trace_eprobe *ep) 52 { 53 if (!ep) 54 return; 55 trace_probe_cleanup(&ep->tp); 56 kfree(ep->event_name); 57 kfree(ep->event_system); 58 if (ep->event) 59 trace_event_put_ref(ep->event); 60 kfree(ep->filter_str); 61 kfree(ep); 62 } 63 64 DEFINE_FREE(trace_event_probe_cleanup, struct trace_eprobe *, 65 if (!IS_ERR_OR_NULL(_T)) trace_event_probe_cleanup(_T)) 66 67 static struct trace_eprobe *to_trace_eprobe(struct dyn_event *ev) 68 { 69 return container_of(ev, struct trace_eprobe, devent); 70 } 71 72 static int eprobe_dyn_event_create(const char *raw_command) 73 { 74 return trace_probe_create(raw_command, __trace_eprobe_create); 75 } 76 77 static int eprobe_dyn_event_show(struct seq_file *m, struct dyn_event *ev) 78 { 79 struct trace_eprobe *ep = to_trace_eprobe(ev); 80 int i; 81 82 seq_printf(m, "e:%s/%s", trace_probe_group_name(&ep->tp), 83 trace_probe_name(&ep->tp)); 84 seq_printf(m, " %s.%s", ep->event_system, ep->event_name); 85 86 for (i = 0; i < ep->tp.nr_args; i++) 87 seq_printf(m, " %s=%s", ep->tp.args[i].name, ep->tp.args[i].comm); 88 seq_putc(m, '\n'); 89 90 trace_probe_dump_args(m, &ep->tp); 91 92 return 0; 93 } 94 95 static int unregister_trace_eprobe(struct trace_eprobe *ep) 96 { 97 /* If other probes are on the event, just unregister eprobe */ 98 if (trace_probe_has_sibling(&ep->tp)) 99 goto unreg; 100 101 /* Enabled event can not be unregistered */ 102 if (trace_probe_is_enabled(&ep->tp)) 103 return -EBUSY; 104 105 /* Will fail if probe is being used by ftrace or perf */ 106 if (trace_probe_unregister_event_call(&ep->tp)) 107 return -EBUSY; 108 109 unreg: 110 dyn_event_remove(&ep->devent); 111 trace_probe_unlink(&ep->tp); 112 113 return 0; 114 } 115 116 static int eprobe_dyn_event_release(struct dyn_event *ev) 117 { 118 struct trace_eprobe *ep = to_trace_eprobe(ev); 119 int ret = unregister_trace_eprobe(ep); 120 121 if (!ret) 122 trace_event_probe_cleanup(ep); 123 return ret; 124 } 125 126 static bool eprobe_dyn_event_is_busy(struct dyn_event *ev) 127 { 128 struct trace_eprobe *ep = to_trace_eprobe(ev); 129 130 return trace_probe_is_enabled(&ep->tp); 131 } 132 133 static bool eprobe_dyn_event_match(const char *system, const char *event, 134 int argc, const char **argv, struct dyn_event *ev) 135 { 136 struct trace_eprobe *ep = to_trace_eprobe(ev); 137 const char *slash; 138 139 /* 140 * We match the following: 141 * event only - match all eprobes with event name 142 * system and event only - match all system/event probes 143 * system only - match all system probes 144 * 145 * The below has the above satisfied with more arguments: 146 * 147 * attached system/event - If the arg has the system and event 148 * the probe is attached to, match 149 * probes with the attachment. 150 * 151 * If any more args are given, then it requires a full match. 152 */ 153 154 /* 155 * If system exists, but this probe is not part of that system 156 * do not match. 157 */ 158 if (system && strcmp(trace_probe_group_name(&ep->tp), system) != 0) 159 return false; 160 161 /* Must match the event name */ 162 if (event[0] != '\0' && strcmp(trace_probe_name(&ep->tp), event) != 0) 163 return false; 164 165 /* No arguments match all */ 166 if (argc < 1) 167 return true; 168 169 /* First argument is the system/event the probe is attached to */ 170 171 slash = strchr(argv[0], '/'); 172 if (!slash) 173 slash = strchr(argv[0], '.'); 174 if (!slash) 175 return false; 176 177 if (strncmp(ep->event_system, argv[0], slash - argv[0])) 178 return false; 179 if (strcmp(ep->event_name, slash + 1)) 180 return false; 181 182 argc--; 183 argv++; 184 185 /* If there are no other args, then match */ 186 if (argc < 1) 187 return true; 188 189 return trace_probe_match_command_args(&ep->tp, argc, argv); 190 } 191 192 static struct dyn_event_operations eprobe_dyn_event_ops = { 193 .create = eprobe_dyn_event_create, 194 .show = eprobe_dyn_event_show, 195 .is_busy = eprobe_dyn_event_is_busy, 196 .free = eprobe_dyn_event_release, 197 .match = eprobe_dyn_event_match, 198 }; 199 200 static struct trace_eprobe *alloc_event_probe(const char *group, 201 const char *this_event, 202 struct trace_event_call *event, 203 int nargs) 204 { 205 struct trace_eprobe *ep __free(trace_event_probe_cleanup) = NULL; 206 const char *event_name; 207 const char *sys_name; 208 int ret; 209 210 if (!event) 211 return ERR_PTR(-ENODEV); 212 213 sys_name = event->class->system; 214 event_name = trace_event_name(event); 215 216 ep = kzalloc_flex(*ep, tp.args, nargs); 217 if (!ep) { 218 trace_event_put_ref(event); 219 return ERR_PTR(-ENOMEM); 220 } 221 ep->event = event; 222 ep->event_name = kstrdup(event_name, GFP_KERNEL); 223 if (!ep->event_name) 224 return ERR_PTR(-ENOMEM); 225 ep->event_system = kstrdup(sys_name, GFP_KERNEL); 226 if (!ep->event_system) 227 return ERR_PTR(-ENOMEM); 228 229 ret = trace_probe_init(&ep->tp, this_event, group, false, nargs); 230 if (ret < 0) 231 return ERR_PTR(ret); 232 233 dyn_event_init(&ep->devent, &eprobe_dyn_event_ops); 234 return_ptr(ep); 235 } 236 237 static int eprobe_event_define_fields(struct trace_event_call *event_call) 238 { 239 struct eprobe_trace_entry_head field; 240 struct trace_probe *tp; 241 242 tp = trace_probe_primary_from_call(event_call); 243 if (WARN_ON_ONCE(!tp)) 244 return -ENOENT; 245 246 return traceprobe_define_arg_fields(event_call, sizeof(field), tp); 247 } 248 249 static struct trace_event_fields eprobe_fields_array[] = { 250 { .type = TRACE_FUNCTION_TYPE, 251 .define_fields = eprobe_event_define_fields }, 252 {} 253 }; 254 255 /* Event entry printers */ 256 static enum print_line_t 257 print_eprobe_event(struct trace_iterator *iter, int flags, 258 struct trace_event *event) 259 { 260 struct eprobe_trace_entry_head *field; 261 struct trace_event_call *pevent; 262 struct trace_event *probed_event; 263 struct trace_seq *s = &iter->seq; 264 struct trace_eprobe *ep; 265 struct trace_probe *tp; 266 unsigned int type; 267 268 field = (struct eprobe_trace_entry_head *)iter->ent; 269 tp = trace_probe_primary_from_call( 270 container_of(event, struct trace_event_call, event)); 271 if (WARN_ON_ONCE(!tp)) 272 goto out; 273 274 ep = container_of(tp, struct trace_eprobe, tp); 275 type = ep->event->event.type; 276 277 trace_seq_printf(s, "%s: (", trace_probe_name(tp)); 278 279 probed_event = ftrace_find_event(type); 280 if (probed_event) { 281 pevent = container_of(probed_event, struct trace_event_call, event); 282 trace_seq_printf(s, "%s.%s", pevent->class->system, 283 trace_event_name(pevent)); 284 } else { 285 trace_seq_printf(s, "%u", type); 286 } 287 288 trace_seq_putc(s, ')'); 289 290 if (trace_probe_print_args(s, tp->args, tp->nr_args, 291 (u8 *)&field[1], field) < 0) 292 goto out; 293 294 trace_seq_putc(s, '\n'); 295 out: 296 return trace_handle_return(s); 297 } 298 299 static nokprobe_inline unsigned long 300 get_event_field(struct fetch_insn *code, void *rec) 301 { 302 struct ftrace_event_field *field = code->data; 303 unsigned long val; 304 void *addr; 305 306 addr = rec + field->offset; 307 308 if (is_string_field(field)) { 309 switch (field->filter_type) { 310 case FILTER_DYN_STRING: 311 val = (unsigned long)(rec + (*(unsigned int *)addr & 0xffff)); 312 break; 313 case FILTER_RDYN_STRING: 314 val = (unsigned long)(addr + (*(unsigned int *)addr & 0xffff)); 315 break; 316 case FILTER_STATIC_STRING: 317 val = (unsigned long)addr; 318 break; 319 case FILTER_PTR_STRING: 320 val = *(unsigned long *)addr; 321 break; 322 default: 323 WARN_ON_ONCE(1); 324 return 0; 325 } 326 return val; 327 } 328 329 switch (field->size) { 330 case 1: 331 if (field->is_signed) 332 val = *(char *)addr; 333 else 334 val = *(unsigned char *)addr; 335 break; 336 case 2: 337 if (field->is_signed) 338 val = *(short *)addr; 339 else 340 val = *(unsigned short *)addr; 341 break; 342 case 4: 343 if (field->is_signed) 344 val = *(int *)addr; 345 else 346 val = *(unsigned int *)addr; 347 break; 348 default: 349 if (field->size == sizeof(long)) { 350 if (field->is_signed) 351 val = *(long *)addr; 352 else 353 val = *(unsigned long *)addr; 354 break; 355 } 356 /* This is an array, point to the addr itself */ 357 val = (unsigned long)addr; 358 break; 359 } 360 return val; 361 } 362 363 static int get_eprobe_size(struct trace_probe *tp, void *rec) 364 { 365 struct fetch_insn *code; 366 struct probe_arg *arg; 367 int i, len, ret = 0; 368 369 for (i = 0; i < tp->nr_args; i++) { 370 arg = tp->args + i; 371 if (arg->dynamic) { 372 unsigned long val; 373 374 code = arg->code; 375 retry: 376 switch (code->op) { 377 case FETCH_OP_TP_ARG: 378 val = get_event_field(code, rec); 379 break; 380 case FETCH_NOP_SYMBOL: /* Ignore a place holder */ 381 code++; 382 goto retry; 383 default: 384 if (process_common_fetch_insn(code, &val) < 0) 385 continue; 386 } 387 code++; 388 len = process_fetch_insn_bottom(code, val, NULL, NULL); 389 if (len > 0) 390 ret += len; 391 } 392 } 393 394 return ret; 395 } 396 397 /* Kprobe specific fetch functions */ 398 399 /* Note that we don't verify it, since the code does not come from user space */ 400 static int 401 process_fetch_insn(struct fetch_insn *code, void *rec, void *edata, 402 void *dest, void *base) 403 { 404 unsigned long val; 405 int ret; 406 407 retry: 408 switch (code->op) { 409 case FETCH_OP_TP_ARG: 410 val = get_event_field(code, rec); 411 break; 412 case FETCH_NOP_SYMBOL: /* Ignore a place holder */ 413 code++; 414 goto retry; 415 default: 416 ret = process_common_fetch_insn(code, &val); 417 if (ret < 0) 418 return ret; 419 } 420 code++; 421 return process_fetch_insn_bottom(code, val, dest, base); 422 } 423 NOKPROBE_SYMBOL(process_fetch_insn) 424 425 /* eprobe handler */ 426 static inline void 427 __eprobe_trace_func(struct eprobe_data *edata, void *rec) 428 { 429 struct eprobe_trace_entry_head *entry; 430 struct trace_event_call *call = trace_probe_event_call(&edata->ep->tp); 431 struct trace_event_buffer fbuffer; 432 int dsize; 433 434 if (WARN_ON_ONCE(call != edata->file->event_call)) 435 return; 436 437 if (trace_trigger_soft_disabled(edata->file)) 438 return; 439 440 dsize = get_eprobe_size(&edata->ep->tp, rec); 441 442 entry = trace_event_buffer_reserve(&fbuffer, edata->file, 443 sizeof(*entry) + edata->ep->tp.size + dsize); 444 445 if (!entry) 446 return; 447 448 entry = fbuffer.entry = ring_buffer_event_data(fbuffer.event); 449 store_trace_args(&entry[1], &edata->ep->tp, rec, NULL, sizeof(*entry), dsize); 450 451 trace_event_buffer_commit(&fbuffer); 452 } 453 454 /* 455 * The event probe implementation uses event triggers to get access to 456 * the event it is attached to, but is not an actual trigger. The below 457 * functions are just stubs to fulfill what is needed to use the trigger 458 * infrastructure. 459 */ 460 static int eprobe_trigger_init(struct event_trigger_data *data) 461 { 462 return 0; 463 } 464 465 static void eprobe_trigger_free(struct event_trigger_data *data) 466 { 467 468 } 469 470 static int eprobe_trigger_print(struct seq_file *m, 471 struct event_trigger_data *data) 472 { 473 /* Do not print eprobe event triggers */ 474 return 0; 475 } 476 477 static void eprobe_trigger_func(struct event_trigger_data *data, 478 struct trace_buffer *buffer, void *rec, 479 struct ring_buffer_event *rbe) 480 { 481 struct eprobe_data *edata = data->private_data; 482 483 if (unlikely(!rec)) 484 return; 485 486 __eprobe_trace_func(edata, rec); 487 } 488 489 static int eprobe_trigger_cmd_parse(struct event_command *cmd_ops, 490 struct trace_event_file *file, 491 char *glob, char *cmd, 492 char *param_and_filter) 493 { 494 return -1; 495 } 496 497 static int eprobe_trigger_reg_func(char *glob, 498 struct event_trigger_data *data, 499 struct trace_event_file *file) 500 { 501 return -1; 502 } 503 504 static void eprobe_trigger_unreg_func(char *glob, 505 struct event_trigger_data *data, 506 struct trace_event_file *file) 507 { 508 509 } 510 511 static struct event_command event_trigger_cmd = { 512 .name = "eprobe", 513 .trigger_type = ETT_EVENT_EPROBE, 514 .flags = EVENT_CMD_FL_NEEDS_REC, 515 .parse = eprobe_trigger_cmd_parse, 516 .reg = eprobe_trigger_reg_func, 517 .unreg = eprobe_trigger_unreg_func, 518 .unreg_all = NULL, 519 .set_filter = NULL, 520 .trigger = eprobe_trigger_func, 521 .print = eprobe_trigger_print, 522 .init = eprobe_trigger_init, 523 .free = eprobe_trigger_free, 524 }; 525 526 static struct event_trigger_data * 527 new_eprobe_trigger(struct trace_eprobe *ep, struct trace_event_file *file) 528 { 529 struct event_trigger_data *trigger; 530 struct event_filter *filter = NULL; 531 struct eprobe_data *edata; 532 int ret; 533 534 edata = kzalloc_obj(*edata); 535 trigger = kzalloc_obj(*trigger); 536 if (!trigger || !edata) { 537 ret = -ENOMEM; 538 goto error; 539 } 540 541 trigger->flags = EVENT_TRIGGER_FL_PROBE; 542 trigger->count = -1; 543 544 /* 545 * EVENT PROBE triggers are not registered as commands with 546 * register_event_command(), as they are not controlled by the user 547 * from the trigger file 548 */ 549 trigger->cmd_ops = &event_trigger_cmd; 550 551 INIT_LIST_HEAD(&trigger->list); 552 553 if (ep->filter_str) { 554 ret = create_event_filter(file->tr, ep->event, 555 ep->filter_str, false, &filter); 556 if (ret) 557 goto error; 558 } 559 RCU_INIT_POINTER(trigger->filter, filter); 560 561 edata->file = file; 562 edata->ep = ep; 563 trigger->private_data = edata; 564 565 return trigger; 566 error: 567 free_event_filter(filter); 568 kfree(edata); 569 kfree(trigger); 570 return ERR_PTR(ret); 571 } 572 573 static int enable_eprobe(struct trace_eprobe *ep, 574 struct trace_event_file *eprobe_file) 575 { 576 struct event_trigger_data *trigger; 577 struct trace_event_file *file; 578 struct trace_array *tr = eprobe_file->tr; 579 580 file = find_event_file(tr, ep->event_system, ep->event_name); 581 if (!file) 582 return -ENOENT; 583 trigger = new_eprobe_trigger(ep, eprobe_file); 584 if (IS_ERR(trigger)) 585 return PTR_ERR(trigger); 586 587 list_add_tail_rcu(&trigger->list, &file->triggers); 588 589 trace_event_trigger_enable_disable(file, 1); 590 update_cond_flag(file); 591 592 return 0; 593 } 594 595 static struct trace_event_functions eprobe_funcs = { 596 .trace = print_eprobe_event 597 }; 598 599 static int disable_eprobe(struct trace_eprobe *ep, 600 struct trace_array *tr) 601 { 602 struct event_trigger_data *trigger = NULL, *iter; 603 struct trace_event_file *file; 604 struct event_filter *filter; 605 struct eprobe_data *edata; 606 607 file = find_event_file(tr, ep->event_system, ep->event_name); 608 if (!file) 609 return -ENOENT; 610 611 list_for_each_entry(iter, &file->triggers, list) { 612 if (!(iter->flags & EVENT_TRIGGER_FL_PROBE)) 613 continue; 614 edata = iter->private_data; 615 if (edata->ep == ep) { 616 trigger = iter; 617 break; 618 } 619 } 620 if (!trigger) 621 return -ENODEV; 622 623 list_del_rcu(&trigger->list); 624 625 trace_event_trigger_enable_disable(file, 0); 626 update_cond_flag(file); 627 628 /* Make sure nothing is using the edata or trigger */ 629 tracepoint_synchronize_unregister(); 630 631 filter = rcu_access_pointer(trigger->filter); 632 633 if (filter) 634 free_event_filter(filter); 635 kfree(edata); 636 kfree(trigger); 637 638 return 0; 639 } 640 641 static int enable_trace_eprobe(struct trace_event_call *call, 642 struct trace_event_file *file) 643 { 644 struct trace_probe *tp; 645 struct trace_eprobe *ep; 646 bool enabled; 647 int ret = 0; 648 int cnt = 0; 649 650 tp = trace_probe_primary_from_call(call); 651 if (WARN_ON_ONCE(!tp)) 652 return -ENODEV; 653 enabled = trace_probe_is_enabled(tp); 654 655 /* This also changes "enabled" state */ 656 if (file) { 657 ret = trace_probe_add_file(tp, file); 658 if (ret) 659 return ret; 660 } else 661 trace_probe_set_flag(tp, TP_FLAG_PROFILE); 662 663 if (enabled) 664 return 0; 665 666 for_each_trace_eprobe_tp(ep, tp) { 667 ret = enable_eprobe(ep, file); 668 if (ret) 669 break; 670 enabled = true; 671 cnt++; 672 } 673 674 if (ret) { 675 /* Failed to enable one of them. Roll back all */ 676 if (enabled) { 677 /* 678 * It's a bug if one failed for something other than memory 679 * not being available but another eprobe succeeded. 680 */ 681 WARN_ON_ONCE(ret != -ENOMEM); 682 683 for_each_trace_eprobe_tp(ep, tp) { 684 disable_eprobe(ep, file->tr); 685 if (!--cnt) 686 break; 687 } 688 } 689 if (file) 690 trace_probe_remove_file(tp, file); 691 else 692 trace_probe_clear_flag(tp, TP_FLAG_PROFILE); 693 } 694 695 return ret; 696 } 697 698 static int disable_trace_eprobe(struct trace_event_call *call, 699 struct trace_event_file *file) 700 { 701 struct trace_probe *tp; 702 struct trace_eprobe *ep; 703 704 tp = trace_probe_primary_from_call(call); 705 if (WARN_ON_ONCE(!tp)) 706 return -ENODEV; 707 708 if (file) { 709 if (!trace_probe_get_file_link(tp, file)) 710 return -ENOENT; 711 if (!trace_probe_has_single_file(tp)) 712 goto out; 713 trace_probe_clear_flag(tp, TP_FLAG_TRACE); 714 } else 715 trace_probe_clear_flag(tp, TP_FLAG_PROFILE); 716 717 if (!trace_probe_is_enabled(tp)) { 718 for_each_trace_eprobe_tp(ep, tp) 719 disable_eprobe(ep, file->tr); 720 } 721 722 out: 723 if (file) 724 /* 725 * Synchronization is done in below function. For perf event, 726 * file == NULL and perf_trace_event_unreg() calls 727 * tracepoint_synchronize_unregister() to ensure synchronize 728 * event. We don't need to care about it. 729 */ 730 trace_probe_remove_file(tp, file); 731 732 return 0; 733 } 734 735 static int eprobe_register(struct trace_event_call *event, 736 enum trace_reg type, void *data) 737 { 738 struct trace_event_file *file = data; 739 740 switch (type) { 741 case TRACE_REG_REGISTER: 742 return enable_trace_eprobe(event, file); 743 case TRACE_REG_UNREGISTER: 744 return disable_trace_eprobe(event, file); 745 #ifdef CONFIG_PERF_EVENTS 746 case TRACE_REG_PERF_REGISTER: 747 case TRACE_REG_PERF_UNREGISTER: 748 case TRACE_REG_PERF_OPEN: 749 case TRACE_REG_PERF_CLOSE: 750 case TRACE_REG_PERF_ADD: 751 case TRACE_REG_PERF_DEL: 752 return 0; 753 #endif 754 } 755 return 0; 756 } 757 758 static inline void init_trace_eprobe_call(struct trace_eprobe *ep) 759 { 760 struct trace_event_call *call = trace_probe_event_call(&ep->tp); 761 762 call->flags = TRACE_EVENT_FL_EPROBE; 763 call->event.funcs = &eprobe_funcs; 764 call->class->fields_array = eprobe_fields_array; 765 call->class->reg = eprobe_register; 766 } 767 768 static struct trace_event_call * 769 find_and_get_event(const char *system, const char *event_name) 770 { 771 struct trace_event_call *tp_event; 772 const char *name; 773 774 list_for_each_entry(tp_event, &ftrace_events, list) { 775 /* Skip other probes and ftrace events */ 776 if (tp_event->flags & 777 (TRACE_EVENT_FL_IGNORE_ENABLE | 778 TRACE_EVENT_FL_KPROBE | 779 TRACE_EVENT_FL_UPROBE | 780 TRACE_EVENT_FL_EPROBE)) 781 continue; 782 if (!tp_event->class->system || 783 strcmp(system, tp_event->class->system)) 784 continue; 785 name = trace_event_name(tp_event); 786 if (!name || strcmp(event_name, name)) 787 continue; 788 if (!trace_event_try_get_ref(tp_event)) 789 return NULL; 790 return tp_event; 791 } 792 return NULL; 793 } 794 795 static int trace_eprobe_parse_filter(struct trace_eprobe *ep, int argc, const char *argv[]) 796 { 797 struct event_filter *dummy = NULL; 798 int i, ret, len = 0; 799 char *p; 800 801 if (argc == 0) { 802 trace_probe_log_err(0, NO_EP_FILTER); 803 return -EINVAL; 804 } 805 806 /* Recover the filter string */ 807 for (i = 0; i < argc; i++) 808 len += strlen(argv[i]) + 1; 809 810 ep->filter_str = kzalloc(len, GFP_KERNEL); 811 if (!ep->filter_str) 812 return -ENOMEM; 813 814 p = ep->filter_str; 815 for (i = 0; i < argc; i++) { 816 if (i) 817 ret = snprintf(p, len, " %s", argv[i]); 818 else 819 ret = snprintf(p, len, "%s", argv[i]); 820 p += ret; 821 len -= ret; 822 } 823 824 /* 825 * Ensure the filter string can be parsed correctly. Note, this 826 * filter string is for the original event, not for the eprobe. 827 */ 828 ret = create_event_filter(top_trace_array(), ep->event, ep->filter_str, 829 true, &dummy); 830 free_event_filter(dummy); 831 if (ret) { 832 kfree(ep->filter_str); 833 ep->filter_str = NULL; 834 } 835 return ret; 836 } 837 838 static int __trace_eprobe_create(int argc, const char *argv[]) 839 { 840 /* 841 * Argument syntax: 842 * e[:[GRP/][ENAME]] SYSTEM.EVENT [FETCHARGS] [if FILTER] 843 * Fetch args (no space): 844 * <name>=$<field>[:TYPE] 845 */ 846 struct traceprobe_parse_context *ctx __free(traceprobe_parse_context) = NULL; 847 struct trace_eprobe *ep __free(trace_event_probe_cleanup) = NULL; 848 const char *trlog __free(trace_probe_log_clear) = NULL; 849 const char *event = NULL, *group = EPROBE_EVENT_SYSTEM; 850 const char *sys_event = NULL, *sys_name = NULL; 851 struct trace_event_call *event_call; 852 char *buf1 __free(kfree) = NULL; 853 char *buf2 __free(kfree) = NULL; 854 char *gbuf __free(kfree) = NULL; 855 int ret = 0, filter_idx = 0; 856 int i, filter_cnt; 857 858 if (argc < 2 || argv[0][0] != 'e') 859 return -ECANCELED; 860 861 trlog = trace_probe_log_init("event_probe", argc, argv); 862 863 event = strchr(&argv[0][1], ':'); 864 if (event) { 865 gbuf = kmalloc(MAX_EVENT_NAME_LEN, GFP_KERNEL); 866 if (!gbuf) 867 return -ENOMEM; 868 event++; 869 ret = traceprobe_parse_event_name(&event, &group, gbuf, 870 event - argv[0]); 871 if (ret) 872 return -EINVAL; 873 } 874 875 trace_probe_log_set_index(1); 876 sys_event = argv[1]; 877 878 buf2 = kmalloc(MAX_EVENT_NAME_LEN, GFP_KERNEL); 879 if (!buf2) 880 return -ENOMEM; 881 882 ret = traceprobe_parse_event_name(&sys_event, &sys_name, buf2, 0); 883 if (ret || !sys_event || !sys_name) { 884 trace_probe_log_err(0, NO_EVENT_INFO); 885 return -EINVAL; 886 } 887 888 if (!event) { 889 buf1 = kstrdup(sys_event, GFP_KERNEL); 890 if (!buf1) 891 return -ENOMEM; 892 event = buf1; 893 } 894 895 for (i = 2; i < argc; i++) { 896 if (!strcmp(argv[i], "if")) { 897 filter_idx = i + 1; 898 filter_cnt = argc - filter_idx; 899 argc = i; 900 break; 901 } 902 } 903 904 if (argc - 2 > MAX_TRACE_ARGS) { 905 trace_probe_log_set_index(2); 906 trace_probe_log_err(0, TOO_MANY_ARGS); 907 return -E2BIG; 908 } 909 910 scoped_guard(mutex, &event_mutex) { 911 event_call = find_and_get_event(sys_name, sys_event); 912 ep = alloc_event_probe(group, event, event_call, argc - 2); 913 } 914 915 if (IS_ERR(ep)) { 916 ret = PTR_ERR(ep); 917 if (ret == -ENODEV) 918 trace_probe_log_err(0, BAD_ATTACH_EVENT); 919 /* This must return -ENOMEM or missing event, else there is a bug */ 920 WARN_ON_ONCE(ret != -ENOMEM && ret != -ENODEV); 921 return ret; 922 } 923 924 if (filter_idx) { 925 trace_probe_log_set_index(filter_idx); 926 ret = trace_eprobe_parse_filter(ep, filter_cnt, argv + filter_idx); 927 if (ret) 928 return -EINVAL; 929 } else 930 ep->filter_str = NULL; 931 932 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 933 if (!ctx) 934 return -ENOMEM; 935 ctx->event = ep->event; 936 ctx->flags = TPARG_FL_KERNEL | TPARG_FL_TEVENT; 937 938 argc -= 2; argv += 2; 939 /* parse arguments */ 940 for (i = 0; i < argc; i++) { 941 trace_probe_log_set_index(i + 2); 942 943 ret = traceprobe_parse_probe_arg(&ep->tp, i, argv[i], ctx); 944 /* Handle symbols "@" */ 945 if (!ret) 946 ret = traceprobe_update_arg(&ep->tp.args[i]); 947 if (ret) 948 return ret; 949 } 950 ret = traceprobe_set_print_fmt(&ep->tp, PROBE_PRINT_EVENT); 951 if (ret < 0) 952 return ret; 953 954 init_trace_eprobe_call(ep); 955 scoped_guard(mutex, &event_mutex) { 956 ret = trace_probe_register_event_call(&ep->tp); 957 if (ret) { 958 if (ret == -EEXIST) { 959 trace_probe_log_set_index(0); 960 trace_probe_log_err(0, EVENT_EXIST); 961 } 962 return ret; 963 } 964 ret = dyn_event_add(&ep->devent, &ep->tp.event->call); 965 if (ret < 0) { 966 trace_probe_unregister_event_call(&ep->tp); 967 return ret; 968 } 969 /* To avoid freeing registered eprobe event, clear ep. */ 970 ep = NULL; 971 } 972 return ret; 973 } 974 975 /* 976 * Register dynevent at core_initcall. This allows kernel to setup eprobe 977 * events in postcore_initcall without tracefs. 978 */ 979 static __init int trace_events_eprobe_init_early(void) 980 { 981 int err = 0; 982 983 err = dyn_event_register(&eprobe_dyn_event_ops); 984 if (err) 985 pr_warn("Could not register eprobe_dyn_event_ops\n"); 986 987 return err; 988 } 989 core_initcall(trace_events_eprobe_init_early); 990