One Level Up Top Level

runtime/kp_events.c - ktap

Data types defined

Functions defined

Source code

  1. /*
  2. * kp_events.c - ktap events management (registry, destroy, event callback)
  3. *
  4. * This file is part of ktap by Jovi Zhangwei.
  5. *
  6. * Copyright (C) 2012-2013 Jovi Zhangwei <jovi.zhangwei@gmail.com>.
  7. *
  8. * ktap is free software; you can redistribute it and/or modify it
  9. * under the terms and conditions of the GNU General Public License,
  10. * version 2, as published by the Free Software Foundation.
  11. *
  12. * ktap is distributed in the hope it will be useful, but WITHOUT
  13. * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  14. * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  15. * more details.
  16. *
  17. * You should have received a copy of the GNU General Public License along with
  18. * this program; if not, write to the Free Software Foundation, Inc.,
  19. * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
  20. */

  22. #include <linux/module.h>
  23. #include <linux/ctype.h>
  24. #include <linux/slab.h>
  25. #include <linux/version.h>
  26. #include <asm/syscall.h>
  27. #include "../include/ktap_types.h"
  28. #include "ktap.h"
  29. #include "kp_obj.h"
  30. #include "kp_str.h"
  31. #include "kp_transport.h"
  32. #include "kp_vm.h"
  33. #include "kp_events.h"

  35. ‌const char *kp_event_tostr(ktap_state_t *ks)
  36. {
  37.     struct ktap_event_data *e = ks->current_event;
  38.     struct ftrace_event_call *call;
  39.     struct trace_iterator *iter;
  40.     struct trace_event *ev;
  41.     enum print_line_t ret = TRACE_TYPE_NO_CONSUME;
  42.     static const char *dummy_msg = "argstr_not_available";

  44.     /* need to check current context is vaild tracing context */
  45.     if (!ks->current_event) {
  46.         kp_error(ks, "cannot stringify event str in invalid context\n");
  47.         return NULL;
  48.     }

  50.     /*check if stringified before */
  51.     if (ks->current_event->argstr)
  52.         return getstr(ks->current_event->argstr);

  54.     /* timer event and raw tracepoint don't have associated argstr */
  55.     if (e->event->type == KTAP_EVENT_TYPE_PERF && e->event->perf->tp_event)
  56.         call = e->event->perf->tp_event;
  57.     else
  58.         return dummy_msg;

  60.     /* Simulate the iterator */

  62.     /*
  63.      * use temp percpu buffer as trace_iterator
  64.      * we cannot use same print_buffer because we may called from printf.
  65.      */
  66.     iter = kp_this_cpu_temp_buffer(ks);

  68.     trace_seq_init(&iter->seq);
  69.     iter->ent = e->data->raw->data;

  71.     ev = &(call->event);
  72.     if (ev)
  73.         ret = ev->funcs->trace(iter, 0, ev);

  75.     if (ret != TRACE_TYPE_NO_CONSUME) {
  76.         struct trace_seq *s = &iter->seq;
  77.         int len = s->len >= PAGE_SIZE ? PAGE_SIZE - 1 : s->len;

  79.         s->buffer[len] = '\0';
  80.         return &s->buffer[0];
  81.     }

  83.     return dummy_msg;
  84. }

  86. /* return string repr of 'argstr' */
  87. ‌const ktap_str_t *kp_event_stringify(ktap_state_t *ks)
  88. {
  89.     const char *str;
  90.     ktap_str_t *ts;

  92.     /*check if stringified before */
  93.     if (ks->current_event->argstr)
  94.         return ks->current_event->argstr;

  96.     str = kp_event_tostr(ks);
  97.     if (!str)
  98.         return NULL;

  100.     ts = kp_str_newz(ks, str);
  101.     ks->current_event->argstr = ts;
  102.     return ts;
  103. }

  105. /*
  106. * This definition should keep update with kernel/trace/trace.h
  107. * TODO: export this struct in kernel
  108. */
  109. ‌struct ftrace_event_field {
  110.     struct list_head        link;
  111.     const char              *name;
  112.     const char              *type;
  113.     int                     filter_type;
  114.     int                     offset;
  115.     int                     size;
  116.     int                     is_signed;
  117. };

  119. ‌static struct list_head *get_fields(struct ftrace_event_call *event_call)
  120. {
  121.     if (!event_call->class->get_fields)
  122.         return &event_call->class->fields;
  123.     return event_call->class->get_fields(event_call);
  124. }

  126. ‌void kp_event_getarg(ktap_state_t *ks, ktap_val_t *ra, int idx)
  127. {
  128.     struct ktap_event_data *e = ks->current_event;
  129.     struct ktap_event *event = e->event;
  130.     struct ktap_event_field *event_fields = &event->fields[idx];

  132.     switch (event_fields->type)  {
  133.     case KTAP_EVENT_FIELD_TYPE_INT: {
  134.         struct trace_entry *entry = e->data->raw->data;
  135.         void *value = (unsigned char *)entry + event_fields->offset;
  136.         int n = *(int *)value;
  137.         set_number(ra, n);
  138.         return;
  139.         }
  140.     case KTAP_EVENT_FIELD_TYPE_LONG: {
  141.         struct trace_entry *entry = e->data->raw->data;
  142.         void *value = (unsigned char *)entry + event_fields->offset;
  143.         long n = *(long *)value;
  144.         set_number(ra, n);
  145.         return;
  146.         }
  147.     case KTAP_EVENT_FIELD_TYPE_STRING: {
  148.         struct trace_entry *entry = e->data->raw->data;
  149.         ktap_str_t *ts;
  150.         void *value = (unsigned char *)entry + event_fields->offset;
  151.         ts = kp_str_newz(ks, (char *)value);
  152.         if (ts)
  153.             set_string(ra, ts);
  154.         else
  155.             set_nil(ra);
  156.         return;
  157.         }
  158.     case KTAP_EVENT_FIELD_TYPE_CONST: {
  159.         set_number(ra, (ktap_number)event_fields->offset);
  160.         return;
  161.         }
  162.     case KTAP_EVENT_FIELD_TYPE_REGESTER: {
  163.         unsigned long *reg = (unsigned long *)((u8 *)e->regs +
  164.                     event_fields->offset);
  165.         set_number(ra, *reg);
  166.         return;
  167.         }
  168.     case KTAP_EVENT_FIELD_TYPE_NIL:
  169.         set_nil(ra);
  170.         return;
  171.     case KTAP_EVENT_FIELD_TYPE_INVALID:
  172.         kp_error(ks, "the field type is not supported yet\n");
  173.         set_nil(ra);
  174.         return;
  175.     }
  176. }

  178. /* init all fields of event, for quick arg1..arg9 access */
  179. ‌static int init_event_fields(ktap_state_t *ks, struct ktap_event *event)
  180. {
  181.     struct ftrace_event_call *event_call = event->perf->tp_event;
  182.     struct ktap_event_field *event_fields = &event->fields[0];
  183.     struct ftrace_event_field *field;
  184.     struct list_head *head;
  185.     int idx = 0, n = 0;

  187.     /* only init fields for tracepoint, not timer event */
  188.     if (!event_call)
  189.         return 0;

  191.     /* intern probename */
  192.     event->name = kp_str_newz(ks, event_call->name);
  193.     if (unlikely(!event->name))
  194.         return -ENOMEM;

  196.     head = get_fields(event_call);
  197.     list_for_each_entry_reverse(field, head, link) {
  198.         if (n++ == 9) {
  199.             /*
  200.              * For some events have fields more than 9, just ignore
  201.              * those rest fields at present.
  202.              *
  203.              * TODO: support access all fields in tracepoint event
  204.              *
  205.              * Examples: mce:mce_record, ext4:ext4_writepages, ...
  206.              */
  207.             return 0;
  208.         }

  210.         event_fields[idx].offset = field->offset;

  212.         if (field->size == 4) {
  213.             event_fields[idx].type = KTAP_EVENT_FIELD_TYPE_INT;
  214.             idx++;
  215.             continue;
  216.         } else if (field->size == 8) {
  217.             event_fields[idx].type = KTAP_EVENT_FIELD_TYPE_LONG;
  218.             idx++;
  219.             continue;
  220.         }
  221.         if (!strncmp(field->type, "char", 4)) {
  222.             event_fields[idx].type = KTAP_EVENT_FIELD_TYPE_STRING;
  223.             idx++;
  224.             continue;
  225.         }

  227.         /* TODO: add more type check */
  228.         event_fields[idx++].type = KTAP_EVENT_FIELD_TYPE_INVALID;
  229.     }

  231.     /* init all rest fields as NIL */
  232.     while (idx < 9)
  233.         event_fields[idx++].type = KTAP_EVENT_FIELD_TYPE_NIL;

  235.     return 0;
  236. }

  238. ‌static inline void call_probe_closure(ktap_state_t *mainthread,
  239.                       ktap_func_t *fn,
  240.                       struct ktap_event_data *e, int rctx)
  241. {
  242.     ktap_state_t *ks;
  243.     ktap_val_t *func;

  245.     ks = kp_vm_new_thread(mainthread, rctx);
  246.     set_func(ks->top, fn);
  247.     func = ks->top;
  248.     incr_top(ks);

  250.     ks->current_event = e;

  252.     kp_vm_call(ks, func, 0);

  254.     ks->current_event = NULL;
  255.     kp_vm_exit_thread(ks);
  256. }

  258. /*
  259. * Callback tracing function for perf event subsystem.
  260. *
  261. * make ktap reentrant, don't disable irq in callback function,
  262. * same as perf and ftrace. to make reentrant, we need some
  263. * percpu data to be context isolation(irq/sirq/nmi/process)
  264. *
  265. * The recursion checking in here is mainly purpose for avoiding
  266. * corrupt ktap_state_t with timer closure callback. For tracepoint
  267. * recusion, perf core already handle it.
  268. *
  269. * Note tracepoint handler is calling with rcu_read_lock.
  270. */
  271. ‌static void perf_callback(struct perf_event *perf_event,
  272.                struct perf_sample_data *data,
  273.                struct pt_regs *regs)
  274. {
  275.     struct ktap_event *event;
  276.     struct ktap_event_data e;
  277.     ktap_state_t *ks;
  278.     int rctx;

  280.     event = perf_event->overflow_handler_context;
  281.     ks = event->ks;

  283.     if (unlikely(ks->stop))
  284.         return;

  286.     rctx = get_recursion_context(ks);
  287.     if (unlikely(rctx < 0))
  288.         return;

  290.     e.event = event;
  291.     e.data = data;
  292.     e.regs = regs;
  293.     e.argstr = NULL;

  295.     call_probe_closure(ks, event->fn, &e, rctx);

  297.     put_recursion_context(ks, rctx);
  298. }

  300. /*
  301. * Generic ktap event creation function (based on perf callback)
  302. * purpose for tracepoints/kprobe/uprobe/profile-timer/hw_breakpoint/pmu.
  303. */
  304. ‌int kp_event_create(ktap_state_t *ks, struct perf_event_attr *attr,
  305.             struct task_struct *task, const char *filter,
  306.             ktap_func_t *fn)
  307. {
  308.     struct ktap_event *event;
  309.     struct perf_event *perf_event;
  310.     void *callback = perf_callback;
  311.     int cpu, ret;

  313.     if (G(ks)->parm->dry_run)
  314.         callback = NULL;

  316.     /*
  317.      * don't tracing until ktap_wait, the reason is:
  318.      * 1). some event may hit before apply filter
  319.      * 2). more simple to manage tracing thread
  320.      * 3). avoid race with mainthread.
  321.      *
  322.      * Another way to do this is make attr.disabled as 1, then use
  323.      * perf_event_enable after filter apply, however, perf_event_enable
  324.      * was not exported in kernel older than 3.3, so we drop this method.
  325.      */
  326.     ks->stop = 1;

  328.     for_each_cpu(cpu, G(ks)->cpumask) {
  329.         event = kzalloc(sizeof(struct ktap_event), GFP_KERNEL);
  330.         if (!event)
  331.             return -ENOMEM;

  333.         event->type = KTAP_EVENT_TYPE_PERF;
  334.         event->ks = ks;
  335.         event->fn = fn;
  336.         perf_event = perf_event_create_kernel_counter(attr, cpu, task,
  337.                                   callback, event);
  338.         if (IS_ERR(perf_event)) {
  339.             int err = PTR_ERR(perf_event);
  340.             kp_error(ks, "unable register perf event: "
  341.                      "[cpu: %d; id: %d; err: %d]\n",
  342.                      cpu, attr->config, err);
  343.             kfree(event);
  344.             return err;
  345.         }

  347.         if (attr->type == PERF_TYPE_TRACEPOINT) {
  348.             const char *name = perf_event->tp_event->name;
  349.             kp_verbose_printf(ks, "enable perf event: "
  350.                           "[cpu: %d; id: %d; name: %s; "
  351.                           "filter: %s; pid: %d]\n",
  352.                           cpu, attr->config, name, filter,
  353.                           task ? task_tgid_vnr(task) : -1);
  354.         } else if (attr->type == PERF_TYPE_SOFTWARE &&
  355.              attr->config == PERF_COUNT_SW_CPU_CLOCK) {
  356.             kp_verbose_printf(ks, "enable profile event: "
  357.                           "[cpu: %d; sample_period: %d]\n",
  358.                           cpu, attr->sample_period);
  359.         } else {
  360.             kp_verbose_printf(ks, "unknown perf event type\n");
  361.         }

  363.         event->perf = perf_event;
  364.         INIT_LIST_HEAD(&event->list);
  365.         list_add_tail(&event->list, &G(ks)->events_head);

  367.         if (init_event_fields(ks, event)) {
  368.             kp_error(ks, "unable init event fields id %d\n",
  369.                     attr->config);
  370.             perf_event_release_kernel(event->perf);
  371.             list_del(&event->list);
  372.             kfree(event);
  373.             return ret;
  374.         }

  376.         if (!filter)
  377.             continue;

  379.         ret = kp_ftrace_profile_set_filter(perf_event, attr->config,
  380.                            filter);
  381.         if (ret) {
  382.             kp_error(ks, "unable set event filter: "
  383.                      "[id: %d; filter: %s; ret: %d]\n",
  384.                      attr->config, filter, ret);
  385.             perf_event_release_kernel(event->perf);
  386.             list_del(&event->list);
  387.             kfree(event);
  388.             return ret;
  389.         }
  390.     }

  392.     return 0;
  393. }

  395. /*
  396. * tracepoint_probe_register functions changed prototype by introduce
  397. * 'struct tracepoint', this cause hard to refer tracepoint by name.
  398. * And these ktap raw tracepoint interface is not courage to use, so disable
  399. * it now.
  400. */
  401. #if 0
  402. /*
  403. * Ignore function proto in here, just use first argument.
  404. */
  405. static void probe_callback(void *__data)
  406. {
  407.     struct ktap_event *event = __data;
  408.     ktap_state_t *ks = event->ks;
  409.     struct ktap_event_data e;
  410.     struct pt_regs regs; /* pt_regs maybe is large for stack */
  411.     int rctx;

  413.     if (unlikely(ks->stop))
  414.         return;

  416.     rctx = get_recursion_context(ks);
  417.     if (unlikely(rctx < 0))
  418.         return;

  420.     perf_fetch_caller_regs(&regs);

  422.     e.event = event;
  423.     e.regs = &regs;
  424.     e.argstr = NULL;

  426.     call_probe_closure(ks, event->fn, &e, rctx);

  428.     put_recursion_context(ks, rctx);
  429. }

  431. /*
  432. * syscall events handling
  433. */

  435. static DEFINE_MUTEX(syscall_trace_lock);
  436. static DECLARE_BITMAP(enabled_enter_syscalls, NR_syscalls);
  437. static DECLARE_BITMAP(enabled_exit_syscalls, NR_syscalls);
  438. static int sys_refcount_enter;
  439. static int sys_refcount_exit;

  441. static int get_syscall_num(const char *name)
  442. {
  443.     int i;

  445.     for (i = 0; i < NR_syscalls; i++) {
  446.         if (syscalls_metadata[i] &&
  447.             !strcmp(name, syscalls_metadata[i]->name + 4))
  448.             return i;
  449.     }
  450.     return -1;
  451. }

  453. static void trace_syscall_enter(void *data, struct pt_regs *regs, long id)
  454. {
  455.     struct ktap_event *event = data;
  456.     ktap_state_t *ks = event->ks;
  457.     struct ktap_event_data e;
  458.     int syscall_nr;
  459.     int rctx;

  461.     if (unlikely(ks->stop))
  462.         return;

  464.     syscall_nr = syscall_get_nr(current, regs);
  465.     if (unlikely(syscall_nr < 0))
  466.         return;
  467.     if (!test_bit(syscall_nr, enabled_enter_syscalls))
  468.         return;

  470.     rctx = get_recursion_context(ks);
  471.     if (unlikely(rctx < 0))
  472.         return;

  474.     e.event = event;
  475.     e.regs = regs;
  476.     e.argstr = NULL;

  478.     call_probe_closure(ks, event->fn, &e, rctx);

  480.     put_recursion_context(ks, rctx);
  481. }

  483. static void trace_syscall_exit(void *data, struct pt_regs *regs, long id)
  484. {
  485.     struct ktap_event *event = data;
  486.     ktap_state_t *ks = event->ks;
  487.     struct ktap_event_data e;
  488.     int syscall_nr;
  489.     int rctx;

  491.     syscall_nr = syscall_get_nr(current, regs);
  492.     if (unlikely(syscall_nr < 0))
  493.         return;
  494.     if (!test_bit(syscall_nr, enabled_exit_syscalls))
  495.         return;

  497.     if (unlikely(ks->stop))
  498.         return;

  500.     rctx = get_recursion_context(ks);
  501.     if (unlikely(rctx < 0))
  502.         return;

  504.     e.event = event;
  505.     e.regs = regs;
  506.     e.argstr = NULL;

  508.     call_probe_closure(ks, event->fn, &e, rctx);

  510.     put_recursion_context(ks, rctx);
  511. }

  513. /* called in dry-run mode, purpose for compare overhead with normal vm call */
  514. static void dry_run_callback(void *data, struct pt_regs *regs, long id)
  515. {

  517. }

  519. static void init_syscall_event_fields(struct ktap_event *event, int is_enter)
  520. {
  521.     struct ftrace_event_call *event_call;
  522.     struct ktap_event_field *event_fields = &event->fields[0];
  523.     struct syscall_metadata *meta = syscalls_metadata[event->syscall_nr];
  524.     int idx = 0;

  526.     event_call = is_enter ? meta->enter_event : meta->exit_event;

  528.     event_fields[0].type = KTAP_EVENT_FIELD_TYPE_CONST;
  529.     event_fields[0].offset = event->syscall_nr;

  531.     if (!is_enter) {
  532. #ifdef CONFIG_X86_64
  533.         event_fields[1].type = KTAP_EVENT_FIELD_TYPE_REGESTER;
  534.         event_fields[1].offset = offsetof(struct pt_regs, ax);
  535. #endif
  536.         return;
  537.     }

  539.     while (idx++ < meta->nb_args) {
  540.         event_fields[idx].type = KTAP_EVENT_FIELD_TYPE_REGESTER;
  541. #ifdef CONFIG_X86_64
  542.         switch (idx) {
  543.         case 1:
  544.             event_fields[idx].offset = offsetof(struct pt_regs, di);
  545.             break;
  546.         case 2:
  547.             event_fields[idx].offset = offsetof(struct pt_regs, si);
  548.             break;
  549.         case 3:
  550.             event_fields[idx].offset = offsetof(struct pt_regs, dx);
  551.             break;
  552.         case 4:
  553.             event_fields[idx].offset =
  554.                         offsetof(struct pt_regs, r10);
  555.             break;
  556.         case 5:
  557.             event_fields[idx].offset = offsetof(struct pt_regs, r8);
  558.             break;
  559.         case 6:
  560.             event_fields[idx].offset = offsetof(struct pt_regs, r9);
  561.             break;
  562.         }
  563. #else
  564. #warning "don't support syscall tracepoint event register access in this arch, use 'trace syscalls:* {}' instead"
  565.         break;
  566. #endif
  567.     }

  569.     /* init all rest fields as NIL */
  570.     while (idx < 9)
  571.         event_fields[idx++].type = KTAP_EVENT_FIELD_TYPE_NIL;
  572. }

  574. static int syscall_event_register(ktap_state_t *ks, const char *event_name,
  575.                   struct ktap_event *event)
  576. {
  577.     int syscall_nr = 0, is_enter = 0;
  578.     void *callback = NULL;
  579.     int ret = 0;

  581.     if (!strncmp(event_name, "sys_enter_", 10)) {
  582.         is_enter = 1;
  583.         event->type = KTAP_EVENT_TYPE_SYSCALL_ENTER;
  584.         syscall_nr = get_syscall_num(event_name + 10);
  585.         callback = trace_syscall_enter;
  586.     } else if (!strncmp(event_name, "sys_exit_", 9)) {
  587.         is_enter = 0;
  588.         event->type = KTAP_EVENT_TYPE_SYSCALL_EXIT;
  589.         syscall_nr = get_syscall_num(event_name + 9);
  590.         callback = trace_syscall_exit;
  591.     }

  593.     if (G(ks)->parm->dry_run)
  594.         callback = dry_run_callback;

  596.     if (syscall_nr < 0)
  597.         return -1;

  599.     event->syscall_nr = syscall_nr;

  601.     init_syscall_event_fields(event, is_enter);

  603.     mutex_lock(&syscall_trace_lock);
  604.     if (is_enter) {
  605.         if (!sys_refcount_enter)
  606.             ret = register_trace_sys_enter(callback, event);
  607.         if (!ret) {
  608.             set_bit(syscall_nr, enabled_enter_syscalls);
  609.             sys_refcount_enter++;
  610.         }
  611.     } else {
  612.         if (!sys_refcount_exit)
  613.             ret = register_trace_sys_exit(callback, event);
  614.         if (!ret) {
  615.             set_bit(syscall_nr, enabled_exit_syscalls);
  616.             sys_refcount_exit++;
  617.         }
  618.     }
  619.     mutex_unlock(&syscall_trace_lock);

  621.     return ret;
  622. }

  624. static int syscall_event_unregister(ktap_state_t *ks, struct ktap_event *event)
  625. {
  626.     int ret = 0;
  627.     void *callback;

  629.     if (event->type == KTAP_EVENT_TYPE_SYSCALL_ENTER)
  630.         callback = trace_syscall_enter;
  631.     else
  632.         callback = trace_syscall_exit;

  634.     if (G(ks)->parm->dry_run)
  635.         callback = dry_run_callback;

  637.     mutex_lock(&syscall_trace_lock);
  638.     if (event->type == KTAP_EVENT_TYPE_SYSCALL_ENTER) {
  639.         sys_refcount_enter--;
  640.             clear_bit(event->syscall_nr, enabled_enter_syscalls);
  641.             if (!sys_refcount_enter)
  642.                     unregister_trace_sys_enter(callback, event);
  643.     } else {
  644.         sys_refcount_exit--;
  645.             clear_bit(event->syscall_nr, enabled_exit_syscalls);
  646.             if (!sys_refcount_exit)
  647.                     unregister_trace_sys_exit(callback, event);
  648.     }
  649.     mutex_unlock(&syscall_trace_lock);

  651.     return ret;
  652. }

  654. /*
  655. * Register tracepoint event directly, not based on perf callback
  656. *
  657. * This tracing method would be more faster than perf callback,
  658. * because it won't need to write trace data into any temp buffer,
  659. * and code path is much shorter than perf callback.
  660. */
  661. int kp_event_create_tracepoint(ktap_state_t *ks, const char *event_name,
  662.                    ktap_func_t *fn)
  663. {
  664.     struct ktap_event *event;
  665.     void *callback = probe_callback;
  666.     int is_syscall = 0;
  667.     int ret;

  669.     if (G(ks)->parm->dry_run)
  670.         callback = NULL;

  672.     if (!strncmp(event_name, "sys_enter_", 10) ||
  673.         !strncmp(event_name, "sys_exit_", 9))
  674.         is_syscall = 1;

  676.     event = kzalloc(sizeof(struct ktap_event), GFP_KERNEL);
  677.     if (!event)
  678.         return -ENOMEM;

  680.     event->ks = ks;
  681.     event->fn = fn;
  682.     event->name = kp_str_newz(ks, event_name);
  683.     if (unlikely(!event->name)) {
  684.         kfree(event);
  685.         return -ENOMEM;
  686.     }

  688.     INIT_LIST_HEAD(&event->list);
  689.     list_add_tail(&event->list, &G(ks)->events_head);

  691.     if (is_syscall) {
  692.         ret = syscall_event_register(ks, event_name, event);
  693.     } else {
  694.         event->type = KTAP_EVENT_TYPE_TRACEPOINT;
  695.         ret = tracepoint_probe_register(event_name, callback, event);
  696.     }

  698.     if (ret) {
  699.         kp_error(ks, "register tracepoint %s failed, ret: %d\n",
  700.                 event_name, ret);
  701.         list_del(&event->list);
  702.         kfree(event);
  703.         return ret;
  704.     }
  705.     return 0;
  706. }

  708. #endif

  710. /* kprobe handler */
  711. ‌static int __kprobes pre_handler_kprobe(struct kprobe *p, struct pt_regs *regs)
  712. {
  713.     struct ktap_event *event = container_of(p, struct ktap_event, kp);
  714.     ktap_state_t *ks = event->ks;
  715.     struct ktap_event_data e;
  716.     int rctx;

  718.     if (unlikely(ks->stop))
  719.         return 0;

  721.     rctx = get_recursion_context(ks);
  722.     if (unlikely(rctx < 0))
  723.         return 0;

  725.     e.event = event;
  726.     e.regs = regs;
  727.     e.argstr = NULL;

  729.     call_probe_closure(ks, event->fn, &e, rctx);

  731.     put_recursion_context(ks, rctx);
  732.     return 0;
  733. }

  735. /*
  736. * Register kprobe event directly, not based on perf callback
  737. *
  738. * This tracing method would be more faster than perf callback,
  739. * because it won't need to write trace data into any temp buffer,
  740. * and code path is much shorter than perf callback.
  741. */
  742. ‌int kp_event_create_kprobe(ktap_state_t *ks, const char *event_name,
  743.                ktap_func_t *fn)
  744. {
  745.     struct ktap_event *event;
  746.     void *callback = pre_handler_kprobe;
  747.     int ret;

  749.     if (G(ks)->parm->dry_run)
  750.         callback = NULL;

  752.     event = kzalloc(sizeof(struct ktap_event), GFP_KERNEL);
  753.     if (!event)
  754.         return -ENOMEM;

  756.     event->ks = ks;
  757.     event->fn = fn;
  758.     event->name = kp_str_newz(ks, event_name);
  759.     if (unlikely(!event->name)) {
  760.         kfree(event);
  761.         return -ENOMEM;
  762.     }

  764.     INIT_LIST_HEAD(&event->list);
  765.     list_add_tail(&event->list, &G(ks)->events_head);

  767.     event->type = KTAP_EVENT_TYPE_KPROBE;

  769.     event->kp.symbol_name = event_name;
  770.     event->kp.pre_handler = callback;
  771.     ret = register_kprobe(&event->kp);
  772.     if (ret) {
  773.         kp_error(ks, "register kprobe event %s failed, ret: %d\n",
  774.                 event_name, ret);
  775.         list_del(&event->list);
  776.         kfree(event);
  777.         return ret;
  778.     }
  779.     return 0;
  780. }


  783. ‌static void events_destroy(ktap_state_t *ks)
  784. {
  785.     struct ktap_event *event;
  786.     struct list_head *tmp, *pos;
  787.     struct list_head *head = &G(ks)->events_head;

  789.     list_for_each(pos, head) {
  790.         event = container_of(pos, struct ktap_event,
  791.                        list);
  792.         if (event->type == KTAP_EVENT_TYPE_PERF)
  793.             perf_event_release_kernel(event->perf);
  794. #if 0
  795.         else if (event->type == KTAP_EVENT_TYPE_TRACEPOINT)
  796.             tracepoint_probe_unregister(getstr(event->name),
  797.                             probe_callback, event);
  798.         else if (event->type == KTAP_EVENT_TYPE_SYSCALL_ENTER ||
  799.              event->type == KTAP_EVENT_TYPE_SYSCALL_EXIT )
  800.             syscall_event_unregister(ks, event);
  801. #endif
  802.         else if (event->type == KTAP_EVENT_TYPE_KPROBE)
  803.             unregister_kprobe(&event->kp);
  804.         }
  805.            /*
  806.      * Ensure our callback won't be called anymore. The buffers
  807.      * will be freed after that.
  808.      */
  809.     tracepoint_synchronize_unregister();

  811.     list_for_each_safe(pos, tmp, head) {
  812.         event = container_of(pos, struct ktap_event,
  813.                        list);
  814.         list_del(&event->list);
  815.         kfree(event);
  816.     }
  817. }

  819. ‌void kp_events_exit(ktap_state_t *ks)
  820. {
  821.     if (!G(ks)->trace_enabled)
  822.         return;

  824.     events_destroy(ks);

  826.     /* call trace_end_closure after all event unregistered */
  827.     if ((G(ks)->state != KTAP_ERROR) && G(ks)->trace_end_closure) {
  828.         G(ks)->state = KTAP_TRACE_END;
  829.         set_func(ks->top, G(ks)->trace_end_closure);
  830.         incr_top(ks);
  831.         kp_vm_call(ks, ks->top - 1, 0);
  832.         G(ks)->trace_end_closure = NULL;
  833.     }

  835.     G(ks)->trace_enabled = 0;
  836. }

  838. ‌int kp_events_init(ktap_state_t *ks)
  839. {
  840.     G(ks)->trace_enabled = 1;
  841.     return 0;
  842. }

One Level Up Top Level