1 // SPDX-License-Identifier: GPL-2.0
2 #include <trace/syscall.h>
3 #include <trace/events/syscalls.h>
4 #include <linux/syscalls.h>
5 #include <linux/slab.h>
6 #include <linux/kernel.h>
7 #include <linux/module.h> /* for MODULE_NAME_LEN via KSYM_SYMBOL_LEN */
8 #include <linux/ftrace.h>
9 #include <linux/perf_event.h>
10 #include <linux/xarray.h>
11 #include <asm/syscall.h>
13 #include "trace_output.h"
16 static DEFINE_MUTEX(syscall_trace_lock);
18 static int syscall_enter_register(struct trace_event_call *event,
19 enum trace_reg type, void *data);
20 static int syscall_exit_register(struct trace_event_call *event,
21 enum trace_reg type, void *data);
23 static struct list_head *
24 syscall_get_enter_fields(struct trace_event_call *call)
26 struct syscall_metadata *entry = call->data;
28 return &entry->enter_fields;
31 extern struct syscall_metadata *__start_syscalls_metadata[];
32 extern struct syscall_metadata *__stop_syscalls_metadata[];
34 static DEFINE_XARRAY(syscalls_metadata_sparse);
35 static struct syscall_metadata **syscalls_metadata;
37 #ifndef ARCH_HAS_SYSCALL_MATCH_SYM_NAME
38 static inline bool arch_syscall_match_sym_name(const char *sym, const char *name)
41 * Only compare after the "sys" prefix. Archs that use
42 * syscall wrappers may have syscalls symbols aliases prefixed
43 * with ".SyS" or ".sys" instead of "sys", leading to an unwanted
46 return !strcmp(sym + 3, name + 3);
50 #ifdef ARCH_TRACE_IGNORE_COMPAT_SYSCALLS
52 * Some architectures that allow for 32bit applications
53 * to run on a 64bit kernel, do not map the syscalls for
54 * the 32bit tasks the same as they do for 64bit tasks.
58 * In such a case, instead of reporting the wrong syscalls,
61 * For an arch to ignore the compat syscalls it needs to
62 * define ARCH_TRACE_IGNORE_COMPAT_SYSCALLS as well as
63 * define the function arch_trace_is_compat_syscall() to let
64 * the tracing system know that it should ignore it.
67 trace_get_syscall_nr(struct task_struct *task, struct pt_regs *regs)
69 if (unlikely(arch_trace_is_compat_syscall(regs)))
72 return syscall_get_nr(task, regs);
76 trace_get_syscall_nr(struct task_struct *task, struct pt_regs *regs)
78 return syscall_get_nr(task, regs);
80 #endif /* ARCH_TRACE_IGNORE_COMPAT_SYSCALLS */
82 static __init struct syscall_metadata *
83 find_syscall_meta(unsigned long syscall)
85 struct syscall_metadata **start;
86 struct syscall_metadata **stop;
87 char str[KSYM_SYMBOL_LEN];
90 start = __start_syscalls_metadata;
91 stop = __stop_syscalls_metadata;
92 kallsyms_lookup(syscall, NULL, NULL, NULL, str);
94 if (arch_syscall_match_sym_name(str, "sys_ni_syscall"))
97 for ( ; start < stop; start++) {
98 if ((*start)->name && arch_syscall_match_sym_name(str, (*start)->name))
104 static struct syscall_metadata *syscall_nr_to_meta(int nr)
106 if (IS_ENABLED(CONFIG_HAVE_SPARSE_SYSCALL_NR))
107 return xa_load(&syscalls_metadata_sparse, (unsigned long)nr);
109 if (!syscalls_metadata || nr >= NR_syscalls || nr < 0)
112 return syscalls_metadata[nr];
115 const char *get_syscall_name(int syscall)
117 struct syscall_metadata *entry;
119 entry = syscall_nr_to_meta(syscall);
126 static enum print_line_t
127 print_syscall_enter(struct trace_iterator *iter, int flags,
128 struct trace_event *event)
130 struct trace_array *tr = iter->tr;
131 struct trace_seq *s = &iter->seq;
132 struct trace_entry *ent = iter->ent;
133 struct syscall_trace_enter *trace;
134 struct syscall_metadata *entry;
137 trace = (typeof(trace))ent;
139 entry = syscall_nr_to_meta(syscall);
144 if (entry->enter_event->event.type != ent->type) {
149 trace_seq_printf(s, "%s(", entry->name);
151 for (i = 0; i < entry->nb_args; i++) {
153 if (trace_seq_has_overflowed(s))
156 /* parameter types */
157 if (tr->trace_flags & TRACE_ITER_VERBOSE)
158 trace_seq_printf(s, "%s ", entry->types[i]);
160 /* parameter values */
161 trace_seq_printf(s, "%s: %lx%s", entry->args[i],
163 i == entry->nb_args - 1 ? "" : ", ");
166 trace_seq_putc(s, ')');
168 trace_seq_putc(s, '\n');
170 return trace_handle_return(s);
173 static enum print_line_t
174 print_syscall_exit(struct trace_iterator *iter, int flags,
175 struct trace_event *event)
177 struct trace_seq *s = &iter->seq;
178 struct trace_entry *ent = iter->ent;
179 struct syscall_trace_exit *trace;
181 struct syscall_metadata *entry;
183 trace = (typeof(trace))ent;
185 entry = syscall_nr_to_meta(syscall);
188 trace_seq_putc(s, '\n');
192 if (entry->exit_event->event.type != ent->type) {
194 return TRACE_TYPE_UNHANDLED;
197 trace_seq_printf(s, "%s -> 0x%lx\n", entry->name,
201 return trace_handle_return(s);
204 extern char *__bad_type_size(void);
206 #define SYSCALL_FIELD(_type, _name) { \
207 .type = #_type, .name = #_name, \
208 .size = sizeof(_type), .align = __alignof__(_type), \
209 .is_signed = is_signed_type(_type), .filter_type = FILTER_OTHER }
212 __set_enter_print_fmt(struct syscall_metadata *entry, char *buf, int len)
217 /* When len=0, we just calculate the needed length */
218 #define LEN_OR_ZERO (len ? len - pos : 0)
220 pos += snprintf(buf + pos, LEN_OR_ZERO, "\"");
221 for (i = 0; i < entry->nb_args; i++) {
222 pos += snprintf(buf + pos, LEN_OR_ZERO, "%s: 0x%%0%zulx%s",
223 entry->args[i], sizeof(unsigned long),
224 i == entry->nb_args - 1 ? "" : ", ");
226 pos += snprintf(buf + pos, LEN_OR_ZERO, "\"");
228 for (i = 0; i < entry->nb_args; i++) {
229 pos += snprintf(buf + pos, LEN_OR_ZERO,
230 ", ((unsigned long)(REC->%s))", entry->args[i]);
235 /* return the length of print_fmt */
239 static int __init set_syscall_print_fmt(struct trace_event_call *call)
243 struct syscall_metadata *entry = call->data;
245 if (entry->enter_event != call) {
246 call->print_fmt = "\"0x%lx\", REC->ret";
250 /* First: called with 0 length to calculate the needed length */
251 len = __set_enter_print_fmt(entry, NULL, 0);
253 print_fmt = kmalloc(len + 1, GFP_KERNEL);
257 /* Second: actually write the @print_fmt */
258 __set_enter_print_fmt(entry, print_fmt, len + 1);
259 call->print_fmt = print_fmt;
264 static void __init free_syscall_print_fmt(struct trace_event_call *call)
266 struct syscall_metadata *entry = call->data;
268 if (entry->enter_event == call)
269 kfree(call->print_fmt);
272 static int __init syscall_enter_define_fields(struct trace_event_call *call)
274 struct syscall_trace_enter trace;
275 struct syscall_metadata *meta = call->data;
276 int offset = offsetof(typeof(trace), args);
280 for (i = 0; i < meta->nb_args; i++) {
281 ret = trace_define_field(call, meta->types[i],
282 meta->args[i], offset,
283 sizeof(unsigned long), 0,
287 offset += sizeof(unsigned long);
293 static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
295 struct trace_array *tr = data;
296 struct trace_event_file *trace_file;
297 struct syscall_trace_enter *entry;
298 struct syscall_metadata *sys_data;
299 struct ring_buffer_event *event;
300 struct trace_buffer *buffer;
301 unsigned int trace_ctx;
302 unsigned long args[6];
306 syscall_nr = trace_get_syscall_nr(current, regs);
307 if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
310 /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */
311 trace_file = rcu_dereference_sched(tr->enter_syscall_files[syscall_nr]);
315 if (trace_trigger_soft_disabled(trace_file))
318 sys_data = syscall_nr_to_meta(syscall_nr);
322 size = sizeof(*entry) + sizeof(unsigned long) * sys_data->nb_args;
324 trace_ctx = tracing_gen_ctx();
326 buffer = tr->array_buffer.buffer;
327 event = trace_buffer_lock_reserve(buffer,
328 sys_data->enter_event->event.type, size, trace_ctx);
332 entry = ring_buffer_event_data(event);
333 entry->nr = syscall_nr;
334 syscall_get_arguments(current, regs, args);
335 memcpy(entry->args, args, sizeof(unsigned long) * sys_data->nb_args);
337 event_trigger_unlock_commit(trace_file, buffer, event, entry,
341 static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
343 struct trace_array *tr = data;
344 struct trace_event_file *trace_file;
345 struct syscall_trace_exit *entry;
346 struct syscall_metadata *sys_data;
347 struct ring_buffer_event *event;
348 struct trace_buffer *buffer;
349 unsigned int trace_ctx;
352 syscall_nr = trace_get_syscall_nr(current, regs);
353 if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
356 /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */
357 trace_file = rcu_dereference_sched(tr->exit_syscall_files[syscall_nr]);
361 if (trace_trigger_soft_disabled(trace_file))
364 sys_data = syscall_nr_to_meta(syscall_nr);
368 trace_ctx = tracing_gen_ctx();
370 buffer = tr->array_buffer.buffer;
371 event = trace_buffer_lock_reserve(buffer,
372 sys_data->exit_event->event.type, sizeof(*entry),
377 entry = ring_buffer_event_data(event);
378 entry->nr = syscall_nr;
379 entry->ret = syscall_get_return_value(current, regs);
381 event_trigger_unlock_commit(trace_file, buffer, event, entry,
385 static int reg_event_syscall_enter(struct trace_event_file *file,
386 struct trace_event_call *call)
388 struct trace_array *tr = file->tr;
392 num = ((struct syscall_metadata *)call->data)->syscall_nr;
393 if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
395 mutex_lock(&syscall_trace_lock);
396 if (!tr->sys_refcount_enter)
397 ret = register_trace_sys_enter(ftrace_syscall_enter, tr);
399 rcu_assign_pointer(tr->enter_syscall_files[num], file);
400 tr->sys_refcount_enter++;
402 mutex_unlock(&syscall_trace_lock);
406 static void unreg_event_syscall_enter(struct trace_event_file *file,
407 struct trace_event_call *call)
409 struct trace_array *tr = file->tr;
412 num = ((struct syscall_metadata *)call->data)->syscall_nr;
413 if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
415 mutex_lock(&syscall_trace_lock);
416 tr->sys_refcount_enter--;
417 RCU_INIT_POINTER(tr->enter_syscall_files[num], NULL);
418 if (!tr->sys_refcount_enter)
419 unregister_trace_sys_enter(ftrace_syscall_enter, tr);
420 mutex_unlock(&syscall_trace_lock);
423 static int reg_event_syscall_exit(struct trace_event_file *file,
424 struct trace_event_call *call)
426 struct trace_array *tr = file->tr;
430 num = ((struct syscall_metadata *)call->data)->syscall_nr;
431 if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
433 mutex_lock(&syscall_trace_lock);
434 if (!tr->sys_refcount_exit)
435 ret = register_trace_sys_exit(ftrace_syscall_exit, tr);
437 rcu_assign_pointer(tr->exit_syscall_files[num], file);
438 tr->sys_refcount_exit++;
440 mutex_unlock(&syscall_trace_lock);
444 static void unreg_event_syscall_exit(struct trace_event_file *file,
445 struct trace_event_call *call)
447 struct trace_array *tr = file->tr;
450 num = ((struct syscall_metadata *)call->data)->syscall_nr;
451 if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
453 mutex_lock(&syscall_trace_lock);
454 tr->sys_refcount_exit--;
455 RCU_INIT_POINTER(tr->exit_syscall_files[num], NULL);
456 if (!tr->sys_refcount_exit)
457 unregister_trace_sys_exit(ftrace_syscall_exit, tr);
458 mutex_unlock(&syscall_trace_lock);
461 static int __init init_syscall_trace(struct trace_event_call *call)
466 num = ((struct syscall_metadata *)call->data)->syscall_nr;
467 if (num < 0 || num >= NR_syscalls) {
468 pr_debug("syscall %s metadata not mapped, disabling ftrace event\n",
469 ((struct syscall_metadata *)call->data)->name);
473 if (set_syscall_print_fmt(call) < 0)
476 id = trace_event_raw_init(call);
479 free_syscall_print_fmt(call);
486 static struct trace_event_fields __refdata syscall_enter_fields_array[] = {
487 SYSCALL_FIELD(int, __syscall_nr),
488 { .type = TRACE_FUNCTION_TYPE,
489 .define_fields = syscall_enter_define_fields },
493 struct trace_event_functions enter_syscall_print_funcs = {
494 .trace = print_syscall_enter,
497 struct trace_event_functions exit_syscall_print_funcs = {
498 .trace = print_syscall_exit,
501 struct trace_event_class __refdata event_class_syscall_enter = {
502 .system = "syscalls",
503 .reg = syscall_enter_register,
504 .fields_array = syscall_enter_fields_array,
505 .get_fields = syscall_get_enter_fields,
506 .raw_init = init_syscall_trace,
509 struct trace_event_class __refdata event_class_syscall_exit = {
510 .system = "syscalls",
511 .reg = syscall_exit_register,
512 .fields_array = (struct trace_event_fields[]){
513 SYSCALL_FIELD(int, __syscall_nr),
514 SYSCALL_FIELD(long, ret),
517 .fields = LIST_HEAD_INIT(event_class_syscall_exit.fields),
518 .raw_init = init_syscall_trace,
521 unsigned long __init __weak arch_syscall_addr(int nr)
523 return (unsigned long)sys_call_table[nr];
526 void __init init_ftrace_syscalls(void)
528 struct syscall_metadata *meta;
533 if (!IS_ENABLED(CONFIG_HAVE_SPARSE_SYSCALL_NR)) {
534 syscalls_metadata = kcalloc(NR_syscalls,
535 sizeof(*syscalls_metadata),
537 if (!syscalls_metadata) {
543 for (i = 0; i < NR_syscalls; i++) {
544 addr = arch_syscall_addr(i);
545 meta = find_syscall_meta(addr);
549 meta->syscall_nr = i;
551 if (!IS_ENABLED(CONFIG_HAVE_SPARSE_SYSCALL_NR)) {
552 syscalls_metadata[i] = meta;
554 ret = xa_store(&syscalls_metadata_sparse, i, meta,
557 "Syscall memory allocation failed\n");
563 #ifdef CONFIG_PERF_EVENTS
565 static DECLARE_BITMAP(enabled_perf_enter_syscalls, NR_syscalls);
566 static DECLARE_BITMAP(enabled_perf_exit_syscalls, NR_syscalls);
567 static int sys_perf_refcount_enter;
568 static int sys_perf_refcount_exit;
570 static int perf_call_bpf_enter(struct trace_event_call *call, struct pt_regs *regs,
571 struct syscall_metadata *sys_data,
572 struct syscall_trace_enter *rec)
574 struct syscall_tp_t {
575 unsigned long long regs;
576 unsigned long syscall_nr;
577 unsigned long args[SYSCALL_DEFINE_MAXARGS];
581 *(struct pt_regs **)¶m = regs;
582 param.syscall_nr = rec->nr;
583 for (i = 0; i < sys_data->nb_args; i++)
584 param.args[i] = rec->args[i];
585 return trace_call_bpf(call, ¶m);
588 static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
590 struct syscall_metadata *sys_data;
591 struct syscall_trace_enter *rec;
592 struct hlist_head *head;
593 unsigned long args[6];
594 bool valid_prog_array;
599 syscall_nr = trace_get_syscall_nr(current, regs);
600 if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
602 if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
605 sys_data = syscall_nr_to_meta(syscall_nr);
609 head = this_cpu_ptr(sys_data->enter_event->perf_events);
610 valid_prog_array = bpf_prog_array_valid(sys_data->enter_event);
611 if (!valid_prog_array && hlist_empty(head))
614 /* get the size after alignment with the u32 buffer size field */
615 size = sizeof(unsigned long) * sys_data->nb_args + sizeof(*rec);
616 size = ALIGN(size + sizeof(u32), sizeof(u64));
619 rec = perf_trace_buf_alloc(size, NULL, &rctx);
623 rec->nr = syscall_nr;
624 syscall_get_arguments(current, regs, args);
625 memcpy(&rec->args, args, sizeof(unsigned long) * sys_data->nb_args);
627 if ((valid_prog_array &&
628 !perf_call_bpf_enter(sys_data->enter_event, regs, sys_data, rec)) ||
630 perf_swevent_put_recursion_context(rctx);
634 perf_trace_buf_submit(rec, size, rctx,
635 sys_data->enter_event->event.type, 1, regs,
639 static int perf_sysenter_enable(struct trace_event_call *call)
644 num = ((struct syscall_metadata *)call->data)->syscall_nr;
646 mutex_lock(&syscall_trace_lock);
647 if (!sys_perf_refcount_enter)
648 ret = register_trace_sys_enter(perf_syscall_enter, NULL);
650 pr_info("event trace: Could not activate syscall entry trace point");
652 set_bit(num, enabled_perf_enter_syscalls);
653 sys_perf_refcount_enter++;
655 mutex_unlock(&syscall_trace_lock);
659 static void perf_sysenter_disable(struct trace_event_call *call)
663 num = ((struct syscall_metadata *)call->data)->syscall_nr;
665 mutex_lock(&syscall_trace_lock);
666 sys_perf_refcount_enter--;
667 clear_bit(num, enabled_perf_enter_syscalls);
668 if (!sys_perf_refcount_enter)
669 unregister_trace_sys_enter(perf_syscall_enter, NULL);
670 mutex_unlock(&syscall_trace_lock);
673 static int perf_call_bpf_exit(struct trace_event_call *call, struct pt_regs *regs,
674 struct syscall_trace_exit *rec)
676 struct syscall_tp_t {
677 unsigned long long regs;
678 unsigned long syscall_nr;
682 *(struct pt_regs **)¶m = regs;
683 param.syscall_nr = rec->nr;
684 param.ret = rec->ret;
685 return trace_call_bpf(call, ¶m);
688 static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
690 struct syscall_metadata *sys_data;
691 struct syscall_trace_exit *rec;
692 struct hlist_head *head;
693 bool valid_prog_array;
698 syscall_nr = trace_get_syscall_nr(current, regs);
699 if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
701 if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
704 sys_data = syscall_nr_to_meta(syscall_nr);
708 head = this_cpu_ptr(sys_data->exit_event->perf_events);
709 valid_prog_array = bpf_prog_array_valid(sys_data->exit_event);
710 if (!valid_prog_array && hlist_empty(head))
713 /* We can probably do that at build time */
714 size = ALIGN(sizeof(*rec) + sizeof(u32), sizeof(u64));
717 rec = perf_trace_buf_alloc(size, NULL, &rctx);
721 rec->nr = syscall_nr;
722 rec->ret = syscall_get_return_value(current, regs);
724 if ((valid_prog_array &&
725 !perf_call_bpf_exit(sys_data->exit_event, regs, rec)) ||
727 perf_swevent_put_recursion_context(rctx);
731 perf_trace_buf_submit(rec, size, rctx, sys_data->exit_event->event.type,
732 1, regs, head, NULL);
735 static int perf_sysexit_enable(struct trace_event_call *call)
740 num = ((struct syscall_metadata *)call->data)->syscall_nr;
742 mutex_lock(&syscall_trace_lock);
743 if (!sys_perf_refcount_exit)
744 ret = register_trace_sys_exit(perf_syscall_exit, NULL);
746 pr_info("event trace: Could not activate syscall exit trace point");
748 set_bit(num, enabled_perf_exit_syscalls);
749 sys_perf_refcount_exit++;
751 mutex_unlock(&syscall_trace_lock);
755 static void perf_sysexit_disable(struct trace_event_call *call)
759 num = ((struct syscall_metadata *)call->data)->syscall_nr;
761 mutex_lock(&syscall_trace_lock);
762 sys_perf_refcount_exit--;
763 clear_bit(num, enabled_perf_exit_syscalls);
764 if (!sys_perf_refcount_exit)
765 unregister_trace_sys_exit(perf_syscall_exit, NULL);
766 mutex_unlock(&syscall_trace_lock);
769 #endif /* CONFIG_PERF_EVENTS */
771 static int syscall_enter_register(struct trace_event_call *event,
772 enum trace_reg type, void *data)
774 struct trace_event_file *file = data;
777 case TRACE_REG_REGISTER:
778 return reg_event_syscall_enter(file, event);
779 case TRACE_REG_UNREGISTER:
780 unreg_event_syscall_enter(file, event);
783 #ifdef CONFIG_PERF_EVENTS
784 case TRACE_REG_PERF_REGISTER:
785 return perf_sysenter_enable(event);
786 case TRACE_REG_PERF_UNREGISTER:
787 perf_sysenter_disable(event);
789 case TRACE_REG_PERF_OPEN:
790 case TRACE_REG_PERF_CLOSE:
791 case TRACE_REG_PERF_ADD:
792 case TRACE_REG_PERF_DEL:
799 static int syscall_exit_register(struct trace_event_call *event,
800 enum trace_reg type, void *data)
802 struct trace_event_file *file = data;
805 case TRACE_REG_REGISTER:
806 return reg_event_syscall_exit(file, event);
807 case TRACE_REG_UNREGISTER:
808 unreg_event_syscall_exit(file, event);
811 #ifdef CONFIG_PERF_EVENTS
812 case TRACE_REG_PERF_REGISTER:
813 return perf_sysexit_enable(event);
814 case TRACE_REG_PERF_UNREGISTER:
815 perf_sysexit_disable(event);
817 case TRACE_REG_PERF_OPEN:
818 case TRACE_REG_PERF_CLOSE:
819 case TRACE_REG_PERF_ADD:
820 case TRACE_REG_PERF_DEL: