1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2021, Microsoft Corporation. 4 * 5 * Authors: 6 * Beau Belgrave <beaub@linux.microsoft.com> 7 */ 8 9 #include <linux/bitmap.h> 10 #include <linux/cdev.h> 11 #include <linux/hashtable.h> 12 #include <linux/list.h> 13 #include <linux/io.h> 14 #include <linux/uio.h> 15 #include <linux/ioctl.h> 16 #include <linux/jhash.h> 17 #include <linux/refcount.h> 18 #include <linux/trace_events.h> 19 #include <linux/tracefs.h> 20 #include <linux/types.h> 21 #include <linux/uaccess.h> 22 /* Reminder to move to uapi when everything works */ 23 #ifdef CONFIG_COMPILE_TEST 24 #include <linux/user_events.h> 25 #else 26 #include <uapi/linux/user_events.h> 27 #endif 28 #include "trace.h" 29 #include "trace_dynevent.h" 30 31 #define USER_EVENTS_PREFIX_LEN (sizeof(USER_EVENTS_PREFIX)-1) 32 33 #define FIELD_DEPTH_TYPE 0 34 #define FIELD_DEPTH_NAME 1 35 #define FIELD_DEPTH_SIZE 2 36 37 /* 38 * Limits how many trace_event calls user processes can create: 39 * Must be a power of two of PAGE_SIZE. 40 */ 41 #define MAX_PAGE_ORDER 0 42 #define MAX_PAGES (1 << MAX_PAGE_ORDER) 43 #define MAX_BYTES (MAX_PAGES * PAGE_SIZE) 44 #define MAX_EVENTS (MAX_BYTES * 8) 45 46 /* Limit how long of an event name plus args within the subsystem. */ 47 #define MAX_EVENT_DESC 512 48 #define EVENT_NAME(user_event) ((user_event)->tracepoint.name) 49 #define MAX_FIELD_ARRAY_SIZE 1024 50 51 /* 52 * The MAP_STATUS_* macros are used for taking a index and determining the 53 * appropriate byte and the bit in the byte to set/reset for an event. 54 * 55 * The lower 3 bits of the index decide which bit to set. 56 * The remaining upper bits of the index decide which byte to use for the bit. 57 * 58 * This is used when an event has a probe attached/removed to reflect live 59 * status of the event wanting tracing or not to user-programs via shared 60 * memory maps. 61 */ 62 #define MAP_STATUS_BYTE(index) ((index) >> 3) 63 #define MAP_STATUS_MASK(index) BIT((index) & 7) 64 65 /* 66 * Internal bits (kernel side only) to keep track of connected probes: 67 * These are used when status is requested in text form about an event. These 68 * bits are compared against an internal byte on the event to determine which 69 * probes to print out to the user. 70 * 71 * These do not reflect the mapped bytes between the user and kernel space. 72 */ 73 #define EVENT_STATUS_FTRACE BIT(0) 74 #define EVENT_STATUS_PERF BIT(1) 75 #define EVENT_STATUS_OTHER BIT(7) 76 77 /* 78 * Stores the pages, tables, and locks for a group of events. 79 * Each logical grouping of events has its own group, with a 80 * matching page for status checks within user programs. This 81 * allows for isolation of events to user programs by various 82 * means. 83 */ 84 struct user_event_group { 85 struct page *pages; 86 char *register_page_data; 87 char *system_name; 88 struct hlist_node node; 89 struct mutex reg_mutex; 90 DECLARE_HASHTABLE(register_table, 8); 91 DECLARE_BITMAP(page_bitmap, MAX_EVENTS); 92 }; 93 94 /* Group for init_user_ns mapping, top-most group */ 95 static struct user_event_group *init_group; 96 97 /* 98 * Stores per-event properties, as users register events 99 * within a file a user_event might be created if it does not 100 * already exist. These are globally used and their lifetime 101 * is tied to the refcnt member. These cannot go away until the 102 * refcnt reaches one. 103 */ 104 struct user_event { 105 struct user_event_group *group; 106 struct tracepoint tracepoint; 107 struct trace_event_call call; 108 struct trace_event_class class; 109 struct dyn_event devent; 110 struct hlist_node node; 111 struct list_head fields; 112 struct list_head validators; 113 refcount_t refcnt; 114 int index; 115 int flags; 116 int min_size; 117 char status; 118 }; 119 120 /* 121 * Stores per-file events references, as users register events 122 * within a file this structure is modified and freed via RCU. 123 * The lifetime of this struct is tied to the lifetime of the file. 124 * These are not shared and only accessible by the file that created it. 125 */ 126 struct user_event_refs { 127 struct rcu_head rcu; 128 int count; 129 struct user_event *events[]; 130 }; 131 132 struct user_event_file_info { 133 struct user_event_group *group; 134 struct user_event_refs *refs; 135 }; 136 137 #define VALIDATOR_ENSURE_NULL (1 << 0) 138 #define VALIDATOR_REL (1 << 1) 139 140 struct user_event_validator { 141 struct list_head link; 142 int offset; 143 int flags; 144 }; 145 146 typedef void (*user_event_func_t) (struct user_event *user, struct iov_iter *i, 147 void *tpdata, bool *faulted); 148 149 static int user_event_parse(struct user_event_group *group, char *name, 150 char *args, char *flags, 151 struct user_event **newuser); 152 153 static u32 user_event_key(char *name) 154 { 155 return jhash(name, strlen(name), 0); 156 } 157 158 static void set_page_reservations(char *pages, bool set) 159 { 160 int page; 161 162 for (page = 0; page < MAX_PAGES; ++page) { 163 void *addr = pages + (PAGE_SIZE * page); 164 165 if (set) 166 SetPageReserved(virt_to_page(addr)); 167 else 168 ClearPageReserved(virt_to_page(addr)); 169 } 170 } 171 172 static void user_event_group_destroy(struct user_event_group *group) 173 { 174 if (group->register_page_data) 175 set_page_reservations(group->register_page_data, false); 176 177 if (group->pages) 178 __free_pages(group->pages, MAX_PAGE_ORDER); 179 180 kfree(group->system_name); 181 kfree(group); 182 } 183 184 static char *user_event_group_system_name(struct user_namespace *user_ns) 185 { 186 char *system_name; 187 int len = sizeof(USER_EVENTS_SYSTEM) + 1; 188 189 if (user_ns != &init_user_ns) { 190 /* 191 * Unexpected at this point: 192 * We only currently support init_user_ns. 193 * When we enable more, this will trigger a failure so log. 194 */ 195 pr_warn("user_events: Namespace other than init_user_ns!\n"); 196 return NULL; 197 } 198 199 system_name = kmalloc(len, GFP_KERNEL); 200 201 if (!system_name) 202 return NULL; 203 204 snprintf(system_name, len, "%s", USER_EVENTS_SYSTEM); 205 206 return system_name; 207 } 208 209 static inline struct user_event_group 210 *user_event_group_from_user_ns(struct user_namespace *user_ns) 211 { 212 if (user_ns == &init_user_ns) 213 return init_group; 214 215 return NULL; 216 } 217 218 static struct user_event_group *current_user_event_group(void) 219 { 220 struct user_namespace *user_ns = current_user_ns(); 221 struct user_event_group *group = NULL; 222 223 while (user_ns) { 224 group = user_event_group_from_user_ns(user_ns); 225 226 if (group) 227 break; 228 229 user_ns = user_ns->parent; 230 } 231 232 return group; 233 } 234 235 static struct user_event_group 236 *user_event_group_create(struct user_namespace *user_ns) 237 { 238 struct user_event_group *group; 239 240 group = kzalloc(sizeof(*group), GFP_KERNEL); 241 242 if (!group) 243 return NULL; 244 245 group->system_name = user_event_group_system_name(user_ns); 246 247 if (!group->system_name) 248 goto error; 249 250 group->pages = alloc_pages(GFP_KERNEL | __GFP_ZERO, MAX_PAGE_ORDER); 251 252 if (!group->pages) 253 goto error; 254 255 group->register_page_data = page_address(group->pages); 256 257 set_page_reservations(group->register_page_data, true); 258 259 /* Zero all bits beside 0 (which is reserved for failures) */ 260 bitmap_zero(group->page_bitmap, MAX_EVENTS); 261 set_bit(0, group->page_bitmap); 262 263 mutex_init(&group->reg_mutex); 264 hash_init(group->register_table); 265 266 return group; 267 error: 268 if (group) 269 user_event_group_destroy(group); 270 271 return NULL; 272 }; 273 274 static __always_inline 275 void user_event_register_set(struct user_event *user) 276 { 277 int i = user->index; 278 279 user->group->register_page_data[MAP_STATUS_BYTE(i)] |= MAP_STATUS_MASK(i); 280 } 281 282 static __always_inline 283 void user_event_register_clear(struct user_event *user) 284 { 285 int i = user->index; 286 287 user->group->register_page_data[MAP_STATUS_BYTE(i)] &= ~MAP_STATUS_MASK(i); 288 } 289 290 static __always_inline __must_check 291 bool user_event_last_ref(struct user_event *user) 292 { 293 return refcount_read(&user->refcnt) == 1; 294 } 295 296 static __always_inline __must_check 297 size_t copy_nofault(void *addr, size_t bytes, struct iov_iter *i) 298 { 299 size_t ret; 300 301 pagefault_disable(); 302 303 ret = copy_from_iter_nocache(addr, bytes, i); 304 305 pagefault_enable(); 306 307 return ret; 308 } 309 310 static struct list_head *user_event_get_fields(struct trace_event_call *call) 311 { 312 struct user_event *user = (struct user_event *)call->data; 313 314 return &user->fields; 315 } 316 317 /* 318 * Parses a register command for user_events 319 * Format: event_name[:FLAG1[,FLAG2...]] [field1[;field2...]] 320 * 321 * Example event named 'test' with a 20 char 'msg' field with an unsigned int 322 * 'id' field after: 323 * test char[20] msg;unsigned int id 324 * 325 * NOTE: Offsets are from the user data perspective, they are not from the 326 * trace_entry/buffer perspective. We automatically add the common properties 327 * sizes to the offset for the user. 328 * 329 * Upon success user_event has its ref count increased by 1. 330 */ 331 static int user_event_parse_cmd(struct user_event_group *group, 332 char *raw_command, struct user_event **newuser) 333 { 334 char *name = raw_command; 335 char *args = strpbrk(name, " "); 336 char *flags; 337 338 if (args) 339 *args++ = '\0'; 340 341 flags = strpbrk(name, ":"); 342 343 if (flags) 344 *flags++ = '\0'; 345 346 return user_event_parse(group, name, args, flags, newuser); 347 } 348 349 static int user_field_array_size(const char *type) 350 { 351 const char *start = strchr(type, '['); 352 char val[8]; 353 char *bracket; 354 int size = 0; 355 356 if (start == NULL) 357 return -EINVAL; 358 359 if (strscpy(val, start + 1, sizeof(val)) <= 0) 360 return -EINVAL; 361 362 bracket = strchr(val, ']'); 363 364 if (!bracket) 365 return -EINVAL; 366 367 *bracket = '\0'; 368 369 if (kstrtouint(val, 0, &size)) 370 return -EINVAL; 371 372 if (size > MAX_FIELD_ARRAY_SIZE) 373 return -EINVAL; 374 375 return size; 376 } 377 378 static int user_field_size(const char *type) 379 { 380 /* long is not allowed from a user, since it's ambigious in size */ 381 if (strcmp(type, "s64") == 0) 382 return sizeof(s64); 383 if (strcmp(type, "u64") == 0) 384 return sizeof(u64); 385 if (strcmp(type, "s32") == 0) 386 return sizeof(s32); 387 if (strcmp(type, "u32") == 0) 388 return sizeof(u32); 389 if (strcmp(type, "int") == 0) 390 return sizeof(int); 391 if (strcmp(type, "unsigned int") == 0) 392 return sizeof(unsigned int); 393 if (strcmp(type, "s16") == 0) 394 return sizeof(s16); 395 if (strcmp(type, "u16") == 0) 396 return sizeof(u16); 397 if (strcmp(type, "short") == 0) 398 return sizeof(short); 399 if (strcmp(type, "unsigned short") == 0) 400 return sizeof(unsigned short); 401 if (strcmp(type, "s8") == 0) 402 return sizeof(s8); 403 if (strcmp(type, "u8") == 0) 404 return sizeof(u8); 405 if (strcmp(type, "char") == 0) 406 return sizeof(char); 407 if (strcmp(type, "unsigned char") == 0) 408 return sizeof(unsigned char); 409 if (str_has_prefix(type, "char[")) 410 return user_field_array_size(type); 411 if (str_has_prefix(type, "unsigned char[")) 412 return user_field_array_size(type); 413 if (str_has_prefix(type, "__data_loc ")) 414 return sizeof(u32); 415 if (str_has_prefix(type, "__rel_loc ")) 416 return sizeof(u32); 417 418 /* Uknown basic type, error */ 419 return -EINVAL; 420 } 421 422 static void user_event_destroy_validators(struct user_event *user) 423 { 424 struct user_event_validator *validator, *next; 425 struct list_head *head = &user->validators; 426 427 list_for_each_entry_safe(validator, next, head, link) { 428 list_del(&validator->link); 429 kfree(validator); 430 } 431 } 432 433 static void user_event_destroy_fields(struct user_event *user) 434 { 435 struct ftrace_event_field *field, *next; 436 struct list_head *head = &user->fields; 437 438 list_for_each_entry_safe(field, next, head, link) { 439 list_del(&field->link); 440 kfree(field); 441 } 442 } 443 444 static int user_event_add_field(struct user_event *user, const char *type, 445 const char *name, int offset, int size, 446 int is_signed, int filter_type) 447 { 448 struct user_event_validator *validator; 449 struct ftrace_event_field *field; 450 int validator_flags = 0; 451 452 field = kmalloc(sizeof(*field), GFP_KERNEL); 453 454 if (!field) 455 return -ENOMEM; 456 457 if (str_has_prefix(type, "__data_loc ")) 458 goto add_validator; 459 460 if (str_has_prefix(type, "__rel_loc ")) { 461 validator_flags |= VALIDATOR_REL; 462 goto add_validator; 463 } 464 465 goto add_field; 466 467 add_validator: 468 if (strstr(type, "char") != NULL) 469 validator_flags |= VALIDATOR_ENSURE_NULL; 470 471 validator = kmalloc(sizeof(*validator), GFP_KERNEL); 472 473 if (!validator) { 474 kfree(field); 475 return -ENOMEM; 476 } 477 478 validator->flags = validator_flags; 479 validator->offset = offset; 480 481 /* Want sequential access when validating */ 482 list_add_tail(&validator->link, &user->validators); 483 484 add_field: 485 field->type = type; 486 field->name = name; 487 field->offset = offset; 488 field->size = size; 489 field->is_signed = is_signed; 490 field->filter_type = filter_type; 491 492 list_add(&field->link, &user->fields); 493 494 /* 495 * Min size from user writes that are required, this does not include 496 * the size of trace_entry (common fields). 497 */ 498 user->min_size = (offset + size) - sizeof(struct trace_entry); 499 500 return 0; 501 } 502 503 /* 504 * Parses the values of a field within the description 505 * Format: type name [size] 506 */ 507 static int user_event_parse_field(char *field, struct user_event *user, 508 u32 *offset) 509 { 510 char *part, *type, *name; 511 u32 depth = 0, saved_offset = *offset; 512 int len, size = -EINVAL; 513 bool is_struct = false; 514 515 field = skip_spaces(field); 516 517 if (*field == '\0') 518 return 0; 519 520 /* Handle types that have a space within */ 521 len = str_has_prefix(field, "unsigned "); 522 if (len) 523 goto skip_next; 524 525 len = str_has_prefix(field, "struct "); 526 if (len) { 527 is_struct = true; 528 goto skip_next; 529 } 530 531 len = str_has_prefix(field, "__data_loc unsigned "); 532 if (len) 533 goto skip_next; 534 535 len = str_has_prefix(field, "__data_loc "); 536 if (len) 537 goto skip_next; 538 539 len = str_has_prefix(field, "__rel_loc unsigned "); 540 if (len) 541 goto skip_next; 542 543 len = str_has_prefix(field, "__rel_loc "); 544 if (len) 545 goto skip_next; 546 547 goto parse; 548 skip_next: 549 type = field; 550 field = strpbrk(field + len, " "); 551 552 if (field == NULL) 553 return -EINVAL; 554 555 *field++ = '\0'; 556 depth++; 557 parse: 558 name = NULL; 559 560 while ((part = strsep(&field, " ")) != NULL) { 561 switch (depth++) { 562 case FIELD_DEPTH_TYPE: 563 type = part; 564 break; 565 case FIELD_DEPTH_NAME: 566 name = part; 567 break; 568 case FIELD_DEPTH_SIZE: 569 if (!is_struct) 570 return -EINVAL; 571 572 if (kstrtou32(part, 10, &size)) 573 return -EINVAL; 574 break; 575 default: 576 return -EINVAL; 577 } 578 } 579 580 if (depth < FIELD_DEPTH_SIZE || !name) 581 return -EINVAL; 582 583 if (depth == FIELD_DEPTH_SIZE) 584 size = user_field_size(type); 585 586 if (size == 0) 587 return -EINVAL; 588 589 if (size < 0) 590 return size; 591 592 *offset = saved_offset + size; 593 594 return user_event_add_field(user, type, name, saved_offset, size, 595 type[0] != 'u', FILTER_OTHER); 596 } 597 598 static int user_event_parse_fields(struct user_event *user, char *args) 599 { 600 char *field; 601 u32 offset = sizeof(struct trace_entry); 602 int ret = -EINVAL; 603 604 if (args == NULL) 605 return 0; 606 607 while ((field = strsep(&args, ";")) != NULL) { 608 ret = user_event_parse_field(field, user, &offset); 609 610 if (ret) 611 break; 612 } 613 614 return ret; 615 } 616 617 static struct trace_event_fields user_event_fields_array[1]; 618 619 static const char *user_field_format(const char *type) 620 { 621 if (strcmp(type, "s64") == 0) 622 return "%lld"; 623 if (strcmp(type, "u64") == 0) 624 return "%llu"; 625 if (strcmp(type, "s32") == 0) 626 return "%d"; 627 if (strcmp(type, "u32") == 0) 628 return "%u"; 629 if (strcmp(type, "int") == 0) 630 return "%d"; 631 if (strcmp(type, "unsigned int") == 0) 632 return "%u"; 633 if (strcmp(type, "s16") == 0) 634 return "%d"; 635 if (strcmp(type, "u16") == 0) 636 return "%u"; 637 if (strcmp(type, "short") == 0) 638 return "%d"; 639 if (strcmp(type, "unsigned short") == 0) 640 return "%u"; 641 if (strcmp(type, "s8") == 0) 642 return "%d"; 643 if (strcmp(type, "u8") == 0) 644 return "%u"; 645 if (strcmp(type, "char") == 0) 646 return "%d"; 647 if (strcmp(type, "unsigned char") == 0) 648 return "%u"; 649 if (strstr(type, "char[") != NULL) 650 return "%s"; 651 652 /* Unknown, likely struct, allowed treat as 64-bit */ 653 return "%llu"; 654 } 655 656 static bool user_field_is_dyn_string(const char *type, const char **str_func) 657 { 658 if (str_has_prefix(type, "__data_loc ")) { 659 *str_func = "__get_str"; 660 goto check; 661 } 662 663 if (str_has_prefix(type, "__rel_loc ")) { 664 *str_func = "__get_rel_str"; 665 goto check; 666 } 667 668 return false; 669 check: 670 return strstr(type, "char") != NULL; 671 } 672 673 #define LEN_OR_ZERO (len ? len - pos : 0) 674 static int user_dyn_field_set_string(int argc, const char **argv, int *iout, 675 char *buf, int len, bool *colon) 676 { 677 int pos = 0, i = *iout; 678 679 *colon = false; 680 681 for (; i < argc; ++i) { 682 if (i != *iout) 683 pos += snprintf(buf + pos, LEN_OR_ZERO, " "); 684 685 pos += snprintf(buf + pos, LEN_OR_ZERO, "%s", argv[i]); 686 687 if (strchr(argv[i], ';')) { 688 ++i; 689 *colon = true; 690 break; 691 } 692 } 693 694 /* Actual set, advance i */ 695 if (len != 0) 696 *iout = i; 697 698 return pos + 1; 699 } 700 701 static int user_field_set_string(struct ftrace_event_field *field, 702 char *buf, int len, bool colon) 703 { 704 int pos = 0; 705 706 pos += snprintf(buf + pos, LEN_OR_ZERO, "%s", field->type); 707 pos += snprintf(buf + pos, LEN_OR_ZERO, " "); 708 pos += snprintf(buf + pos, LEN_OR_ZERO, "%s", field->name); 709 710 if (colon) 711 pos += snprintf(buf + pos, LEN_OR_ZERO, ";"); 712 713 return pos + 1; 714 } 715 716 static int user_event_set_print_fmt(struct user_event *user, char *buf, int len) 717 { 718 struct ftrace_event_field *field, *next; 719 struct list_head *head = &user->fields; 720 int pos = 0, depth = 0; 721 const char *str_func; 722 723 pos += snprintf(buf + pos, LEN_OR_ZERO, "\""); 724 725 list_for_each_entry_safe_reverse(field, next, head, link) { 726 if (depth != 0) 727 pos += snprintf(buf + pos, LEN_OR_ZERO, " "); 728 729 pos += snprintf(buf + pos, LEN_OR_ZERO, "%s=%s", 730 field->name, user_field_format(field->type)); 731 732 depth++; 733 } 734 735 pos += snprintf(buf + pos, LEN_OR_ZERO, "\""); 736 737 list_for_each_entry_safe_reverse(field, next, head, link) { 738 if (user_field_is_dyn_string(field->type, &str_func)) 739 pos += snprintf(buf + pos, LEN_OR_ZERO, 740 ", %s(%s)", str_func, field->name); 741 else 742 pos += snprintf(buf + pos, LEN_OR_ZERO, 743 ", REC->%s", field->name); 744 } 745 746 return pos + 1; 747 } 748 #undef LEN_OR_ZERO 749 750 static int user_event_create_print_fmt(struct user_event *user) 751 { 752 char *print_fmt; 753 int len; 754 755 len = user_event_set_print_fmt(user, NULL, 0); 756 757 print_fmt = kmalloc(len, GFP_KERNEL); 758 759 if (!print_fmt) 760 return -ENOMEM; 761 762 user_event_set_print_fmt(user, print_fmt, len); 763 764 user->call.print_fmt = print_fmt; 765 766 return 0; 767 } 768 769 static enum print_line_t user_event_print_trace(struct trace_iterator *iter, 770 int flags, 771 struct trace_event *event) 772 { 773 /* Unsafe to try to decode user provided print_fmt, use hex */ 774 trace_print_hex_dump_seq(&iter->seq, "", DUMP_PREFIX_OFFSET, 16, 775 1, iter->ent, iter->ent_size, true); 776 777 return trace_handle_return(&iter->seq); 778 } 779 780 static struct trace_event_functions user_event_funcs = { 781 .trace = user_event_print_trace, 782 }; 783 784 static int user_event_set_call_visible(struct user_event *user, bool visible) 785 { 786 int ret; 787 const struct cred *old_cred; 788 struct cred *cred; 789 790 cred = prepare_creds(); 791 792 if (!cred) 793 return -ENOMEM; 794 795 /* 796 * While by default tracefs is locked down, systems can be configured 797 * to allow user_event files to be less locked down. The extreme case 798 * being "other" has read/write access to user_events_data/status. 799 * 800 * When not locked down, processes may not have permissions to 801 * add/remove calls themselves to tracefs. We need to temporarily 802 * switch to root file permission to allow for this scenario. 803 */ 804 cred->fsuid = GLOBAL_ROOT_UID; 805 806 old_cred = override_creds(cred); 807 808 if (visible) 809 ret = trace_add_event_call(&user->call); 810 else 811 ret = trace_remove_event_call(&user->call); 812 813 revert_creds(old_cred); 814 put_cred(cred); 815 816 return ret; 817 } 818 819 static int destroy_user_event(struct user_event *user) 820 { 821 int ret = 0; 822 823 /* Must destroy fields before call removal */ 824 user_event_destroy_fields(user); 825 826 ret = user_event_set_call_visible(user, false); 827 828 if (ret) 829 return ret; 830 831 dyn_event_remove(&user->devent); 832 833 user_event_register_clear(user); 834 clear_bit(user->index, user->group->page_bitmap); 835 hash_del(&user->node); 836 837 user_event_destroy_validators(user); 838 kfree(user->call.print_fmt); 839 kfree(EVENT_NAME(user)); 840 kfree(user); 841 842 return ret; 843 } 844 845 static struct user_event *find_user_event(struct user_event_group *group, 846 char *name, u32 *outkey) 847 { 848 struct user_event *user; 849 u32 key = user_event_key(name); 850 851 *outkey = key; 852 853 hash_for_each_possible(group->register_table, user, node, key) 854 if (!strcmp(EVENT_NAME(user), name)) { 855 refcount_inc(&user->refcnt); 856 return user; 857 } 858 859 return NULL; 860 } 861 862 static int user_event_validate(struct user_event *user, void *data, int len) 863 { 864 struct list_head *head = &user->validators; 865 struct user_event_validator *validator; 866 void *pos, *end = data + len; 867 u32 loc, offset, size; 868 869 list_for_each_entry(validator, head, link) { 870 pos = data + validator->offset; 871 872 /* Already done min_size check, no bounds check here */ 873 loc = *(u32 *)pos; 874 offset = loc & 0xffff; 875 size = loc >> 16; 876 877 if (likely(validator->flags & VALIDATOR_REL)) 878 pos += offset + sizeof(loc); 879 else 880 pos = data + offset; 881 882 pos += size; 883 884 if (unlikely(pos > end)) 885 return -EFAULT; 886 887 if (likely(validator->flags & VALIDATOR_ENSURE_NULL)) 888 if (unlikely(*(char *)(pos - 1) != '\0')) 889 return -EFAULT; 890 } 891 892 return 0; 893 } 894 895 /* 896 * Writes the user supplied payload out to a trace file. 897 */ 898 static void user_event_ftrace(struct user_event *user, struct iov_iter *i, 899 void *tpdata, bool *faulted) 900 { 901 struct trace_event_file *file; 902 struct trace_entry *entry; 903 struct trace_event_buffer event_buffer; 904 size_t size = sizeof(*entry) + i->count; 905 906 file = (struct trace_event_file *)tpdata; 907 908 if (!file || 909 !(file->flags & EVENT_FILE_FL_ENABLED) || 910 trace_trigger_soft_disabled(file)) 911 return; 912 913 /* Allocates and fills trace_entry, + 1 of this is data payload */ 914 entry = trace_event_buffer_reserve(&event_buffer, file, size); 915 916 if (unlikely(!entry)) 917 return; 918 919 if (unlikely(!copy_nofault(entry + 1, i->count, i))) 920 goto discard; 921 922 if (!list_empty(&user->validators) && 923 unlikely(user_event_validate(user, entry, size))) 924 goto discard; 925 926 trace_event_buffer_commit(&event_buffer); 927 928 return; 929 discard: 930 *faulted = true; 931 __trace_event_discard_commit(event_buffer.buffer, 932 event_buffer.event); 933 } 934 935 #ifdef CONFIG_PERF_EVENTS 936 /* 937 * Writes the user supplied payload out to perf ring buffer. 938 */ 939 static void user_event_perf(struct user_event *user, struct iov_iter *i, 940 void *tpdata, bool *faulted) 941 { 942 struct hlist_head *perf_head; 943 944 perf_head = this_cpu_ptr(user->call.perf_events); 945 946 if (perf_head && !hlist_empty(perf_head)) { 947 struct trace_entry *perf_entry; 948 struct pt_regs *regs; 949 size_t size = sizeof(*perf_entry) + i->count; 950 int context; 951 952 perf_entry = perf_trace_buf_alloc(ALIGN(size, 8), 953 ®s, &context); 954 955 if (unlikely(!perf_entry)) 956 return; 957 958 perf_fetch_caller_regs(regs); 959 960 if (unlikely(!copy_nofault(perf_entry + 1, i->count, i))) 961 goto discard; 962 963 if (!list_empty(&user->validators) && 964 unlikely(user_event_validate(user, perf_entry, size))) 965 goto discard; 966 967 perf_trace_buf_submit(perf_entry, size, context, 968 user->call.event.type, 1, regs, 969 perf_head, NULL); 970 971 return; 972 discard: 973 *faulted = true; 974 perf_swevent_put_recursion_context(context); 975 } 976 } 977 #endif 978 979 /* 980 * Update the register page that is shared between user processes. 981 */ 982 static void update_reg_page_for(struct user_event *user) 983 { 984 struct tracepoint *tp = &user->tracepoint; 985 char status = 0; 986 987 if (atomic_read(&tp->key.enabled) > 0) { 988 struct tracepoint_func *probe_func_ptr; 989 user_event_func_t probe_func; 990 991 rcu_read_lock_sched(); 992 993 probe_func_ptr = rcu_dereference_sched(tp->funcs); 994 995 if (probe_func_ptr) { 996 do { 997 probe_func = probe_func_ptr->func; 998 999 if (probe_func == user_event_ftrace) 1000 status |= EVENT_STATUS_FTRACE; 1001 #ifdef CONFIG_PERF_EVENTS 1002 else if (probe_func == user_event_perf) 1003 status |= EVENT_STATUS_PERF; 1004 #endif 1005 else 1006 status |= EVENT_STATUS_OTHER; 1007 } while ((++probe_func_ptr)->func); 1008 } 1009 1010 rcu_read_unlock_sched(); 1011 } 1012 1013 if (status) 1014 user_event_register_set(user); 1015 else 1016 user_event_register_clear(user); 1017 1018 user->status = status; 1019 } 1020 1021 /* 1022 * Register callback for our events from tracing sub-systems. 1023 */ 1024 static int user_event_reg(struct trace_event_call *call, 1025 enum trace_reg type, 1026 void *data) 1027 { 1028 struct user_event *user = (struct user_event *)call->data; 1029 int ret = 0; 1030 1031 if (!user) 1032 return -ENOENT; 1033 1034 switch (type) { 1035 case TRACE_REG_REGISTER: 1036 ret = tracepoint_probe_register(call->tp, 1037 call->class->probe, 1038 data); 1039 if (!ret) 1040 goto inc; 1041 break; 1042 1043 case TRACE_REG_UNREGISTER: 1044 tracepoint_probe_unregister(call->tp, 1045 call->class->probe, 1046 data); 1047 goto dec; 1048 1049 #ifdef CONFIG_PERF_EVENTS 1050 case TRACE_REG_PERF_REGISTER: 1051 ret = tracepoint_probe_register(call->tp, 1052 call->class->perf_probe, 1053 data); 1054 if (!ret) 1055 goto inc; 1056 break; 1057 1058 case TRACE_REG_PERF_UNREGISTER: 1059 tracepoint_probe_unregister(call->tp, 1060 call->class->perf_probe, 1061 data); 1062 goto dec; 1063 1064 case TRACE_REG_PERF_OPEN: 1065 case TRACE_REG_PERF_CLOSE: 1066 case TRACE_REG_PERF_ADD: 1067 case TRACE_REG_PERF_DEL: 1068 break; 1069 #endif 1070 } 1071 1072 return ret; 1073 inc: 1074 refcount_inc(&user->refcnt); 1075 update_reg_page_for(user); 1076 return 0; 1077 dec: 1078 update_reg_page_for(user); 1079 refcount_dec(&user->refcnt); 1080 return 0; 1081 } 1082 1083 static int user_event_create(const char *raw_command) 1084 { 1085 struct user_event_group *group; 1086 struct user_event *user; 1087 char *name; 1088 int ret; 1089 1090 if (!str_has_prefix(raw_command, USER_EVENTS_PREFIX)) 1091 return -ECANCELED; 1092 1093 raw_command += USER_EVENTS_PREFIX_LEN; 1094 raw_command = skip_spaces(raw_command); 1095 1096 name = kstrdup(raw_command, GFP_KERNEL); 1097 1098 if (!name) 1099 return -ENOMEM; 1100 1101 group = current_user_event_group(); 1102 1103 if (!group) { 1104 kfree(name); 1105 return -ENOENT; 1106 } 1107 1108 mutex_lock(&group->reg_mutex); 1109 1110 ret = user_event_parse_cmd(group, name, &user); 1111 1112 if (!ret) 1113 refcount_dec(&user->refcnt); 1114 1115 mutex_unlock(&group->reg_mutex); 1116 1117 if (ret) 1118 kfree(name); 1119 1120 return ret; 1121 } 1122 1123 static int user_event_show(struct seq_file *m, struct dyn_event *ev) 1124 { 1125 struct user_event *user = container_of(ev, struct user_event, devent); 1126 struct ftrace_event_field *field, *next; 1127 struct list_head *head; 1128 int depth = 0; 1129 1130 seq_printf(m, "%s%s", USER_EVENTS_PREFIX, EVENT_NAME(user)); 1131 1132 head = trace_get_fields(&user->call); 1133 1134 list_for_each_entry_safe_reverse(field, next, head, link) { 1135 if (depth == 0) 1136 seq_puts(m, " "); 1137 else 1138 seq_puts(m, "; "); 1139 1140 seq_printf(m, "%s %s", field->type, field->name); 1141 1142 if (str_has_prefix(field->type, "struct ")) 1143 seq_printf(m, " %d", field->size); 1144 1145 depth++; 1146 } 1147 1148 seq_puts(m, "\n"); 1149 1150 return 0; 1151 } 1152 1153 static bool user_event_is_busy(struct dyn_event *ev) 1154 { 1155 struct user_event *user = container_of(ev, struct user_event, devent); 1156 1157 return !user_event_last_ref(user); 1158 } 1159 1160 static int user_event_free(struct dyn_event *ev) 1161 { 1162 struct user_event *user = container_of(ev, struct user_event, devent); 1163 1164 if (!user_event_last_ref(user)) 1165 return -EBUSY; 1166 1167 return destroy_user_event(user); 1168 } 1169 1170 static bool user_field_match(struct ftrace_event_field *field, int argc, 1171 const char **argv, int *iout) 1172 { 1173 char *field_name = NULL, *dyn_field_name = NULL; 1174 bool colon = false, match = false; 1175 int dyn_len, len; 1176 1177 if (*iout >= argc) 1178 return false; 1179 1180 dyn_len = user_dyn_field_set_string(argc, argv, iout, dyn_field_name, 1181 0, &colon); 1182 1183 len = user_field_set_string(field, field_name, 0, colon); 1184 1185 if (dyn_len != len) 1186 return false; 1187 1188 dyn_field_name = kmalloc(dyn_len, GFP_KERNEL); 1189 field_name = kmalloc(len, GFP_KERNEL); 1190 1191 if (!dyn_field_name || !field_name) 1192 goto out; 1193 1194 user_dyn_field_set_string(argc, argv, iout, dyn_field_name, 1195 dyn_len, &colon); 1196 1197 user_field_set_string(field, field_name, len, colon); 1198 1199 match = strcmp(dyn_field_name, field_name) == 0; 1200 out: 1201 kfree(dyn_field_name); 1202 kfree(field_name); 1203 1204 return match; 1205 } 1206 1207 static bool user_fields_match(struct user_event *user, int argc, 1208 const char **argv) 1209 { 1210 struct ftrace_event_field *field, *next; 1211 struct list_head *head = &user->fields; 1212 int i = 0; 1213 1214 list_for_each_entry_safe_reverse(field, next, head, link) 1215 if (!user_field_match(field, argc, argv, &i)) 1216 return false; 1217 1218 if (i != argc) 1219 return false; 1220 1221 return true; 1222 } 1223 1224 static bool user_event_match(const char *system, const char *event, 1225 int argc, const char **argv, struct dyn_event *ev) 1226 { 1227 struct user_event *user = container_of(ev, struct user_event, devent); 1228 bool match; 1229 1230 match = strcmp(EVENT_NAME(user), event) == 0 && 1231 (!system || strcmp(system, USER_EVENTS_SYSTEM) == 0); 1232 1233 if (match && argc > 0) 1234 match = user_fields_match(user, argc, argv); 1235 1236 return match; 1237 } 1238 1239 static struct dyn_event_operations user_event_dops = { 1240 .create = user_event_create, 1241 .show = user_event_show, 1242 .is_busy = user_event_is_busy, 1243 .free = user_event_free, 1244 .match = user_event_match, 1245 }; 1246 1247 static int user_event_trace_register(struct user_event *user) 1248 { 1249 int ret; 1250 1251 ret = register_trace_event(&user->call.event); 1252 1253 if (!ret) 1254 return -ENODEV; 1255 1256 ret = user_event_set_call_visible(user, true); 1257 1258 if (ret) 1259 unregister_trace_event(&user->call.event); 1260 1261 return ret; 1262 } 1263 1264 /* 1265 * Parses the event name, arguments and flags then registers if successful. 1266 * The name buffer lifetime is owned by this method for success cases only. 1267 * Upon success the returned user_event has its ref count increased by 1. 1268 */ 1269 static int user_event_parse(struct user_event_group *group, char *name, 1270 char *args, char *flags, 1271 struct user_event **newuser) 1272 { 1273 int ret; 1274 int index; 1275 u32 key; 1276 struct user_event *user; 1277 1278 /* Prevent dyn_event from racing */ 1279 mutex_lock(&event_mutex); 1280 user = find_user_event(group, name, &key); 1281 mutex_unlock(&event_mutex); 1282 1283 if (user) { 1284 *newuser = user; 1285 /* 1286 * Name is allocated by caller, free it since it already exists. 1287 * Caller only worries about failure cases for freeing. 1288 */ 1289 kfree(name); 1290 return 0; 1291 } 1292 1293 index = find_first_zero_bit(group->page_bitmap, MAX_EVENTS); 1294 1295 if (index == MAX_EVENTS) 1296 return -EMFILE; 1297 1298 user = kzalloc(sizeof(*user), GFP_KERNEL); 1299 1300 if (!user) 1301 return -ENOMEM; 1302 1303 INIT_LIST_HEAD(&user->class.fields); 1304 INIT_LIST_HEAD(&user->fields); 1305 INIT_LIST_HEAD(&user->validators); 1306 1307 user->group = group; 1308 user->tracepoint.name = name; 1309 1310 ret = user_event_parse_fields(user, args); 1311 1312 if (ret) 1313 goto put_user; 1314 1315 ret = user_event_create_print_fmt(user); 1316 1317 if (ret) 1318 goto put_user; 1319 1320 user->call.data = user; 1321 user->call.class = &user->class; 1322 user->call.name = name; 1323 user->call.flags = TRACE_EVENT_FL_TRACEPOINT; 1324 user->call.tp = &user->tracepoint; 1325 user->call.event.funcs = &user_event_funcs; 1326 user->class.system = group->system_name; 1327 1328 user->class.fields_array = user_event_fields_array; 1329 user->class.get_fields = user_event_get_fields; 1330 user->class.reg = user_event_reg; 1331 user->class.probe = user_event_ftrace; 1332 #ifdef CONFIG_PERF_EVENTS 1333 user->class.perf_probe = user_event_perf; 1334 #endif 1335 1336 mutex_lock(&event_mutex); 1337 1338 ret = user_event_trace_register(user); 1339 1340 if (ret) 1341 goto put_user_lock; 1342 1343 user->index = index; 1344 1345 /* Ensure we track self ref and caller ref (2) */ 1346 refcount_set(&user->refcnt, 2); 1347 1348 dyn_event_init(&user->devent, &user_event_dops); 1349 dyn_event_add(&user->devent, &user->call); 1350 set_bit(user->index, group->page_bitmap); 1351 hash_add(group->register_table, &user->node, key); 1352 1353 mutex_unlock(&event_mutex); 1354 1355 *newuser = user; 1356 return 0; 1357 put_user_lock: 1358 mutex_unlock(&event_mutex); 1359 put_user: 1360 user_event_destroy_fields(user); 1361 user_event_destroy_validators(user); 1362 kfree(user->call.print_fmt); 1363 kfree(user); 1364 return ret; 1365 } 1366 1367 /* 1368 * Deletes a previously created event if it is no longer being used. 1369 */ 1370 static int delete_user_event(struct user_event_group *group, char *name) 1371 { 1372 u32 key; 1373 struct user_event *user = find_user_event(group, name, &key); 1374 1375 if (!user) 1376 return -ENOENT; 1377 1378 refcount_dec(&user->refcnt); 1379 1380 if (!user_event_last_ref(user)) 1381 return -EBUSY; 1382 1383 return destroy_user_event(user); 1384 } 1385 1386 /* 1387 * Validates the user payload and writes via iterator. 1388 */ 1389 static ssize_t user_events_write_core(struct file *file, struct iov_iter *i) 1390 { 1391 struct user_event_file_info *info = file->private_data; 1392 struct user_event_refs *refs; 1393 struct user_event *user = NULL; 1394 struct tracepoint *tp; 1395 ssize_t ret = i->count; 1396 int idx; 1397 1398 if (unlikely(copy_from_iter(&idx, sizeof(idx), i) != sizeof(idx))) 1399 return -EFAULT; 1400 1401 rcu_read_lock_sched(); 1402 1403 refs = rcu_dereference_sched(info->refs); 1404 1405 /* 1406 * The refs->events array is protected by RCU, and new items may be 1407 * added. But the user retrieved from indexing into the events array 1408 * shall be immutable while the file is opened. 1409 */ 1410 if (likely(refs && idx < refs->count)) 1411 user = refs->events[idx]; 1412 1413 rcu_read_unlock_sched(); 1414 1415 if (unlikely(user == NULL)) 1416 return -ENOENT; 1417 1418 if (unlikely(i->count < user->min_size)) 1419 return -EINVAL; 1420 1421 tp = &user->tracepoint; 1422 1423 /* 1424 * It's possible key.enabled disables after this check, however 1425 * we don't mind if a few events are included in this condition. 1426 */ 1427 if (likely(atomic_read(&tp->key.enabled) > 0)) { 1428 struct tracepoint_func *probe_func_ptr; 1429 user_event_func_t probe_func; 1430 struct iov_iter copy; 1431 void *tpdata; 1432 bool faulted; 1433 1434 if (unlikely(fault_in_iov_iter_readable(i, i->count))) 1435 return -EFAULT; 1436 1437 faulted = false; 1438 1439 rcu_read_lock_sched(); 1440 1441 probe_func_ptr = rcu_dereference_sched(tp->funcs); 1442 1443 if (probe_func_ptr) { 1444 do { 1445 copy = *i; 1446 probe_func = probe_func_ptr->func; 1447 tpdata = probe_func_ptr->data; 1448 probe_func(user, ©, tpdata, &faulted); 1449 } while ((++probe_func_ptr)->func); 1450 } 1451 1452 rcu_read_unlock_sched(); 1453 1454 if (unlikely(faulted)) 1455 return -EFAULT; 1456 } 1457 1458 return ret; 1459 } 1460 1461 static int user_events_open(struct inode *node, struct file *file) 1462 { 1463 struct user_event_group *group; 1464 struct user_event_file_info *info; 1465 1466 group = current_user_event_group(); 1467 1468 if (!group) 1469 return -ENOENT; 1470 1471 info = kzalloc(sizeof(*info), GFP_KERNEL); 1472 1473 if (!info) 1474 return -ENOMEM; 1475 1476 info->group = group; 1477 1478 file->private_data = info; 1479 1480 return 0; 1481 } 1482 1483 static ssize_t user_events_write(struct file *file, const char __user *ubuf, 1484 size_t count, loff_t *ppos) 1485 { 1486 struct iovec iov; 1487 struct iov_iter i; 1488 1489 if (unlikely(*ppos != 0)) 1490 return -EFAULT; 1491 1492 if (unlikely(import_single_range(ITER_SOURCE, (char __user *)ubuf, 1493 count, &iov, &i))) 1494 return -EFAULT; 1495 1496 return user_events_write_core(file, &i); 1497 } 1498 1499 static ssize_t user_events_write_iter(struct kiocb *kp, struct iov_iter *i) 1500 { 1501 return user_events_write_core(kp->ki_filp, i); 1502 } 1503 1504 static int user_events_ref_add(struct user_event_file_info *info, 1505 struct user_event *user) 1506 { 1507 struct user_event_group *group = info->group; 1508 struct user_event_refs *refs, *new_refs; 1509 int i, size, count = 0; 1510 1511 refs = rcu_dereference_protected(info->refs, 1512 lockdep_is_held(&group->reg_mutex)); 1513 1514 if (refs) { 1515 count = refs->count; 1516 1517 for (i = 0; i < count; ++i) 1518 if (refs->events[i] == user) 1519 return i; 1520 } 1521 1522 size = struct_size(refs, events, count + 1); 1523 1524 new_refs = kzalloc(size, GFP_KERNEL); 1525 1526 if (!new_refs) 1527 return -ENOMEM; 1528 1529 new_refs->count = count + 1; 1530 1531 for (i = 0; i < count; ++i) 1532 new_refs->events[i] = refs->events[i]; 1533 1534 new_refs->events[i] = user; 1535 1536 refcount_inc(&user->refcnt); 1537 1538 rcu_assign_pointer(info->refs, new_refs); 1539 1540 if (refs) 1541 kfree_rcu(refs, rcu); 1542 1543 return i; 1544 } 1545 1546 static long user_reg_get(struct user_reg __user *ureg, struct user_reg *kreg) 1547 { 1548 u32 size; 1549 long ret; 1550 1551 ret = get_user(size, &ureg->size); 1552 1553 if (ret) 1554 return ret; 1555 1556 if (size > PAGE_SIZE) 1557 return -E2BIG; 1558 1559 if (size < offsetofend(struct user_reg, write_index)) 1560 return -EINVAL; 1561 1562 ret = copy_struct_from_user(kreg, sizeof(*kreg), ureg, size); 1563 1564 if (ret) 1565 return ret; 1566 1567 kreg->size = size; 1568 1569 return 0; 1570 } 1571 1572 /* 1573 * Registers a user_event on behalf of a user process. 1574 */ 1575 static long user_events_ioctl_reg(struct user_event_file_info *info, 1576 unsigned long uarg) 1577 { 1578 struct user_reg __user *ureg = (struct user_reg __user *)uarg; 1579 struct user_reg reg; 1580 struct user_event *user; 1581 char *name; 1582 long ret; 1583 1584 ret = user_reg_get(ureg, ®); 1585 1586 if (ret) 1587 return ret; 1588 1589 name = strndup_user((const char __user *)(uintptr_t)reg.name_args, 1590 MAX_EVENT_DESC); 1591 1592 if (IS_ERR(name)) { 1593 ret = PTR_ERR(name); 1594 return ret; 1595 } 1596 1597 ret = user_event_parse_cmd(info->group, name, &user); 1598 1599 if (ret) { 1600 kfree(name); 1601 return ret; 1602 } 1603 1604 ret = user_events_ref_add(info, user); 1605 1606 /* No longer need parse ref, ref_add either worked or not */ 1607 refcount_dec(&user->refcnt); 1608 1609 /* Positive number is index and valid */ 1610 if (ret < 0) 1611 return ret; 1612 1613 put_user((u32)ret, &ureg->write_index); 1614 put_user(user->index, &ureg->status_bit); 1615 1616 return 0; 1617 } 1618 1619 /* 1620 * Deletes a user_event on behalf of a user process. 1621 */ 1622 static long user_events_ioctl_del(struct user_event_file_info *info, 1623 unsigned long uarg) 1624 { 1625 void __user *ubuf = (void __user *)uarg; 1626 char *name; 1627 long ret; 1628 1629 name = strndup_user(ubuf, MAX_EVENT_DESC); 1630 1631 if (IS_ERR(name)) 1632 return PTR_ERR(name); 1633 1634 /* event_mutex prevents dyn_event from racing */ 1635 mutex_lock(&event_mutex); 1636 ret = delete_user_event(info->group, name); 1637 mutex_unlock(&event_mutex); 1638 1639 kfree(name); 1640 1641 return ret; 1642 } 1643 1644 /* 1645 * Handles the ioctl from user mode to register or alter operations. 1646 */ 1647 static long user_events_ioctl(struct file *file, unsigned int cmd, 1648 unsigned long uarg) 1649 { 1650 struct user_event_file_info *info = file->private_data; 1651 struct user_event_group *group = info->group; 1652 long ret = -ENOTTY; 1653 1654 switch (cmd) { 1655 case DIAG_IOCSREG: 1656 mutex_lock(&group->reg_mutex); 1657 ret = user_events_ioctl_reg(info, uarg); 1658 mutex_unlock(&group->reg_mutex); 1659 break; 1660 1661 case DIAG_IOCSDEL: 1662 mutex_lock(&group->reg_mutex); 1663 ret = user_events_ioctl_del(info, uarg); 1664 mutex_unlock(&group->reg_mutex); 1665 break; 1666 } 1667 1668 return ret; 1669 } 1670 1671 /* 1672 * Handles the final close of the file from user mode. 1673 */ 1674 static int user_events_release(struct inode *node, struct file *file) 1675 { 1676 struct user_event_file_info *info = file->private_data; 1677 struct user_event_group *group; 1678 struct user_event_refs *refs; 1679 struct user_event *user; 1680 int i; 1681 1682 if (!info) 1683 return -EINVAL; 1684 1685 group = info->group; 1686 1687 /* 1688 * Ensure refs cannot change under any situation by taking the 1689 * register mutex during the final freeing of the references. 1690 */ 1691 mutex_lock(&group->reg_mutex); 1692 1693 refs = info->refs; 1694 1695 if (!refs) 1696 goto out; 1697 1698 /* 1699 * The lifetime of refs has reached an end, it's tied to this file. 1700 * The underlying user_events are ref counted, and cannot be freed. 1701 * After this decrement, the user_events may be freed elsewhere. 1702 */ 1703 for (i = 0; i < refs->count; ++i) { 1704 user = refs->events[i]; 1705 1706 if (user) 1707 refcount_dec(&user->refcnt); 1708 } 1709 out: 1710 file->private_data = NULL; 1711 1712 mutex_unlock(&group->reg_mutex); 1713 1714 kfree(refs); 1715 kfree(info); 1716 1717 return 0; 1718 } 1719 1720 static const struct file_operations user_data_fops = { 1721 .open = user_events_open, 1722 .write = user_events_write, 1723 .write_iter = user_events_write_iter, 1724 .unlocked_ioctl = user_events_ioctl, 1725 .release = user_events_release, 1726 }; 1727 1728 static struct user_event_group *user_status_group(struct file *file) 1729 { 1730 struct seq_file *m = file->private_data; 1731 1732 if (!m) 1733 return NULL; 1734 1735 return m->private; 1736 } 1737 1738 /* 1739 * Maps the shared page into the user process for checking if event is enabled. 1740 */ 1741 static int user_status_mmap(struct file *file, struct vm_area_struct *vma) 1742 { 1743 char *pages; 1744 struct user_event_group *group = user_status_group(file); 1745 unsigned long size = vma->vm_end - vma->vm_start; 1746 1747 if (size != MAX_BYTES) 1748 return -EINVAL; 1749 1750 if (!group) 1751 return -EINVAL; 1752 1753 pages = group->register_page_data; 1754 1755 return remap_pfn_range(vma, vma->vm_start, 1756 virt_to_phys(pages) >> PAGE_SHIFT, 1757 size, vm_get_page_prot(VM_READ)); 1758 } 1759 1760 static void *user_seq_start(struct seq_file *m, loff_t *pos) 1761 { 1762 if (*pos) 1763 return NULL; 1764 1765 return (void *)1; 1766 } 1767 1768 static void *user_seq_next(struct seq_file *m, void *p, loff_t *pos) 1769 { 1770 ++*pos; 1771 return NULL; 1772 } 1773 1774 static void user_seq_stop(struct seq_file *m, void *p) 1775 { 1776 } 1777 1778 static int user_seq_show(struct seq_file *m, void *p) 1779 { 1780 struct user_event_group *group = m->private; 1781 struct user_event *user; 1782 char status; 1783 int i, active = 0, busy = 0, flags; 1784 1785 if (!group) 1786 return -EINVAL; 1787 1788 mutex_lock(&group->reg_mutex); 1789 1790 hash_for_each(group->register_table, i, user, node) { 1791 status = user->status; 1792 flags = user->flags; 1793 1794 seq_printf(m, "%d:%s", user->index, EVENT_NAME(user)); 1795 1796 if (flags != 0 || status != 0) 1797 seq_puts(m, " #"); 1798 1799 if (status != 0) { 1800 seq_puts(m, " Used by"); 1801 if (status & EVENT_STATUS_FTRACE) 1802 seq_puts(m, " ftrace"); 1803 if (status & EVENT_STATUS_PERF) 1804 seq_puts(m, " perf"); 1805 if (status & EVENT_STATUS_OTHER) 1806 seq_puts(m, " other"); 1807 busy++; 1808 } 1809 1810 seq_puts(m, "\n"); 1811 active++; 1812 } 1813 1814 mutex_unlock(&group->reg_mutex); 1815 1816 seq_puts(m, "\n"); 1817 seq_printf(m, "Active: %d\n", active); 1818 seq_printf(m, "Busy: %d\n", busy); 1819 seq_printf(m, "Max: %ld\n", MAX_EVENTS); 1820 1821 return 0; 1822 } 1823 1824 static const struct seq_operations user_seq_ops = { 1825 .start = user_seq_start, 1826 .next = user_seq_next, 1827 .stop = user_seq_stop, 1828 .show = user_seq_show, 1829 }; 1830 1831 static int user_status_open(struct inode *node, struct file *file) 1832 { 1833 struct user_event_group *group; 1834 int ret; 1835 1836 group = current_user_event_group(); 1837 1838 if (!group) 1839 return -ENOENT; 1840 1841 ret = seq_open(file, &user_seq_ops); 1842 1843 if (!ret) { 1844 /* Chain group to seq_file */ 1845 struct seq_file *m = file->private_data; 1846 1847 m->private = group; 1848 } 1849 1850 return ret; 1851 } 1852 1853 static const struct file_operations user_status_fops = { 1854 .open = user_status_open, 1855 .mmap = user_status_mmap, 1856 .read = seq_read, 1857 .llseek = seq_lseek, 1858 .release = seq_release, 1859 }; 1860 1861 /* 1862 * Creates a set of tracefs files to allow user mode interactions. 1863 */ 1864 static int create_user_tracefs(void) 1865 { 1866 struct dentry *edata, *emmap; 1867 1868 edata = tracefs_create_file("user_events_data", TRACE_MODE_WRITE, 1869 NULL, NULL, &user_data_fops); 1870 1871 if (!edata) { 1872 pr_warn("Could not create tracefs 'user_events_data' entry\n"); 1873 goto err; 1874 } 1875 1876 /* mmap with MAP_SHARED requires writable fd */ 1877 emmap = tracefs_create_file("user_events_status", TRACE_MODE_WRITE, 1878 NULL, NULL, &user_status_fops); 1879 1880 if (!emmap) { 1881 tracefs_remove(edata); 1882 pr_warn("Could not create tracefs 'user_events_mmap' entry\n"); 1883 goto err; 1884 } 1885 1886 return 0; 1887 err: 1888 return -ENODEV; 1889 } 1890 1891 static int __init trace_events_user_init(void) 1892 { 1893 int ret; 1894 1895 init_group = user_event_group_create(&init_user_ns); 1896 1897 if (!init_group) 1898 return -ENOMEM; 1899 1900 ret = create_user_tracefs(); 1901 1902 if (ret) { 1903 pr_warn("user_events could not register with tracefs\n"); 1904 user_event_group_destroy(init_group); 1905 init_group = NULL; 1906 return ret; 1907 } 1908 1909 if (dyn_event_register(&user_event_dops)) 1910 pr_warn("user_events could not register with dyn_events\n"); 1911 1912 return 0; 1913 } 1914 1915 fs_initcall(trace_events_user_init); 1916