1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Kprobes-based tracing events 4 * 5 * Created by Masami Hiramatsu <mhiramat@redhat.com> 6 * 7 */ 8 #define pr_fmt(fmt) "trace_kprobe: " fmt 9 10 #include <linux/bpf-cgroup.h> 11 #include <linux/security.h> 12 #include <linux/module.h> 13 #include <linux/uaccess.h> 14 #include <linux/rculist.h> 15 #include <linux/error-injection.h> 16 17 #include <asm/setup.h> /* for COMMAND_LINE_SIZE */ 18 19 #include "trace_dynevent.h" 20 #include "trace_kprobe_selftest.h" 21 #include "trace_probe.h" 22 #include "trace_probe_tmpl.h" 23 #include "trace_probe_kernel.h" 24 25 #define KPROBE_EVENT_SYSTEM "kprobes" 26 #define KRETPROBE_MAXACTIVE_MAX 4096 27 28 /* Kprobe early definition from command line */ 29 static char kprobe_boot_events_buf[COMMAND_LINE_SIZE] __initdata; 30 31 static int __init set_kprobe_boot_events(char *str) 32 { 33 strscpy(kprobe_boot_events_buf, str, COMMAND_LINE_SIZE); 34 disable_tracing_selftest("running kprobe events"); 35 36 return 1; 37 } 38 __setup("kprobe_event=", set_kprobe_boot_events); 39 40 static int trace_kprobe_create(const char *raw_command); 41 static int trace_kprobe_show(struct seq_file *m, struct dyn_event *ev); 42 static int trace_kprobe_release(struct dyn_event *ev); 43 static bool trace_kprobe_is_busy(struct dyn_event *ev); 44 static bool trace_kprobe_match(const char *system, const char *event, 45 int argc, const char **argv, struct dyn_event *ev); 46 47 static struct dyn_event_operations trace_kprobe_ops = { 48 .create = trace_kprobe_create, 49 .show = trace_kprobe_show, 50 .is_busy = trace_kprobe_is_busy, 51 .free = trace_kprobe_release, 52 .match = trace_kprobe_match, 53 }; 54 55 /* 56 * Kprobe event core functions 57 */ 58 struct trace_kprobe { 59 struct dyn_event devent; 60 struct kretprobe rp; /* Use rp.kp for kprobe use */ 61 unsigned long __percpu *nhit; 62 const char *symbol; /* symbol name */ 63 struct trace_probe tp; 64 }; 65 66 static bool is_trace_kprobe(struct dyn_event *ev) 67 { 68 return ev->ops == &trace_kprobe_ops; 69 } 70 71 static struct trace_kprobe *to_trace_kprobe(struct dyn_event *ev) 72 { 73 return container_of(ev, struct trace_kprobe, devent); 74 } 75 76 /** 77 * for_each_trace_kprobe - iterate over the trace_kprobe list 78 * @pos: the struct trace_kprobe * for each entry 79 * @dpos: the struct dyn_event * to use as a loop cursor 80 */ 81 #define for_each_trace_kprobe(pos, dpos) \ 82 for_each_dyn_event(dpos) \ 83 if (is_trace_kprobe(dpos) && (pos = to_trace_kprobe(dpos))) 84 85 static nokprobe_inline bool trace_kprobe_is_return(struct trace_kprobe *tk) 86 { 87 return tk->rp.handler != NULL; 88 } 89 90 static nokprobe_inline const char *trace_kprobe_symbol(struct trace_kprobe *tk) 91 { 92 return tk->symbol ? tk->symbol : "unknown"; 93 } 94 95 static nokprobe_inline unsigned long trace_kprobe_offset(struct trace_kprobe *tk) 96 { 97 return tk->rp.kp.offset; 98 } 99 100 static nokprobe_inline bool trace_kprobe_has_gone(struct trace_kprobe *tk) 101 { 102 return kprobe_gone(&tk->rp.kp); 103 } 104 105 static nokprobe_inline bool trace_kprobe_within_module(struct trace_kprobe *tk, 106 struct module *mod) 107 { 108 int len = strlen(module_name(mod)); 109 const char *name = trace_kprobe_symbol(tk); 110 111 return strncmp(module_name(mod), name, len) == 0 && name[len] == ':'; 112 } 113 114 static nokprobe_inline bool trace_kprobe_module_exist(struct trace_kprobe *tk) 115 { 116 char *p; 117 bool ret; 118 119 if (!tk->symbol) 120 return false; 121 p = strchr(tk->symbol, ':'); 122 if (!p) 123 return true; 124 *p = '\0'; 125 rcu_read_lock_sched(); 126 ret = !!find_module(tk->symbol); 127 rcu_read_unlock_sched(); 128 *p = ':'; 129 130 return ret; 131 } 132 133 static bool trace_kprobe_is_busy(struct dyn_event *ev) 134 { 135 struct trace_kprobe *tk = to_trace_kprobe(ev); 136 137 return trace_probe_is_enabled(&tk->tp); 138 } 139 140 static bool trace_kprobe_match_command_head(struct trace_kprobe *tk, 141 int argc, const char **argv) 142 { 143 char buf[MAX_ARGSTR_LEN + 1]; 144 145 if (!argc) 146 return true; 147 148 if (!tk->symbol) 149 snprintf(buf, sizeof(buf), "0x%p", tk->rp.kp.addr); 150 else if (tk->rp.kp.offset) 151 snprintf(buf, sizeof(buf), "%s+%u", 152 trace_kprobe_symbol(tk), tk->rp.kp.offset); 153 else 154 snprintf(buf, sizeof(buf), "%s", trace_kprobe_symbol(tk)); 155 if (strcmp(buf, argv[0])) 156 return false; 157 argc--; argv++; 158 159 return trace_probe_match_command_args(&tk->tp, argc, argv); 160 } 161 162 static bool trace_kprobe_match(const char *system, const char *event, 163 int argc, const char **argv, struct dyn_event *ev) 164 { 165 struct trace_kprobe *tk = to_trace_kprobe(ev); 166 167 return (event[0] == '\0' || 168 strcmp(trace_probe_name(&tk->tp), event) == 0) && 169 (!system || strcmp(trace_probe_group_name(&tk->tp), system) == 0) && 170 trace_kprobe_match_command_head(tk, argc, argv); 171 } 172 173 static nokprobe_inline unsigned long trace_kprobe_nhit(struct trace_kprobe *tk) 174 { 175 unsigned long nhit = 0; 176 int cpu; 177 178 for_each_possible_cpu(cpu) 179 nhit += *per_cpu_ptr(tk->nhit, cpu); 180 181 return nhit; 182 } 183 184 static nokprobe_inline bool trace_kprobe_is_registered(struct trace_kprobe *tk) 185 { 186 return !(list_empty(&tk->rp.kp.list) && 187 hlist_unhashed(&tk->rp.kp.hlist)); 188 } 189 190 /* Return 0 if it fails to find the symbol address */ 191 static nokprobe_inline 192 unsigned long trace_kprobe_address(struct trace_kprobe *tk) 193 { 194 unsigned long addr; 195 196 if (tk->symbol) { 197 addr = (unsigned long) 198 kallsyms_lookup_name(trace_kprobe_symbol(tk)); 199 if (addr) 200 addr += tk->rp.kp.offset; 201 } else { 202 addr = (unsigned long)tk->rp.kp.addr; 203 } 204 return addr; 205 } 206 207 static nokprobe_inline struct trace_kprobe * 208 trace_kprobe_primary_from_call(struct trace_event_call *call) 209 { 210 struct trace_probe *tp; 211 212 tp = trace_probe_primary_from_call(call); 213 if (WARN_ON_ONCE(!tp)) 214 return NULL; 215 216 return container_of(tp, struct trace_kprobe, tp); 217 } 218 219 bool trace_kprobe_on_func_entry(struct trace_event_call *call) 220 { 221 struct trace_kprobe *tk = trace_kprobe_primary_from_call(call); 222 223 return tk ? (kprobe_on_func_entry(tk->rp.kp.addr, 224 tk->rp.kp.addr ? NULL : tk->rp.kp.symbol_name, 225 tk->rp.kp.addr ? 0 : tk->rp.kp.offset) == 0) : false; 226 } 227 228 bool trace_kprobe_error_injectable(struct trace_event_call *call) 229 { 230 struct trace_kprobe *tk = trace_kprobe_primary_from_call(call); 231 232 return tk ? within_error_injection_list(trace_kprobe_address(tk)) : 233 false; 234 } 235 236 static int register_kprobe_event(struct trace_kprobe *tk); 237 static int unregister_kprobe_event(struct trace_kprobe *tk); 238 239 static int kprobe_dispatcher(struct kprobe *kp, struct pt_regs *regs); 240 static int kretprobe_dispatcher(struct kretprobe_instance *ri, 241 struct pt_regs *regs); 242 243 static void free_trace_kprobe(struct trace_kprobe *tk) 244 { 245 if (tk) { 246 trace_probe_cleanup(&tk->tp); 247 kfree(tk->symbol); 248 free_percpu(tk->nhit); 249 kfree(tk); 250 } 251 } 252 253 /* 254 * Allocate new trace_probe and initialize it (including kprobes). 255 */ 256 static struct trace_kprobe *alloc_trace_kprobe(const char *group, 257 const char *event, 258 void *addr, 259 const char *symbol, 260 unsigned long offs, 261 int maxactive, 262 int nargs, bool is_return) 263 { 264 struct trace_kprobe *tk; 265 int ret = -ENOMEM; 266 267 tk = kzalloc(struct_size(tk, tp.args, nargs), GFP_KERNEL); 268 if (!tk) 269 return ERR_PTR(ret); 270 271 tk->nhit = alloc_percpu(unsigned long); 272 if (!tk->nhit) 273 goto error; 274 275 if (symbol) { 276 tk->symbol = kstrdup(symbol, GFP_KERNEL); 277 if (!tk->symbol) 278 goto error; 279 tk->rp.kp.symbol_name = tk->symbol; 280 tk->rp.kp.offset = offs; 281 } else 282 tk->rp.kp.addr = addr; 283 284 if (is_return) 285 tk->rp.handler = kretprobe_dispatcher; 286 else 287 tk->rp.kp.pre_handler = kprobe_dispatcher; 288 289 tk->rp.maxactive = maxactive; 290 INIT_HLIST_NODE(&tk->rp.kp.hlist); 291 INIT_LIST_HEAD(&tk->rp.kp.list); 292 293 ret = trace_probe_init(&tk->tp, event, group, false); 294 if (ret < 0) 295 goto error; 296 297 dyn_event_init(&tk->devent, &trace_kprobe_ops); 298 return tk; 299 error: 300 free_trace_kprobe(tk); 301 return ERR_PTR(ret); 302 } 303 304 static struct trace_kprobe *find_trace_kprobe(const char *event, 305 const char *group) 306 { 307 struct dyn_event *pos; 308 struct trace_kprobe *tk; 309 310 for_each_trace_kprobe(tk, pos) 311 if (strcmp(trace_probe_name(&tk->tp), event) == 0 && 312 strcmp(trace_probe_group_name(&tk->tp), group) == 0) 313 return tk; 314 return NULL; 315 } 316 317 static inline int __enable_trace_kprobe(struct trace_kprobe *tk) 318 { 319 int ret = 0; 320 321 if (trace_kprobe_is_registered(tk) && !trace_kprobe_has_gone(tk)) { 322 if (trace_kprobe_is_return(tk)) 323 ret = enable_kretprobe(&tk->rp); 324 else 325 ret = enable_kprobe(&tk->rp.kp); 326 } 327 328 return ret; 329 } 330 331 static void __disable_trace_kprobe(struct trace_probe *tp) 332 { 333 struct trace_kprobe *tk; 334 335 list_for_each_entry(tk, trace_probe_probe_list(tp), tp.list) { 336 if (!trace_kprobe_is_registered(tk)) 337 continue; 338 if (trace_kprobe_is_return(tk)) 339 disable_kretprobe(&tk->rp); 340 else 341 disable_kprobe(&tk->rp.kp); 342 } 343 } 344 345 /* 346 * Enable trace_probe 347 * if the file is NULL, enable "perf" handler, or enable "trace" handler. 348 */ 349 static int enable_trace_kprobe(struct trace_event_call *call, 350 struct trace_event_file *file) 351 { 352 struct trace_probe *tp; 353 struct trace_kprobe *tk; 354 bool enabled; 355 int ret = 0; 356 357 tp = trace_probe_primary_from_call(call); 358 if (WARN_ON_ONCE(!tp)) 359 return -ENODEV; 360 enabled = trace_probe_is_enabled(tp); 361 362 /* This also changes "enabled" state */ 363 if (file) { 364 ret = trace_probe_add_file(tp, file); 365 if (ret) 366 return ret; 367 } else 368 trace_probe_set_flag(tp, TP_FLAG_PROFILE); 369 370 if (enabled) 371 return 0; 372 373 list_for_each_entry(tk, trace_probe_probe_list(tp), tp.list) { 374 if (trace_kprobe_has_gone(tk)) 375 continue; 376 ret = __enable_trace_kprobe(tk); 377 if (ret) 378 break; 379 enabled = true; 380 } 381 382 if (ret) { 383 /* Failed to enable one of them. Roll back all */ 384 if (enabled) 385 __disable_trace_kprobe(tp); 386 if (file) 387 trace_probe_remove_file(tp, file); 388 else 389 trace_probe_clear_flag(tp, TP_FLAG_PROFILE); 390 } 391 392 return ret; 393 } 394 395 /* 396 * Disable trace_probe 397 * if the file is NULL, disable "perf" handler, or disable "trace" handler. 398 */ 399 static int disable_trace_kprobe(struct trace_event_call *call, 400 struct trace_event_file *file) 401 { 402 struct trace_probe *tp; 403 404 tp = trace_probe_primary_from_call(call); 405 if (WARN_ON_ONCE(!tp)) 406 return -ENODEV; 407 408 if (file) { 409 if (!trace_probe_get_file_link(tp, file)) 410 return -ENOENT; 411 if (!trace_probe_has_single_file(tp)) 412 goto out; 413 trace_probe_clear_flag(tp, TP_FLAG_TRACE); 414 } else 415 trace_probe_clear_flag(tp, TP_FLAG_PROFILE); 416 417 if (!trace_probe_is_enabled(tp)) 418 __disable_trace_kprobe(tp); 419 420 out: 421 if (file) 422 /* 423 * Synchronization is done in below function. For perf event, 424 * file == NULL and perf_trace_event_unreg() calls 425 * tracepoint_synchronize_unregister() to ensure synchronize 426 * event. We don't need to care about it. 427 */ 428 trace_probe_remove_file(tp, file); 429 430 return 0; 431 } 432 433 #if defined(CONFIG_DYNAMIC_FTRACE) && \ 434 !defined(CONFIG_KPROBE_EVENTS_ON_NOTRACE) 435 static bool __within_notrace_func(unsigned long addr) 436 { 437 unsigned long offset, size; 438 439 if (!addr || !kallsyms_lookup_size_offset(addr, &size, &offset)) 440 return false; 441 442 /* Get the entry address of the target function */ 443 addr -= offset; 444 445 /* 446 * Since ftrace_location_range() does inclusive range check, we need 447 * to subtract 1 byte from the end address. 448 */ 449 return !ftrace_location_range(addr, addr + size - 1); 450 } 451 452 static bool within_notrace_func(struct trace_kprobe *tk) 453 { 454 unsigned long addr = trace_kprobe_address(tk); 455 char symname[KSYM_NAME_LEN], *p; 456 457 if (!__within_notrace_func(addr)) 458 return false; 459 460 /* Check if the address is on a suffixed-symbol */ 461 if (!lookup_symbol_name(addr, symname)) { 462 p = strchr(symname, '.'); 463 if (!p) 464 return true; 465 *p = '\0'; 466 addr = (unsigned long)kprobe_lookup_name(symname, 0); 467 if (addr) 468 return __within_notrace_func(addr); 469 } 470 471 return true; 472 } 473 #else 474 #define within_notrace_func(tk) (false) 475 #endif 476 477 /* Internal register function - just handle k*probes and flags */ 478 static int __register_trace_kprobe(struct trace_kprobe *tk) 479 { 480 int i, ret; 481 482 ret = security_locked_down(LOCKDOWN_KPROBES); 483 if (ret) 484 return ret; 485 486 if (trace_kprobe_is_registered(tk)) 487 return -EINVAL; 488 489 if (within_notrace_func(tk)) { 490 pr_warn("Could not probe notrace function %s\n", 491 trace_kprobe_symbol(tk)); 492 return -EINVAL; 493 } 494 495 for (i = 0; i < tk->tp.nr_args; i++) { 496 ret = traceprobe_update_arg(&tk->tp.args[i]); 497 if (ret) 498 return ret; 499 } 500 501 /* Set/clear disabled flag according to tp->flag */ 502 if (trace_probe_is_enabled(&tk->tp)) 503 tk->rp.kp.flags &= ~KPROBE_FLAG_DISABLED; 504 else 505 tk->rp.kp.flags |= KPROBE_FLAG_DISABLED; 506 507 if (trace_kprobe_is_return(tk)) 508 ret = register_kretprobe(&tk->rp); 509 else 510 ret = register_kprobe(&tk->rp.kp); 511 512 return ret; 513 } 514 515 /* Internal unregister function - just handle k*probes and flags */ 516 static void __unregister_trace_kprobe(struct trace_kprobe *tk) 517 { 518 if (trace_kprobe_is_registered(tk)) { 519 if (trace_kprobe_is_return(tk)) 520 unregister_kretprobe(&tk->rp); 521 else 522 unregister_kprobe(&tk->rp.kp); 523 /* Cleanup kprobe for reuse and mark it unregistered */ 524 INIT_HLIST_NODE(&tk->rp.kp.hlist); 525 INIT_LIST_HEAD(&tk->rp.kp.list); 526 if (tk->rp.kp.symbol_name) 527 tk->rp.kp.addr = NULL; 528 } 529 } 530 531 /* Unregister a trace_probe and probe_event */ 532 static int unregister_trace_kprobe(struct trace_kprobe *tk) 533 { 534 /* If other probes are on the event, just unregister kprobe */ 535 if (trace_probe_has_sibling(&tk->tp)) 536 goto unreg; 537 538 /* Enabled event can not be unregistered */ 539 if (trace_probe_is_enabled(&tk->tp)) 540 return -EBUSY; 541 542 /* If there's a reference to the dynamic event */ 543 if (trace_event_dyn_busy(trace_probe_event_call(&tk->tp))) 544 return -EBUSY; 545 546 /* Will fail if probe is being used by ftrace or perf */ 547 if (unregister_kprobe_event(tk)) 548 return -EBUSY; 549 550 unreg: 551 __unregister_trace_kprobe(tk); 552 dyn_event_remove(&tk->devent); 553 trace_probe_unlink(&tk->tp); 554 555 return 0; 556 } 557 558 static bool trace_kprobe_has_same_kprobe(struct trace_kprobe *orig, 559 struct trace_kprobe *comp) 560 { 561 struct trace_probe_event *tpe = orig->tp.event; 562 int i; 563 564 list_for_each_entry(orig, &tpe->probes, tp.list) { 565 if (strcmp(trace_kprobe_symbol(orig), 566 trace_kprobe_symbol(comp)) || 567 trace_kprobe_offset(orig) != trace_kprobe_offset(comp)) 568 continue; 569 570 /* 571 * trace_probe_compare_arg_type() ensured that nr_args and 572 * each argument name and type are same. Let's compare comm. 573 */ 574 for (i = 0; i < orig->tp.nr_args; i++) { 575 if (strcmp(orig->tp.args[i].comm, 576 comp->tp.args[i].comm)) 577 break; 578 } 579 580 if (i == orig->tp.nr_args) 581 return true; 582 } 583 584 return false; 585 } 586 587 static int append_trace_kprobe(struct trace_kprobe *tk, struct trace_kprobe *to) 588 { 589 int ret; 590 591 ret = trace_probe_compare_arg_type(&tk->tp, &to->tp); 592 if (ret) { 593 /* Note that argument starts index = 2 */ 594 trace_probe_log_set_index(ret + 1); 595 trace_probe_log_err(0, DIFF_ARG_TYPE); 596 return -EEXIST; 597 } 598 if (trace_kprobe_has_same_kprobe(to, tk)) { 599 trace_probe_log_set_index(0); 600 trace_probe_log_err(0, SAME_PROBE); 601 return -EEXIST; 602 } 603 604 /* Append to existing event */ 605 ret = trace_probe_append(&tk->tp, &to->tp); 606 if (ret) 607 return ret; 608 609 /* Register k*probe */ 610 ret = __register_trace_kprobe(tk); 611 if (ret == -ENOENT && !trace_kprobe_module_exist(tk)) { 612 pr_warn("This probe might be able to register after target module is loaded. Continue.\n"); 613 ret = 0; 614 } 615 616 if (ret) 617 trace_probe_unlink(&tk->tp); 618 else 619 dyn_event_add(&tk->devent, trace_probe_event_call(&tk->tp)); 620 621 return ret; 622 } 623 624 /* Register a trace_probe and probe_event */ 625 static int register_trace_kprobe(struct trace_kprobe *tk) 626 { 627 struct trace_kprobe *old_tk; 628 int ret; 629 630 mutex_lock(&event_mutex); 631 632 old_tk = find_trace_kprobe(trace_probe_name(&tk->tp), 633 trace_probe_group_name(&tk->tp)); 634 if (old_tk) { 635 if (trace_kprobe_is_return(tk) != trace_kprobe_is_return(old_tk)) { 636 trace_probe_log_set_index(0); 637 trace_probe_log_err(0, DIFF_PROBE_TYPE); 638 ret = -EEXIST; 639 } else { 640 ret = append_trace_kprobe(tk, old_tk); 641 } 642 goto end; 643 } 644 645 /* Register new event */ 646 ret = register_kprobe_event(tk); 647 if (ret) { 648 if (ret == -EEXIST) { 649 trace_probe_log_set_index(0); 650 trace_probe_log_err(0, EVENT_EXIST); 651 } else 652 pr_warn("Failed to register probe event(%d)\n", ret); 653 goto end; 654 } 655 656 /* Register k*probe */ 657 ret = __register_trace_kprobe(tk); 658 if (ret == -ENOENT && !trace_kprobe_module_exist(tk)) { 659 pr_warn("This probe might be able to register after target module is loaded. Continue.\n"); 660 ret = 0; 661 } 662 663 if (ret < 0) 664 unregister_kprobe_event(tk); 665 else 666 dyn_event_add(&tk->devent, trace_probe_event_call(&tk->tp)); 667 668 end: 669 mutex_unlock(&event_mutex); 670 return ret; 671 } 672 673 /* Module notifier call back, checking event on the module */ 674 static int trace_kprobe_module_callback(struct notifier_block *nb, 675 unsigned long val, void *data) 676 { 677 struct module *mod = data; 678 struct dyn_event *pos; 679 struct trace_kprobe *tk; 680 int ret; 681 682 if (val != MODULE_STATE_COMING) 683 return NOTIFY_DONE; 684 685 /* Update probes on coming module */ 686 mutex_lock(&event_mutex); 687 for_each_trace_kprobe(tk, pos) { 688 if (trace_kprobe_within_module(tk, mod)) { 689 /* Don't need to check busy - this should have gone. */ 690 __unregister_trace_kprobe(tk); 691 ret = __register_trace_kprobe(tk); 692 if (ret) 693 pr_warn("Failed to re-register probe %s on %s: %d\n", 694 trace_probe_name(&tk->tp), 695 module_name(mod), ret); 696 } 697 } 698 mutex_unlock(&event_mutex); 699 700 return NOTIFY_DONE; 701 } 702 703 static struct notifier_block trace_kprobe_module_nb = { 704 .notifier_call = trace_kprobe_module_callback, 705 .priority = 1 /* Invoked after kprobe module callback */ 706 }; 707 708 static int count_symbols(void *data, unsigned long unused) 709 { 710 unsigned int *count = data; 711 712 (*count)++; 713 714 return 0; 715 } 716 717 static unsigned int number_of_same_symbols(char *func_name) 718 { 719 unsigned int count; 720 721 count = 0; 722 kallsyms_on_each_match_symbol(count_symbols, func_name, &count); 723 724 return count; 725 } 726 727 static int __trace_kprobe_create(int argc, const char *argv[]) 728 { 729 /* 730 * Argument syntax: 731 * - Add kprobe: 732 * p[:[GRP/][EVENT]] [MOD:]KSYM[+OFFS]|KADDR [FETCHARGS] 733 * - Add kretprobe: 734 * r[MAXACTIVE][:[GRP/][EVENT]] [MOD:]KSYM[+0] [FETCHARGS] 735 * Or 736 * p[:[GRP/][EVENT]] [MOD:]KSYM[+0]%return [FETCHARGS] 737 * 738 * Fetch args: 739 * $retval : fetch return value 740 * $stack : fetch stack address 741 * $stackN : fetch Nth of stack (N:0-) 742 * $comm : fetch current task comm 743 * @ADDR : fetch memory at ADDR (ADDR should be in kernel) 744 * @SYM[+|-offs] : fetch memory at SYM +|- offs (SYM is a data symbol) 745 * %REG : fetch register REG 746 * Dereferencing memory fetch: 747 * +|-offs(ARG) : fetch memory at ARG +|- offs address. 748 * Alias name of args: 749 * NAME=FETCHARG : set NAME as alias of FETCHARG. 750 * Type of args: 751 * FETCHARG:TYPE : use TYPE instead of unsigned long. 752 */ 753 struct trace_kprobe *tk = NULL; 754 int i, len, new_argc = 0, ret = 0; 755 bool is_return = false; 756 char *symbol = NULL, *tmp = NULL; 757 const char **new_argv = NULL; 758 const char *event = NULL, *group = KPROBE_EVENT_SYSTEM; 759 enum probe_print_type ptype; 760 int maxactive = 0; 761 long offset = 0; 762 void *addr = NULL; 763 char buf[MAX_EVENT_NAME_LEN]; 764 char gbuf[MAX_EVENT_NAME_LEN]; 765 char abuf[MAX_BTF_ARGS_LEN]; 766 struct traceprobe_parse_context ctx = { .flags = TPARG_FL_KERNEL }; 767 768 switch (argv[0][0]) { 769 case 'r': 770 is_return = true; 771 break; 772 case 'p': 773 break; 774 default: 775 return -ECANCELED; 776 } 777 if (argc < 2) 778 return -ECANCELED; 779 780 trace_probe_log_init("trace_kprobe", argc, argv); 781 782 event = strchr(&argv[0][1], ':'); 783 if (event) 784 event++; 785 786 if (isdigit(argv[0][1])) { 787 if (!is_return) { 788 trace_probe_log_err(1, BAD_MAXACT_TYPE); 789 goto parse_error; 790 } 791 if (event) 792 len = event - &argv[0][1] - 1; 793 else 794 len = strlen(&argv[0][1]); 795 if (len > MAX_EVENT_NAME_LEN - 1) { 796 trace_probe_log_err(1, BAD_MAXACT); 797 goto parse_error; 798 } 799 memcpy(buf, &argv[0][1], len); 800 buf[len] = '\0'; 801 ret = kstrtouint(buf, 0, &maxactive); 802 if (ret || !maxactive) { 803 trace_probe_log_err(1, BAD_MAXACT); 804 goto parse_error; 805 } 806 /* kretprobes instances are iterated over via a list. The 807 * maximum should stay reasonable. 808 */ 809 if (maxactive > KRETPROBE_MAXACTIVE_MAX) { 810 trace_probe_log_err(1, MAXACT_TOO_BIG); 811 goto parse_error; 812 } 813 } 814 815 /* try to parse an address. if that fails, try to read the 816 * input as a symbol. */ 817 if (kstrtoul(argv[1], 0, (unsigned long *)&addr)) { 818 trace_probe_log_set_index(1); 819 /* Check whether uprobe event specified */ 820 if (strchr(argv[1], '/') && strchr(argv[1], ':')) { 821 ret = -ECANCELED; 822 goto error; 823 } 824 /* a symbol specified */ 825 symbol = kstrdup(argv[1], GFP_KERNEL); 826 if (!symbol) 827 return -ENOMEM; 828 829 tmp = strchr(symbol, '%'); 830 if (tmp) { 831 if (!strcmp(tmp, "%return")) { 832 *tmp = '\0'; 833 is_return = true; 834 } else { 835 trace_probe_log_err(tmp - symbol, BAD_ADDR_SUFFIX); 836 goto parse_error; 837 } 838 } 839 840 /* TODO: support .init module functions */ 841 ret = traceprobe_split_symbol_offset(symbol, &offset); 842 if (ret || offset < 0 || offset > UINT_MAX) { 843 trace_probe_log_err(0, BAD_PROBE_ADDR); 844 goto parse_error; 845 } 846 if (is_return) 847 ctx.flags |= TPARG_FL_RETURN; 848 ret = kprobe_on_func_entry(NULL, symbol, offset); 849 if (ret == 0 && !is_return) 850 ctx.flags |= TPARG_FL_FENTRY; 851 /* Defer the ENOENT case until register kprobe */ 852 if (ret == -EINVAL && is_return) { 853 trace_probe_log_err(0, BAD_RETPROBE); 854 goto parse_error; 855 } 856 } 857 858 if (symbol && !strchr(symbol, ':')) { 859 unsigned int count; 860 861 count = number_of_same_symbols(symbol); 862 if (count > 1) { 863 /* 864 * Users should use ADDR to remove the ambiguity of 865 * using KSYM only. 866 */ 867 trace_probe_log_err(0, NON_UNIQ_SYMBOL); 868 ret = -EADDRNOTAVAIL; 869 870 goto error; 871 } else if (count == 0) { 872 /* 873 * We can return ENOENT earlier than when register the 874 * kprobe. 875 */ 876 trace_probe_log_err(0, BAD_PROBE_ADDR); 877 ret = -ENOENT; 878 879 goto error; 880 } 881 } 882 883 trace_probe_log_set_index(0); 884 if (event) { 885 ret = traceprobe_parse_event_name(&event, &group, gbuf, 886 event - argv[0]); 887 if (ret) 888 goto parse_error; 889 } 890 891 if (!event) { 892 /* Make a new event name */ 893 if (symbol) 894 snprintf(buf, MAX_EVENT_NAME_LEN, "%c_%s_%ld", 895 is_return ? 'r' : 'p', symbol, offset); 896 else 897 snprintf(buf, MAX_EVENT_NAME_LEN, "%c_0x%p", 898 is_return ? 'r' : 'p', addr); 899 sanitize_event_name(buf); 900 event = buf; 901 } 902 903 argc -= 2; argv += 2; 904 ctx.funcname = symbol; 905 new_argv = traceprobe_expand_meta_args(argc, argv, &new_argc, 906 abuf, MAX_BTF_ARGS_LEN, &ctx); 907 if (IS_ERR(new_argv)) { 908 ret = PTR_ERR(new_argv); 909 new_argv = NULL; 910 goto out; 911 } 912 if (new_argv) { 913 argc = new_argc; 914 argv = new_argv; 915 } 916 917 /* setup a probe */ 918 tk = alloc_trace_kprobe(group, event, addr, symbol, offset, maxactive, 919 argc, is_return); 920 if (IS_ERR(tk)) { 921 ret = PTR_ERR(tk); 922 /* This must return -ENOMEM, else there is a bug */ 923 WARN_ON_ONCE(ret != -ENOMEM); 924 goto out; /* We know tk is not allocated */ 925 } 926 927 /* parse arguments */ 928 for (i = 0; i < argc && i < MAX_TRACE_ARGS; i++) { 929 trace_probe_log_set_index(i + 2); 930 ctx.offset = 0; 931 ret = traceprobe_parse_probe_arg(&tk->tp, i, argv[i], &ctx); 932 if (ret) 933 goto error; /* This can be -ENOMEM */ 934 } 935 936 ptype = is_return ? PROBE_PRINT_RETURN : PROBE_PRINT_NORMAL; 937 ret = traceprobe_set_print_fmt(&tk->tp, ptype); 938 if (ret < 0) 939 goto error; 940 941 ret = register_trace_kprobe(tk); 942 if (ret) { 943 trace_probe_log_set_index(1); 944 if (ret == -EILSEQ) 945 trace_probe_log_err(0, BAD_INSN_BNDRY); 946 else if (ret == -ENOENT) 947 trace_probe_log_err(0, BAD_PROBE_ADDR); 948 else if (ret != -ENOMEM && ret != -EEXIST) 949 trace_probe_log_err(0, FAIL_REG_PROBE); 950 goto error; 951 } 952 953 out: 954 traceprobe_finish_parse(&ctx); 955 trace_probe_log_clear(); 956 kfree(new_argv); 957 kfree(symbol); 958 return ret; 959 960 parse_error: 961 ret = -EINVAL; 962 error: 963 free_trace_kprobe(tk); 964 goto out; 965 } 966 967 static int trace_kprobe_create(const char *raw_command) 968 { 969 return trace_probe_create(raw_command, __trace_kprobe_create); 970 } 971 972 static int create_or_delete_trace_kprobe(const char *raw_command) 973 { 974 int ret; 975 976 if (raw_command[0] == '-') 977 return dyn_event_release(raw_command, &trace_kprobe_ops); 978 979 ret = trace_kprobe_create(raw_command); 980 return ret == -ECANCELED ? -EINVAL : ret; 981 } 982 983 static int trace_kprobe_run_command(struct dynevent_cmd *cmd) 984 { 985 return create_or_delete_trace_kprobe(cmd->seq.buffer); 986 } 987 988 /** 989 * kprobe_event_cmd_init - Initialize a kprobe event command object 990 * @cmd: A pointer to the dynevent_cmd struct representing the new event 991 * @buf: A pointer to the buffer used to build the command 992 * @maxlen: The length of the buffer passed in @buf 993 * 994 * Initialize a synthetic event command object. Use this before 995 * calling any of the other kprobe_event functions. 996 */ 997 void kprobe_event_cmd_init(struct dynevent_cmd *cmd, char *buf, int maxlen) 998 { 999 dynevent_cmd_init(cmd, buf, maxlen, DYNEVENT_TYPE_KPROBE, 1000 trace_kprobe_run_command); 1001 } 1002 EXPORT_SYMBOL_GPL(kprobe_event_cmd_init); 1003 1004 /** 1005 * __kprobe_event_gen_cmd_start - Generate a kprobe event command from arg list 1006 * @cmd: A pointer to the dynevent_cmd struct representing the new event 1007 * @name: The name of the kprobe event 1008 * @loc: The location of the kprobe event 1009 * @kretprobe: Is this a return probe? 1010 * @args: Variable number of arg (pairs), one pair for each field 1011 * 1012 * NOTE: Users normally won't want to call this function directly, but 1013 * rather use the kprobe_event_gen_cmd_start() wrapper, which automatically 1014 * adds a NULL to the end of the arg list. If this function is used 1015 * directly, make sure the last arg in the variable arg list is NULL. 1016 * 1017 * Generate a kprobe event command to be executed by 1018 * kprobe_event_gen_cmd_end(). This function can be used to generate the 1019 * complete command or only the first part of it; in the latter case, 1020 * kprobe_event_add_fields() can be used to add more fields following this. 1021 * 1022 * Unlikely the synth_event_gen_cmd_start(), @loc must be specified. This 1023 * returns -EINVAL if @loc == NULL. 1024 * 1025 * Return: 0 if successful, error otherwise. 1026 */ 1027 int __kprobe_event_gen_cmd_start(struct dynevent_cmd *cmd, bool kretprobe, 1028 const char *name, const char *loc, ...) 1029 { 1030 char buf[MAX_EVENT_NAME_LEN]; 1031 struct dynevent_arg arg; 1032 va_list args; 1033 int ret; 1034 1035 if (cmd->type != DYNEVENT_TYPE_KPROBE) 1036 return -EINVAL; 1037 1038 if (!loc) 1039 return -EINVAL; 1040 1041 if (kretprobe) 1042 snprintf(buf, MAX_EVENT_NAME_LEN, "r:kprobes/%s", name); 1043 else 1044 snprintf(buf, MAX_EVENT_NAME_LEN, "p:kprobes/%s", name); 1045 1046 ret = dynevent_str_add(cmd, buf); 1047 if (ret) 1048 return ret; 1049 1050 dynevent_arg_init(&arg, 0); 1051 arg.str = loc; 1052 ret = dynevent_arg_add(cmd, &arg, NULL); 1053 if (ret) 1054 return ret; 1055 1056 va_start(args, loc); 1057 for (;;) { 1058 const char *field; 1059 1060 field = va_arg(args, const char *); 1061 if (!field) 1062 break; 1063 1064 if (++cmd->n_fields > MAX_TRACE_ARGS) { 1065 ret = -EINVAL; 1066 break; 1067 } 1068 1069 arg.str = field; 1070 ret = dynevent_arg_add(cmd, &arg, NULL); 1071 if (ret) 1072 break; 1073 } 1074 va_end(args); 1075 1076 return ret; 1077 } 1078 EXPORT_SYMBOL_GPL(__kprobe_event_gen_cmd_start); 1079 1080 /** 1081 * __kprobe_event_add_fields - Add probe fields to a kprobe command from arg list 1082 * @cmd: A pointer to the dynevent_cmd struct representing the new event 1083 * @args: Variable number of arg (pairs), one pair for each field 1084 * 1085 * NOTE: Users normally won't want to call this function directly, but 1086 * rather use the kprobe_event_add_fields() wrapper, which 1087 * automatically adds a NULL to the end of the arg list. If this 1088 * function is used directly, make sure the last arg in the variable 1089 * arg list is NULL. 1090 * 1091 * Add probe fields to an existing kprobe command using a variable 1092 * list of args. Fields are added in the same order they're listed. 1093 * 1094 * Return: 0 if successful, error otherwise. 1095 */ 1096 int __kprobe_event_add_fields(struct dynevent_cmd *cmd, ...) 1097 { 1098 struct dynevent_arg arg; 1099 va_list args; 1100 int ret = 0; 1101 1102 if (cmd->type != DYNEVENT_TYPE_KPROBE) 1103 return -EINVAL; 1104 1105 dynevent_arg_init(&arg, 0); 1106 1107 va_start(args, cmd); 1108 for (;;) { 1109 const char *field; 1110 1111 field = va_arg(args, const char *); 1112 if (!field) 1113 break; 1114 1115 if (++cmd->n_fields > MAX_TRACE_ARGS) { 1116 ret = -EINVAL; 1117 break; 1118 } 1119 1120 arg.str = field; 1121 ret = dynevent_arg_add(cmd, &arg, NULL); 1122 if (ret) 1123 break; 1124 } 1125 va_end(args); 1126 1127 return ret; 1128 } 1129 EXPORT_SYMBOL_GPL(__kprobe_event_add_fields); 1130 1131 /** 1132 * kprobe_event_delete - Delete a kprobe event 1133 * @name: The name of the kprobe event to delete 1134 * 1135 * Delete a kprobe event with the give @name from kernel code rather 1136 * than directly from the command line. 1137 * 1138 * Return: 0 if successful, error otherwise. 1139 */ 1140 int kprobe_event_delete(const char *name) 1141 { 1142 char buf[MAX_EVENT_NAME_LEN]; 1143 1144 snprintf(buf, MAX_EVENT_NAME_LEN, "-:%s", name); 1145 1146 return create_or_delete_trace_kprobe(buf); 1147 } 1148 EXPORT_SYMBOL_GPL(kprobe_event_delete); 1149 1150 static int trace_kprobe_release(struct dyn_event *ev) 1151 { 1152 struct trace_kprobe *tk = to_trace_kprobe(ev); 1153 int ret = unregister_trace_kprobe(tk); 1154 1155 if (!ret) 1156 free_trace_kprobe(tk); 1157 return ret; 1158 } 1159 1160 static int trace_kprobe_show(struct seq_file *m, struct dyn_event *ev) 1161 { 1162 struct trace_kprobe *tk = to_trace_kprobe(ev); 1163 int i; 1164 1165 seq_putc(m, trace_kprobe_is_return(tk) ? 'r' : 'p'); 1166 if (trace_kprobe_is_return(tk) && tk->rp.maxactive) 1167 seq_printf(m, "%d", tk->rp.maxactive); 1168 seq_printf(m, ":%s/%s", trace_probe_group_name(&tk->tp), 1169 trace_probe_name(&tk->tp)); 1170 1171 if (!tk->symbol) 1172 seq_printf(m, " 0x%p", tk->rp.kp.addr); 1173 else if (tk->rp.kp.offset) 1174 seq_printf(m, " %s+%u", trace_kprobe_symbol(tk), 1175 tk->rp.kp.offset); 1176 else 1177 seq_printf(m, " %s", trace_kprobe_symbol(tk)); 1178 1179 for (i = 0; i < tk->tp.nr_args; i++) 1180 seq_printf(m, " %s=%s", tk->tp.args[i].name, tk->tp.args[i].comm); 1181 seq_putc(m, '\n'); 1182 1183 return 0; 1184 } 1185 1186 static int probes_seq_show(struct seq_file *m, void *v) 1187 { 1188 struct dyn_event *ev = v; 1189 1190 if (!is_trace_kprobe(ev)) 1191 return 0; 1192 1193 return trace_kprobe_show(m, ev); 1194 } 1195 1196 static const struct seq_operations probes_seq_op = { 1197 .start = dyn_event_seq_start, 1198 .next = dyn_event_seq_next, 1199 .stop = dyn_event_seq_stop, 1200 .show = probes_seq_show 1201 }; 1202 1203 static int probes_open(struct inode *inode, struct file *file) 1204 { 1205 int ret; 1206 1207 ret = security_locked_down(LOCKDOWN_TRACEFS); 1208 if (ret) 1209 return ret; 1210 1211 if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC)) { 1212 ret = dyn_events_release_all(&trace_kprobe_ops); 1213 if (ret < 0) 1214 return ret; 1215 } 1216 1217 return seq_open(file, &probes_seq_op); 1218 } 1219 1220 static ssize_t probes_write(struct file *file, const char __user *buffer, 1221 size_t count, loff_t *ppos) 1222 { 1223 return trace_parse_run_command(file, buffer, count, ppos, 1224 create_or_delete_trace_kprobe); 1225 } 1226 1227 static const struct file_operations kprobe_events_ops = { 1228 .owner = THIS_MODULE, 1229 .open = probes_open, 1230 .read = seq_read, 1231 .llseek = seq_lseek, 1232 .release = seq_release, 1233 .write = probes_write, 1234 }; 1235 1236 /* Probes profiling interfaces */ 1237 static int probes_profile_seq_show(struct seq_file *m, void *v) 1238 { 1239 struct dyn_event *ev = v; 1240 struct trace_kprobe *tk; 1241 unsigned long nmissed; 1242 1243 if (!is_trace_kprobe(ev)) 1244 return 0; 1245 1246 tk = to_trace_kprobe(ev); 1247 nmissed = trace_kprobe_is_return(tk) ? 1248 tk->rp.kp.nmissed + tk->rp.nmissed : tk->rp.kp.nmissed; 1249 seq_printf(m, " %-44s %15lu %15lu\n", 1250 trace_probe_name(&tk->tp), 1251 trace_kprobe_nhit(tk), 1252 nmissed); 1253 1254 return 0; 1255 } 1256 1257 static const struct seq_operations profile_seq_op = { 1258 .start = dyn_event_seq_start, 1259 .next = dyn_event_seq_next, 1260 .stop = dyn_event_seq_stop, 1261 .show = probes_profile_seq_show 1262 }; 1263 1264 static int profile_open(struct inode *inode, struct file *file) 1265 { 1266 int ret; 1267 1268 ret = security_locked_down(LOCKDOWN_TRACEFS); 1269 if (ret) 1270 return ret; 1271 1272 return seq_open(file, &profile_seq_op); 1273 } 1274 1275 static const struct file_operations kprobe_profile_ops = { 1276 .owner = THIS_MODULE, 1277 .open = profile_open, 1278 .read = seq_read, 1279 .llseek = seq_lseek, 1280 .release = seq_release, 1281 }; 1282 1283 /* Note that we don't verify it, since the code does not come from user space */ 1284 static int 1285 process_fetch_insn(struct fetch_insn *code, void *rec, void *dest, 1286 void *base) 1287 { 1288 struct pt_regs *regs = rec; 1289 unsigned long val; 1290 int ret; 1291 1292 retry: 1293 /* 1st stage: get value from context */ 1294 switch (code->op) { 1295 case FETCH_OP_REG: 1296 val = regs_get_register(regs, code->param); 1297 break; 1298 case FETCH_OP_STACK: 1299 val = regs_get_kernel_stack_nth(regs, code->param); 1300 break; 1301 case FETCH_OP_STACKP: 1302 val = kernel_stack_pointer(regs); 1303 break; 1304 case FETCH_OP_RETVAL: 1305 val = regs_return_value(regs); 1306 break; 1307 #ifdef CONFIG_HAVE_FUNCTION_ARG_ACCESS_API 1308 case FETCH_OP_ARG: 1309 val = regs_get_kernel_argument(regs, code->param); 1310 break; 1311 #endif 1312 case FETCH_NOP_SYMBOL: /* Ignore a place holder */ 1313 code++; 1314 goto retry; 1315 default: 1316 ret = process_common_fetch_insn(code, &val); 1317 if (ret < 0) 1318 return ret; 1319 } 1320 code++; 1321 1322 return process_fetch_insn_bottom(code, val, dest, base); 1323 } 1324 NOKPROBE_SYMBOL(process_fetch_insn) 1325 1326 /* Kprobe handler */ 1327 static nokprobe_inline void 1328 __kprobe_trace_func(struct trace_kprobe *tk, struct pt_regs *regs, 1329 struct trace_event_file *trace_file) 1330 { 1331 struct kprobe_trace_entry_head *entry; 1332 struct trace_event_call *call = trace_probe_event_call(&tk->tp); 1333 struct trace_event_buffer fbuffer; 1334 int dsize; 1335 1336 WARN_ON(call != trace_file->event_call); 1337 1338 if (trace_trigger_soft_disabled(trace_file)) 1339 return; 1340 1341 dsize = __get_data_size(&tk->tp, regs); 1342 1343 entry = trace_event_buffer_reserve(&fbuffer, trace_file, 1344 sizeof(*entry) + tk->tp.size + dsize); 1345 if (!entry) 1346 return; 1347 1348 fbuffer.regs = regs; 1349 entry->ip = (unsigned long)tk->rp.kp.addr; 1350 store_trace_args(&entry[1], &tk->tp, regs, sizeof(*entry), dsize); 1351 1352 trace_event_buffer_commit(&fbuffer); 1353 } 1354 1355 static void 1356 kprobe_trace_func(struct trace_kprobe *tk, struct pt_regs *regs) 1357 { 1358 struct event_file_link *link; 1359 1360 trace_probe_for_each_link_rcu(link, &tk->tp) 1361 __kprobe_trace_func(tk, regs, link->file); 1362 } 1363 NOKPROBE_SYMBOL(kprobe_trace_func); 1364 1365 /* Kretprobe handler */ 1366 static nokprobe_inline void 1367 __kretprobe_trace_func(struct trace_kprobe *tk, struct kretprobe_instance *ri, 1368 struct pt_regs *regs, 1369 struct trace_event_file *trace_file) 1370 { 1371 struct kretprobe_trace_entry_head *entry; 1372 struct trace_event_buffer fbuffer; 1373 struct trace_event_call *call = trace_probe_event_call(&tk->tp); 1374 int dsize; 1375 1376 WARN_ON(call != trace_file->event_call); 1377 1378 if (trace_trigger_soft_disabled(trace_file)) 1379 return; 1380 1381 dsize = __get_data_size(&tk->tp, regs); 1382 1383 entry = trace_event_buffer_reserve(&fbuffer, trace_file, 1384 sizeof(*entry) + tk->tp.size + dsize); 1385 if (!entry) 1386 return; 1387 1388 fbuffer.regs = regs; 1389 entry->func = (unsigned long)tk->rp.kp.addr; 1390 entry->ret_ip = get_kretprobe_retaddr(ri); 1391 store_trace_args(&entry[1], &tk->tp, regs, sizeof(*entry), dsize); 1392 1393 trace_event_buffer_commit(&fbuffer); 1394 } 1395 1396 static void 1397 kretprobe_trace_func(struct trace_kprobe *tk, struct kretprobe_instance *ri, 1398 struct pt_regs *regs) 1399 { 1400 struct event_file_link *link; 1401 1402 trace_probe_for_each_link_rcu(link, &tk->tp) 1403 __kretprobe_trace_func(tk, ri, regs, link->file); 1404 } 1405 NOKPROBE_SYMBOL(kretprobe_trace_func); 1406 1407 /* Event entry printers */ 1408 static enum print_line_t 1409 print_kprobe_event(struct trace_iterator *iter, int flags, 1410 struct trace_event *event) 1411 { 1412 struct kprobe_trace_entry_head *field; 1413 struct trace_seq *s = &iter->seq; 1414 struct trace_probe *tp; 1415 1416 field = (struct kprobe_trace_entry_head *)iter->ent; 1417 tp = trace_probe_primary_from_call( 1418 container_of(event, struct trace_event_call, event)); 1419 if (WARN_ON_ONCE(!tp)) 1420 goto out; 1421 1422 trace_seq_printf(s, "%s: (", trace_probe_name(tp)); 1423 1424 if (!seq_print_ip_sym(s, field->ip, flags | TRACE_ITER_SYM_OFFSET)) 1425 goto out; 1426 1427 trace_seq_putc(s, ')'); 1428 1429 if (trace_probe_print_args(s, tp->args, tp->nr_args, 1430 (u8 *)&field[1], field) < 0) 1431 goto out; 1432 1433 trace_seq_putc(s, '\n'); 1434 out: 1435 return trace_handle_return(s); 1436 } 1437 1438 static enum print_line_t 1439 print_kretprobe_event(struct trace_iterator *iter, int flags, 1440 struct trace_event *event) 1441 { 1442 struct kretprobe_trace_entry_head *field; 1443 struct trace_seq *s = &iter->seq; 1444 struct trace_probe *tp; 1445 1446 field = (struct kretprobe_trace_entry_head *)iter->ent; 1447 tp = trace_probe_primary_from_call( 1448 container_of(event, struct trace_event_call, event)); 1449 if (WARN_ON_ONCE(!tp)) 1450 goto out; 1451 1452 trace_seq_printf(s, "%s: (", trace_probe_name(tp)); 1453 1454 if (!seq_print_ip_sym(s, field->ret_ip, flags | TRACE_ITER_SYM_OFFSET)) 1455 goto out; 1456 1457 trace_seq_puts(s, " <- "); 1458 1459 if (!seq_print_ip_sym(s, field->func, flags & ~TRACE_ITER_SYM_OFFSET)) 1460 goto out; 1461 1462 trace_seq_putc(s, ')'); 1463 1464 if (trace_probe_print_args(s, tp->args, tp->nr_args, 1465 (u8 *)&field[1], field) < 0) 1466 goto out; 1467 1468 trace_seq_putc(s, '\n'); 1469 1470 out: 1471 return trace_handle_return(s); 1472 } 1473 1474 1475 static int kprobe_event_define_fields(struct trace_event_call *event_call) 1476 { 1477 int ret; 1478 struct kprobe_trace_entry_head field; 1479 struct trace_probe *tp; 1480 1481 tp = trace_probe_primary_from_call(event_call); 1482 if (WARN_ON_ONCE(!tp)) 1483 return -ENOENT; 1484 1485 DEFINE_FIELD(unsigned long, ip, FIELD_STRING_IP, 0); 1486 1487 return traceprobe_define_arg_fields(event_call, sizeof(field), tp); 1488 } 1489 1490 static int kretprobe_event_define_fields(struct trace_event_call *event_call) 1491 { 1492 int ret; 1493 struct kretprobe_trace_entry_head field; 1494 struct trace_probe *tp; 1495 1496 tp = trace_probe_primary_from_call(event_call); 1497 if (WARN_ON_ONCE(!tp)) 1498 return -ENOENT; 1499 1500 DEFINE_FIELD(unsigned long, func, FIELD_STRING_FUNC, 0); 1501 DEFINE_FIELD(unsigned long, ret_ip, FIELD_STRING_RETIP, 0); 1502 1503 return traceprobe_define_arg_fields(event_call, sizeof(field), tp); 1504 } 1505 1506 #ifdef CONFIG_PERF_EVENTS 1507 1508 /* Kprobe profile handler */ 1509 static int 1510 kprobe_perf_func(struct trace_kprobe *tk, struct pt_regs *regs) 1511 { 1512 struct trace_event_call *call = trace_probe_event_call(&tk->tp); 1513 struct kprobe_trace_entry_head *entry; 1514 struct hlist_head *head; 1515 int size, __size, dsize; 1516 int rctx; 1517 1518 if (bpf_prog_array_valid(call)) { 1519 unsigned long orig_ip = instruction_pointer(regs); 1520 int ret; 1521 1522 ret = trace_call_bpf(call, regs); 1523 1524 /* 1525 * We need to check and see if we modified the pc of the 1526 * pt_regs, and if so return 1 so that we don't do the 1527 * single stepping. 1528 */ 1529 if (orig_ip != instruction_pointer(regs)) 1530 return 1; 1531 if (!ret) 1532 return 0; 1533 } 1534 1535 head = this_cpu_ptr(call->perf_events); 1536 if (hlist_empty(head)) 1537 return 0; 1538 1539 dsize = __get_data_size(&tk->tp, regs); 1540 __size = sizeof(*entry) + tk->tp.size + dsize; 1541 size = ALIGN(__size + sizeof(u32), sizeof(u64)); 1542 size -= sizeof(u32); 1543 1544 entry = perf_trace_buf_alloc(size, NULL, &rctx); 1545 if (!entry) 1546 return 0; 1547 1548 entry->ip = (unsigned long)tk->rp.kp.addr; 1549 memset(&entry[1], 0, dsize); 1550 store_trace_args(&entry[1], &tk->tp, regs, sizeof(*entry), dsize); 1551 perf_trace_buf_submit(entry, size, rctx, call->event.type, 1, regs, 1552 head, NULL); 1553 return 0; 1554 } 1555 NOKPROBE_SYMBOL(kprobe_perf_func); 1556 1557 /* Kretprobe profile handler */ 1558 static void 1559 kretprobe_perf_func(struct trace_kprobe *tk, struct kretprobe_instance *ri, 1560 struct pt_regs *regs) 1561 { 1562 struct trace_event_call *call = trace_probe_event_call(&tk->tp); 1563 struct kretprobe_trace_entry_head *entry; 1564 struct hlist_head *head; 1565 int size, __size, dsize; 1566 int rctx; 1567 1568 if (bpf_prog_array_valid(call) && !trace_call_bpf(call, regs)) 1569 return; 1570 1571 head = this_cpu_ptr(call->perf_events); 1572 if (hlist_empty(head)) 1573 return; 1574 1575 dsize = __get_data_size(&tk->tp, regs); 1576 __size = sizeof(*entry) + tk->tp.size + dsize; 1577 size = ALIGN(__size + sizeof(u32), sizeof(u64)); 1578 size -= sizeof(u32); 1579 1580 entry = perf_trace_buf_alloc(size, NULL, &rctx); 1581 if (!entry) 1582 return; 1583 1584 entry->func = (unsigned long)tk->rp.kp.addr; 1585 entry->ret_ip = get_kretprobe_retaddr(ri); 1586 store_trace_args(&entry[1], &tk->tp, regs, sizeof(*entry), dsize); 1587 perf_trace_buf_submit(entry, size, rctx, call->event.type, 1, regs, 1588 head, NULL); 1589 } 1590 NOKPROBE_SYMBOL(kretprobe_perf_func); 1591 1592 int bpf_get_kprobe_info(const struct perf_event *event, u32 *fd_type, 1593 const char **symbol, u64 *probe_offset, 1594 u64 *probe_addr, bool perf_type_tracepoint) 1595 { 1596 const char *pevent = trace_event_name(event->tp_event); 1597 const char *group = event->tp_event->class->system; 1598 struct trace_kprobe *tk; 1599 1600 if (perf_type_tracepoint) 1601 tk = find_trace_kprobe(pevent, group); 1602 else 1603 tk = trace_kprobe_primary_from_call(event->tp_event); 1604 if (!tk) 1605 return -EINVAL; 1606 1607 *fd_type = trace_kprobe_is_return(tk) ? BPF_FD_TYPE_KRETPROBE 1608 : BPF_FD_TYPE_KPROBE; 1609 *probe_offset = tk->rp.kp.offset; 1610 *probe_addr = kallsyms_show_value(current_cred()) ? 1611 (unsigned long)tk->rp.kp.addr : 0; 1612 *symbol = tk->symbol; 1613 return 0; 1614 } 1615 #endif /* CONFIG_PERF_EVENTS */ 1616 1617 /* 1618 * called by perf_trace_init() or __ftrace_set_clr_event() under event_mutex. 1619 * 1620 * kprobe_trace_self_tests_init() does enable_trace_probe/disable_trace_probe 1621 * lockless, but we can't race with this __init function. 1622 */ 1623 static int kprobe_register(struct trace_event_call *event, 1624 enum trace_reg type, void *data) 1625 { 1626 struct trace_event_file *file = data; 1627 1628 switch (type) { 1629 case TRACE_REG_REGISTER: 1630 return enable_trace_kprobe(event, file); 1631 case TRACE_REG_UNREGISTER: 1632 return disable_trace_kprobe(event, file); 1633 1634 #ifdef CONFIG_PERF_EVENTS 1635 case TRACE_REG_PERF_REGISTER: 1636 return enable_trace_kprobe(event, NULL); 1637 case TRACE_REG_PERF_UNREGISTER: 1638 return disable_trace_kprobe(event, NULL); 1639 case TRACE_REG_PERF_OPEN: 1640 case TRACE_REG_PERF_CLOSE: 1641 case TRACE_REG_PERF_ADD: 1642 case TRACE_REG_PERF_DEL: 1643 return 0; 1644 #endif 1645 } 1646 return 0; 1647 } 1648 1649 static int kprobe_dispatcher(struct kprobe *kp, struct pt_regs *regs) 1650 { 1651 struct trace_kprobe *tk = container_of(kp, struct trace_kprobe, rp.kp); 1652 int ret = 0; 1653 1654 raw_cpu_inc(*tk->nhit); 1655 1656 if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE)) 1657 kprobe_trace_func(tk, regs); 1658 #ifdef CONFIG_PERF_EVENTS 1659 if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE)) 1660 ret = kprobe_perf_func(tk, regs); 1661 #endif 1662 return ret; 1663 } 1664 NOKPROBE_SYMBOL(kprobe_dispatcher); 1665 1666 static int 1667 kretprobe_dispatcher(struct kretprobe_instance *ri, struct pt_regs *regs) 1668 { 1669 struct kretprobe *rp = get_kretprobe(ri); 1670 struct trace_kprobe *tk; 1671 1672 /* 1673 * There is a small chance that get_kretprobe(ri) returns NULL when 1674 * the kretprobe is unregister on another CPU between kretprobe's 1675 * trampoline_handler and this function. 1676 */ 1677 if (unlikely(!rp)) 1678 return 0; 1679 1680 tk = container_of(rp, struct trace_kprobe, rp); 1681 raw_cpu_inc(*tk->nhit); 1682 1683 if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE)) 1684 kretprobe_trace_func(tk, ri, regs); 1685 #ifdef CONFIG_PERF_EVENTS 1686 if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE)) 1687 kretprobe_perf_func(tk, ri, regs); 1688 #endif 1689 return 0; /* We don't tweak kernel, so just return 0 */ 1690 } 1691 NOKPROBE_SYMBOL(kretprobe_dispatcher); 1692 1693 static struct trace_event_functions kretprobe_funcs = { 1694 .trace = print_kretprobe_event 1695 }; 1696 1697 static struct trace_event_functions kprobe_funcs = { 1698 .trace = print_kprobe_event 1699 }; 1700 1701 static struct trace_event_fields kretprobe_fields_array[] = { 1702 { .type = TRACE_FUNCTION_TYPE, 1703 .define_fields = kretprobe_event_define_fields }, 1704 {} 1705 }; 1706 1707 static struct trace_event_fields kprobe_fields_array[] = { 1708 { .type = TRACE_FUNCTION_TYPE, 1709 .define_fields = kprobe_event_define_fields }, 1710 {} 1711 }; 1712 1713 static inline void init_trace_event_call(struct trace_kprobe *tk) 1714 { 1715 struct trace_event_call *call = trace_probe_event_call(&tk->tp); 1716 1717 if (trace_kprobe_is_return(tk)) { 1718 call->event.funcs = &kretprobe_funcs; 1719 call->class->fields_array = kretprobe_fields_array; 1720 } else { 1721 call->event.funcs = &kprobe_funcs; 1722 call->class->fields_array = kprobe_fields_array; 1723 } 1724 1725 call->flags = TRACE_EVENT_FL_KPROBE; 1726 call->class->reg = kprobe_register; 1727 } 1728 1729 static int register_kprobe_event(struct trace_kprobe *tk) 1730 { 1731 init_trace_event_call(tk); 1732 1733 return trace_probe_register_event_call(&tk->tp); 1734 } 1735 1736 static int unregister_kprobe_event(struct trace_kprobe *tk) 1737 { 1738 return trace_probe_unregister_event_call(&tk->tp); 1739 } 1740 1741 #ifdef CONFIG_PERF_EVENTS 1742 1743 /* create a trace_kprobe, but don't add it to global lists */ 1744 struct trace_event_call * 1745 create_local_trace_kprobe(char *func, void *addr, unsigned long offs, 1746 bool is_return) 1747 { 1748 enum probe_print_type ptype; 1749 struct trace_kprobe *tk; 1750 int ret; 1751 char *event; 1752 1753 if (func) { 1754 unsigned int count; 1755 1756 count = number_of_same_symbols(func); 1757 if (count > 1) 1758 /* 1759 * Users should use addr to remove the ambiguity of 1760 * using func only. 1761 */ 1762 return ERR_PTR(-EADDRNOTAVAIL); 1763 else if (count == 0) 1764 /* 1765 * We can return ENOENT earlier than when register the 1766 * kprobe. 1767 */ 1768 return ERR_PTR(-ENOENT); 1769 } 1770 1771 /* 1772 * local trace_kprobes are not added to dyn_event, so they are never 1773 * searched in find_trace_kprobe(). Therefore, there is no concern of 1774 * duplicated name here. 1775 */ 1776 event = func ? func : "DUMMY_EVENT"; 1777 1778 tk = alloc_trace_kprobe(KPROBE_EVENT_SYSTEM, event, (void *)addr, func, 1779 offs, 0 /* maxactive */, 0 /* nargs */, 1780 is_return); 1781 1782 if (IS_ERR(tk)) { 1783 pr_info("Failed to allocate trace_probe.(%d)\n", 1784 (int)PTR_ERR(tk)); 1785 return ERR_CAST(tk); 1786 } 1787 1788 init_trace_event_call(tk); 1789 1790 ptype = trace_kprobe_is_return(tk) ? 1791 PROBE_PRINT_RETURN : PROBE_PRINT_NORMAL; 1792 if (traceprobe_set_print_fmt(&tk->tp, ptype) < 0) { 1793 ret = -ENOMEM; 1794 goto error; 1795 } 1796 1797 ret = __register_trace_kprobe(tk); 1798 if (ret < 0) 1799 goto error; 1800 1801 return trace_probe_event_call(&tk->tp); 1802 error: 1803 free_trace_kprobe(tk); 1804 return ERR_PTR(ret); 1805 } 1806 1807 void destroy_local_trace_kprobe(struct trace_event_call *event_call) 1808 { 1809 struct trace_kprobe *tk; 1810 1811 tk = trace_kprobe_primary_from_call(event_call); 1812 if (unlikely(!tk)) 1813 return; 1814 1815 if (trace_probe_is_enabled(&tk->tp)) { 1816 WARN_ON(1); 1817 return; 1818 } 1819 1820 __unregister_trace_kprobe(tk); 1821 1822 free_trace_kprobe(tk); 1823 } 1824 #endif /* CONFIG_PERF_EVENTS */ 1825 1826 static __init void enable_boot_kprobe_events(void) 1827 { 1828 struct trace_array *tr = top_trace_array(); 1829 struct trace_event_file *file; 1830 struct trace_kprobe *tk; 1831 struct dyn_event *pos; 1832 1833 mutex_lock(&event_mutex); 1834 for_each_trace_kprobe(tk, pos) { 1835 list_for_each_entry(file, &tr->events, list) 1836 if (file->event_call == trace_probe_event_call(&tk->tp)) 1837 trace_event_enable_disable(file, 1, 0); 1838 } 1839 mutex_unlock(&event_mutex); 1840 } 1841 1842 static __init void setup_boot_kprobe_events(void) 1843 { 1844 char *p, *cmd = kprobe_boot_events_buf; 1845 int ret; 1846 1847 strreplace(kprobe_boot_events_buf, ',', ' '); 1848 1849 while (cmd && *cmd != '\0') { 1850 p = strchr(cmd, ';'); 1851 if (p) 1852 *p++ = '\0'; 1853 1854 ret = create_or_delete_trace_kprobe(cmd); 1855 if (ret) 1856 pr_warn("Failed to add event(%d): %s\n", ret, cmd); 1857 1858 cmd = p; 1859 } 1860 1861 enable_boot_kprobe_events(); 1862 } 1863 1864 /* 1865 * Register dynevent at core_initcall. This allows kernel to setup kprobe 1866 * events in postcore_initcall without tracefs. 1867 */ 1868 static __init int init_kprobe_trace_early(void) 1869 { 1870 int ret; 1871 1872 ret = dyn_event_register(&trace_kprobe_ops); 1873 if (ret) 1874 return ret; 1875 1876 if (register_module_notifier(&trace_kprobe_module_nb)) 1877 return -EINVAL; 1878 1879 return 0; 1880 } 1881 core_initcall(init_kprobe_trace_early); 1882 1883 /* Make a tracefs interface for controlling probe points */ 1884 static __init int init_kprobe_trace(void) 1885 { 1886 int ret; 1887 1888 ret = tracing_init_dentry(); 1889 if (ret) 1890 return 0; 1891 1892 /* Event list interface */ 1893 trace_create_file("kprobe_events", TRACE_MODE_WRITE, 1894 NULL, NULL, &kprobe_events_ops); 1895 1896 /* Profile interface */ 1897 trace_create_file("kprobe_profile", TRACE_MODE_READ, 1898 NULL, NULL, &kprobe_profile_ops); 1899 1900 setup_boot_kprobe_events(); 1901 1902 return 0; 1903 } 1904 fs_initcall(init_kprobe_trace); 1905 1906 1907 #ifdef CONFIG_FTRACE_STARTUP_TEST 1908 static __init struct trace_event_file * 1909 find_trace_probe_file(struct trace_kprobe *tk, struct trace_array *tr) 1910 { 1911 struct trace_event_file *file; 1912 1913 list_for_each_entry(file, &tr->events, list) 1914 if (file->event_call == trace_probe_event_call(&tk->tp)) 1915 return file; 1916 1917 return NULL; 1918 } 1919 1920 /* 1921 * Nobody but us can call enable_trace_kprobe/disable_trace_kprobe at this 1922 * stage, we can do this lockless. 1923 */ 1924 static __init int kprobe_trace_self_tests_init(void) 1925 { 1926 int ret, warn = 0; 1927 int (*target)(int, int, int, int, int, int); 1928 struct trace_kprobe *tk; 1929 struct trace_event_file *file; 1930 1931 if (tracing_is_disabled()) 1932 return -ENODEV; 1933 1934 if (tracing_selftest_disabled) 1935 return 0; 1936 1937 target = kprobe_trace_selftest_target; 1938 1939 pr_info("Testing kprobe tracing: "); 1940 1941 ret = create_or_delete_trace_kprobe("p:testprobe kprobe_trace_selftest_target $stack $stack0 +0($stack)"); 1942 if (WARN_ON_ONCE(ret)) { 1943 pr_warn("error on probing function entry.\n"); 1944 warn++; 1945 } else { 1946 /* Enable trace point */ 1947 tk = find_trace_kprobe("testprobe", KPROBE_EVENT_SYSTEM); 1948 if (WARN_ON_ONCE(tk == NULL)) { 1949 pr_warn("error on getting new probe.\n"); 1950 warn++; 1951 } else { 1952 file = find_trace_probe_file(tk, top_trace_array()); 1953 if (WARN_ON_ONCE(file == NULL)) { 1954 pr_warn("error on getting probe file.\n"); 1955 warn++; 1956 } else 1957 enable_trace_kprobe( 1958 trace_probe_event_call(&tk->tp), file); 1959 } 1960 } 1961 1962 ret = create_or_delete_trace_kprobe("r:testprobe2 kprobe_trace_selftest_target $retval"); 1963 if (WARN_ON_ONCE(ret)) { 1964 pr_warn("error on probing function return.\n"); 1965 warn++; 1966 } else { 1967 /* Enable trace point */ 1968 tk = find_trace_kprobe("testprobe2", KPROBE_EVENT_SYSTEM); 1969 if (WARN_ON_ONCE(tk == NULL)) { 1970 pr_warn("error on getting 2nd new probe.\n"); 1971 warn++; 1972 } else { 1973 file = find_trace_probe_file(tk, top_trace_array()); 1974 if (WARN_ON_ONCE(file == NULL)) { 1975 pr_warn("error on getting probe file.\n"); 1976 warn++; 1977 } else 1978 enable_trace_kprobe( 1979 trace_probe_event_call(&tk->tp), file); 1980 } 1981 } 1982 1983 if (warn) 1984 goto end; 1985 1986 ret = target(1, 2, 3, 4, 5, 6); 1987 1988 /* 1989 * Not expecting an error here, the check is only to prevent the 1990 * optimizer from removing the call to target() as otherwise there 1991 * are no side-effects and the call is never performed. 1992 */ 1993 if (ret != 21) 1994 warn++; 1995 1996 /* Disable trace points before removing it */ 1997 tk = find_trace_kprobe("testprobe", KPROBE_EVENT_SYSTEM); 1998 if (WARN_ON_ONCE(tk == NULL)) { 1999 pr_warn("error on getting test probe.\n"); 2000 warn++; 2001 } else { 2002 if (trace_kprobe_nhit(tk) != 1) { 2003 pr_warn("incorrect number of testprobe hits\n"); 2004 warn++; 2005 } 2006 2007 file = find_trace_probe_file(tk, top_trace_array()); 2008 if (WARN_ON_ONCE(file == NULL)) { 2009 pr_warn("error on getting probe file.\n"); 2010 warn++; 2011 } else 2012 disable_trace_kprobe( 2013 trace_probe_event_call(&tk->tp), file); 2014 } 2015 2016 tk = find_trace_kprobe("testprobe2", KPROBE_EVENT_SYSTEM); 2017 if (WARN_ON_ONCE(tk == NULL)) { 2018 pr_warn("error on getting 2nd test probe.\n"); 2019 warn++; 2020 } else { 2021 if (trace_kprobe_nhit(tk) != 1) { 2022 pr_warn("incorrect number of testprobe2 hits\n"); 2023 warn++; 2024 } 2025 2026 file = find_trace_probe_file(tk, top_trace_array()); 2027 if (WARN_ON_ONCE(file == NULL)) { 2028 pr_warn("error on getting probe file.\n"); 2029 warn++; 2030 } else 2031 disable_trace_kprobe( 2032 trace_probe_event_call(&tk->tp), file); 2033 } 2034 2035 ret = create_or_delete_trace_kprobe("-:testprobe"); 2036 if (WARN_ON_ONCE(ret)) { 2037 pr_warn("error on deleting a probe.\n"); 2038 warn++; 2039 } 2040 2041 ret = create_or_delete_trace_kprobe("-:testprobe2"); 2042 if (WARN_ON_ONCE(ret)) { 2043 pr_warn("error on deleting a probe.\n"); 2044 warn++; 2045 } 2046 2047 end: 2048 ret = dyn_events_release_all(&trace_kprobe_ops); 2049 if (WARN_ON_ONCE(ret)) { 2050 pr_warn("error on cleaning up probes.\n"); 2051 warn++; 2052 } 2053 /* 2054 * Wait for the optimizer work to finish. Otherwise it might fiddle 2055 * with probes in already freed __init text. 2056 */ 2057 wait_for_kprobe_optimizer(); 2058 if (warn) 2059 pr_cont("NG: Some tests are failed. Please check them.\n"); 2060 else 2061 pr_cont("OK\n"); 2062 return 0; 2063 } 2064 2065 late_initcall(kprobe_trace_self_tests_init); 2066 2067 #endif 2068