1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * event probes 4 * 5 * Part of this code was copied from kernel/trace/trace_kprobe.c written by 6 * Masami Hiramatsu <mhiramat@kernel.org> 7 * 8 * Copyright (C) 2021, VMware Inc, Steven Rostedt <rostedt@goodmis.org> 9 * Copyright (C) 2021, VMware Inc, Tzvetomir Stoyanov tz.stoyanov@gmail.com> 10 * 11 */ 12 #include <linux/cleanup.h> 13 #include <linux/ftrace.h> 14 #include <linux/module.h> 15 #include <linux/mutex.h> 16 17 #include "trace_dynevent.h" 18 #include "trace_probe.h" 19 #include "trace_probe_kernel.h" 20 #include "trace_probe_tmpl.h" 21 22 #define EPROBE_EVENT_SYSTEM "eprobes" 23 24 struct trace_eprobe { 25 /* tracepoint system */ 26 const char *event_system; 27 28 /* tracepoint event */ 29 const char *event_name; 30 31 /* filter string for the tracepoint */ 32 char *filter_str; 33 34 struct trace_event_call *event; 35 36 struct dyn_event devent; 37 struct trace_probe tp; 38 }; 39 40 struct eprobe_data { 41 struct trace_event_file *file; 42 struct trace_eprobe *ep; 43 }; 44 45 46 #define for_each_trace_eprobe_tp(ep, _tp) \ 47 list_for_each_entry(ep, trace_probe_probe_list(_tp), tp.list) 48 49 static int __trace_eprobe_create(int argc, const char *argv[]); 50 51 static void trace_event_probe_cleanup(struct trace_eprobe *ep) 52 { 53 if (!ep) 54 return; 55 trace_probe_cleanup(&ep->tp); 56 kfree(ep->event_name); 57 kfree(ep->event_system); 58 if (ep->event) 59 trace_event_put_ref(ep->event); 60 kfree(ep->filter_str); 61 kfree(ep); 62 } 63 64 DEFINE_FREE(trace_event_probe_cleanup, struct trace_eprobe *, 65 if (!IS_ERR_OR_NULL(_T)) trace_event_probe_cleanup(_T)) 66 67 static struct trace_eprobe *to_trace_eprobe(struct dyn_event *ev) 68 { 69 return container_of(ev, struct trace_eprobe, devent); 70 } 71 72 static int eprobe_dyn_event_create(const char *raw_command) 73 { 74 return trace_probe_create(raw_command, __trace_eprobe_create); 75 } 76 77 static int eprobe_dyn_event_show(struct seq_file *m, struct dyn_event *ev) 78 { 79 struct trace_eprobe *ep = to_trace_eprobe(ev); 80 int i; 81 82 seq_printf(m, "e:%s/%s", trace_probe_group_name(&ep->tp), 83 trace_probe_name(&ep->tp)); 84 seq_printf(m, " %s.%s", ep->event_system, ep->event_name); 85 86 for (i = 0; i < ep->tp.nr_args; i++) 87 seq_printf(m, " %s=%s", ep->tp.args[i].name, ep->tp.args[i].comm); 88 seq_putc(m, '\n'); 89 90 return 0; 91 } 92 93 static int unregister_trace_eprobe(struct trace_eprobe *ep) 94 { 95 /* If other probes are on the event, just unregister eprobe */ 96 if (trace_probe_has_sibling(&ep->tp)) 97 goto unreg; 98 99 /* Enabled event can not be unregistered */ 100 if (trace_probe_is_enabled(&ep->tp)) 101 return -EBUSY; 102 103 /* Will fail if probe is being used by ftrace or perf */ 104 if (trace_probe_unregister_event_call(&ep->tp)) 105 return -EBUSY; 106 107 unreg: 108 dyn_event_remove(&ep->devent); 109 trace_probe_unlink(&ep->tp); 110 111 return 0; 112 } 113 114 static int eprobe_dyn_event_release(struct dyn_event *ev) 115 { 116 struct trace_eprobe *ep = to_trace_eprobe(ev); 117 int ret = unregister_trace_eprobe(ep); 118 119 if (!ret) 120 trace_event_probe_cleanup(ep); 121 return ret; 122 } 123 124 static bool eprobe_dyn_event_is_busy(struct dyn_event *ev) 125 { 126 struct trace_eprobe *ep = to_trace_eprobe(ev); 127 128 return trace_probe_is_enabled(&ep->tp); 129 } 130 131 static bool eprobe_dyn_event_match(const char *system, const char *event, 132 int argc, const char **argv, struct dyn_event *ev) 133 { 134 struct trace_eprobe *ep = to_trace_eprobe(ev); 135 const char *slash; 136 137 /* 138 * We match the following: 139 * event only - match all eprobes with event name 140 * system and event only - match all system/event probes 141 * system only - match all system probes 142 * 143 * The below has the above satisfied with more arguments: 144 * 145 * attached system/event - If the arg has the system and event 146 * the probe is attached to, match 147 * probes with the attachment. 148 * 149 * If any more args are given, then it requires a full match. 150 */ 151 152 /* 153 * If system exists, but this probe is not part of that system 154 * do not match. 155 */ 156 if (system && strcmp(trace_probe_group_name(&ep->tp), system) != 0) 157 return false; 158 159 /* Must match the event name */ 160 if (event[0] != '\0' && strcmp(trace_probe_name(&ep->tp), event) != 0) 161 return false; 162 163 /* No arguments match all */ 164 if (argc < 1) 165 return true; 166 167 /* First argument is the system/event the probe is attached to */ 168 169 slash = strchr(argv[0], '/'); 170 if (!slash) 171 slash = strchr(argv[0], '.'); 172 if (!slash) 173 return false; 174 175 if (strncmp(ep->event_system, argv[0], slash - argv[0]) || 176 ep->event_system[slash - argv[0]] != '\0') 177 return false; 178 if (strcmp(ep->event_name, slash + 1)) 179 return false; 180 181 argc--; 182 argv++; 183 184 /* If there are no other args, then match */ 185 if (argc < 1) 186 return true; 187 188 return trace_probe_match_command_args(&ep->tp, argc, argv); 189 } 190 191 static struct dyn_event_operations eprobe_dyn_event_ops = { 192 .create = eprobe_dyn_event_create, 193 .show = eprobe_dyn_event_show, 194 .is_busy = eprobe_dyn_event_is_busy, 195 .free = eprobe_dyn_event_release, 196 .match = eprobe_dyn_event_match, 197 }; 198 199 static struct trace_eprobe *alloc_event_probe(const char *group, 200 const char *this_event, 201 struct trace_event_call *event, 202 int nargs) 203 { 204 struct trace_eprobe *ep __free(trace_event_probe_cleanup) = NULL; 205 const char *event_name; 206 const char *sys_name; 207 int ret; 208 209 if (!event) 210 return ERR_PTR(-ENODEV); 211 212 sys_name = event->class->system; 213 event_name = trace_event_name(event); 214 215 ep = kzalloc_flex(*ep, tp.args, nargs); 216 if (!ep) { 217 trace_event_put_ref(event); 218 return ERR_PTR(-ENOMEM); 219 } 220 ep->event = event; 221 ep->event_name = kstrdup(event_name, GFP_KERNEL); 222 if (!ep->event_name) 223 return ERR_PTR(-ENOMEM); 224 ep->event_system = kstrdup(sys_name, GFP_KERNEL); 225 if (!ep->event_system) 226 return ERR_PTR(-ENOMEM); 227 228 ret = trace_probe_init(&ep->tp, this_event, group, false, nargs); 229 if (ret < 0) 230 return ERR_PTR(ret); 231 232 dyn_event_init(&ep->devent, &eprobe_dyn_event_ops); 233 return_ptr(ep); 234 } 235 236 static int eprobe_event_define_fields(struct trace_event_call *event_call) 237 { 238 struct eprobe_trace_entry_head field; 239 struct trace_probe *tp; 240 241 tp = trace_probe_primary_from_call(event_call); 242 if (WARN_ON_ONCE(!tp)) 243 return -ENOENT; 244 245 return traceprobe_define_arg_fields(event_call, sizeof(field), tp); 246 } 247 248 static struct trace_event_fields eprobe_fields_array[] = { 249 { .type = TRACE_FUNCTION_TYPE, 250 .define_fields = eprobe_event_define_fields }, 251 {} 252 }; 253 254 /* Event entry printers */ 255 static enum print_line_t 256 print_eprobe_event(struct trace_iterator *iter, int flags, 257 struct trace_event *event) 258 { 259 struct eprobe_trace_entry_head *field; 260 struct trace_event_call *pevent; 261 struct trace_event *probed_event; 262 struct trace_seq *s = &iter->seq; 263 struct trace_eprobe *ep; 264 struct trace_probe *tp; 265 unsigned int type; 266 267 field = (struct eprobe_trace_entry_head *)iter->ent; 268 tp = trace_probe_primary_from_call( 269 container_of(event, struct trace_event_call, event)); 270 if (WARN_ON_ONCE(!tp)) 271 goto out; 272 273 ep = container_of(tp, struct trace_eprobe, tp); 274 type = ep->event->event.type; 275 276 trace_seq_printf(s, "%s: (", trace_probe_name(tp)); 277 278 probed_event = ftrace_find_event(type); 279 if (probed_event) { 280 pevent = container_of(probed_event, struct trace_event_call, event); 281 trace_seq_printf(s, "%s.%s", pevent->class->system, 282 trace_event_name(pevent)); 283 } else { 284 trace_seq_printf(s, "%u", type); 285 } 286 287 trace_seq_putc(s, ')'); 288 289 if (trace_probe_print_args(s, tp->args, tp->nr_args, 290 (u8 *)&field[1], field) < 0) 291 goto out; 292 293 trace_seq_putc(s, '\n'); 294 out: 295 return trace_handle_return(s); 296 } 297 298 static nokprobe_inline unsigned long 299 get_event_field(struct fetch_insn *code, void *rec) 300 { 301 struct ftrace_event_field *field = code->data; 302 unsigned long val; 303 void *addr; 304 305 addr = rec + field->offset; 306 307 if (is_string_field(field)) { 308 switch (field->filter_type) { 309 case FILTER_DYN_STRING: 310 val = (unsigned long)(rec + (*(unsigned int *)addr & 0xffff)); 311 break; 312 case FILTER_RDYN_STRING: 313 val = (unsigned long)(addr + (*(unsigned int *)addr & 0xffff)); 314 break; 315 case FILTER_STATIC_STRING: 316 val = (unsigned long)addr; 317 break; 318 case FILTER_PTR_STRING: 319 val = *(unsigned long *)addr; 320 break; 321 default: 322 WARN_ON_ONCE(1); 323 return 0; 324 } 325 return val; 326 } 327 328 switch (field->size) { 329 case 1: 330 if (field->is_signed) 331 val = *(char *)addr; 332 else 333 val = *(unsigned char *)addr; 334 break; 335 case 2: 336 if (field->is_signed) 337 val = *(short *)addr; 338 else 339 val = *(unsigned short *)addr; 340 break; 341 case 4: 342 if (field->is_signed) 343 val = *(int *)addr; 344 else 345 val = *(unsigned int *)addr; 346 break; 347 default: 348 if (field->size == sizeof(long)) { 349 if (field->is_signed) 350 val = *(long *)addr; 351 else 352 val = *(unsigned long *)addr; 353 break; 354 } 355 /* This is an array, point to the addr itself */ 356 val = (unsigned long)addr; 357 break; 358 } 359 return val; 360 } 361 362 static int get_eprobe_size(struct trace_probe *tp, void *rec) 363 { 364 struct fetch_insn *code; 365 struct probe_arg *arg; 366 int i, len, ret = 0; 367 368 for (i = 0; i < tp->nr_args; i++) { 369 arg = tp->args + i; 370 if (arg->dynamic) { 371 unsigned long val; 372 373 code = arg->code; 374 retry: 375 switch (code->op) { 376 case FETCH_OP_TP_ARG: 377 val = get_event_field(code, rec); 378 break; 379 case FETCH_NOP_SYMBOL: /* Ignore a place holder */ 380 code++; 381 goto retry; 382 default: 383 if (process_common_fetch_insn(code, &val) < 0) 384 continue; 385 } 386 code++; 387 len = process_fetch_insn_bottom(code, val, NULL, NULL); 388 if (len > 0) 389 ret += len; 390 } 391 } 392 393 return ret; 394 } 395 396 /* Kprobe specific fetch functions */ 397 398 /* Note that we don't verify it, since the code does not come from user space */ 399 static int 400 process_fetch_insn(struct fetch_insn *code, void *rec, void *edata, 401 void *dest, void *base) 402 { 403 unsigned long val; 404 int ret; 405 406 retry: 407 switch (code->op) { 408 case FETCH_OP_TP_ARG: 409 val = get_event_field(code, rec); 410 break; 411 case FETCH_NOP_SYMBOL: /* Ignore a place holder */ 412 code++; 413 goto retry; 414 default: 415 ret = process_common_fetch_insn(code, &val); 416 if (ret < 0) 417 return ret; 418 } 419 code++; 420 return process_fetch_insn_bottom(code, val, dest, base); 421 } 422 NOKPROBE_SYMBOL(process_fetch_insn) 423 424 /* eprobe handler */ 425 static inline void 426 __eprobe_trace_func(struct eprobe_data *edata, void *rec) 427 { 428 struct eprobe_trace_entry_head *entry; 429 struct trace_event_call *call = trace_probe_event_call(&edata->ep->tp); 430 struct trace_event_buffer fbuffer; 431 int dsize; 432 433 if (WARN_ON_ONCE(call != edata->file->event_call)) 434 return; 435 436 if (trace_trigger_soft_disabled(edata->file)) 437 return; 438 439 dsize = get_eprobe_size(&edata->ep->tp, rec); 440 441 entry = trace_event_buffer_reserve(&fbuffer, edata->file, 442 sizeof(*entry) + edata->ep->tp.size + dsize); 443 444 if (!entry) 445 return; 446 447 entry = fbuffer.entry = ring_buffer_event_data(fbuffer.event); 448 store_trace_args(&entry[1], &edata->ep->tp, rec, NULL, sizeof(*entry), dsize); 449 450 trace_event_buffer_commit(&fbuffer); 451 } 452 453 /* 454 * The event probe implementation uses event triggers to get access to 455 * the event it is attached to, but is not an actual trigger. The below 456 * functions are just stubs to fulfill what is needed to use the trigger 457 * infrastructure. 458 */ 459 static int eprobe_trigger_init(struct event_trigger_data *data) 460 { 461 return 0; 462 } 463 464 static void eprobe_trigger_free(struct event_trigger_data *data) 465 { 466 467 } 468 469 static int eprobe_trigger_print(struct seq_file *m, 470 struct event_trigger_data *data) 471 { 472 /* Do not print eprobe event triggers */ 473 return 0; 474 } 475 476 static void eprobe_trigger_func(struct event_trigger_data *data, 477 struct trace_buffer *buffer, void *rec, 478 struct ring_buffer_event *rbe) 479 { 480 struct eprobe_data *edata = data->private_data; 481 482 if (unlikely(!rec)) 483 return; 484 485 __eprobe_trace_func(edata, rec); 486 } 487 488 static int eprobe_trigger_cmd_parse(struct event_command *cmd_ops, 489 struct trace_event_file *file, 490 char *glob, char *cmd, 491 char *param_and_filter) 492 { 493 return -1; 494 } 495 496 static int eprobe_trigger_reg_func(char *glob, 497 struct event_trigger_data *data, 498 struct trace_event_file *file) 499 { 500 return -1; 501 } 502 503 static void eprobe_trigger_unreg_func(char *glob, 504 struct event_trigger_data *data, 505 struct trace_event_file *file) 506 { 507 508 } 509 510 static struct event_command event_trigger_cmd = { 511 .name = "eprobe", 512 .trigger_type = ETT_EVENT_EPROBE, 513 .flags = EVENT_CMD_FL_NEEDS_REC, 514 .parse = eprobe_trigger_cmd_parse, 515 .reg = eprobe_trigger_reg_func, 516 .unreg = eprobe_trigger_unreg_func, 517 .unreg_all = NULL, 518 .set_filter = NULL, 519 .trigger = eprobe_trigger_func, 520 .print = eprobe_trigger_print, 521 .init = eprobe_trigger_init, 522 .free = eprobe_trigger_free, 523 }; 524 525 static struct event_trigger_data * 526 new_eprobe_trigger(struct trace_eprobe *ep, struct trace_event_file *file) 527 { 528 struct event_trigger_data *trigger; 529 struct event_filter *filter = NULL; 530 struct eprobe_data *edata; 531 int ret; 532 533 edata = kzalloc_obj(*edata); 534 trigger = kzalloc_obj(*trigger); 535 if (!trigger || !edata) { 536 ret = -ENOMEM; 537 goto error; 538 } 539 540 trigger->flags = EVENT_TRIGGER_FL_PROBE; 541 trigger->count = -1; 542 543 /* 544 * EVENT PROBE triggers are not registered as commands with 545 * register_event_command(), as they are not controlled by the user 546 * from the trigger file 547 */ 548 trigger->cmd_ops = &event_trigger_cmd; 549 550 INIT_LIST_HEAD(&trigger->list); 551 552 if (ep->filter_str) { 553 ret = create_event_filter(file->tr, ep->event, 554 ep->filter_str, false, &filter); 555 if (ret) 556 goto error; 557 } 558 RCU_INIT_POINTER(trigger->filter, filter); 559 560 edata->file = file; 561 edata->ep = ep; 562 trigger->private_data = edata; 563 564 return trigger; 565 error: 566 free_event_filter(filter); 567 kfree(edata); 568 kfree(trigger); 569 return ERR_PTR(ret); 570 } 571 572 static int enable_eprobe(struct trace_eprobe *ep, 573 struct trace_event_file *eprobe_file) 574 { 575 struct event_trigger_data *trigger; 576 struct trace_event_file *file; 577 struct trace_array *tr = eprobe_file->tr; 578 579 file = find_event_file(tr, ep->event_system, ep->event_name); 580 if (!file) 581 return -ENOENT; 582 trigger = new_eprobe_trigger(ep, eprobe_file); 583 if (IS_ERR(trigger)) 584 return PTR_ERR(trigger); 585 586 list_add_tail_rcu(&trigger->list, &file->triggers); 587 588 trace_event_trigger_enable_disable(file, 1); 589 update_cond_flag(file); 590 591 return 0; 592 } 593 594 static struct trace_event_functions eprobe_funcs = { 595 .trace = print_eprobe_event 596 }; 597 598 static int disable_eprobe(struct trace_eprobe *ep, 599 struct trace_array *tr) 600 { 601 struct event_trigger_data *trigger = NULL, *iter; 602 struct trace_event_file *file; 603 struct event_filter *filter; 604 struct eprobe_data *edata; 605 606 file = find_event_file(tr, ep->event_system, ep->event_name); 607 if (!file) 608 return -ENOENT; 609 610 list_for_each_entry(iter, &file->triggers, list) { 611 if (!(iter->flags & EVENT_TRIGGER_FL_PROBE)) 612 continue; 613 edata = iter->private_data; 614 if (edata->ep == ep) { 615 trigger = iter; 616 break; 617 } 618 } 619 if (!trigger) 620 return -ENODEV; 621 622 list_del_rcu(&trigger->list); 623 624 trace_event_trigger_enable_disable(file, 0); 625 update_cond_flag(file); 626 627 /* Make sure nothing is using the edata or trigger */ 628 tracepoint_synchronize_unregister(); 629 630 filter = rcu_access_pointer(trigger->filter); 631 632 if (filter) 633 free_event_filter(filter); 634 kfree(edata); 635 kfree(trigger); 636 637 return 0; 638 } 639 640 static int enable_trace_eprobe(struct trace_event_call *call, 641 struct trace_event_file *file) 642 { 643 struct trace_probe *tp; 644 struct trace_eprobe *ep; 645 bool enabled; 646 int ret = 0; 647 int cnt = 0; 648 649 tp = trace_probe_primary_from_call(call); 650 if (WARN_ON_ONCE(!tp)) 651 return -ENODEV; 652 enabled = trace_probe_is_enabled(tp); 653 654 /* This also changes "enabled" state */ 655 if (file) { 656 ret = trace_probe_add_file(tp, file); 657 if (ret) 658 return ret; 659 } else 660 trace_probe_set_flag(tp, TP_FLAG_PROFILE); 661 662 if (enabled) 663 return 0; 664 665 for_each_trace_eprobe_tp(ep, tp) { 666 ret = enable_eprobe(ep, file); 667 if (ret) 668 break; 669 enabled = true; 670 cnt++; 671 } 672 673 if (ret) { 674 /* Failed to enable one of them. Roll back all */ 675 if (enabled) { 676 /* 677 * It's a bug if one failed for something other than memory 678 * not being available but another eprobe succeeded. 679 */ 680 WARN_ON_ONCE(ret != -ENOMEM); 681 682 for_each_trace_eprobe_tp(ep, tp) { 683 disable_eprobe(ep, file->tr); 684 if (!--cnt) 685 break; 686 } 687 } 688 if (file) 689 trace_probe_remove_file(tp, file); 690 else 691 trace_probe_clear_flag(tp, TP_FLAG_PROFILE); 692 } 693 694 return ret; 695 } 696 697 static int disable_trace_eprobe(struct trace_event_call *call, 698 struct trace_event_file *file) 699 { 700 struct trace_probe *tp; 701 struct trace_eprobe *ep; 702 703 tp = trace_probe_primary_from_call(call); 704 if (WARN_ON_ONCE(!tp)) 705 return -ENODEV; 706 707 if (file) { 708 if (!trace_probe_get_file_link(tp, file)) 709 return -ENOENT; 710 if (!trace_probe_has_single_file(tp)) 711 goto out; 712 trace_probe_clear_flag(tp, TP_FLAG_TRACE); 713 } else 714 trace_probe_clear_flag(tp, TP_FLAG_PROFILE); 715 716 if (!trace_probe_is_enabled(tp)) { 717 for_each_trace_eprobe_tp(ep, tp) 718 disable_eprobe(ep, file->tr); 719 } 720 721 out: 722 if (file) 723 /* 724 * Synchronization is done in below function. For perf event, 725 * file == NULL and perf_trace_event_unreg() calls 726 * tracepoint_synchronize_unregister() to ensure synchronize 727 * event. We don't need to care about it. 728 */ 729 trace_probe_remove_file(tp, file); 730 731 return 0; 732 } 733 734 static int eprobe_register(struct trace_event_call *event, 735 enum trace_reg type, void *data) 736 { 737 struct trace_event_file *file = data; 738 739 switch (type) { 740 case TRACE_REG_REGISTER: 741 return enable_trace_eprobe(event, file); 742 case TRACE_REG_UNREGISTER: 743 return disable_trace_eprobe(event, file); 744 #ifdef CONFIG_PERF_EVENTS 745 case TRACE_REG_PERF_REGISTER: 746 case TRACE_REG_PERF_UNREGISTER: 747 case TRACE_REG_PERF_OPEN: 748 case TRACE_REG_PERF_CLOSE: 749 case TRACE_REG_PERF_ADD: 750 case TRACE_REG_PERF_DEL: 751 return 0; 752 #endif 753 } 754 return 0; 755 } 756 757 static inline void init_trace_eprobe_call(struct trace_eprobe *ep) 758 { 759 struct trace_event_call *call = trace_probe_event_call(&ep->tp); 760 761 call->flags = TRACE_EVENT_FL_EPROBE; 762 call->event.funcs = &eprobe_funcs; 763 call->class->fields_array = eprobe_fields_array; 764 call->class->reg = eprobe_register; 765 } 766 767 static struct trace_event_call * 768 find_and_get_event(const char *system, const char *event_name) 769 { 770 struct trace_event_call *tp_event; 771 const char *name; 772 773 list_for_each_entry(tp_event, &ftrace_events, list) { 774 /* Skip other probes and ftrace events */ 775 if (tp_event->flags & 776 (TRACE_EVENT_FL_IGNORE_ENABLE | 777 TRACE_EVENT_FL_KPROBE | 778 TRACE_EVENT_FL_UPROBE | 779 TRACE_EVENT_FL_EPROBE)) 780 continue; 781 if (!tp_event->class->system || 782 strcmp(system, tp_event->class->system)) 783 continue; 784 name = trace_event_name(tp_event); 785 if (!name || strcmp(event_name, name)) 786 continue; 787 if (!trace_event_try_get_ref(tp_event)) 788 return NULL; 789 return tp_event; 790 } 791 return NULL; 792 } 793 794 static int trace_eprobe_parse_filter(struct trace_eprobe *ep, int argc, const char *argv[]) 795 { 796 struct event_filter *dummy = NULL; 797 int i, ret, len = 0; 798 char *p; 799 800 if (argc == 0) { 801 trace_probe_log_err(0, NO_EP_FILTER); 802 return -EINVAL; 803 } 804 805 /* Recover the filter string */ 806 for (i = 0; i < argc; i++) 807 len += strlen(argv[i]) + 1; 808 809 ep->filter_str = kzalloc(len, GFP_KERNEL); 810 if (!ep->filter_str) 811 return -ENOMEM; 812 813 p = ep->filter_str; 814 for (i = 0; i < argc; i++) { 815 if (i) 816 ret = snprintf(p, len, " %s", argv[i]); 817 else 818 ret = snprintf(p, len, "%s", argv[i]); 819 p += ret; 820 len -= ret; 821 } 822 823 /* 824 * Ensure the filter string can be parsed correctly. Note, this 825 * filter string is for the original event, not for the eprobe. 826 */ 827 ret = create_event_filter(top_trace_array(), ep->event, ep->filter_str, 828 true, &dummy); 829 free_event_filter(dummy); 830 if (ret) { 831 kfree(ep->filter_str); 832 ep->filter_str = NULL; 833 } 834 return ret; 835 } 836 837 static int __trace_eprobe_create(int argc, const char *argv[]) 838 { 839 /* 840 * Argument syntax: 841 * e[:[GRP/][ENAME]] SYSTEM.EVENT [FETCHARGS] [if FILTER] 842 * Fetch args (no space): 843 * <name>=$<field>[:TYPE] 844 */ 845 struct traceprobe_parse_context *ctx __free(traceprobe_parse_context) = NULL; 846 struct trace_eprobe *ep __free(trace_event_probe_cleanup) = NULL; 847 const char *trlog __free(trace_probe_log_clear) = NULL; 848 const char *event = NULL, *group = EPROBE_EVENT_SYSTEM; 849 const char *sys_event = NULL, *sys_name = NULL; 850 struct trace_event_call *event_call; 851 char *buf1 __free(kfree) = NULL; 852 char *buf2 __free(kfree) = NULL; 853 char *gbuf __free(kfree) = NULL; 854 int ret = 0, filter_idx = 0; 855 int i, filter_cnt; 856 857 if (argc < 2 || argv[0][0] != 'e') 858 return -ECANCELED; 859 860 trlog = trace_probe_log_init("event_probe", argc, argv); 861 862 event = strchr(&argv[0][1], ':'); 863 if (event) { 864 gbuf = kmalloc(MAX_EVENT_NAME_LEN, GFP_KERNEL); 865 if (!gbuf) 866 return -ENOMEM; 867 event++; 868 ret = traceprobe_parse_event_name(&event, &group, gbuf, 869 event - argv[0]); 870 if (ret) 871 return -EINVAL; 872 } 873 874 trace_probe_log_set_index(1); 875 sys_event = argv[1]; 876 877 buf2 = kmalloc(MAX_EVENT_NAME_LEN, GFP_KERNEL); 878 if (!buf2) 879 return -ENOMEM; 880 881 ret = traceprobe_parse_event_name(&sys_event, &sys_name, buf2, 0); 882 if (ret || !sys_event || !sys_name) { 883 trace_probe_log_err(0, NO_EVENT_INFO); 884 return -EINVAL; 885 } 886 887 if (!event) { 888 buf1 = kstrdup(sys_event, GFP_KERNEL); 889 if (!buf1) 890 return -ENOMEM; 891 event = buf1; 892 } 893 894 for (i = 2; i < argc; i++) { 895 if (!strcmp(argv[i], "if")) { 896 filter_idx = i + 1; 897 filter_cnt = argc - filter_idx; 898 argc = i; 899 break; 900 } 901 } 902 903 if (argc - 2 > MAX_TRACE_ARGS) { 904 trace_probe_log_set_index(2); 905 trace_probe_log_err(0, TOO_MANY_ARGS); 906 return -E2BIG; 907 } 908 909 scoped_guard(mutex, &event_mutex) { 910 event_call = find_and_get_event(sys_name, sys_event); 911 ep = alloc_event_probe(group, event, event_call, argc - 2); 912 } 913 914 if (IS_ERR(ep)) { 915 ret = PTR_ERR(ep); 916 if (ret == -ENODEV) 917 trace_probe_log_err(0, BAD_ATTACH_EVENT); 918 /* This must return -ENOMEM or missing event, else there is a bug */ 919 WARN_ON_ONCE(ret != -ENOMEM && ret != -ENODEV); 920 return ret; 921 } 922 923 if (filter_idx) { 924 trace_probe_log_set_index(filter_idx); 925 ret = trace_eprobe_parse_filter(ep, filter_cnt, argv + filter_idx); 926 if (ret) 927 return -EINVAL; 928 } else 929 ep->filter_str = NULL; 930 931 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 932 if (!ctx) 933 return -ENOMEM; 934 ctx->event = ep->event; 935 ctx->flags = TPARG_FL_KERNEL | TPARG_FL_TEVENT; 936 937 argc -= 2; argv += 2; 938 /* parse arguments */ 939 for (i = 0; i < argc; i++) { 940 trace_probe_log_set_index(i + 2); 941 942 ret = traceprobe_parse_probe_arg(&ep->tp, i, argv[i], ctx); 943 /* Handle symbols "@" */ 944 if (!ret) 945 ret = traceprobe_update_arg(&ep->tp.args[i]); 946 if (ret) 947 return ret; 948 } 949 ret = traceprobe_set_print_fmt(&ep->tp, PROBE_PRINT_EVENT); 950 if (ret < 0) 951 return ret; 952 953 init_trace_eprobe_call(ep); 954 scoped_guard(mutex, &event_mutex) { 955 ret = trace_probe_register_event_call(&ep->tp); 956 if (ret) { 957 if (ret == -EEXIST) { 958 trace_probe_log_set_index(0); 959 trace_probe_log_err(0, EVENT_EXIST); 960 } 961 return ret; 962 } 963 ret = dyn_event_add(&ep->devent, &ep->tp.event->call); 964 if (ret < 0) { 965 trace_probe_unregister_event_call(&ep->tp); 966 return ret; 967 } 968 /* To avoid freeing registered eprobe event, clear ep. */ 969 ep = NULL; 970 } 971 return ret; 972 } 973 974 /* 975 * Register dynevent at core_initcall. This allows kernel to setup eprobe 976 * events in postcore_initcall without tracefs. 977 */ 978 static __init int trace_events_eprobe_init_early(void) 979 { 980 int err = 0; 981 982 err = dyn_event_register(&eprobe_dyn_event_ops); 983 if (err) 984 pr_warn("Could not register eprobe_dyn_event_ops\n"); 985 986 return err; 987 } 988 core_initcall(trace_events_eprobe_init_early); 989