1 // SPDX-License-Identifier: GPL-2.0
2 #include <trace/syscall.h>
3 #include <trace/events/syscalls.h>
4 #include <linux/syscalls.h>
5 #include <linux/slab.h>
6 #include <linux/kernel.h>
7 #include <linux/module.h> /* for MODULE_NAME_LEN via KSYM_SYMBOL_LEN */
8 #include <linux/ftrace.h>
9 #include <linux/perf_event.h>
10 #include <linux/xarray.h>
11 #include <asm/syscall.h>
13 #include "trace_output.h"
16 static DEFINE_MUTEX(syscall_trace_lock);
18 static int syscall_enter_register(struct trace_event_call *event,
19 enum trace_reg type, void *data);
20 static int syscall_exit_register(struct trace_event_call *event,
21 enum trace_reg type, void *data);
23 static struct list_head *
24 syscall_get_enter_fields(struct trace_event_call *call)
26 struct syscall_metadata *entry = call->data;
28 return &entry->enter_fields;
31 extern struct syscall_metadata *__start_syscalls_metadata[];
32 extern struct syscall_metadata *__stop_syscalls_metadata[];
34 static DEFINE_XARRAY(syscalls_metadata_sparse);
35 static struct syscall_metadata **syscalls_metadata;
37 #ifndef ARCH_HAS_SYSCALL_MATCH_SYM_NAME
38 static inline bool arch_syscall_match_sym_name(const char *sym, const char *name)
41 * Only compare after the "sys" prefix. Archs that use
42 * syscall wrappers may have syscalls symbols aliases prefixed
43 * with ".SyS" or ".sys" instead of "sys", leading to an unwanted
46 return !strcmp(sym + 3, name + 3);
50 #ifdef ARCH_TRACE_IGNORE_COMPAT_SYSCALLS
52 * Some architectures that allow for 32bit applications
53 * to run on a 64bit kernel, do not map the syscalls for
54 * the 32bit tasks the same as they do for 64bit tasks.
58 * In such a case, instead of reporting the wrong syscalls,
61 * For an arch to ignore the compat syscalls it needs to
62 * define ARCH_TRACE_IGNORE_COMPAT_SYSCALLS as well as
63 * define the function arch_trace_is_compat_syscall() to let
64 * the tracing system know that it should ignore it.
67 trace_get_syscall_nr(struct task_struct *task, struct pt_regs *regs)
69 if (unlikely(arch_trace_is_compat_syscall(regs)))
72 return syscall_get_nr(task, regs);
76 trace_get_syscall_nr(struct task_struct *task, struct pt_regs *regs)
78 return syscall_get_nr(task, regs);
80 #endif /* ARCH_TRACE_IGNORE_COMPAT_SYSCALLS */
82 static __init struct syscall_metadata *
83 find_syscall_meta(unsigned long syscall)
85 struct syscall_metadata **start;
86 struct syscall_metadata **stop;
87 char str[KSYM_SYMBOL_LEN];
90 start = __start_syscalls_metadata;
91 stop = __stop_syscalls_metadata;
92 kallsyms_lookup(syscall, NULL, NULL, NULL, str);
94 if (arch_syscall_match_sym_name(str, "sys_ni_syscall"))
97 for ( ; start < stop; start++) {
98 if ((*start)->name && arch_syscall_match_sym_name(str, (*start)->name))
104 static struct syscall_metadata *syscall_nr_to_meta(int nr)
106 if (IS_ENABLED(CONFIG_HAVE_SPARSE_SYSCALL_NR))
107 return xa_load(&syscalls_metadata_sparse, (unsigned long)nr);
109 if (!syscalls_metadata || nr >= NR_syscalls || nr < 0)
112 return syscalls_metadata[nr];
115 const char *get_syscall_name(int syscall)
117 struct syscall_metadata *entry;
119 entry = syscall_nr_to_meta(syscall);
126 static enum print_line_t
127 print_syscall_enter(struct trace_iterator *iter, int flags,
128 struct trace_event *event)
130 struct trace_array *tr = iter->tr;
131 struct trace_seq *s = &iter->seq;
132 struct trace_entry *ent = iter->ent;
133 struct syscall_trace_enter *trace;
134 struct syscall_metadata *entry;
137 trace = (typeof(trace))ent;
139 entry = syscall_nr_to_meta(syscall);
144 if (entry->enter_event->event.type != ent->type) {
149 trace_seq_printf(s, "%s(", entry->name);
151 for (i = 0; i < entry->nb_args; i++) {
153 if (trace_seq_has_overflowed(s))
156 /* parameter types */
157 if (tr && tr->trace_flags & TRACE_ITER_VERBOSE)
158 trace_seq_printf(s, "%s ", entry->types[i]);
160 /* parameter values */
161 trace_seq_printf(s, "%s: %lx%s", entry->args[i],
163 i == entry->nb_args - 1 ? "" : ", ");
166 trace_seq_putc(s, ')');
168 trace_seq_putc(s, '\n');
170 return trace_handle_return(s);
173 static enum print_line_t
174 print_syscall_exit(struct trace_iterator *iter, int flags,
175 struct trace_event *event)
177 struct trace_seq *s = &iter->seq;
178 struct trace_entry *ent = iter->ent;
179 struct syscall_trace_exit *trace;
181 struct syscall_metadata *entry;
183 trace = (typeof(trace))ent;
185 entry = syscall_nr_to_meta(syscall);
188 trace_seq_putc(s, '\n');
192 if (entry->exit_event->event.type != ent->type) {
194 return TRACE_TYPE_UNHANDLED;
197 trace_seq_printf(s, "%s -> 0x%lx\n", entry->name,
201 return trace_handle_return(s);
204 extern char *__bad_type_size(void);
206 #define SYSCALL_FIELD(_type, _name) { \
207 .type = #_type, .name = #_name, \
208 .size = sizeof(_type), .align = __alignof__(_type), \
209 .is_signed = is_signed_type(_type), .filter_type = FILTER_OTHER }
212 __set_enter_print_fmt(struct syscall_metadata *entry, char *buf, int len)
217 /* When len=0, we just calculate the needed length */
218 #define LEN_OR_ZERO (len ? len - pos : 0)
220 pos += snprintf(buf + pos, LEN_OR_ZERO, "\"");
221 for (i = 0; i < entry->nb_args; i++) {
222 pos += snprintf(buf + pos, LEN_OR_ZERO, "%s: 0x%%0%zulx%s",
223 entry->args[i], sizeof(unsigned long),
224 i == entry->nb_args - 1 ? "" : ", ");
226 pos += snprintf(buf + pos, LEN_OR_ZERO, "\"");
228 for (i = 0; i < entry->nb_args; i++) {
229 pos += snprintf(buf + pos, LEN_OR_ZERO,
230 ", ((unsigned long)(REC->%s))", entry->args[i]);
235 /* return the length of print_fmt */
239 static int __init set_syscall_print_fmt(struct trace_event_call *call)
243 struct syscall_metadata *entry = call->data;
245 if (entry->enter_event != call) {
246 call->print_fmt = "\"0x%lx\", REC->ret";
250 /* First: called with 0 length to calculate the needed length */
251 len = __set_enter_print_fmt(entry, NULL, 0);
253 print_fmt = kmalloc(len + 1, GFP_KERNEL);
257 /* Second: actually write the @print_fmt */
258 __set_enter_print_fmt(entry, print_fmt, len + 1);
259 call->print_fmt = print_fmt;
264 static void __init free_syscall_print_fmt(struct trace_event_call *call)
266 struct syscall_metadata *entry = call->data;
268 if (entry->enter_event == call)
269 kfree(call->print_fmt);
272 static int __init syscall_enter_define_fields(struct trace_event_call *call)
274 struct syscall_trace_enter trace;
275 struct syscall_metadata *meta = call->data;
276 int offset = offsetof(typeof(trace), args);
280 for (i = 0; i < meta->nb_args; i++) {
281 ret = trace_define_field(call, meta->types[i],
282 meta->args[i], offset,
283 sizeof(unsigned long), 0,
287 offset += sizeof(unsigned long);
293 static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
295 struct trace_array *tr = data;
296 struct trace_event_file *trace_file;
297 struct syscall_trace_enter *entry;
298 struct syscall_metadata *sys_data;
299 struct trace_event_buffer fbuffer;
300 unsigned long args[6];
304 syscall_nr = trace_get_syscall_nr(current, regs);
305 if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
308 /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */
309 trace_file = rcu_dereference_sched(tr->enter_syscall_files[syscall_nr]);
313 if (trace_trigger_soft_disabled(trace_file))
316 sys_data = syscall_nr_to_meta(syscall_nr);
320 size = sizeof(*entry) + sizeof(unsigned long) * sys_data->nb_args;
322 entry = trace_event_buffer_reserve(&fbuffer, trace_file, size);
326 entry = ring_buffer_event_data(fbuffer.event);
327 entry->nr = syscall_nr;
328 syscall_get_arguments(current, regs, args);
329 memcpy(entry->args, args, sizeof(unsigned long) * sys_data->nb_args);
331 trace_event_buffer_commit(&fbuffer);
334 static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
336 struct trace_array *tr = data;
337 struct trace_event_file *trace_file;
338 struct syscall_trace_exit *entry;
339 struct syscall_metadata *sys_data;
340 struct trace_event_buffer fbuffer;
343 syscall_nr = trace_get_syscall_nr(current, regs);
344 if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
347 /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */
348 trace_file = rcu_dereference_sched(tr->exit_syscall_files[syscall_nr]);
352 if (trace_trigger_soft_disabled(trace_file))
355 sys_data = syscall_nr_to_meta(syscall_nr);
359 entry = trace_event_buffer_reserve(&fbuffer, trace_file, sizeof(*entry));
363 entry = ring_buffer_event_data(fbuffer.event);
364 entry->nr = syscall_nr;
365 entry->ret = syscall_get_return_value(current, regs);
367 trace_event_buffer_commit(&fbuffer);
370 static int reg_event_syscall_enter(struct trace_event_file *file,
371 struct trace_event_call *call)
373 struct trace_array *tr = file->tr;
377 num = ((struct syscall_metadata *)call->data)->syscall_nr;
378 if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
380 mutex_lock(&syscall_trace_lock);
381 if (!tr->sys_refcount_enter)
382 ret = register_trace_sys_enter(ftrace_syscall_enter, tr);
384 rcu_assign_pointer(tr->enter_syscall_files[num], file);
385 tr->sys_refcount_enter++;
387 mutex_unlock(&syscall_trace_lock);
391 static void unreg_event_syscall_enter(struct trace_event_file *file,
392 struct trace_event_call *call)
394 struct trace_array *tr = file->tr;
397 num = ((struct syscall_metadata *)call->data)->syscall_nr;
398 if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
400 mutex_lock(&syscall_trace_lock);
401 tr->sys_refcount_enter--;
402 RCU_INIT_POINTER(tr->enter_syscall_files[num], NULL);
403 if (!tr->sys_refcount_enter)
404 unregister_trace_sys_enter(ftrace_syscall_enter, tr);
405 mutex_unlock(&syscall_trace_lock);
408 static int reg_event_syscall_exit(struct trace_event_file *file,
409 struct trace_event_call *call)
411 struct trace_array *tr = file->tr;
415 num = ((struct syscall_metadata *)call->data)->syscall_nr;
416 if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
418 mutex_lock(&syscall_trace_lock);
419 if (!tr->sys_refcount_exit)
420 ret = register_trace_sys_exit(ftrace_syscall_exit, tr);
422 rcu_assign_pointer(tr->exit_syscall_files[num], file);
423 tr->sys_refcount_exit++;
425 mutex_unlock(&syscall_trace_lock);
429 static void unreg_event_syscall_exit(struct trace_event_file *file,
430 struct trace_event_call *call)
432 struct trace_array *tr = file->tr;
435 num = ((struct syscall_metadata *)call->data)->syscall_nr;
436 if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
438 mutex_lock(&syscall_trace_lock);
439 tr->sys_refcount_exit--;
440 RCU_INIT_POINTER(tr->exit_syscall_files[num], NULL);
441 if (!tr->sys_refcount_exit)
442 unregister_trace_sys_exit(ftrace_syscall_exit, tr);
443 mutex_unlock(&syscall_trace_lock);
446 static int __init init_syscall_trace(struct trace_event_call *call)
451 num = ((struct syscall_metadata *)call->data)->syscall_nr;
452 if (num < 0 || num >= NR_syscalls) {
453 pr_debug("syscall %s metadata not mapped, disabling ftrace event\n",
454 ((struct syscall_metadata *)call->data)->name);
458 if (set_syscall_print_fmt(call) < 0)
461 id = trace_event_raw_init(call);
464 free_syscall_print_fmt(call);
471 static struct trace_event_fields __refdata syscall_enter_fields_array[] = {
472 SYSCALL_FIELD(int, __syscall_nr),
473 { .type = TRACE_FUNCTION_TYPE,
474 .define_fields = syscall_enter_define_fields },
478 struct trace_event_functions enter_syscall_print_funcs = {
479 .trace = print_syscall_enter,
482 struct trace_event_functions exit_syscall_print_funcs = {
483 .trace = print_syscall_exit,
486 struct trace_event_class __refdata event_class_syscall_enter = {
487 .system = "syscalls",
488 .reg = syscall_enter_register,
489 .fields_array = syscall_enter_fields_array,
490 .get_fields = syscall_get_enter_fields,
491 .raw_init = init_syscall_trace,
494 struct trace_event_class __refdata event_class_syscall_exit = {
495 .system = "syscalls",
496 .reg = syscall_exit_register,
497 .fields_array = (struct trace_event_fields[]){
498 SYSCALL_FIELD(int, __syscall_nr),
499 SYSCALL_FIELD(long, ret),
502 .fields = LIST_HEAD_INIT(event_class_syscall_exit.fields),
503 .raw_init = init_syscall_trace,
506 unsigned long __init __weak arch_syscall_addr(int nr)
508 return (unsigned long)sys_call_table[nr];
511 void __init init_ftrace_syscalls(void)
513 struct syscall_metadata *meta;
518 if (!IS_ENABLED(CONFIG_HAVE_SPARSE_SYSCALL_NR)) {
519 syscalls_metadata = kcalloc(NR_syscalls,
520 sizeof(*syscalls_metadata),
522 if (!syscalls_metadata) {
528 for (i = 0; i < NR_syscalls; i++) {
529 addr = arch_syscall_addr(i);
530 meta = find_syscall_meta(addr);
534 meta->syscall_nr = i;
536 if (!IS_ENABLED(CONFIG_HAVE_SPARSE_SYSCALL_NR)) {
537 syscalls_metadata[i] = meta;
539 ret = xa_store(&syscalls_metadata_sparse, i, meta,
542 "Syscall memory allocation failed\n");
548 #ifdef CONFIG_PERF_EVENTS
550 static DECLARE_BITMAP(enabled_perf_enter_syscalls, NR_syscalls);
551 static DECLARE_BITMAP(enabled_perf_exit_syscalls, NR_syscalls);
552 static int sys_perf_refcount_enter;
553 static int sys_perf_refcount_exit;
555 static int perf_call_bpf_enter(struct trace_event_call *call, struct pt_regs *regs,
556 struct syscall_metadata *sys_data,
557 struct syscall_trace_enter *rec)
559 struct syscall_tp_t {
560 unsigned long long regs;
561 unsigned long syscall_nr;
562 unsigned long args[SYSCALL_DEFINE_MAXARGS];
566 *(struct pt_regs **)¶m = regs;
567 param.syscall_nr = rec->nr;
568 for (i = 0; i < sys_data->nb_args; i++)
569 param.args[i] = rec->args[i];
570 return trace_call_bpf(call, ¶m);
573 static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
575 struct syscall_metadata *sys_data;
576 struct syscall_trace_enter *rec;
577 struct hlist_head *head;
578 unsigned long args[6];
579 bool valid_prog_array;
584 syscall_nr = trace_get_syscall_nr(current, regs);
585 if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
587 if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
590 sys_data = syscall_nr_to_meta(syscall_nr);
594 head = this_cpu_ptr(sys_data->enter_event->perf_events);
595 valid_prog_array = bpf_prog_array_valid(sys_data->enter_event);
596 if (!valid_prog_array && hlist_empty(head))
599 /* get the size after alignment with the u32 buffer size field */
600 size = sizeof(unsigned long) * sys_data->nb_args + sizeof(*rec);
601 size = ALIGN(size + sizeof(u32), sizeof(u64));
604 rec = perf_trace_buf_alloc(size, NULL, &rctx);
608 rec->nr = syscall_nr;
609 syscall_get_arguments(current, regs, args);
610 memcpy(&rec->args, args, sizeof(unsigned long) * sys_data->nb_args);
612 if ((valid_prog_array &&
613 !perf_call_bpf_enter(sys_data->enter_event, regs, sys_data, rec)) ||
615 perf_swevent_put_recursion_context(rctx);
619 perf_trace_buf_submit(rec, size, rctx,
620 sys_data->enter_event->event.type, 1, regs,
624 static int perf_sysenter_enable(struct trace_event_call *call)
629 num = ((struct syscall_metadata *)call->data)->syscall_nr;
631 mutex_lock(&syscall_trace_lock);
632 if (!sys_perf_refcount_enter)
633 ret = register_trace_sys_enter(perf_syscall_enter, NULL);
635 pr_info("event trace: Could not activate syscall entry trace point");
637 set_bit(num, enabled_perf_enter_syscalls);
638 sys_perf_refcount_enter++;
640 mutex_unlock(&syscall_trace_lock);
644 static void perf_sysenter_disable(struct trace_event_call *call)
648 num = ((struct syscall_metadata *)call->data)->syscall_nr;
650 mutex_lock(&syscall_trace_lock);
651 sys_perf_refcount_enter--;
652 clear_bit(num, enabled_perf_enter_syscalls);
653 if (!sys_perf_refcount_enter)
654 unregister_trace_sys_enter(perf_syscall_enter, NULL);
655 mutex_unlock(&syscall_trace_lock);
658 static int perf_call_bpf_exit(struct trace_event_call *call, struct pt_regs *regs,
659 struct syscall_trace_exit *rec)
661 struct syscall_tp_t {
662 unsigned long long regs;
663 unsigned long syscall_nr;
667 *(struct pt_regs **)¶m = regs;
668 param.syscall_nr = rec->nr;
669 param.ret = rec->ret;
670 return trace_call_bpf(call, ¶m);
673 static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
675 struct syscall_metadata *sys_data;
676 struct syscall_trace_exit *rec;
677 struct hlist_head *head;
678 bool valid_prog_array;
683 syscall_nr = trace_get_syscall_nr(current, regs);
684 if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
686 if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
689 sys_data = syscall_nr_to_meta(syscall_nr);
693 head = this_cpu_ptr(sys_data->exit_event->perf_events);
694 valid_prog_array = bpf_prog_array_valid(sys_data->exit_event);
695 if (!valid_prog_array && hlist_empty(head))
698 /* We can probably do that at build time */
699 size = ALIGN(sizeof(*rec) + sizeof(u32), sizeof(u64));
702 rec = perf_trace_buf_alloc(size, NULL, &rctx);
706 rec->nr = syscall_nr;
707 rec->ret = syscall_get_return_value(current, regs);
709 if ((valid_prog_array &&
710 !perf_call_bpf_exit(sys_data->exit_event, regs, rec)) ||
712 perf_swevent_put_recursion_context(rctx);
716 perf_trace_buf_submit(rec, size, rctx, sys_data->exit_event->event.type,
717 1, regs, head, NULL);
720 static int perf_sysexit_enable(struct trace_event_call *call)
725 num = ((struct syscall_metadata *)call->data)->syscall_nr;
727 mutex_lock(&syscall_trace_lock);
728 if (!sys_perf_refcount_exit)
729 ret = register_trace_sys_exit(perf_syscall_exit, NULL);
731 pr_info("event trace: Could not activate syscall exit trace point");
733 set_bit(num, enabled_perf_exit_syscalls);
734 sys_perf_refcount_exit++;
736 mutex_unlock(&syscall_trace_lock);
740 static void perf_sysexit_disable(struct trace_event_call *call)
744 num = ((struct syscall_metadata *)call->data)->syscall_nr;
746 mutex_lock(&syscall_trace_lock);
747 sys_perf_refcount_exit--;
748 clear_bit(num, enabled_perf_exit_syscalls);
749 if (!sys_perf_refcount_exit)
750 unregister_trace_sys_exit(perf_syscall_exit, NULL);
751 mutex_unlock(&syscall_trace_lock);
754 #endif /* CONFIG_PERF_EVENTS */
756 static int syscall_enter_register(struct trace_event_call *event,
757 enum trace_reg type, void *data)
759 struct trace_event_file *file = data;
762 case TRACE_REG_REGISTER:
763 return reg_event_syscall_enter(file, event);
764 case TRACE_REG_UNREGISTER:
765 unreg_event_syscall_enter(file, event);
768 #ifdef CONFIG_PERF_EVENTS
769 case TRACE_REG_PERF_REGISTER:
770 return perf_sysenter_enable(event);
771 case TRACE_REG_PERF_UNREGISTER:
772 perf_sysenter_disable(event);
774 case TRACE_REG_PERF_OPEN:
775 case TRACE_REG_PERF_CLOSE:
776 case TRACE_REG_PERF_ADD:
777 case TRACE_REG_PERF_DEL:
784 static int syscall_exit_register(struct trace_event_call *event,
785 enum trace_reg type, void *data)
787 struct trace_event_file *file = data;
790 case TRACE_REG_REGISTER:
791 return reg_event_syscall_exit(file, event);
792 case TRACE_REG_UNREGISTER:
793 unreg_event_syscall_exit(file, event);
796 #ifdef CONFIG_PERF_EVENTS
797 case TRACE_REG_PERF_REGISTER:
798 return perf_sysexit_enable(event);
799 case TRACE_REG_PERF_UNREGISTER:
800 perf_sysexit_disable(event);
802 case TRACE_REG_PERF_OPEN:
803 case TRACE_REG_PERF_CLOSE:
804 case TRACE_REG_PERF_ADD:
805 case TRACE_REG_PERF_DEL: