src/lttng-syscalls.c

   1 /* SPDX-License-Identifier: (GPL-2.0-only or LGPL-2.1-only)
   2  *
   3  * lttng-syscalls.c
   4  *
   5  * LTTng syscall probes.
   6  *
   7  * Copyright (C) 2010-2012 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
   8  */
   9
  10 #include <linux/module.h>
  11 #include <linux/slab.h>
  12 #include <linux/compat.h>
  13 #include <linux/err.h>
  14 #include <linux/bitmap.h>
  15 #include <linux/in.h>
  16 #include <linux/in6.h>
  17 #include <linux/seq_file.h>
  18 #include <linux/stringify.h>
  19 #include <linux/file.h>
  20 #include <linux/anon_inodes.h>
  21 #include <linux/fcntl.h>
  22 #include <linux/mman.h>
  23 #include <asm/ptrace.h>
  24 #include <asm/syscall.h>
  25
  26 #include <lttng/bitfield.h>
  27 #include <wrapper/tracepoint.h>
  28 #include <wrapper/file.h>
  29 #include <wrapper/rcu.h>
  30 #include <wrapper/syscall.h>
  31 #include <lttng/events.h>
  32 #include <lttng/events-internal.h>
  33 #include <lttng/utils.h>
  34
  35 #include "lttng-syscalls.h"
  36
  37 #ifndef CONFIG_COMPAT
  38 # ifndef is_compat_task
  39 #  define is_compat_task()      (0)
  40 # endif
  41 #endif
  42
  43 /* in_compat_syscall appears in kernel 4.6. */
  44 #ifndef in_compat_syscall
  45  #define in_compat_syscall()    is_compat_task()
  46 #endif
  47
  48 enum sc_type {
  49         SC_TYPE_ENTRY,
  50         SC_TYPE_EXIT,
  51         SC_TYPE_COMPAT_ENTRY,
  52         SC_TYPE_COMPAT_EXIT,
  53 };
  54
  55 #define SYSCALL_ENTRY_TOK               syscall_entry_
  56 #define COMPAT_SYSCALL_ENTRY_TOK        compat_syscall_entry_
  57 #define SYSCALL_EXIT_TOK                syscall_exit_
  58 #define COMPAT_SYSCALL_EXIT_TOK         compat_syscall_exit_
  59
  60 #define SYSCALL_ENTRY_STR               __stringify(SYSCALL_ENTRY_TOK)
  61 #define COMPAT_SYSCALL_ENTRY_STR        __stringify(COMPAT_SYSCALL_ENTRY_TOK)
  62 #define SYSCALL_EXIT_STR                __stringify(SYSCALL_EXIT_TOK)
  63 #define COMPAT_SYSCALL_EXIT_STR         __stringify(COMPAT_SYSCALL_EXIT_TOK)
  64
  65 void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id);
  66 void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret);
  67
  68 /*
  69  * Forward declarations for old kernels.
  70  */
  71 struct mmsghdr;
  72 struct rlimit64;
  73 struct oldold_utsname;
  74 struct old_utsname;
  75 struct sel_arg_struct;
  76 struct mmap_arg_struct;
  77 struct file_handle;
  78 struct user_msghdr;
  79
  80 /*
  81  * Forward declaration for kernels >= 5.6
  82  */
  83 struct timex;
  84 struct timeval;
  85 struct itimerval;
  86 struct itimerspec;
  87
  88 #if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(5,6,0))
  89 typedef __kernel_old_time_t time_t;
  90 #endif
  91
  92 #ifdef IA32_NR_syscalls
  93 #define NR_compat_syscalls IA32_NR_syscalls
  94 #else
  95 #define NR_compat_syscalls NR_syscalls
  96 #endif
  97
  98 /*
  99  * Create LTTng tracepoint probes.
 100  */
 101 #define LTTNG_PACKAGE_BUILD
 102 #define CREATE_TRACE_POINTS
 103 #define TP_MODULE_NOINIT
 104 #define TRACE_INCLUDE_PATH instrumentation/syscalls/headers
 105
 106 #define PARAMS(args...) args
 107
 108 /* Handle unknown syscalls */
 109 #undef TRACE_SYSTEM
 110 #define TRACE_SYSTEM syscalls_unknown
 111 #include <instrumentation/syscalls/headers/syscalls_unknown.h>
 112 #undef TRACE_SYSTEM
 113
 114 #undef TP_PROBE_CB
 115
 116 extern const struct trace_syscall_table sc_table;
 117 extern const struct trace_syscall_table compat_sc_table;
 118
 119 /* Event syscall exit table */
 120 extern const struct trace_syscall_table sc_exit_table;
 121 extern const struct trace_syscall_table compat_sc_exit_table;
 122
 123
 124 #undef SC_EXIT
 125
 126 #undef CREATE_SYSCALL_TABLE
 127
 128 struct lttng_syscall_filter {
 129         DECLARE_BITMAP(sc_entry, NR_syscalls);
 130         DECLARE_BITMAP(sc_exit, NR_syscalls);
 131         DECLARE_BITMAP(sc_compat_entry, NR_compat_syscalls);
 132         DECLARE_BITMAP(sc_compat_exit, NR_compat_syscalls);
 133
 134         /*
 135          * Reference counters keeping track of number of events enabled
 136          * for each bit.
 137          */
 138         u32 sc_entry_refcount_map[NR_syscalls];
 139         u32 sc_exit_refcount_map[NR_syscalls];
 140         u32 sc_compat_entry_refcount_map[NR_compat_syscalls];
 141         u32 sc_compat_exit_refcount_map[NR_compat_syscalls];
 142 };
 143
 144 static void syscall_entry_event_unknown(struct hlist_head *unknown_action_list_head,
 145         struct pt_regs *regs, long id)
 146 {
 147         unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 148         struct lttng_kernel_event_common_private *event_priv;
 149
 150         lttng_syscall_get_arguments(current, regs, args);
 151         lttng_hlist_for_each_entry_rcu(event_priv, unknown_action_list_head, u.syscall.node) {
 152                 if (unlikely(in_compat_syscall()))
 153                         __event_probe__compat_syscall_entry_unknown(event_priv->pub, id, args);
 154                 else
 155                         __event_probe__syscall_entry_unknown(event_priv->pub, id, args);
 156         }
 157 }
 158
 159 static __always_inline
 160 void syscall_entry_event_call_func(struct hlist_head *action_list,
 161                 void *func, unsigned int nrargs,
 162                 struct pt_regs *regs)
 163 {
 164         struct lttng_kernel_event_common_private *event_priv;
 165
 166         switch (nrargs) {
 167         case 0:
 168         {
 169                 void (*fptr)(void *__data) = func;
 170
 171                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 172                         fptr(event_priv->pub);
 173                 break;
 174         }
 175         case 1:
 176         {
 177                 void (*fptr)(void *__data, unsigned long arg0) = func;
 178                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 179
 180                 lttng_syscall_get_arguments(current, regs, args);
 181                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 182                         fptr(event_priv->pub, args[0]);
 183                 break;
 184         }
 185         case 2:
 186         {
 187                 void (*fptr)(void *__data,
 188                         unsigned long arg0,
 189                         unsigned long arg1) = func;
 190                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 191
 192                 lttng_syscall_get_arguments(current, regs, args);
 193                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 194                         fptr(event_priv->pub, args[0], args[1]);
 195                 break;
 196         }
 197         case 3:
 198         {
 199                 void (*fptr)(void *__data,
 200                         unsigned long arg0,
 201                         unsigned long arg1,
 202                         unsigned long arg2) = func;
 203                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 204
 205                 lttng_syscall_get_arguments(current, regs, args);
 206                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 207                         fptr(event_priv->pub, args[0], args[1], args[2]);
 208                 break;
 209         }
 210         case 4:
 211         {
 212                 void (*fptr)(void *__data,
 213                         unsigned long arg0,
 214                         unsigned long arg1,
 215                         unsigned long arg2,
 216                         unsigned long arg3) = func;
 217                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 218
 219                 lttng_syscall_get_arguments(current, regs, args);
 220                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 221                         fptr(event_priv->pub, args[0], args[1], args[2], args[3]);
 222                 break;
 223         }
 224         case 5:
 225         {
 226                 void (*fptr)(void *__data,
 227                         unsigned long arg0,
 228                         unsigned long arg1,
 229                         unsigned long arg2,
 230                         unsigned long arg3,
 231                         unsigned long arg4) = func;
 232                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 233
 234                 lttng_syscall_get_arguments(current, regs, args);
 235                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 236                         fptr(event_priv->pub, args[0], args[1], args[2], args[3], args[4]);
 237                 break;
 238         }
 239         case 6:
 240         {
 241                 void (*fptr)(void *__data,
 242                         unsigned long arg0,
 243                         unsigned long arg1,
 244                         unsigned long arg2,
 245                         unsigned long arg3,
 246                         unsigned long arg4,
 247                         unsigned long arg5) = func;
 248                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 249
 250                 lttng_syscall_get_arguments(current, regs, args);
 251                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 252                         fptr(event_priv->pub, args[0], args[1], args[2],
 253                              args[3], args[4], args[5]);
 254                 break;
 255         }
 256         default:
 257                 break;
 258         }
 259 }
 260
 261 void syscall_entry_event_probe(void *__data, struct pt_regs *regs, long id)
 262 {
 263         struct lttng_kernel_syscall_table *syscall_table = __data;
 264         struct hlist_head *action_list, *unknown_action_list;
 265         const struct trace_syscall_entry *table, *entry;
 266         size_t table_len;
 267
 268         if (unlikely(in_compat_syscall())) {
 269                 struct lttng_syscall_filter *filter = syscall_table->sc_filter;
 270
 271                 if (id < 0 || id >= NR_compat_syscalls
 272                         || (!READ_ONCE(syscall_table->syscall_all_entry) && !test_bit(id, filter->sc_compat_entry))) {
 273                         /* System call filtered out. */
 274                         return;
 275                 }
 276                 table = compat_sc_table.table;
 277                 table_len = compat_sc_table.len;
 278                 unknown_action_list = &syscall_table->compat_unknown_syscall_dispatch;
 279         } else {
 280                 struct lttng_syscall_filter *filter = syscall_table->sc_filter;
 281
 282                 if (id < 0 || id >= NR_syscalls
 283                         || (!READ_ONCE(syscall_table->syscall_all_entry) && !test_bit(id, filter->sc_entry))) {
 284                         /* System call filtered out. */
 285                         return;
 286                 }
 287                 table = sc_table.table;
 288                 table_len = sc_table.len;
 289                 unknown_action_list = &syscall_table->unknown_syscall_dispatch;
 290         }
 291         if (unlikely(id < 0 || id >= table_len)) {
 292                 syscall_entry_event_unknown(unknown_action_list, regs, id);
 293                 return;
 294         }
 295
 296         entry = &table[id];
 297         if (!entry->event_func) {
 298                 syscall_entry_event_unknown(unknown_action_list, regs, id);
 299                 return;
 300         }
 301
 302         if (unlikely(in_compat_syscall())) {
 303                 action_list = &syscall_table->compat_syscall_dispatch[id];
 304         } else {
 305                 action_list = &syscall_table->syscall_dispatch[id];
 306         }
 307         if (unlikely(hlist_empty(action_list)))
 308                 return;
 309
 310         syscall_entry_event_call_func(action_list, entry->event_func, entry->nrargs, regs);
 311 }
 312
 313 static void syscall_exit_event_unknown(struct hlist_head *unknown_action_list_head,
 314         struct pt_regs *regs, long id, long ret)
 315 {
 316         unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 317         struct lttng_kernel_event_common_private *event_priv;
 318
 319         lttng_syscall_get_arguments(current, regs, args);
 320         lttng_hlist_for_each_entry_rcu(event_priv, unknown_action_list_head, u.syscall.node) {
 321                 if (unlikely(in_compat_syscall()))
 322                         __event_probe__compat_syscall_exit_unknown(event_priv->pub, id, ret,
 323                                 args);
 324                 else
 325                         __event_probe__syscall_exit_unknown(event_priv->pub, id, ret, args);
 326         }
 327 }
 328
 329 static __always_inline
 330 void syscall_exit_event_call_func(struct hlist_head *action_list,
 331                 void *func, unsigned int nrargs,
 332                 struct pt_regs *regs, long ret)
 333 {
 334         struct lttng_kernel_event_common_private *event_priv;
 335
 336         switch (nrargs) {
 337         case 0:
 338         {
 339                 void (*fptr)(void *__data, long ret) = func;
 340
 341                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 342                         fptr(event_priv->pub, ret);
 343                 break;
 344         }
 345         case 1:
 346         {
 347                 void (*fptr)(void *__data,
 348                         long ret,
 349                         unsigned long arg0) = func;
 350                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 351
 352                 lttng_syscall_get_arguments(current, regs, args);
 353                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 354                         fptr(event_priv->pub, ret, args[0]);
 355                 break;
 356         }
 357         case 2:
 358         {
 359                 void (*fptr)(void *__data,
 360                         long ret,
 361                         unsigned long arg0,
 362                         unsigned long arg1) = func;
 363                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 364
 365                 lttng_syscall_get_arguments(current, regs, args);
 366                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 367                         fptr(event_priv->pub, ret, args[0], args[1]);
 368                 break;
 369         }
 370         case 3:
 371         {
 372                 void (*fptr)(void *__data,
 373                         long ret,
 374                         unsigned long arg0,
 375                         unsigned long arg1,
 376                         unsigned long arg2) = func;
 377                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 378
 379                 lttng_syscall_get_arguments(current, regs, args);
 380                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 381                         fptr(event_priv->pub, ret, args[0], args[1], args[2]);
 382                 break;
 383         }
 384         case 4:
 385         {
 386                 void (*fptr)(void *__data,
 387                         long ret,
 388                         unsigned long arg0,
 389                         unsigned long arg1,
 390                         unsigned long arg2,
 391                         unsigned long arg3) = func;
 392                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 393
 394                 lttng_syscall_get_arguments(current, regs, args);
 395                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 396                         fptr(event_priv->pub, ret, args[0], args[1], args[2], args[3]);
 397                 break;
 398         }
 399         case 5:
 400         {
 401                 void (*fptr)(void *__data,
 402                         long ret,
 403                         unsigned long arg0,
 404                         unsigned long arg1,
 405                         unsigned long arg2,
 406                         unsigned long arg3,
 407                         unsigned long arg4) = func;
 408                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 409
 410                 lttng_syscall_get_arguments(current, regs, args);
 411                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 412                         fptr(event_priv->pub, ret, args[0], args[1], args[2], args[3], args[4]);
 413                 break;
 414         }
 415         case 6:
 416         {
 417                 void (*fptr)(void *__data,
 418                         long ret,
 419                         unsigned long arg0,
 420                         unsigned long arg1,
 421                         unsigned long arg2,
 422                         unsigned long arg3,
 423                         unsigned long arg4,
 424                         unsigned long arg5) = func;
 425                 unsigned long args[LTTNG_SYSCALL_NR_ARGS];
 426
 427                 lttng_syscall_get_arguments(current, regs, args);
 428                 lttng_hlist_for_each_entry_rcu(event_priv, action_list, u.syscall.node)
 429                         fptr(event_priv->pub, ret, args[0], args[1], args[2],
 430                              args[3], args[4], args[5]);
 431                 break;
 432         }
 433         default:
 434                 break;
 435         }
 436 }
 437
 438 void syscall_exit_event_probe(void *__data, struct pt_regs *regs, long ret)
 439 {
 440         struct lttng_kernel_syscall_table *syscall_table = __data;
 441         struct hlist_head *action_list, *unknown_action_list;
 442         const struct trace_syscall_entry *table, *entry;
 443         size_t table_len;
 444         long id;
 445
 446         id = syscall_get_nr(current, regs);
 447
 448         if (unlikely(in_compat_syscall())) {
 449                 struct lttng_syscall_filter *filter = syscall_table->sc_filter;
 450
 451                 if (id < 0 || id >= NR_compat_syscalls
 452                         || (!READ_ONCE(syscall_table->syscall_all_exit) && !test_bit(id, filter->sc_compat_exit))) {
 453                         /* System call filtered out. */
 454                         return;
 455                 }
 456                 table = compat_sc_exit_table.table;
 457                 table_len = compat_sc_exit_table.len;
 458                 unknown_action_list = &syscall_table->compat_unknown_syscall_exit_dispatch;
 459         } else {
 460                 struct lttng_syscall_filter *filter = syscall_table->sc_filter;
 461
 462                 if (id < 0 || id >= NR_syscalls
 463                         || (!READ_ONCE(syscall_table->syscall_all_exit) && !test_bit(id, filter->sc_exit))) {
 464                         /* System call filtered out. */
 465                         return;
 466                 }
 467                 table = sc_exit_table.table;
 468                 table_len = sc_exit_table.len;
 469                 unknown_action_list = &syscall_table->unknown_syscall_exit_dispatch;
 470         }
 471         if (unlikely(id < 0 || id >= table_len)) {
 472                 syscall_exit_event_unknown(unknown_action_list, regs, id, ret);
 473                 return;
 474         }
 475
 476         entry = &table[id];
 477         if (!entry->event_func) {
 478                 syscall_exit_event_unknown(unknown_action_list, regs, id, ret);
 479                 return;
 480         }
 481
 482         if (unlikely(in_compat_syscall())) {
 483                 action_list = &syscall_table->compat_syscall_exit_dispatch[id];
 484         } else {
 485                 action_list = &syscall_table->syscall_exit_dispatch[id];
 486         }
 487         if (unlikely(hlist_empty(action_list)))
 488                 return;
 489
 490         syscall_exit_event_call_func(action_list, entry->event_func, entry->nrargs,
 491                                regs, ret);
 492 }
 493
 494 static
 495 struct lttng_kernel_syscall_table *get_syscall_table_from_enabler(struct lttng_event_enabler_common *event_enabler)
 496 {
 497         switch (event_enabler->enabler_type) {
 498         case LTTNG_EVENT_ENABLER_TYPE_RECORDER:
 499         {
 500                 struct lttng_event_recorder_enabler *event_recorder_enabler =
 501                         container_of(event_enabler, struct lttng_event_recorder_enabler, parent);
 502                 return &event_recorder_enabler->chan->priv->parent.syscall_table;
 503         }
 504         case LTTNG_EVENT_ENABLER_TYPE_NOTIFIER:
 505         {
 506                 struct lttng_event_notifier_enabler *event_notifier_enabler =
 507                         container_of(event_enabler, struct lttng_event_notifier_enabler, parent);
 508                 return &event_notifier_enabler->group->syscall_table;
 509         }
 510         default:
 511                 return NULL;
 512         }
 513 }
 514
 515 static
 516 struct lttng_kernel_syscall_table *get_syscall_table_from_event(struct lttng_kernel_event_common *event)
 517 {
 518         switch (event->type) {
 519         case LTTNG_KERNEL_EVENT_TYPE_RECORDER:
 520         {
 521                 struct lttng_kernel_event_recorder *event_recorder =
 522                         container_of(event, struct lttng_kernel_event_recorder, parent);
 523                 return &event_recorder->chan->priv->parent.syscall_table;
 524         }
 525         case LTTNG_KERNEL_EVENT_TYPE_NOTIFIER:
 526         {
 527                 struct lttng_kernel_event_notifier *event_notifier =
 528                         container_of(event, struct lttng_kernel_event_notifier, parent);
 529                 return &event_notifier->priv->group->syscall_table;
 530         }
 531         default:
 532                 return NULL;
 533         }
 534 }
 535
 536 static
 537 void lttng_syscall_event_enabler_create_event(struct lttng_event_enabler_common *syscall_event_enabler,
 538                 const struct lttng_kernel_event_desc *desc, struct hlist_head *dispatch_table,
 539                 enum sc_type type, unsigned int syscall_nr)
 540 {
 541         struct lttng_kernel_event_common *event;
 542
 543         switch (syscall_event_enabler->enabler_type) {
 544         case LTTNG_EVENT_ENABLER_TYPE_RECORDER:
 545         {
 546                 struct lttng_event_recorder_enabler *syscall_event_recorder_enabler =
 547                         container_of(syscall_event_enabler, struct lttng_event_recorder_enabler, parent);
 548                 struct lttng_event_recorder_enabler *event_recorder_enabler;
 549                 struct lttng_kernel_abi_event ev;
 550
 551                 /* We need to create an event for this syscall/enabler. */
 552                 memset(&ev, 0, sizeof(ev));
 553                 switch (type) {
 554                 case SC_TYPE_ENTRY:
 555                         ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
 556                         ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
 557                         break;
 558                 case SC_TYPE_EXIT:
 559                         ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
 560                         ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
 561                         break;
 562                 case SC_TYPE_COMPAT_ENTRY:
 563                         ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
 564                         ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
 565                         break;
 566                 case SC_TYPE_COMPAT_EXIT:
 567                         ev.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
 568                         ev.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
 569                         break;
 570                 }
 571                 strncpy(ev.name, desc->event_name, LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1);
 572                 ev.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 573                 ev.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
 574                 event_recorder_enabler = lttng_event_recorder_enabler_create(LTTNG_ENABLER_FORMAT_NAME, &ev,
 575                                 syscall_event_recorder_enabler->chan);
 576                 WARN_ON_ONCE(!event_recorder_enabler);
 577                 if (!event_recorder_enabler)
 578                         return;
 579                 event = _lttng_kernel_event_create(&event_recorder_enabler->parent, desc);
 580                 WARN_ON_ONCE(IS_ERR(event));
 581                 lttng_event_enabler_destroy(&event_recorder_enabler->parent);
 582                 if (IS_ERR(event)) {
 583                         printk(KERN_INFO "Unable to create event recorder %s\n", desc->event_name);
 584                         return;
 585                 }
 586                 event->priv->u.syscall.syscall_id = syscall_nr;
 587                 if (dispatch_table)
 588                         hlist_add_head_rcu(&event->priv->u.syscall.node, dispatch_table);
 589                 break;
 590         }
 591         case LTTNG_EVENT_ENABLER_TYPE_NOTIFIER:
 592         {
 593                 struct lttng_event_notifier_enabler *syscall_event_notifier_enabler =
 594                         container_of(syscall_event_enabler, struct lttng_event_notifier_enabler, parent);
 595                 struct lttng_event_notifier_enabler *event_notifier_enabler;
 596                 struct lttng_kernel_abi_event_notifier event_notifier_param;
 597                 uint64_t user_token = syscall_event_enabler->user_token;
 598                 uint64_t error_counter_index = syscall_event_notifier_enabler->error_counter_index;
 599
 600                 memset(&event_notifier_param, 0, sizeof(event_notifier_param));
 601                 switch (type) {
 602                 case SC_TYPE_ENTRY:
 603                         event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
 604                         event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
 605                         break;
 606                 case SC_TYPE_EXIT:
 607                         event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
 608                         event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_NATIVE;
 609                         break;
 610                 case SC_TYPE_COMPAT_ENTRY:
 611                         event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
 612                         event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
 613                         break;
 614                 case SC_TYPE_COMPAT_EXIT:
 615                         event_notifier_param.event.u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
 616                         event_notifier_param.event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_COMPAT;
 617                         break;
 618                 }
 619                 strncat(event_notifier_param.event.name, desc->event_name,
 620                         LTTNG_KERNEL_ABI_SYM_NAME_LEN - strlen(event_notifier_param.event.name) - 1);
 621                 event_notifier_param.event.name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 622                 event_notifier_param.event.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
 623                 event_notifier_param.event.token = user_token;
 624                 event_notifier_param.error_counter_index = error_counter_index;
 625
 626                 event_notifier_enabler = lttng_event_notifier_enabler_create(LTTNG_ENABLER_FORMAT_NAME,
 627                                 &event_notifier_param, syscall_event_notifier_enabler->group);
 628                 WARN_ON_ONCE(!event_notifier_enabler);
 629                 event = _lttng_kernel_event_create(&event_notifier_enabler->parent, desc);
 630                 WARN_ON_ONCE(IS_ERR(event));
 631                 lttng_event_enabler_destroy(&event_notifier_enabler->parent);
 632                 if (IS_ERR(event)) {
 633                         printk(KERN_INFO "Unable to create event notifier %s\n", desc->event_name);
 634                         return;
 635                 }
 636                 event->priv->u.syscall.syscall_id = syscall_nr;
 637                 if (dispatch_table)
 638                         hlist_add_head_rcu(&event->priv->u.syscall.node, dispatch_table);
 639                 break;
 640         }
 641         default:
 642                 break;
 643         }
 644 }
 645
 646 static
 647 void lttng_syscall_event_enabler_create_matching_syscall_table_events(struct lttng_event_enabler_common *syscall_event_enabler_common,
 648                 const struct trace_syscall_entry *table, size_t table_len, enum sc_type type)
 649 {
 650         struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(syscall_event_enabler_common);
 651         const struct lttng_kernel_event_desc *desc;
 652         unsigned int i;
 653
 654 #ifndef CONFIG_COMPAT
 655         if (type == SC_TYPE_COMPAT_ENTRY || type == SC_TYPE_COMPAT_EXIT)
 656                 return;
 657 #endif
 658         /* iterate over all syscall and create event that match */
 659         for (i = 0; i < table_len; i++) {
 660                 struct lttng_kernel_event_common_private *event_priv;
 661                 struct hlist_head *head;
 662                 bool found = false;
 663
 664                 desc = table[i].desc;
 665                 if (!desc) {
 666                         /* Unknown syscall */
 667                         continue;
 668                 }
 669
 670                 if (!lttng_desc_match_enabler(desc, syscall_event_enabler_common))
 671                         continue;
 672
 673                 /*
 674                  * Check if already created.
 675                  */
 676                 head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
 677                 lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
 678                         if (lttng_event_enabler_desc_match_event(syscall_event_enabler_common, desc, event_priv->pub)) {
 679                                 found = true;
 680                                 break;
 681                         }
 682                 }
 683                 if (found)
 684                         continue;
 685
 686                 lttng_syscall_event_enabler_create_event(syscall_event_enabler_common, desc, NULL, type, i);
 687         }
 688 }
 689
 690 static
 691 bool lttng_syscall_event_enabler_is_wildcard_all(struct lttng_event_enabler_common *event_enabler)
 692 {
 693         if (event_enabler->event_param.instrumentation != LTTNG_KERNEL_ABI_SYSCALL)
 694                 return false;
 695         if (event_enabler->event_param.u.syscall.abi != LTTNG_KERNEL_ABI_SYSCALL_ABI_ALL)
 696                 return false;
 697         if (event_enabler->event_param.u.syscall.match != LTTNG_KERNEL_ABI_SYSCALL_MATCH_NAME)
 698                 return false;
 699         if (strcmp(event_enabler->event_param.name, "*"))
 700                 return false;
 701         return true;
 702 }
 703
 704 static
 705 void create_unknown_syscall_event(struct lttng_event_enabler_common *event_enabler, enum sc_type type)
 706 {
 707         struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(event_enabler);
 708         struct lttng_event_ht *events_ht = lttng_get_event_ht_from_enabler(event_enabler);
 709         struct lttng_kernel_event_common_private *event_priv;
 710         const struct lttng_kernel_event_desc *desc;
 711         struct hlist_head *unknown_dispatch_list;
 712         bool found = false;
 713         struct hlist_head *head;
 714
 715 #ifndef CONFIG_COMPAT
 716         if (type == SC_TYPE_COMPAT_ENTRY || type == SC_TYPE_COMPAT_EXIT)
 717                 return;
 718 #endif
 719         /*
 720          * Considering that currently system calls can only be enabled on a per
 721          * name basis (or wildcard based on a name), unknown syscall events are
 722          * only used when matching *all* system calls, because this is the only
 723          * case which can be associated with an unknown system call.
 724          *
 725          * When enabling system call on a per system call number basis will be
 726          * supported, this will need to be revisited.
 727          */
 728         if (!lttng_syscall_event_enabler_is_wildcard_all(event_enabler))
 729                 return;
 730
 731         switch (type) {
 732         case SC_TYPE_ENTRY:
 733                 desc = &__event_desc___syscall_entry_unknown;
 734                 unknown_dispatch_list = &syscall_table->unknown_syscall_dispatch;
 735                 break;
 736         case SC_TYPE_EXIT:
 737                 desc = &__event_desc___syscall_exit_unknown;
 738                 unknown_dispatch_list = &syscall_table->unknown_syscall_exit_dispatch;
 739                 break;
 740         case SC_TYPE_COMPAT_ENTRY:
 741                 desc = &__event_desc___compat_syscall_entry_unknown;
 742                 unknown_dispatch_list = &syscall_table->compat_unknown_syscall_dispatch;
 743                 break;
 744         case SC_TYPE_COMPAT_EXIT:
 745                 desc = &__event_desc___compat_syscall_exit_unknown;
 746                 unknown_dispatch_list = &syscall_table->compat_unknown_syscall_exit_dispatch;
 747                 break;
 748         default:
 749                 WARN_ON_ONCE(1);
 750         }
 751
 752         /*
 753          * Check if already created.
 754          */
 755         head = utils_borrow_hash_table_bucket(events_ht->table, LTTNG_EVENT_HT_SIZE, desc->event_name);
 756         lttng_hlist_for_each_entry(event_priv, head, hlist_node) {
 757                 if (lttng_event_enabler_desc_match_event(event_enabler, desc, event_priv->pub)) {
 758                         found = true;
 759                         break;
 760                 }
 761         }
 762         if (!found)
 763                 lttng_syscall_event_enabler_create_event(event_enabler, desc, unknown_dispatch_list, type, -1U);
 764 }
 765
 766 static
 767 void lttng_syscall_event_enabler_create_matching_events(struct lttng_event_enabler_common *event_enabler)
 768 {
 769         enum lttng_kernel_abi_syscall_entryexit entryexit = event_enabler->event_param.u.syscall.entryexit;
 770
 771         if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
 772                 lttng_syscall_event_enabler_create_matching_syscall_table_events(event_enabler,
 773                         sc_table.table, sc_table.len, SC_TYPE_ENTRY);
 774                 lttng_syscall_event_enabler_create_matching_syscall_table_events(event_enabler,
 775                         compat_sc_table.table, compat_sc_table.len, SC_TYPE_COMPAT_ENTRY);
 776                 create_unknown_syscall_event(event_enabler, SC_TYPE_ENTRY);
 777                 create_unknown_syscall_event(event_enabler, SC_TYPE_COMPAT_ENTRY);
 778         }
 779
 780         if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT) {
 781                 lttng_syscall_event_enabler_create_matching_syscall_table_events(event_enabler,
 782                         sc_exit_table.table, sc_exit_table.len, SC_TYPE_EXIT);
 783                 lttng_syscall_event_enabler_create_matching_syscall_table_events(event_enabler,
 784                         compat_sc_exit_table.table, compat_sc_exit_table.len, SC_TYPE_COMPAT_EXIT);
 785                 create_unknown_syscall_event(event_enabler, SC_TYPE_EXIT);
 786                 create_unknown_syscall_event(event_enabler, SC_TYPE_COMPAT_EXIT);
 787         }
 788 }
 789
 790 /*
 791  * Should be called with sessions lock held.
 792  */
 793 int lttng_event_enabler_create_syscall_events_if_missing(struct lttng_event_enabler_common *syscall_event_enabler)
 794 {
 795         struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(syscall_event_enabler);
 796         int ret;
 797
 798         if (!syscall_table->syscall_dispatch) {
 799                 /* create syscall table mapping syscall to events */
 800                 syscall_table->syscall_dispatch = kzalloc(sizeof(struct hlist_head) * sc_table.len, GFP_KERNEL);
 801                 if (!syscall_table->syscall_dispatch)
 802                         return -ENOMEM;
 803         }
 804         if (!syscall_table->syscall_exit_dispatch) {
 805                 /* create syscall table mapping syscall to events */
 806                 syscall_table->syscall_exit_dispatch = kzalloc(sizeof(struct hlist_head) * sc_exit_table.len, GFP_KERNEL);
 807                 if (!syscall_table->syscall_exit_dispatch)
 808                         return -ENOMEM;
 809         }
 810
 811 #ifdef CONFIG_COMPAT
 812         if (!syscall_table->compat_syscall_dispatch) {
 813                 /* create syscall table mapping compat syscall to events */
 814                 syscall_table->compat_syscall_dispatch = kzalloc(sizeof(struct hlist_head) * compat_sc_table.len, GFP_KERNEL);
 815                 if (!syscall_table->compat_syscall_dispatch)
 816                         return -ENOMEM;
 817         }
 818
 819         if (!syscall_table->compat_syscall_exit_dispatch) {
 820                 /* create syscall table mapping compat syscall to events */
 821                 syscall_table->compat_syscall_exit_dispatch = kzalloc(sizeof(struct hlist_head) * compat_sc_exit_table.len, GFP_KERNEL);
 822                 if (!syscall_table->compat_syscall_exit_dispatch)
 823                         return -ENOMEM;
 824         }
 825 #endif
 826         if (!syscall_table->sc_filter) {
 827                 syscall_table->sc_filter = kzalloc(sizeof(struct lttng_syscall_filter),
 828                                 GFP_KERNEL);
 829                 if (!syscall_table->sc_filter)
 830                         return -ENOMEM;
 831         }
 832
 833         if (!syscall_table->sys_enter_registered) {
 834                 ret = lttng_wrapper_tracepoint_probe_register("sys_enter",
 835                                 (void *) syscall_entry_event_probe, syscall_table);
 836                 if (ret)
 837                         return ret;
 838                 syscall_table->sys_enter_registered = 1;
 839         }
 840         if (!syscall_table->sys_exit_registered) {
 841                 ret = lttng_wrapper_tracepoint_probe_register("sys_exit",
 842                                 (void *) syscall_exit_event_probe, syscall_table);
 843                 if (ret) {
 844                         WARN_ON_ONCE(lttng_wrapper_tracepoint_probe_unregister("sys_enter",
 845                                 (void *) syscall_entry_event_probe, syscall_table));
 846                         return ret;
 847                 }
 848                 syscall_table->sys_exit_registered = 1;
 849         }
 850
 851         lttng_syscall_event_enabler_create_matching_events(syscall_event_enabler);
 852
 853         return ret;
 854 }
 855
 856 int lttng_syscalls_unregister_syscall_table(struct lttng_kernel_syscall_table *syscall_table)
 857 {
 858         int ret;
 859
 860         if (!syscall_table->syscall_dispatch)
 861                 return 0;
 862         if (syscall_table->sys_enter_registered) {
 863                 ret = lttng_wrapper_tracepoint_probe_unregister("sys_enter",
 864                                 (void *) syscall_entry_event_probe, syscall_table);
 865                 if (ret)
 866                         return ret;
 867                 syscall_table->sys_enter_registered = 0;
 868         }
 869         if (syscall_table->sys_exit_registered) {
 870                 ret = lttng_wrapper_tracepoint_probe_unregister("sys_exit",
 871                                 (void *) syscall_exit_event_probe, syscall_table);
 872                 if (ret)
 873                         return ret;
 874                 syscall_table->sys_exit_registered = 0;
 875         }
 876         return 0;
 877 }
 878
 879 int lttng_syscalls_destroy_syscall_table(struct lttng_kernel_syscall_table *syscall_table)
 880 {
 881         kfree(syscall_table->syscall_dispatch);
 882         kfree(syscall_table->syscall_exit_dispatch);
 883 #ifdef CONFIG_COMPAT
 884         kfree(syscall_table->compat_syscall_dispatch);
 885         kfree(syscall_table->compat_syscall_exit_dispatch);
 886 #endif
 887         kfree(syscall_table->sc_filter);
 888         return 0;
 889 }
 890
 891 static
 892 int get_syscall_nr(const char *syscall_name)
 893 {
 894         int syscall_nr = -1;
 895         int i;
 896
 897         for (i = 0; i < sc_table.len; i++) {
 898                 const struct trace_syscall_entry *entry;
 899                 const char *it_name;
 900
 901                 entry = &sc_table.table[i];
 902                 if (!entry->desc)
 903                         continue;
 904                 it_name = entry->desc->event_name;
 905                 it_name += strlen(SYSCALL_ENTRY_STR);
 906                 if (!strcmp(syscall_name, it_name)) {
 907                         syscall_nr = i;
 908                         break;
 909                 }
 910         }
 911         return syscall_nr;
 912 }
 913
 914 static
 915 int get_compat_syscall_nr(const char *syscall_name)
 916 {
 917         int syscall_nr = -1;
 918         int i;
 919
 920         for (i = 0; i < compat_sc_table.len; i++) {
 921                 const struct trace_syscall_entry *entry;
 922                 const char *it_name;
 923
 924                 entry = &compat_sc_table.table[i];
 925                 if (!entry->desc)
 926                         continue;
 927                 it_name = entry->desc->event_name;
 928                 it_name += strlen(COMPAT_SYSCALL_ENTRY_STR);
 929                 if (!strcmp(syscall_name, it_name)) {
 930                         syscall_nr = i;
 931                         break;
 932                 }
 933         }
 934         return syscall_nr;
 935 }
 936
 937 static
 938 uint32_t get_sc_tables_len(void)
 939 {
 940         return sc_table.len + compat_sc_table.len;
 941 }
 942
 943 static
 944 const char *get_syscall_name(const char *desc_name,
 945                 enum lttng_syscall_abi abi,
 946                 enum lttng_syscall_entryexit entryexit)
 947 {
 948         size_t prefix_len = 0;
 949
 950
 951         switch (entryexit) {
 952         case LTTNG_SYSCALL_ENTRY:
 953                 switch (abi) {
 954                 case LTTNG_SYSCALL_ABI_NATIVE:
 955                         prefix_len = strlen(SYSCALL_ENTRY_STR);
 956                         break;
 957                 case LTTNG_SYSCALL_ABI_COMPAT:
 958                         prefix_len = strlen(COMPAT_SYSCALL_ENTRY_STR);
 959                         break;
 960                 }
 961                 break;
 962         case LTTNG_SYSCALL_EXIT:
 963                 switch (abi) {
 964                 case LTTNG_SYSCALL_ABI_NATIVE:
 965                         prefix_len = strlen(SYSCALL_EXIT_STR);
 966                         break;
 967                 case LTTNG_SYSCALL_ABI_COMPAT:
 968                         prefix_len = strlen(COMPAT_SYSCALL_EXIT_STR);
 969                         break;
 970                 }
 971                 break;
 972         }
 973         WARN_ON_ONCE(prefix_len == 0);
 974         return desc_name + prefix_len;
 975 }
 976
 977 static
 978 int lttng_syscall_filter_enable(
 979                 struct lttng_syscall_filter *filter,
 980                 const char *desc_name, enum lttng_syscall_abi abi,
 981                 enum lttng_syscall_entryexit entryexit)
 982 {
 983         const char *syscall_name;
 984         unsigned long *bitmap;
 985         u32 *refcount_map;
 986         int syscall_nr;
 987
 988         syscall_name = get_syscall_name(desc_name, abi, entryexit);
 989
 990         switch (abi) {
 991         case LTTNG_SYSCALL_ABI_NATIVE:
 992                 syscall_nr = get_syscall_nr(syscall_name);
 993                 break;
 994         case LTTNG_SYSCALL_ABI_COMPAT:
 995                 syscall_nr = get_compat_syscall_nr(syscall_name);
 996                 break;
 997         default:
 998                 return -EINVAL;
 999         }
1000         if (syscall_nr < 0)
1001                 return -ENOENT;
1002
1003         switch (entryexit) {
1004         case LTTNG_SYSCALL_ENTRY:
1005                 switch (abi) {
1006                 case LTTNG_SYSCALL_ABI_NATIVE:
1007                         bitmap = filter->sc_entry;
1008                         refcount_map = filter->sc_entry_refcount_map;
1009                         break;
1010                 case LTTNG_SYSCALL_ABI_COMPAT:
1011                         bitmap = filter->sc_compat_entry;
1012                         refcount_map = filter->sc_compat_entry_refcount_map;
1013                         break;
1014                 default:
1015                         return -EINVAL;
1016                 }
1017                 break;
1018         case LTTNG_SYSCALL_EXIT:
1019                 switch (abi) {
1020                 case LTTNG_SYSCALL_ABI_NATIVE:
1021                         bitmap = filter->sc_exit;
1022                         refcount_map = filter->sc_exit_refcount_map;
1023                         break;
1024                 case LTTNG_SYSCALL_ABI_COMPAT:
1025                         bitmap = filter->sc_compat_exit;
1026                         refcount_map = filter->sc_compat_exit_refcount_map;
1027                         break;
1028                 default:
1029                         return -EINVAL;
1030                 }
1031                 break;
1032         default:
1033                 return -EINVAL;
1034         }
1035         if (refcount_map[syscall_nr] == U32_MAX)
1036                 return -EOVERFLOW;
1037         if (refcount_map[syscall_nr]++ == 0)
1038                 bitmap_set(bitmap, syscall_nr, 1);
1039         return 0;
1040 }
1041
1042 int lttng_syscall_filter_enable_event(struct lttng_kernel_event_common *event)
1043 {
1044         struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_event(event);
1045         unsigned int syscall_id = event->priv->u.syscall.syscall_id;
1046         struct hlist_head *dispatch_list;
1047         int ret;
1048
1049         WARN_ON_ONCE(event->priv->instrumentation != LTTNG_KERNEL_ABI_SYSCALL);
1050
1051         /* Skip unknown syscall */
1052         if (syscall_id == -1U)
1053                 return 0;
1054
1055         ret = lttng_syscall_filter_enable(syscall_table->sc_filter,
1056                 event->priv->desc->event_name, event->priv->u.syscall.abi,
1057                 event->priv->u.syscall.entryexit);
1058         if (ret)
1059                 return ret;
1060
1061         switch (event->priv->u.syscall.entryexit) {
1062         case LTTNG_SYSCALL_ENTRY:
1063                 switch (event->priv->u.syscall.abi) {
1064                 case LTTNG_SYSCALL_ABI_NATIVE:
1065                         dispatch_list = &syscall_table->syscall_dispatch[syscall_id];
1066                         break;
1067                 case LTTNG_SYSCALL_ABI_COMPAT:
1068                         dispatch_list = &syscall_table->compat_syscall_dispatch[syscall_id];
1069                         break;
1070                 default:
1071                         ret = -EINVAL;
1072                         goto end;
1073                 }
1074                 break;
1075         case LTTNG_SYSCALL_EXIT:
1076                 switch (event->priv->u.syscall.abi) {
1077                 case LTTNG_SYSCALL_ABI_NATIVE:
1078                         dispatch_list = &syscall_table->syscall_exit_dispatch[syscall_id];
1079                         break;
1080                 case LTTNG_SYSCALL_ABI_COMPAT:
1081                         dispatch_list = &syscall_table->compat_syscall_exit_dispatch[syscall_id];
1082                         break;
1083                 default:
1084                         ret = -EINVAL;
1085                         goto end;
1086                 }
1087                 break;
1088         default:
1089                 ret = -EINVAL;
1090                 goto end;
1091         }
1092
1093         hlist_add_head_rcu(&event->priv->u.syscall.node, dispatch_list);
1094 end:
1095         return ret;
1096 }
1097
1098 static
1099 int lttng_syscall_filter_disable(struct lttng_syscall_filter *filter,
1100                 const char *desc_name, enum lttng_syscall_abi abi,
1101                 enum lttng_syscall_entryexit entryexit)
1102 {
1103         const char *syscall_name;
1104         unsigned long *bitmap;
1105         u32 *refcount_map;
1106         int syscall_nr;
1107
1108         syscall_name = get_syscall_name(desc_name, abi, entryexit);
1109
1110         switch (abi) {
1111         case LTTNG_SYSCALL_ABI_NATIVE:
1112                 syscall_nr = get_syscall_nr(syscall_name);
1113                 break;
1114         case LTTNG_SYSCALL_ABI_COMPAT:
1115                 syscall_nr = get_compat_syscall_nr(syscall_name);
1116                 break;
1117         default:
1118                 return -EINVAL;
1119         }
1120         if (syscall_nr < 0)
1121                 return -ENOENT;
1122
1123         switch (entryexit) {
1124         case LTTNG_SYSCALL_ENTRY:
1125                 switch (abi) {
1126                 case LTTNG_SYSCALL_ABI_NATIVE:
1127                         bitmap = filter->sc_entry;
1128                         refcount_map = filter->sc_entry_refcount_map;
1129                         break;
1130                 case LTTNG_SYSCALL_ABI_COMPAT:
1131                         bitmap = filter->sc_compat_entry;
1132                         refcount_map = filter->sc_compat_entry_refcount_map;
1133                         break;
1134                 default:
1135                         return -EINVAL;
1136                 }
1137                 break;
1138         case LTTNG_SYSCALL_EXIT:
1139                 switch (abi) {
1140                 case LTTNG_SYSCALL_ABI_NATIVE:
1141                         bitmap = filter->sc_exit;
1142                         refcount_map = filter->sc_exit_refcount_map;
1143                         break;
1144                 case LTTNG_SYSCALL_ABI_COMPAT:
1145                         bitmap = filter->sc_compat_exit;
1146                         refcount_map = filter->sc_compat_exit_refcount_map;
1147                         break;
1148                 default:
1149                         return -EINVAL;
1150                 }
1151                 break;
1152         default:
1153                 return -EINVAL;
1154         }
1155         if (refcount_map[syscall_nr] == 0)
1156                 return -ENOENT;
1157         if (--refcount_map[syscall_nr] == 0)
1158                 bitmap_clear(bitmap, syscall_nr, 1);
1159         return 0;
1160 }
1161
1162 int lttng_syscall_filter_disable_event(struct lttng_kernel_event_common *event)
1163 {
1164         struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_event(event);
1165         unsigned int syscall_id = event->priv->u.syscall.syscall_id;
1166         int ret;
1167
1168         /* Skip unknown syscall */
1169         if (syscall_id == -1U)
1170                 return 0;
1171
1172         ret = lttng_syscall_filter_disable(syscall_table->sc_filter,
1173                 event->priv->desc->event_name, event->priv->u.syscall.abi,
1174                 event->priv->u.syscall.entryexit);
1175         if (ret)
1176                 return ret;
1177         hlist_del_rcu(&event->priv->u.syscall.node);
1178         return 0;
1179 }
1180
1181 void lttng_syscall_table_set_wildcard_all(struct lttng_event_enabler_common *event_enabler)
1182 {
1183         struct lttng_kernel_syscall_table *syscall_table = get_syscall_table_from_enabler(event_enabler);
1184         enum lttng_kernel_abi_syscall_entryexit entryexit;
1185         int enabled = event_enabler->enabled;
1186
1187         if (!lttng_syscall_event_enabler_is_wildcard_all(event_enabler))
1188                 return;
1189         entryexit = event_enabler->event_param.u.syscall.entryexit;
1190         if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRY || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT)
1191                 WRITE_ONCE(syscall_table->syscall_all_entry, enabled);
1192
1193         if (entryexit == LTTNG_KERNEL_ABI_SYSCALL_EXIT || entryexit == LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT)
1194                 WRITE_ONCE(syscall_table->syscall_all_exit, enabled);
1195 }
1196
1197 static
1198 const struct trace_syscall_entry *syscall_list_get_entry(loff_t *pos)
1199 {
1200         const struct trace_syscall_entry *entry;
1201         int iter = 0;
1202
1203         for (entry = sc_table.table;
1204                         entry < sc_table.table + sc_table.len;
1205                          entry++) {
1206                 if (iter++ >= *pos)
1207                         return entry;
1208         }
1209         for (entry = compat_sc_table.table;
1210                         entry < compat_sc_table.table + compat_sc_table.len;
1211                          entry++) {
1212                 if (iter++ >= *pos)
1213                         return entry;
1214         }
1215         /* End of list */
1216         return NULL;
1217 }
1218
1219 static
1220 void *syscall_list_start(struct seq_file *m, loff_t *pos)
1221 {
1222         return (void *) syscall_list_get_entry(pos);
1223 }
1224
1225 static
1226 void *syscall_list_next(struct seq_file *m, void *p, loff_t *ppos)
1227 {
1228         (*ppos)++;
1229         return (void *) syscall_list_get_entry(ppos);
1230 }
1231
1232 static
1233 void syscall_list_stop(struct seq_file *m, void *p)
1234 {
1235 }
1236
1237 static
1238 int get_sc_table(const struct trace_syscall_entry *entry,
1239                 const struct trace_syscall_entry **table,
1240                 unsigned int *bitness)
1241 {
1242         if (entry >= sc_table.table && entry < sc_table.table + sc_table.len) {
1243                 if (bitness)
1244                         *bitness = BITS_PER_LONG;
1245                 if (table)
1246                         *table = sc_table.table;
1247                 return 0;
1248         }
1249         if (!(entry >= compat_sc_table.table
1250                         && entry < compat_sc_table.table + compat_sc_table.len)) {
1251                 return -EINVAL;
1252         }
1253         if (bitness)
1254                 *bitness = 32;
1255         if (table)
1256                 *table = compat_sc_table.table;
1257         return 0;
1258 }
1259
1260 static
1261 int syscall_list_show(struct seq_file *m, void *p)
1262 {
1263         const struct trace_syscall_entry *table, *entry = p;
1264         unsigned int bitness;
1265         unsigned long index;
1266         int ret;
1267         const char *name;
1268
1269         ret = get_sc_table(entry, &table, &bitness);
1270         if (ret)
1271                 return ret;
1272         if (!entry->desc)
1273                 return 0;
1274         if (table == sc_table.table) {
1275                 index = entry - table;
1276                 name = &entry->desc->event_name[strlen(SYSCALL_ENTRY_STR)];
1277         } else {
1278                 index = (entry - table) + sc_table.len;
1279                 name = &entry->desc->event_name[strlen(COMPAT_SYSCALL_ENTRY_STR)];
1280         }
1281         seq_printf(m,   "syscall { index = %lu; name = %s; bitness = %u; };\n",
1282                 index, name, bitness);
1283         return 0;
1284 }
1285
1286 static
1287 const struct seq_operations lttng_syscall_list_seq_ops = {
1288         .start = syscall_list_start,
1289         .next = syscall_list_next,
1290         .stop = syscall_list_stop,
1291         .show = syscall_list_show,
1292 };
1293
1294 static
1295 int lttng_syscall_list_open(struct inode *inode, struct file *file)
1296 {
1297         return seq_open(file, &lttng_syscall_list_seq_ops);
1298 }
1299
1300 const struct file_operations lttng_syscall_list_fops = {
1301         .owner = THIS_MODULE,
1302         .open = lttng_syscall_list_open,
1303         .read = seq_read,
1304         .llseek = seq_lseek,
1305         .release = seq_release,
1306 };
1307
1308 /*
1309  * A syscall is enabled if it is traced for either entry or exit.
1310  */
1311 long lttng_syscall_table_get_active_mask(struct lttng_kernel_syscall_table *syscall_table,
1312                 struct lttng_kernel_abi_syscall_mask __user *usyscall_mask)
1313 {
1314         uint32_t len, sc_tables_len, bitmask_len;
1315         int ret = 0, bit;
1316         char *tmp_mask;
1317         struct lttng_syscall_filter *filter;
1318
1319         ret = get_user(len, &usyscall_mask->len);
1320         if (ret)
1321                 return ret;
1322         sc_tables_len = get_sc_tables_len();
1323         bitmask_len = ALIGN(sc_tables_len, 8) >> 3;
1324         if (len < sc_tables_len) {
1325                 return put_user(sc_tables_len, &usyscall_mask->len);
1326         }
1327         /* Array is large enough, we can copy array to user-space. */
1328         tmp_mask = kzalloc(bitmask_len, GFP_KERNEL);
1329         if (!tmp_mask)
1330                 return -ENOMEM;
1331         filter = syscall_table->sc_filter;
1332
1333         for (bit = 0; bit < sc_table.len; bit++) {
1334                 char state;
1335
1336                 if (syscall_table->syscall_dispatch) {
1337                         if (!(READ_ONCE(syscall_table->syscall_all_entry)
1338                                         || READ_ONCE(syscall_table->syscall_all_exit)) && filter)
1339                                 state = test_bit(bit, filter->sc_entry)
1340                                         || test_bit(bit, filter->sc_exit);
1341                         else
1342                                 state = 1;
1343                 } else {
1344                         state = 0;
1345                 }
1346                 bt_bitfield_write_be(tmp_mask, char, bit, 1, state);
1347         }
1348         for (; bit < sc_tables_len; bit++) {
1349                 char state;
1350
1351                 if (syscall_table->compat_syscall_dispatch) {
1352                         if (!(READ_ONCE(syscall_table->syscall_all_entry)
1353                                         || READ_ONCE(syscall_table->syscall_all_exit)) && filter)
1354                                 state = test_bit(bit - sc_table.len,
1355                                                 filter->sc_compat_entry)
1356                                         || test_bit(bit - sc_table.len,
1357                                                 filter->sc_compat_exit);
1358                         else
1359                                 state = 1;
1360                 } else {
1361                         state = 0;
1362                 }
1363                 bt_bitfield_write_be(tmp_mask, char, bit, 1, state);
1364         }
1365         if (copy_to_user(usyscall_mask->mask, tmp_mask, bitmask_len))
1366                 ret = -EFAULT;
1367         kfree(tmp_mask);
1368         return ret;
1369 }
1370
1371 int lttng_abi_syscall_list(void)
1372 {
1373         struct file *syscall_list_file;
1374         int file_fd, ret;
1375
1376         file_fd = lttng_get_unused_fd();
1377         if (file_fd < 0) {
1378                 ret = file_fd;
1379                 goto fd_error;
1380         }
1381
1382         syscall_list_file = anon_inode_getfile("[lttng_syscall_list]",
1383                                           &lttng_syscall_list_fops,
1384                                           NULL, O_RDWR);
1385         if (IS_ERR(syscall_list_file)) {
1386                 ret = PTR_ERR(syscall_list_file);
1387                 goto file_error;
1388         }
1389         ret = lttng_syscall_list_fops.open(NULL, syscall_list_file);
1390         if (ret < 0)
1391                 goto open_error;
1392         fd_install(file_fd, syscall_list_file);
1393         return file_fd;
1394
1395 open_error:
1396         fput(syscall_list_file);
1397 file_error:
1398         put_unused_fd(file_fd);
1399 fd_error:
1400         return ret;
1401 }