src/lttng-syscalls.c

   1 /* SPDX-License-Identifier: (GPL-2.0-only or LGPL-2.1-only)
   2  *
   3  * lttng-syscalls.c
   4  *
   5  * LTTng syscall probes.
   6  *
   7  * Copyright (C) 2010-2012 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
   8  */
   9
  10 #include <linux/module.h>
  11 #include <linux/slab.h>
  12 #include <linux/compat.h>
  13 #include <linux/err.h>
  14 #include <linux/bitmap.h>
  15 #include <linux/in.h>
  16 #include <linux/in6.h>
  17 #include <linux/seq_file.h>
  18 #include <linux/stringify.h>
  19 #include <linux/file.h>
  20 #include <linux/anon_inodes.h>
  21 #include <linux/fcntl.h>
  22 #include <linux/mman.h>
  23 #include <asm/ptrace.h>
  24 #include <asm/syscall.h>
  25
  26 #include <lttng/bitfield.h>
  27 #include <wrapper/tracepoint.h>
  28 #include <wrapper/file.h>
  29 #include <wrapper/rcu.h>
  30 #include <wrapper/syscall.h>
  31 #include <lttng/events.h>
  32 #include <lttng/events-internal.h>
  33 #include <lttng/utils.h>
  34
  35 #include "lttng-syscalls.h"
  36
  37 #ifndef CONFIG_COMPAT
  38 # ifndef is_compat_task
  39 #  define is_compat_task()      (0)
  40 # endif
  41 #endif
  42
  43 /* in_compat_syscall appears in kernel 4.6. */
  44 #ifndef in_compat_syscall
  45  #define in_compat_syscall()    is_compat_task()
  46 #endif
  47
  48 enum sc_type {
  49         SC_TYPE_ENTRY,
  50         SC_TYPE_EXIT,
  51         SC_TYPE_COMPAT_ENTRY,
  52         SC_TYPE_COMPAT_EXIT,
  53 };
  54
  55 #define SYSCALL_ENTRY_TOK               syscall_entry_
  56 #define COMPAT_SYSCALL_ENTRY_TOK        compat_syscall_entry_
  57 #define SYSCALL_EXIT_TOK                syscall_exit_
  58 #define COMPAT_SYSCALL_EXIT_TOK         compat_syscall_exit_
  59
  60 #define SYSCALL_ENTRY_STR               __stringify(SYSCALL_ENTRY_TOK)
  61 #define COMPAT_SYSCALL_ENTRY_STR        __stringify(COMPAT_SYSCALL_ENTRY_TOK)
  62 #define SYSCALL_EXIT_STR                __stringify(SYSCALL_EXIT_TOK)
  63 #define COMPAT_SYSCALL_EXIT_STR         __stringify(COMPAT_SYSCALL_EXIT_TOK)
  64
  65 void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id);
  66 void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret);
  67
  68 /*
  69  * Forward declarations for old kernels.
  70  */
  71 struct mmsghdr;
  72 struct rlimit64;
  73 struct oldold_utsname;
  74 struct old_utsname;
  75 struct sel_arg_struct;
  76 struct mmap_arg_struct;
  77 struct file_handle;
  78 struct user_msghdr;
  79
  80 /*
  81  * Forward declaration for kernels >= 5.6
  82  */
  83 struct timex;
  84 struct timeval;
  85 struct itimerval;
  86 struct itimerspec;
  87
  88 #if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(5,6,0))
  89 typedef __kernel_old_time_t time_t;
  90 #endif
  91
  92 #ifdef IA32_NR_syscalls
  93 #define NR_compat_syscalls IA32_NR_syscalls
  94 #else
  95 #define NR_compat_syscalls NR_syscalls
  96 #endif
  97
  98 /*
  99  * Create LTTng tracepoint probes.
 100  */
 101 #define LTTNG_PACKAGE_BUILD
 102 #define CREATE_TRACE_POINTS
 103 #define TP_MODULE_NOINIT
 104 #define TRACE_INCLUDE_PATH instrumentation/syscalls/headers
 105
 106 #define PARAMS(args...) args
 107
 108 /* Handle unknown syscalls */
 109 #undef TRACE_SYSTEM
 110 #define TRACE_SYSTEM syscalls_unknown
 111 #include <instrumentation/syscalls/headers/syscalls_unknown.h>
 112 #undef TRACE_SYSTEM
 113
 114 #undef TP_PROBE_CB
 115
 116 extern const struct trace_syscall_table sc_table;
 117 extern const struct trace_syscall_table compat_sc_table;
 118
 119 /* Event syscall exit table */
 120 extern const struct trace_syscall_table sc_exit_table;
 121 extern const struct trace_syscall_table compat_sc_exit_table;
 122
 123
 124 #undef SC_EXIT
 125
 126 #undef CREATE_SYSCALL_TABLE
 127
 128 struct lttng_syscall_filter {
 129         DECLARE_BITMAP(sc_entry, NR_syscalls);
 130         DECLARE_BITMAP(sc_exit, NR_syscalls);
 131         DECLARE_BITMAP(sc_compat_entry, NR_compat_syscalls);
 132         DECLARE_BITMAP(sc_compat_exit, NR_compat_syscalls);
 133 };
 134
 135 static
 136 int lttng_syscalls_create_matching_event_notifiers(struct lttng_event_enabler_common *event_enabler);
 137
 138 static void syscall_entry_event_unknown(struct hlist_head *unknown_action_list_head,
 139         struct pt_regs *regs, long id)
 140 {
 141         unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 142         struct lttng_kernel_event_common_private *event_priv;
 143
 144         lttng_syscall_get_arguments(current, regs, args);
 145         lttng_hlist_for_each_entry_rcu(event_priv, unknown_action_list_head, u.syscall.node) {
 146                 if (unlikely(in_compat_syscall()))
 147                         __event_probe__compat_syscall_entry_unknown(event_priv->pub, id, args);
 148                 else
 149                         __event_probe__syscall_entry_unknown(event_priv->pub, id, args);
 150         }
 151 }
 152
 153 static __always_inline
 154 void syscall_entry_event_call_func(struct hlist_head *action_list,
 155                 void *func, unsigned int nrargs,
 156                 struct pt_regs *regs)
 157 {
 158         struct lttng_kernel_event_common_private *event_priv;
 159
 160         switch (nrargs) {
 161         case 0:
 162         {
 163                 void (*fptr)(void *__data) = func;
 164
 165                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 166                         fptr(event_priv->pub);
 167                 break;
 168         }
 169         case 1:
 170         {
 171                 void (*fptr)(void *__data, unsigned long arg0) = func;
 172                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 173
 174                 lttng_syscall_get_arguments(current, regs, args);
 175                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 176                         fptr(event_priv->pub, args[0]);
 177                 break;
 178         }
 179         case 2:
 180         {
 181                 void (*fptr)(void *__data,
 182                         unsigned long arg0,
 183                         unsigned long arg1) = func;
 184                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 185
 186                 lttng_syscall_get_arguments(current, regs, args);
 187                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 188                         fptr(event_priv->pub, args[0], args[1]);
 189                 break;
 190         }
 191         case 3:
 192         {
 193                 void (*fptr)(void *__data,
 194                         unsigned long arg0,
 195                         unsigned long arg1,
 196                         unsigned long arg2) = func;
 197                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 198
 199                 lttng_syscall_get_arguments(current, regs, args);
 200                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 201                         fptr(event_priv->pub, args[0], args[1], args[2]);
 202                 break;
 203         }
 204         case 4:
 205         {
 206                 void (*fptr)(void *__data,
 207                         unsigned long arg0,
 208                         unsigned long arg1,
 209                         unsigned long arg2,
 210                         unsigned long arg3) = func;
 211                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 212
 213                 lttng_syscall_get_arguments(current, regs, args);
 214                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 215                         fptr(event_priv->pub, args[0], args[1], args[2], args[3]);
 216                 break;
 217         }
 218         case 5:
 219         {
 220                 void (*fptr)(void *__data,
 221                         unsigned long arg0,
 222                         unsigned long arg1,
 223                         unsigned long arg2,
 224                         unsigned long arg3,
 225                         unsigned long arg4) = func;
 226                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 227
 228                 lttng_syscall_get_arguments(current, regs, args);
 229                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 230                         fptr(event_priv->pub, args[0], args[1], args[2], args[3], args[4]);
 231                 break;
 232         }
 233         case 6:
 234         {
 235                 void (*fptr)(void *__data,
 236                         unsigned long arg0,
 237                         unsigned long arg1,
 238                         unsigned long arg2,
 239                         unsigned long arg3,
 240                         unsigned long arg4,
 241                         unsigned long arg5) = func;
 242                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 243
 244                 lttng_syscall_get_arguments(current, regs, args);
 245                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 246                         fptr(event_priv->pub, args[0], args[1], args[2],
 247                              args[3], args[4], args[5]);
 248                 break;
 249         }
 250         default:
 251                 break;
 252         }
 253 }
 254
 255 void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id)
 256 {
 257         struct lttng_kernel_syscall_table *syscall_table = __data;
 258         struct hlist_head *action_list, *unknown_action_list;
 259         const struct trace_syscall_entry *table, *entry;
 260         size_t table_len;
 261
 262         if (unlikely(in_compat_syscall())) {
 263                 struct lttng_syscall_filter *filter = syscall_table->sc_filter;
 264
 265                 if (id < 0 || id >= NR_compat_syscalls
 266                         || (!READ_ONCE(syscall_table->syscall_all_entry) && !test_bit(id, filter->sc_compat_entry))) {
 267                         /* System call filtered out. */
 268                         return;
 269                 }
 270                 table = compat_sc_table.table;
 271                 table_len = compat_sc_table.len;
 272                 unknown_action_list = &syscall_table->compat_unknown_syscall_dispatch;
 273         } else {
 274                 struct lttng_syscall_filter *filter = syscall_table->sc_filter;
 275
 276                 if (id < 0 || id >= NR_syscalls
 277                         || (!READ_ONCE(syscall_table->syscall_all_entry) && !test_bit(id, filter->sc_entry))) {
 278                         /* System call filtered out. */
 279                         return;
 280                 }
 281                 table = sc_table.table;
 282                 table_len = sc_table.len;
 283                 unknown_action_list = &syscall_table->unknown_syscall_dispatch;
 284         }
 285         if (unlikely(id < 0 || id >= table_len)) {
 286                 syscall_entry_event_unknown(unknown_action_list, regs, id);
 287                 return;
 288         }
 289
 290         entry = &table[id];
 291         if (!entry->event_func) {
 292                 syscall_entry_event_unknown(unknown_action_list, regs, id);
 293                 return;
 294         }
 295
 296         if (unlikely(in_compat_syscall())) {
 297                 action_list = &syscall_table->compat_syscall_dispatch[id];
 298         } else {
 299                 action_list = &syscall_table->syscall_dispatch[id];
 300         }
 301         if (unlikely(hlist_empty(action_list)))
 302                 return;
 303
 304         syscall_entry_event_call_func(action_list, entry->event_func, entry->nrargs, regs);
 305 }
 306
 307 static void syscall_exit_event_unknown(struct hlist_head *unknown_action_list_head,
 308         struct pt_regs *regs, long id, long ret)
 309 {
 310         unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 311         struct lttng_kernel_event_common_private *event_priv;
 312
 313         lttng_syscall_get_arguments(current, regs, args);
 314         lttng_hlist_for_each_entry_rcu(event_priv, unknown_action_list_head, u.syscall.node) {
 315                 if (unlikely(in_compat_syscall()))
 316                         __event_probe__compat_syscall_exit_unknown(event_priv->pub, id, ret,
 317                                 args);
 318                 else
 319                         __event_probe__syscall_exit_unknown(event_priv->pub, id, ret, args);
 320         }
 321 }
 322
 323 static __always_inline
 324 void syscall_exit_event_call_func(struct hlist_head *action_list,
 325                 void *func, unsigned int nrargs,
 326                 struct pt_regs *regs, long ret)
 327 {
 328         struct lttng_kernel_event_common_private *event_priv;
 329
 330         switch (nrargs) {
 331         case 0:
 332         {
 333                 void (*fptr)(void *__data, long ret) = func;
 334
 335                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 336                         fptr(event_priv->pub, ret);
 337                 break;
 338         }
 339         case 1:
 340         {
 341                 void (*fptr)(void *__data,
 342                         long ret,
 343                         unsigned long arg0) = func;
 344                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 345
 346                 lttng_syscall_get_arguments(current, regs, args);
 347                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 348                         fptr(event_priv->pub, ret, args[0]);
 349                 break;
 350         }
 351         case 2:
 352         {
 353                 void (*fptr)(void *__data,
 354                         long ret,
 355                         unsigned long arg0,
 356                         unsigned long arg1) = func;
 357                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 358
 359                 lttng_syscall_get_arguments(current, regs, args);
 360                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 361                         fptr(event_priv->pub, ret, args[0], args[1]);
 362                 break;
 363         }
 364         case 3:
 365         {
 366                 void (*fptr)(void *__data,
 367                         long ret,
 368                         unsigned long arg0,
 369                         unsigned long arg1,
 370                         unsigned long arg2) = func;
 371                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 372
 373                 lttng_syscall_get_arguments(current, regs, args);
 374                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 375                         fptr(event_priv->pub, ret, args[0], args[1], args[2]);
 376                 break;
 377         }
 378         case 4:
 379         {
 380                 void (*fptr)(void *__data,
 381                         long ret,
 382                         unsigned long arg0,
 383                         unsigned long arg1,
 384                         unsigned long arg2,
 385                         unsigned long arg3) = func;
 386                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 387
 388                 lttng_syscall_get_arguments(current, regs, args);
 389                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 390                         fptr(event_priv->pub, ret, args[0], args[1], args[2], args[3]);
 391                 break;
 392         }
 393         case 5:
 394         {
 395                 void (*fptr)(void *__data,
 396                         long ret,
 397                         unsigned long arg0,
 398                         unsigned long arg1,
 399                         unsigned long arg2,
 400                         unsigned long arg3,
 401                         unsigned long arg4) = func;
 402                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 403
 404                 lttng_syscall_get_arguments(current, regs, args);
 405                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 406                         fptr(event_priv->pub, ret, args[0], args[1], args[2], args[3], args[4]);
 407                 break;
 408         }
 409         case 6:
 410         {
 411                 void (*fptr)(void *__data,
 412                         long ret,
 413                         unsigned long arg0,
 414                         unsigned long arg1,
 415                         unsigned long arg2,
 416                         unsigned long arg3,
 417                         unsigned long arg4,
 418                         unsigned long arg5) = func;
 419                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 420
 421                 lttng_syscall_get_arguments(current, regs, args);
 422                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 423                         fptr(event_priv->pub, ret, args[0], args[1], args[2],
 424                              args[3], args[4], args[5]);
 425                 break;
 426         }
 427         default:
 428                 break;
 429         }
 430 }
 431
 432 void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
 433 {
 434         struct lttng_kernel_syscall_table *syscall_table = __data;
 435         struct hlist_head *action_list, *unknown_action_list;
 436         const struct trace_syscall_entry *table, *entry;
 437         size_t table_len;
 438         long id;
 439
 440         id = syscall_get_nr(current, regs);
 441
 442         if (unlikely(in_compat_syscall())) {
 443                 struct lttng_syscall_filter *filter = syscall_table->sc_filter;
 444
 445                 if (id < 0 || id >= NR_compat_syscalls
 446                         || (!READ_ONCE(syscall_table->syscall_all_exit) && !test_bit(id, filter->sc_compat_exit))) {
 447                         /* System call filtered out. */
 448                         return;
 449                 }
 450                 table = compat_sc_exit_table.table;
 451                 table_len = compat_sc_exit_table.len;
 452                 unknown_action_list = &syscall_table->compat_unknown_syscall_exit_dispatch;
 453         } else {
 454                 struct lttng_syscall_filter *filter = syscall_table->sc_filter;
 455
 456                 if (id < 0 || id >= NR_syscalls
 457                         || (!READ_ONCE(syscall_table->syscall_all_exit) && !test_bit(id, filter->sc_exit))) {
 458                         /* System call filtered out. */
 459                         return;
 460                 }
 461                 table = sc_exit_table.table;
 462                 table_len = sc_exit_table.len;
 463                 unknown_action_list = &syscall_table->unknown_syscall_exit_dispatch;
 464         }
 465         if (unlikely(id < 0 || id >= table_len)) {
 466                 syscall_exit_event_unknown(unknown_action_list, regs, id, ret);
 467                 return;
 468         }
 469
 470         entry = &table[id];
 471         if (!entry->event_func) {
 472                 syscall_exit_event_unknown(unknown_action_list, regs, id, ret);
 473                 return;
 474         }
 475
 476         if (unlikely(in_compat_syscall())) {
 477                 action_list = &syscall_table->compat_syscall_exit_dispatch[id];
 478         } else {
 479                 action_list = &syscall_table->syscall_exit_dispatch[id];
 480         }
 481         if (unlikely(hlist_empty(action_list)))
 482                 return;
 483
 484         syscall_exit_event_call_func(action_list, entry->event_func, entry->nrargs,
 485                                regs, ret);
 486 }
 487
 488 static
 489 struct lttng_kernel_syscall_table *get_syscall_table_from_enabler(struct lttng_event_enabler_common *event_enabler)
 490 {
 491         switch (event_enabler->enabler_type) {
 492         case LTTNG_EVENT_ENABLER_TYPE_RECORDER:
 493         {
 494                 struct lttng_event_recorder_enabler *event_recorder_enabler =
 495                         container_of(event_enabler, struct lttng_event_recorder_enabler, parent);
 496                 return &event_recorder_enabler->chan->priv->parent.syscall_table;
 497         }
 498         case LTTNG_EVENT_ENABLER_TYPE_NOTIFIER:
 499         {
 500                 struct lttng_event_notifier_enabler *event_notifier_enabler =
 501                         container_of(event_enabler, struct lttng_event_notifier_enabler, parent);
 502                 return &event_notifier_enabler->group->syscall_table;
 503         }
 504         default:
 505                 return NULL;
 506         }
 507 }
 508
 509 static
 510 struct lttng_kernel_syscall_table *get_syscall_table_from_event(struct lttng_kernel_event_common *event)
 511 {
 512         switch (event->type) {
 513         case LTTNG_KERNEL_EVENT_TYPE_RECORDER:
 514         {
 515                 struct lttng_kernel_event_recorder *event_recorder =
 516                         container_of(event, struct lttng_kernel_event_recorder, parent);
 517                 return &event_recorder->chan->priv->parent.syscall_table;
 518         }
 519         case LTTNG_KERNEL_EVENT_TYPE_NOTIFIER:
 520         {
 521                 struct lttng_kernel_event_notifier *event_notifier =
 522                         container_of(event, struct lttng_kernel_event_notifier, parent);
 523                 return &event_notifier->priv->group->syscall_table;
 524         }
 525         default:
 526                 return NULL;
 527         }
 528 }
 529
 530 static
 531 void lttng_syscall_event_enabler_create_event(struct lttng_event_enabler_common *syscall_event_enabler,
 532                 const struct lttng_kernel_event_desc *desc, struct hlist_head *dispatch_table,
 533                 enum sc_type type, unsigned int syscall_nr)
 534 {
 535         struct lttng_kernel_event_common *event;
 536
 537         switch (syscall_event_enabler->enabler_type) {
 538         case LTTNG_EVENT_ENABLER_TYPE_RECORDER:
 539         {
 540                 struct lttng_event_recorder_enabler *syscall_event_recorder_enabler =
 541                         container_of(syscall_event_enabler, struct lttng_event_recorder_enabler, parent);
 542                 struct lttng_event_recorder_enabler *event_recorder_enabler;
 543                 struct lttng_kernel_abi_event ev;
 544
 545                 /* We need to create an event for this syscall/enabler. */
 546                 memset(&ev, 0, sizeof(ev));
 547                 switch (type) {
 548                 case SC_TYPE_ENTRY:
 549                         ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
 550                         ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
 551                         break;
 552                 case SC_TYPE_EXIT:
 553                         ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
 554                         ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
 555                         break;
 556                 case SC_TYPE_COMPAT_ENTRY:
 557                         ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
 558                         ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
 559                         break;
 560                 case SC_TYPE_COMPAT_EXIT:
 561                         ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
 562                         ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
 563                         break;
 564                 }
 565                 strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1);
 566                 ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 567                 ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
 568                 event_recorder_enabler = lttng_event_recorder_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev,
 569                                 syscall_event_recorder_enabler->chan);
 570                 WARN_ON_ONCE(!event_recorder_enabler);
 571                 if (!event_recorder_enabler)
 572                         return;
 573                 event = _lttng_kernel_event_create(&event_recorder_enabler->parent, desc);
 574                 WARN_ON_ONCE(!event || IS_ERR(event));
 575                 lttng_event_enabler_destroy(&event_recorder_enabler->parent);
 576                 if (!event || IS_ERR(event)) {
 577                         printk(KERN_INFO "Unable to create event recorder %s\n", desc->event_name);
 578                         return;
 579                 }
 580                 if (dispatch_table)
 581                         hlist_add_head_rcu(&event->priv->u.syscall.node, &dispatch_table[syscall_nr]);
 582                 break;
 583         }
 584         case LTTNG_EVENT_ENABLER_TYPE_NOTIFIER:
 585         {
 586                 struct lttng_event_notifier_enabler *syscall_event_notifier_enabler =
 587                         container_of(syscall_event_enabler, struct lttng_event_notifier_enabler, parent);
 588                 struct lttng_event_notifier_enabler *event_notifier_enabler;
 589                 struct lttng_kernel_abi_event_notifier event_notifier_param;
 590                 uint64_t user_token = syscall_event_enabler->user_token;
 591                 uint64_t error_counter_index = syscall_event_notifier_enabler->error_counter_index;
 592
 593                 memset(&event_notifier_param, 0, sizeof(event_notifier_param));
 594                 switch (type) {
 595                 case SC_TYPE_ENTRY:
 596                         event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
 597                         event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
 598                         break;
 599                 case SC_TYPE_EXIT:
 600                         event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
 601                         event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
 602                         break;
 603                 case SC_TYPE_COMPAT_ENTRY:
 604                         event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
 605                         event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
 606                         break;
 607                 case SC_TYPE_COMPAT_EXIT:
 608                         event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
 609                         event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
 610                         break;
 611                 }
 612                 strncat(event_notifier_param.event.name, desc->event_name,
 613                         LTTNG_KERNEL_ABI_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
 614                 event_notifier_param.event.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 615                 event_notifier_param.event.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
 616                 event_notifier_param.event.token = user_token;
 617                 event_notifier_param.error_counter_index = error_counter_index;
 618
 619                 event_notifier_enabler = lttng_event_notifier_enabler_create(LTTNG_ENABLER_FORMAT_NAME,
 620                                 &event_notifier_param, syscall_event_notifier_enabler->group);
 621                 WARN_ON_ONCE(!event_notifier_enabler);
 622                 event = _lttng_kernel_event_create(&event_notifier_enabler->parent, desc);
 623                 WARN_ON_ONCE(!event || IS_ERR(event));
 624                 lttng_event_enabler_destroy(&event_notifier_enabler->parent);
 625                 if (!event || IS_ERR(event)) {
 626                         printk(KERN_INFO "Unable to create event notifier %s\n", desc->event_name);
 627                         return;
 628                 }
 629                 event->priv->u.syscall.syscall_id = syscall_nr;
 630                 if (dispatch_table)
 631                         hlist_add_head_rcu(&event->priv->u.syscall.node, dispatch_table);
 632                 break;
 633         }
 634         default:
 635                 break;
 636         }
 637 }
 638
 639 static
 640 void lttng_syscall_event_enabler_create_matching_events(struct lttng_event_enabler_common *syscall_event_enabler_common,
 641                 const struct trace_syscall_entry *table,
 642                 size_t table_len,
 643                 struct hlist_head *dispatch_table,
 644                 enum sc_type type)
 645 {
 646         struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(syscall_event_enabler_common);
 647         const struct lttng_kernel_event_desc *desc;
 648         unsigned int i;
 649
 650         if (!IS_ENABLED(CONFIG_COMPAT) && (type == SC_TYPE_COMPAT_ENTRY || type == SC_TYPE_COMPAT_EXIT))
 651                 return;
 652
 653         /* iterate over all syscall and create event_notifier that match */
 654         for (i = 0; i < table_len; i++) {
 655                 struct lttng_kernel_event_common_private *event_priv;
 656                 struct hlist_head *head;
 657                 int found = 0;
 658
 659                 desc = table[i].desc;
 660                 if (!desc) {
 661                         /* Unknown syscall */
 662                         continue;
 663                 }
 664
 665                 if (!lttng_desc_match_enabler(desc, syscall_event_enabler_common))
 666                         continue;
 667
 668                 /*
 669                  * Check if already created.
 670                  */
 671                 head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
 672                 lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
 673                         if (lttng_event_enabler_desc_match_event(syscall_event_enabler_common, desc, event_priv->pub))
 674                                 found = 1;
 675                 }
 676                 if (found)
 677                         continue;
 678
 679                 lttng_syscall_event_enabler_create_event(syscall_event_enabler_common, desc, dispatch_table, type, i);
 680         }
 681 }
 682
 683 static
 684 bool lttng_syscall_event_enabler_is_wildcard_all(struct lttng_event_enabler_common *event_enabler)
 685 {
 686         if (event_enabler->event_param.instrumentation != LTTNG_KERNEL_ABI_SYSCALL)
 687                 return false;
 688         if (event_enabler->event_param.u.syscall.abi != LTTNG_KERNEL_ABI_SYSCALL_ABI_ALL)
 689                 return false;
 690         if (event_enabler->event_param.u.syscall.match != LTTNG_KERNEL_ABI_SYSCALL_MATCH_NAME)
 691                 return false;
 692         if (strcmp(event_enabler->event_param.name, "*"))
 693                 return false;
 694         return true;
 695 }
 696
 697 static
 698 void create_unknown_syscall_event(struct lttng_event_enabler_common *event_enabler, enum sc_type type)
 699 {
 700         struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(event_enabler);
 701         struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(event_enabler);
 702         struct lttng_kernel_event_common_private *event_priv;
 703         const struct lttng_kernel_event_desc *desc;
 704         struct hlist_head *unknown_dispatch_list;
 705         bool found = false;
 706         struct hlist_head *head;
 707
 708         if (!IS_ENABLED(CONFIG_COMPAT) && (type == SC_TYPE_COMPAT_ENTRY || type == SC_TYPE_COMPAT_EXIT))
 709                 return;
 710
 711         /*
 712          * Considering that currently system calls can only be enabled on a per
 713          * name basis (or wildcard based on a name), unknown syscall events are
 714          * only used when matching *all* system calls, because this is the only
 715          * case which can be associated with an unknown system call.
 716          *
 717          * When enabling system call on a per system call number basis will be
 718          * supported, this will need to be revisited.
 719          */
 720         if (!lttng_syscall_event_enabler_is_wildcard_all(event_enabler))
 721                 return;
 722
 723         switch (type) {
 724         case SC_TYPE_ENTRY:
 725                 desc = &__event_desc___syscall_entry_unknown;
 726                 unknown_dispatch_list = &syscall_table->unknown_syscall_dispatch;
 727                 break;
 728         case SC_TYPE_EXIT:
 729                 desc = &__event_desc___syscall_exit_unknown;
 730                 unknown_dispatch_list = &syscall_table->unknown_syscall_exit_dispatch;
 731                 break;
 732         case SC_TYPE_COMPAT_ENTRY:
 733                 desc = &__event_desc___compat_syscall_entry_unknown;
 734                 unknown_dispatch_list = &syscall_table->compat_unknown_syscall_dispatch;
 735                 break;
 736         case SC_TYPE_COMPAT_EXIT:
 737                 desc = &__event_desc___compat_syscall_exit_unknown;
 738                 unknown_dispatch_list = &syscall_table->compat_unknown_syscall_exit_dispatch;
 739                 break;
 740         default:
 741                 WARN_ON_ONCE(1);
 742         }
 743
 744         /*
 745          * Check if already created.
 746          */
 747         head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
 748         lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
 749                 if (lttng_event_enabler_desc_match_event(event_enabler, desc, event_priv->pub))
 750                         found = true;
 751         }
 752         if (!found)
 753                 lttng_syscall_event_enabler_create_event(event_enabler, desc, unknown_dispatch_list, type, -1U);
 754 }
 755
 756 static
 757 int lttng_syscalls_populate_events(struct lttng_event_enabler_common *syscall_event_enabler)
 758 {
 759         struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(syscall_event_enabler);
 760         struct lttng_event_recorder_enabler *event_recorder_enabler;
 761         struct lttng_kernel_channel_buffer *chan;
 762         int ret;
 763
 764         if (syscall_event_enabler->enabler_type != LTTNG_EVENT_ENABLER_TYPE_RECORDER)
 765                 return 0;
 766         event_recorder_enabler = container_of(syscall_event_enabler, struct lttng_event_recorder_enabler, parent);
 767         chan = event_recorder_enabler->chan;
 768
 769         lttng_syscall_event_enabler_create_matching_events(&event_recorder_enabler->parent, sc_table.table, sc_table.len,
 770                         syscall_table->syscall_dispatch, SC_TYPE_ENTRY);
 771         lttng_syscall_event_enabler_create_matching_events(&event_recorder_enabler->parent, sc_exit_table.table, sc_exit_table.len,
 772                         syscall_table->syscall_exit_dispatch, SC_TYPE_EXIT);
 773         create_unknown_syscall_event(syscall_event_enabler, SC_TYPE_ENTRY);
 774         create_unknown_syscall_event(syscall_event_enabler, SC_TYPE_EXIT);
 775
 776         lttng_syscall_event_enabler_create_matching_events(&event_recorder_enabler->parent, compat_sc_table.table, compat_sc_table.len,
 777                         syscall_table->compat_syscall_dispatch, SC_TYPE_COMPAT_ENTRY);
 778         lttng_syscall_event_enabler_create_matching_events(&event_recorder_enabler->parent, compat_sc_exit_table.table, compat_sc_exit_table.len,
 779                         syscall_table->compat_syscall_exit_dispatch, SC_TYPE_COMPAT_EXIT);
 780         create_unknown_syscall_event(syscall_event_enabler, SC_TYPE_COMPAT_ENTRY);
 781         create_unknown_syscall_event(syscall_event_enabler, SC_TYPE_COMPAT_EXIT);
 782
 783         return ret;
 784 }
 785
 786 /*
 787  * Should be called with sessions lock held.
 788  */
 789 int lttng_event_enabler_create_syscall_events_if_missing(struct lttng_event_enabler_common *syscall_event_enabler)
 790 {
 791         struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(syscall_event_enabler);
 792         int ret;
 793
 794         if (!syscall_table->syscall_dispatch) {
 795                 /* create syscall table mapping syscall to events */
 796                 syscall_table->syscall_dispatch = kzalloc(sizeof(struct hlist_head) * sc_table.len, GFP_KERNEL);
 797                 if (!syscall_table->syscall_dispatch)
 798                         return -ENOMEM;
 799         }
 800         if (!syscall_table->syscall_exit_dispatch) {
 801                 /* create syscall table mapping syscall to events */
 802                 syscall_table->syscall_exit_dispatch = kzalloc(sizeof(struct hlist_head) * sc_exit_table.len, GFP_KERNEL);
 803                 if (!syscall_table->syscall_exit_dispatch)
 804                         return -ENOMEM;
 805         }
 806
 807 #ifdef CONFIG_COMPAT
 808         if (!syscall_table->compat_syscall_dispatch) {
 809                 /* create syscall table mapping compat syscall to events */
 810                 syscall_table->compat_syscall_dispatch = kzalloc(sizeof(struct hlist_head) * compat_sc_table.len, GFP_KERNEL);
 811                 if (!syscall_table->compat_syscall_dispatch)
 812                         return -ENOMEM;
 813         }
 814
 815         if (!syscall_table->compat_syscall_exit_dispatch) {
 816                 /* create syscall table mapping compat syscall to events */
 817                 syscall_table->compat_syscall_exit_dispatch = kzalloc(sizeof(struct hlist_head) * compat_sc_exit_table.len, GFP_KERNEL);
 818                 if (!syscall_table->compat_syscall_exit_dispatch)
 819                         return -ENOMEM;
 820         }
 821 #endif
 822         if (!syscall_table->sc_filter) {
 823                 syscall_table->sc_filter = kzalloc(sizeof(struct lttng_syscall_filter),
 824                                 GFP_KERNEL);
 825                 if (!syscall_table->sc_filter)
 826                         return -ENOMEM;
 827         }
 828
 829         ret = lttng_syscalls_populate_events(syscall_event_enabler);
 830         if (ret)
 831                 return ret;
 832
 833         ret = lttng_syscalls_create_matching_event_notifiers(syscall_event_enabler);
 834         if (ret)
 835                 return ret;
 836
 837         if (!syscall_table->sys_enter_registered) {
 838                 ret = lttng_wrapper_tracepoint_probe_register("sys_enter",
 839                                 (void *) syscall_entry_event_probe, syscall_table);
 840                 if (ret)
 841                         return ret;
 842                 syscall_table->sys_enter_registered = 1;
 843         }
 844         if (!syscall_table->sys_exit_registered) {
 845                 ret = lttng_wrapper_tracepoint_probe_register("sys_exit",
 846                                 (void *) syscall_exit_event_probe, syscall_table);
 847                 if (ret) {
 848                         WARN_ON_ONCE(lttng_wrapper_tracepoint_probe_unregister("sys_enter",
 849                                 (void *) syscall_entry_event_probe, syscall_table));
 850                         return ret;
 851                 }
 852                 syscall_table->sys_exit_registered = 1;
 853         }
 854
 855         return ret;
 856 }
 857
 858 static
 859 int lttng_syscalls_create_matching_event_notifiers(struct lttng_event_enabler_common *event_enabler)
 860 {
 861         int ret;
 862         enum lttng_kernel_abi_syscall_entryexit entryexit =
 863                         event_enabler->event_param.u.syscall.entryexit;
 864         struct lttng_event_notifier_enabler *event_notifier_enabler;
 865
 866         if (event_enabler->enabler_type != LTTNG_EVENT_ENABLER_TYPE_NOTIFIER)
 867                 return 0;
 868         event_notifier_enabler = container_of(event_enabler, struct lttng_event_notifier_enabler, parent);
 869
 870         if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
 871                 lttng_syscall_event_enabler_create_matching_events(&event_notifier_enabler->parent,
 872                         sc_table.table, sc_table.len, NULL, SC_TYPE_ENTRY);
 873                 lttng_syscall_event_enabler_create_matching_events(&event_notifier_enabler->parent,
 874                         compat_sc_table.table, compat_sc_table.len, NULL, SC_TYPE_COMPAT_ENTRY);
 875                 create_unknown_syscall_event(event_enabler, SC_TYPE_ENTRY);
 876                 create_unknown_syscall_event(event_enabler, SC_TYPE_COMPAT_ENTRY);
 877         }
 878
 879         if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
 880                 lttng_syscall_event_enabler_create_matching_events(&event_notifier_enabler->parent,
 881                         sc_exit_table.table, sc_exit_table.len, NULL, SC_TYPE_EXIT);
 882                 lttng_syscall_event_enabler_create_matching_events(&event_notifier_enabler->parent,
 883                         compat_sc_exit_table.table, compat_sc_exit_table.len, NULL, SC_TYPE_COMPAT_EXIT);
 884                 create_unknown_syscall_event(event_enabler, SC_TYPE_EXIT);
 885                 create_unknown_syscall_event(event_enabler, SC_TYPE_COMPAT_EXIT);
 886         }
 887         return ret;
 888 }
 889
 890 int lttng_syscalls_unregister_syscall_table(struct lttng_kernel_syscall_table *syscall_table)
 891 {
 892         int ret;
 893
 894         if (!syscall_table->syscall_dispatch)
 895                 return 0;
 896         if (syscall_table->sys_enter_registered) {
 897                 ret = lttng_wrapper_tracepoint_probe_unregister("sys_enter",
 898                                 (void *) syscall_entry_event_probe, syscall_table);
 899                 if (ret)
 900                         return ret;
 901                 syscall_table->sys_enter_registered = 0;
 902         }
 903         if (syscall_table->sys_exit_registered) {
 904                 ret = lttng_wrapper_tracepoint_probe_unregister("sys_exit",
 905                                 (void *) syscall_exit_event_probe, syscall_table);
 906                 if (ret)
 907                         return ret;
 908                 syscall_table->sys_exit_registered = 0;
 909         }
 910         return 0;
 911 }
 912
 913 int lttng_syscalls_destroy_syscall_table(struct lttng_kernel_syscall_table *syscall_table)
 914 {
 915         kfree(syscall_table->syscall_dispatch);
 916         kfree(syscall_table->syscall_exit_dispatch);
 917 #ifdef CONFIG_COMPAT
 918         kfree(syscall_table->compat_syscall_dispatch);
 919         kfree(syscall_table->compat_syscall_exit_dispatch);
 920 #endif
 921         kfree(syscall_table->sc_filter);
 922         return 0;
 923 }
 924
 925 static
 926 int get_syscall_nr(const char *syscall_name)
 927 {
 928         int syscall_nr = -1;
 929         int i;
 930
 931         for (i = 0; i < sc_table.len; i++) {
 932                 const struct trace_syscall_entry *entry;
 933                 const char *it_name;
 934
 935                 entry = &sc_table.table[i];
 936                 if (!entry->desc)
 937                         continue;
 938                 it_name = entry->desc->event_name;
 939                 it_name += strlen(SYSCALL_ENTRY_STR);
 940                 if (!strcmp(syscall_name, it_name)) {
 941                         syscall_nr = i;
 942                         break;
 943                 }
 944         }
 945         return syscall_nr;
 946 }
 947
 948 static
 949 int get_compat_syscall_nr(const char *syscall_name)
 950 {
 951         int syscall_nr = -1;
 952         int i;
 953
 954         for (i = 0; i < compat_sc_table.len; i++) {
 955                 const struct trace_syscall_entry *entry;
 956                 const char *it_name;
 957
 958                 entry = &compat_sc_table.table[i];
 959                 if (!entry->desc)
 960                         continue;
 961                 it_name = entry->desc->event_name;
 962                 it_name += strlen(COMPAT_SYSCALL_ENTRY_STR);
 963                 if (!strcmp(syscall_name, it_name)) {
 964                         syscall_nr = i;
 965                         break;
 966                 }
 967         }
 968         return syscall_nr;
 969 }
 970
 971 static
 972 uint32_t get_sc_tables_len(void)
 973 {
 974         return sc_table.len + compat_sc_table.len;
 975 }
 976
 977 static
 978 const char *get_syscall_name(const char *desc_name,
 979                 enum lttng_syscall_abi abi,
 980                 enum lttng_syscall_entryexit entryexit)
 981 {
 982         size_t prefix_len = 0;
 983
 984
 985         switch (entryexit) {
 986         case LTTNG_SYSCALL_ENTRY:
 987                 switch (abi) {
 988                 case LTTNG_SYSCALL_ABI_NATIVE:
 989                         prefix_len = strlen(SYSCALL_ENTRY_STR);
 990                         break;
 991                 case LTTNG_SYSCALL_ABI_COMPAT:
 992                         prefix_len = strlen(COMPAT_SYSCALL_ENTRY_STR);
 993                         break;
 994                 }
 995                 break;
 996         case LTTNG_SYSCALL_EXIT:
 997                 switch (abi) {
 998                 case LTTNG_SYSCALL_ABI_NATIVE:
 999                         prefix_len = strlen(SYSCALL_EXIT_STR);
1000                         break;
1001                 case LTTNG_SYSCALL_ABI_COMPAT:
1002                         prefix_len = strlen(COMPAT_SYSCALL_EXIT_STR);
1003                         break;
1004                 }
1005                 break;
1006         }
1007         WARN_ON_ONCE(prefix_len == 0);
1008         return desc_name + prefix_len;
1009 }
1010
1011 static
1012 int lttng_syscall_filter_enable(
1013                 struct lttng_syscall_filter *filter,
1014                 const char *desc_name, enum lttng_syscall_abi abi,
1015                 enum lttng_syscall_entryexit entryexit)
1016 {
1017         const char *syscall_name;
1018         unsigned long *bitmap;
1019         int syscall_nr;
1020
1021         syscall_name = get_syscall_name(desc_name, abi, entryexit);
1022
1023         switch (abi) {
1024         case LTTNG_SYSCALL_ABI_NATIVE:
1025                 syscall_nr = get_syscall_nr(syscall_name);
1026                 break;
1027         case LTTNG_SYSCALL_ABI_COMPAT:
1028                 syscall_nr = get_compat_syscall_nr(syscall_name);
1029                 break;
1030         default:
1031                 return -EINVAL;
1032         }
1033         if (syscall_nr < 0)
1034                 return -ENOENT;
1035
1036         switch (entryexit) {
1037         case LTTNG_SYSCALL_ENTRY:
1038                 switch (abi) {
1039                 case LTTNG_SYSCALL_ABI_NATIVE:
1040                         bitmap = filter->sc_entry;
1041                         break;
1042                 case LTTNG_SYSCALL_ABI_COMPAT:
1043                         bitmap = filter->sc_compat_entry;
1044                         break;
1045                 default:
1046                         return -EINVAL;
1047                 }
1048                 break;
1049         case LTTNG_SYSCALL_EXIT:
1050                 switch (abi) {
1051                 case LTTNG_SYSCALL_ABI_NATIVE:
1052                         bitmap = filter->sc_exit;
1053                         break;
1054                 case LTTNG_SYSCALL_ABI_COMPAT:
1055                         bitmap = filter->sc_compat_exit;
1056                         break;
1057                 default:
1058                         return -EINVAL;
1059                 }
1060                 break;
1061         default:
1062                 return -EINVAL;
1063         }
1064         if (test_bit(syscall_nr, bitmap))
1065                 return -EEXIST;
1066         bitmap_set(bitmap, syscall_nr, 1);
1067         return 0;
1068 }
1069
1070 int lttng_syscall_filter_enable_event(struct lttng_kernel_event_common *event)
1071 {
1072         struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_event(event);
1073         int ret;
1074
1075         WARN_ON_ONCE(event->priv->instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
1076
1077         ret = lttng_syscall_filter_enable(syscall_table->sc_filter,
1078                 event->priv->desc->event_name, event->priv->u.syscall.abi,
1079                 event->priv->u.syscall.entryexit);
1080         if (ret)
1081                 return ret;
1082
1083         switch (event->type) {
1084         case LTTNG_KERNEL_EVENT_TYPE_RECORDER:
1085                 break;
1086         case LTTNG_KERNEL_EVENT_TYPE_NOTIFIER:
1087         {
1088                 unsigned int syscall_id = event->priv->u.syscall.syscall_id;
1089                 struct hlist_head *dispatch_list;
1090
1091                 switch (event->priv->u.syscall.entryexit) {
1092                 case LTTNG_SYSCALL_ENTRY:
1093                         switch (event->priv->u.syscall.abi) {
1094                         case LTTNG_SYSCALL_ABI_NATIVE:
1095                                 dispatch_list = &syscall_table->syscall_dispatch[syscall_id];
1096                                 break;
1097                         case LTTNG_SYSCALL_ABI_COMPAT:
1098                                 dispatch_list = &syscall_table->compat_syscall_dispatch[syscall_id];
1099                                 break;
1100                         default:
1101                                 ret = -EINVAL;
1102                                 goto end;
1103                         }
1104                         break;
1105                 case LTTNG_SYSCALL_EXIT:
1106                         switch (event->priv->u.syscall.abi) {
1107                         case LTTNG_SYSCALL_ABI_NATIVE:
1108                                 dispatch_list = &syscall_table->syscall_exit_dispatch[syscall_id];
1109                                 break;
1110                         case LTTNG_SYSCALL_ABI_COMPAT:
1111                                 dispatch_list = &syscall_table->compat_syscall_exit_dispatch[syscall_id];
1112                                 break;
1113                         default:
1114                                 ret = -EINVAL;
1115                                 goto end;
1116                         }
1117                         break;
1118                 default:
1119                         ret = -EINVAL;
1120                         goto end;
1121                 }
1122
1123                 hlist_add_head_rcu(&event->priv->u.syscall.node, dispatch_list);
1124                 break;
1125         }
1126         default:
1127                 WARN_ON_ONCE(1);
1128                 return -ENOSYS;
1129         }
1130 end:
1131         return ret;
1132 }
1133
1134 static
1135 int lttng_syscall_filter_disable(struct lttng_syscall_filter *filter,
1136                 const char *desc_name, enum lttng_syscall_abi abi,
1137                 enum lttng_syscall_entryexit entryexit)
1138 {
1139         const char *syscall_name;
1140         unsigned long *bitmap;
1141         int syscall_nr;
1142
1143         syscall_name = get_syscall_name(desc_name, abi, entryexit);
1144
1145         switch (abi) {
1146         case LTTNG_SYSCALL_ABI_NATIVE:
1147                 syscall_nr = get_syscall_nr(syscall_name);
1148                 break;
1149         case LTTNG_SYSCALL_ABI_COMPAT:
1150                 syscall_nr = get_compat_syscall_nr(syscall_name);
1151                 break;
1152         default:
1153                 return -EINVAL;
1154         }
1155         if (syscall_nr < 0)
1156                 return -ENOENT;
1157
1158         switch (entryexit) {
1159         case LTTNG_SYSCALL_ENTRY:
1160                 switch (abi) {
1161                 case LTTNG_SYSCALL_ABI_NATIVE:
1162                         bitmap = filter->sc_entry;
1163                         break;
1164                 case LTTNG_SYSCALL_ABI_COMPAT:
1165                         bitmap = filter->sc_compat_entry;
1166                         break;
1167                 default:
1168                         return -EINVAL;
1169                 }
1170                 break;
1171         case LTTNG_SYSCALL_EXIT:
1172                 switch (abi) {
1173                 case LTTNG_SYSCALL_ABI_NATIVE:
1174                         bitmap = filter->sc_exit;
1175                         break;
1176                 case LTTNG_SYSCALL_ABI_COMPAT:
1177                         bitmap = filter->sc_compat_exit;
1178                         break;
1179                 default:
1180                         return -EINVAL;
1181                 }
1182                 break;
1183         default:
1184                 return -EINVAL;
1185         }
1186         if (!test_bit(syscall_nr, bitmap))
1187                 return -EEXIST;
1188         bitmap_clear(bitmap, syscall_nr, 1);
1189
1190         return 0;
1191 }
1192
1193 int lttng_syscall_filter_disable_event(struct lttng_kernel_event_common *event)
1194 {
1195         struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_event(event);
1196         int ret;
1197
1198         ret = lttng_syscall_filter_disable(syscall_table->sc_filter,
1199                 event->priv->desc->event_name, event->priv->u.syscall.abi,
1200                 event->priv->u.syscall.entryexit);
1201         if (ret)
1202                 return ret;
1203
1204         switch (event->type) {
1205         case LTTNG_KERNEL_EVENT_TYPE_RECORDER:
1206                 break;
1207         case LTTNG_KERNEL_EVENT_TYPE_NOTIFIER:
1208         {
1209                 hlist_del_rcu(&event->priv->u.syscall.node);
1210                 break;
1211         }
1212         default:
1213                 WARN_ON_ONCE(1);
1214                 return -ENOSYS;
1215         }
1216         return 0;
1217 }
1218
1219 void lttng_syscall_table_set_wildcard_all(struct lttng_event_enabler_common *event_enabler)
1220 {
1221         struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(event_enabler);
1222         enum lttng_kernel_abi_syscall_entryexit entryexit;
1223         int enabled = event_enabler->enabled;
1224
1225         if (!lttng_syscall_event_enabler_is_wildcard_all(event_enabler))
1226                 return;
1227         entryexit = event_enabler->event_param.u.syscall.entryexit;
1228         if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT)
1229                 WRITE_ONCE(syscall_table->syscall_all_entry, enabled);
1230
1231         if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT)
1232                 WRITE_ONCE(syscall_table->syscall_all_exit, enabled);
1233 }
1234
1235 static
1236 const struct trace_syscall_entry *syscall_list_get_entry(loff_t *pos)
1237 {
1238         const struct trace_syscall_entry *entry;
1239         int iter = 0;
1240
1241         for (entry = sc_table.table;
1242                         entry < sc_table.table + sc_table.len;
1243                          entry++) {
1244                 if (iter++ >= *pos)
1245                         return entry;
1246         }
1247         for (entry = compat_sc_table.table;
1248                         entry < compat_sc_table.table + compat_sc_table.len;
1249                          entry++) {
1250                 if (iter++ >= *pos)
1251                         return entry;
1252         }
1253         /* End of list */
1254         return NULL;
1255 }
1256
1257 static
1258 void *syscall_list_start(struct seq_file *m, loff_t *pos)
1259 {
1260         return (void *) syscall_list_get_entry(pos);
1261 }
1262
1263 static
1264 void *syscall_list_next(struct seq_file *m, void *p, loff_t *ppos)
1265 {
1266         (*ppos)++;
1267         return (void *) syscall_list_get_entry(ppos);
1268 }
1269
1270 static
1271 void syscall_list_stop(struct seq_file *m, void *p)
1272 {
1273 }
1274
1275 static
1276 int get_sc_table(const struct trace_syscall_entry *entry,
1277                 const struct trace_syscall_entry **table,
1278                 unsigned int *bitness)
1279 {
1280         if (entry >= sc_table.table && entry < sc_table.table + sc_table.len) {
1281                 if (bitness)
1282                         *bitness = BITS_PER_LONG;
1283                 if (table)
1284                         *table = sc_table.table;
1285                 return 0;
1286         }
1287         if (!(entry >= compat_sc_table.table
1288                         && entry < compat_sc_table.table + compat_sc_table.len)) {
1289                 return -EINVAL;
1290         }
1291         if (bitness)
1292                 *bitness = 32;
1293         if (table)
1294                 *table = compat_sc_table.table;
1295         return 0;
1296 }
1297
1298 static
1299 int syscall_list_show(struct seq_file *m, void *p)
1300 {
1301         const struct trace_syscall_entry *table, *entry = p;
1302         unsigned int bitness;
1303         unsigned long index;
1304         int ret;
1305         const char *name;
1306
1307         ret = get_sc_table(entry, &table, &bitness);
1308         if (ret)
1309                 return ret;
1310         if (!entry->desc)
1311                 return 0;
1312         if (table == sc_table.table) {
1313                 index = entry - table;
1314                 name = &entry->desc->event_name[strlen(SYSCALL_ENTRY_STR)];
1315         } else {
1316                 index = (entry - table) + sc_table.len;
1317                 name = &entry->desc->event_name[strlen(COMPAT_SYSCALL_ENTRY_STR)];
1318         }
1319         seq_printf(m,   "syscall { index = %lu; name = %s; bitness = %u; };\n",
1320                 index, name, bitness);
1321         return 0;
1322 }
1323
1324 static
1325 const struct seq_operations lttng_syscall_list_seq_ops = {
1326         .start = syscall_list_start,
1327         .next = syscall_list_next,
1328         .stop = syscall_list_stop,
1329         .show = syscall_list_show,
1330 };
1331
1332 static
1333 int lttng_syscall_list_open(struct inode *inode, struct file *file)
1334 {
1335         return seq_open(file, &lttng_syscall_list_seq_ops);
1336 }
1337
1338 const struct file_operations lttng_syscall_list_fops = {
1339         .owner = THIS_MODULE,
1340         .open = lttng_syscall_list_open,
1341         .read = seq_read,
1342         .llseek = seq_lseek,
1343         .release = seq_release,
1344 };
1345
1346 /*
1347  * A syscall is enabled if it is traced for either entry or exit.
1348  */
1349 long lttng_syscall_table_get_active_mask(struct lttng_kernel_syscall_table *syscall_table,
1350                 struct lttng_kernel_abi_syscall_mask __user *usyscall_mask)
1351 {
1352         uint32_t len, sc_tables_len, bitmask_len;
1353         int ret = 0, bit;
1354         char *tmp_mask;
1355         struct lttng_syscall_filter *filter;
1356
1357         ret = get_user(len, &usyscall_mask->len);
1358         if (ret)
1359                 return ret;
1360         sc_tables_len = get_sc_tables_len();
1361         bitmask_len = ALIGN(sc_tables_len, 8) >> 3;
1362         if (len < sc_tables_len) {
1363                 return put_user(sc_tables_len, &usyscall_mask->len);
1364         }
1365         /* Array is large enough, we can copy array to user-space. */
1366         tmp_mask = kzalloc(bitmask_len, GFP_KERNEL);
1367         if (!tmp_mask)
1368                 return -ENOMEM;
1369         filter = syscall_table->sc_filter;
1370
1371         for (bit = 0; bit < sc_table.len; bit++) {
1372                 char state;
1373
1374                 if (syscall_table->syscall_dispatch) {
1375                         if (!(READ_ONCE(syscall_table->syscall_all_entry)
1376                                         || READ_ONCE(syscall_table->syscall_all_exit)) && filter)
1377                                 state = test_bit(bit, filter->sc_entry)
1378                                         || test_bit(bit, filter->sc_exit);
1379                         else
1380                                 state = 1;
1381                 } else {
1382                         state = 0;
1383                 }
1384                 bt_bitfield_write_be(tmp_mask, char, bit, 1, state);
1385         }
1386         for (; bit < sc_tables_len; bit++) {
1387                 char state;
1388
1389                 if (syscall_table->compat_syscall_dispatch) {
1390                         if (!(READ_ONCE(syscall_table->syscall_all_entry)
1391                                         || READ_ONCE(syscall_table->syscall_all_exit)) && filter)
1392                                 state = test_bit(bit - sc_table.len,
1393                                                 filter->sc_compat_entry)
1394                                         || test_bit(bit - sc_table.len,
1395                                                 filter->sc_compat_exit);
1396                         else
1397                                 state = 1;
1398                 } else {
1399                         state = 0;
1400                 }
1401                 bt_bitfield_write_be(tmp_mask, char, bit, 1, state);
1402         }
1403         if (copy_to_user(usyscall_mask->mask, tmp_mask, bitmask_len))
1404                 ret = -EFAULT;
1405         kfree(tmp_mask);
1406         return ret;
1407 }
1408
1409 int lttng_abi_syscall_list(void)
1410 {
1411         struct file *syscall_list_file;
1412         int file_fd, ret;
1413
1414         file_fd = lttng_get_unused_fd();
1415         if (file_fd < 0) {
1416                 ret = file_fd;
1417                 goto fd_error;
1418         }
1419
1420         syscall_list_file = anon_inode_getfile("[lttng_syscall_list]",
1421                                           &lttng_syscall_list_fops,
1422                                           NULL, O_RDWR);
1423         if (IS_ERR(syscall_list_file)) {
1424                 ret = PTR_ERR(syscall_list_file);
1425                 goto file_error;
1426         }
1427         ret = lttng_syscall_list_fops.open(NULL, syscall_list_file);
1428         if (ret < 0)
1429                 goto open_error;
1430         fd_install(file_fd, syscall_list_file);
1431         return file_fd;
1432
1433 open_error:
1434         fput(syscall_list_file);
1435 file_error:
1436         put_unused_fd(file_fd);
1437 fd_error:
1438         return ret;
1439 }