1 // SPDX-License-Identifier: GPL-2.0
2 #include <trace/syscall.h>
3 #include <trace/events/syscalls.h>
4 #include <linux/syscalls.h>
5 #include <linux/slab.h>
6 #include <linux/kernel.h>
7 #include <linux/module.h> /* for MODULE_NAME_LEN via KSYM_SYMBOL_LEN */
8 #include <linux/ftrace.h>
9 #include <linux/perf_event.h>
10 #include <linux/xarray.h>
11 #include <asm/syscall.h>
13 #include "trace_output.h"
16 static DEFINE_MUTEX(syscall_trace_lock);
18 static int syscall_enter_register(struct trace_event_call *event,
19 enum trace_reg type, void *data);
20 static int syscall_exit_register(struct trace_event_call *event,
21 enum trace_reg type, void *data);
23 static struct list_head *
24 syscall_get_enter_fields(struct trace_event_call *call)
26 struct syscall_metadata *entry = call->data;
28 return &entry->enter_fields;
31 extern struct syscall_metadata *__start_syscalls_metadata[];
32 extern struct syscall_metadata *__stop_syscalls_metadata[];
34 static DEFINE_XARRAY(syscalls_metadata_sparse);
35 static struct syscall_metadata **syscalls_metadata;
37 #ifndef ARCH_HAS_SYSCALL_MATCH_SYM_NAME
38 static inline bool arch_syscall_match_sym_name(const char *sym, const char *name)
41 * Only compare after the "sys" prefix. Archs that use
42 * syscall wrappers may have syscalls symbols aliases prefixed
43 * with ".SyS" or ".sys" instead of "sys", leading to an unwanted
46 return !strcmp(sym + 3, name + 3);
50 #ifdef ARCH_TRACE_IGNORE_COMPAT_SYSCALLS
52 * Some architectures that allow for 32bit applications
53 * to run on a 64bit kernel, do not map the syscalls for
54 * the 32bit tasks the same as they do for 64bit tasks.
58 * In such a case, instead of reporting the wrong syscalls,
61 * For an arch to ignore the compat syscalls it needs to
62 * define ARCH_TRACE_IGNORE_COMPAT_SYSCALLS as well as
63 * define the function arch_trace_is_compat_syscall() to let
64 * the tracing system know that it should ignore it.
67 trace_get_syscall_nr(struct task_struct *task, struct pt_regs *regs)
69 if (unlikely(arch_trace_is_compat_syscall(regs)))
72 return syscall_get_nr(task, regs);
76 trace_get_syscall_nr(struct task_struct *task, struct pt_regs *regs)
78 return syscall_get_nr(task, regs);
80 #endif /* ARCH_TRACE_IGNORE_COMPAT_SYSCALLS */
82 static __init struct syscall_metadata *
83 find_syscall_meta(unsigned long syscall)
85 struct syscall_metadata **start;
86 struct syscall_metadata **stop;
87 char str[KSYM_SYMBOL_LEN];
90 start = __start_syscalls_metadata;
91 stop = __stop_syscalls_metadata;
92 kallsyms_lookup(syscall, NULL, NULL, NULL, str);
94 if (arch_syscall_match_sym_name(str, "sys_ni_syscall"))
97 for ( ; start < stop; start++) {
98 if ((*start)->name && arch_syscall_match_sym_name(str, (*start)->name))
104 static struct syscall_metadata *syscall_nr_to_meta(int nr)
106 if (IS_ENABLED(CONFIG_HAVE_SPARSE_SYSCALL_NR))
107 return xa_load(&syscalls_metadata_sparse, (unsigned long)nr);
109 if (!syscalls_metadata || nr >= NR_syscalls || nr < 0)
112 return syscalls_metadata[nr];
115 const char *get_syscall_name(int syscall)
117 struct syscall_metadata *entry;
119 entry = syscall_nr_to_meta(syscall);
126 static enum print_line_t
127 print_syscall_enter(struct trace_iterator *iter, int flags,
128 struct trace_event *event)
130 struct trace_array *tr = iter->tr;
131 struct trace_seq *s = &iter->seq;
132 struct trace_entry *ent = iter->ent;
133 struct syscall_trace_enter *trace;
134 struct syscall_metadata *entry;
137 trace = (typeof(trace))ent;
139 entry = syscall_nr_to_meta(syscall);
144 if (entry->enter_event->event.type != ent->type) {
149 trace_seq_printf(s, "%s(", entry->name);
151 for (i = 0; i < entry->nb_args; i++) {
153 if (trace_seq_has_overflowed(s))
156 /* parameter types */
157 if (tr->trace_flags & TRACE_ITER_VERBOSE)
158 trace_seq_printf(s, "%s ", entry->types[i]);
160 /* parameter values */
161 trace_seq_printf(s, "%s: %lx%s", entry->args[i],
163 i == entry->nb_args - 1 ? "" : ", ");
166 trace_seq_putc(s, ')');
168 trace_seq_putc(s, '\n');
170 return trace_handle_return(s);
173 static enum print_line_t
174 print_syscall_exit(struct trace_iterator *iter, int flags,
175 struct trace_event *event)
177 struct trace_seq *s = &iter->seq;
178 struct trace_entry *ent = iter->ent;
179 struct syscall_trace_exit *trace;
181 struct syscall_metadata *entry;
183 trace = (typeof(trace))ent;
185 entry = syscall_nr_to_meta(syscall);
188 trace_seq_putc(s, '\n');
192 if (entry->exit_event->event.type != ent->type) {
194 return TRACE_TYPE_UNHANDLED;
197 trace_seq_printf(s, "%s -> 0x%lx\n", entry->name,
201 return trace_handle_return(s);
204 extern char *__bad_type_size(void);
206 #define SYSCALL_FIELD(_type, _name) { \
207 .type = #_type, .name = #_name, \
208 .size = sizeof(_type), .align = __alignof__(_type), \
209 .is_signed = is_signed_type(_type), .filter_type = FILTER_OTHER }
212 __set_enter_print_fmt(struct syscall_metadata *entry, char *buf, int len)
217 /* When len=0, we just calculate the needed length */
218 #define LEN_OR_ZERO (len ? len - pos : 0)
220 pos += snprintf(buf + pos, LEN_OR_ZERO, "\"");
221 for (i = 0; i < entry->nb_args; i++) {
222 pos += snprintf(buf + pos, LEN_OR_ZERO, "%s: 0x%%0%zulx%s",
223 entry->args[i], sizeof(unsigned long),
224 i == entry->nb_args - 1 ? "" : ", ");
226 pos += snprintf(buf + pos, LEN_OR_ZERO, "\"");
228 for (i = 0; i < entry->nb_args; i++) {
229 pos += snprintf(buf + pos, LEN_OR_ZERO,
230 ", ((unsigned long)(REC->%s))", entry->args[i]);
235 /* return the length of print_fmt */
239 static int __init set_syscall_print_fmt(struct trace_event_call *call)
243 struct syscall_metadata *entry = call->data;
245 if (entry->enter_event != call) {
246 call->print_fmt = "\"0x%lx\", REC->ret";
250 /* First: called with 0 length to calculate the needed length */
251 len = __set_enter_print_fmt(entry, NULL, 0);
253 print_fmt = kmalloc(len + 1, GFP_KERNEL);
257 /* Second: actually write the @print_fmt */
258 __set_enter_print_fmt(entry, print_fmt, len + 1);
259 call->print_fmt = print_fmt;
264 static void __init free_syscall_print_fmt(struct trace_event_call *call)
266 struct syscall_metadata *entry = call->data;
268 if (entry->enter_event == call)
269 kfree(call->print_fmt);
272 static int __init syscall_enter_define_fields(struct trace_event_call *call)
274 struct syscall_trace_enter trace;
275 struct syscall_metadata *meta = call->data;
276 int offset = offsetof(typeof(trace), args);
279 for (i = 0; i < meta->nb_args; i++) {
280 ret = trace_define_field(call, meta->types[i],
281 meta->args[i], offset,
282 sizeof(unsigned long), 0,
286 offset += sizeof(unsigned long);
292 static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
294 struct trace_array *tr = data;
295 struct trace_event_file *trace_file;
296 struct syscall_trace_enter *entry;
297 struct syscall_metadata *sys_data;
298 struct ring_buffer_event *event;
299 struct ring_buffer *buffer;
300 unsigned long irq_flags;
301 unsigned long args[6];
306 syscall_nr = trace_get_syscall_nr(current, regs);
307 if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
310 /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */
311 trace_file = rcu_dereference_sched(tr->enter_syscall_files[syscall_nr]);
315 if (trace_trigger_soft_disabled(trace_file))
318 sys_data = syscall_nr_to_meta(syscall_nr);
322 size = sizeof(*entry) + sizeof(unsigned long) * sys_data->nb_args;
324 local_save_flags(irq_flags);
325 pc = preempt_count();
327 buffer = tr->trace_buffer.buffer;
328 event = trace_buffer_lock_reserve(buffer,
329 sys_data->enter_event->event.type, size, irq_flags, pc);
333 entry = ring_buffer_event_data(event);
334 entry->nr = syscall_nr;
335 syscall_get_arguments(current, regs, args);
336 memcpy(entry->args, args, sizeof(unsigned long) * sys_data->nb_args);
338 event_trigger_unlock_commit(trace_file, buffer, event, entry,
342 static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
344 struct trace_array *tr = data;
345 struct trace_event_file *trace_file;
346 struct syscall_trace_exit *entry;
347 struct syscall_metadata *sys_data;
348 struct ring_buffer_event *event;
349 struct ring_buffer *buffer;
350 unsigned long irq_flags;
354 syscall_nr = trace_get_syscall_nr(current, regs);
355 if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
358 /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */
359 trace_file = rcu_dereference_sched(tr->exit_syscall_files[syscall_nr]);
363 if (trace_trigger_soft_disabled(trace_file))
366 sys_data = syscall_nr_to_meta(syscall_nr);
370 local_save_flags(irq_flags);
371 pc = preempt_count();
373 buffer = tr->trace_buffer.buffer;
374 event = trace_buffer_lock_reserve(buffer,
375 sys_data->exit_event->event.type, sizeof(*entry),
380 entry = ring_buffer_event_data(event);
381 entry->nr = syscall_nr;
382 entry->ret = syscall_get_return_value(current, regs);
384 event_trigger_unlock_commit(trace_file, buffer, event, entry,
388 static int reg_event_syscall_enter(struct trace_event_file *file,
389 struct trace_event_call *call)
391 struct trace_array *tr = file->tr;
395 num = ((struct syscall_metadata *)call->data)->syscall_nr;
396 if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
398 mutex_lock(&syscall_trace_lock);
399 if (!tr->sys_refcount_enter)
400 ret = register_trace_sys_enter(ftrace_syscall_enter, tr);
402 rcu_assign_pointer(tr->enter_syscall_files[num], file);
403 tr->sys_refcount_enter++;
405 mutex_unlock(&syscall_trace_lock);
409 static void unreg_event_syscall_enter(struct trace_event_file *file,
410 struct trace_event_call *call)
412 struct trace_array *tr = file->tr;
415 num = ((struct syscall_metadata *)call->data)->syscall_nr;
416 if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
418 mutex_lock(&syscall_trace_lock);
419 tr->sys_refcount_enter--;
420 RCU_INIT_POINTER(tr->enter_syscall_files[num], NULL);
421 if (!tr->sys_refcount_enter)
422 unregister_trace_sys_enter(ftrace_syscall_enter, tr);
423 mutex_unlock(&syscall_trace_lock);
426 static int reg_event_syscall_exit(struct trace_event_file *file,
427 struct trace_event_call *call)
429 struct trace_array *tr = file->tr;
433 num = ((struct syscall_metadata *)call->data)->syscall_nr;
434 if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
436 mutex_lock(&syscall_trace_lock);
437 if (!tr->sys_refcount_exit)
438 ret = register_trace_sys_exit(ftrace_syscall_exit, tr);
440 rcu_assign_pointer(tr->exit_syscall_files[num], file);
441 tr->sys_refcount_exit++;
443 mutex_unlock(&syscall_trace_lock);
447 static void unreg_event_syscall_exit(struct trace_event_file *file,
448 struct trace_event_call *call)
450 struct trace_array *tr = file->tr;
453 num = ((struct syscall_metadata *)call->data)->syscall_nr;
454 if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
456 mutex_lock(&syscall_trace_lock);
457 tr->sys_refcount_exit--;
458 RCU_INIT_POINTER(tr->exit_syscall_files[num], NULL);
459 if (!tr->sys_refcount_exit)
460 unregister_trace_sys_exit(ftrace_syscall_exit, tr);
461 mutex_unlock(&syscall_trace_lock);
464 static int __init init_syscall_trace(struct trace_event_call *call)
469 num = ((struct syscall_metadata *)call->data)->syscall_nr;
470 if (num < 0 || num >= NR_syscalls) {
471 pr_debug("syscall %s metadata not mapped, disabling ftrace event\n",
472 ((struct syscall_metadata *)call->data)->name);
476 if (set_syscall_print_fmt(call) < 0)
479 id = trace_event_raw_init(call);
482 free_syscall_print_fmt(call);
489 static struct trace_event_fields __refdata syscall_enter_fields_array[] = {
490 SYSCALL_FIELD(int, __syscall_nr),
491 { .type = TRACE_FUNCTION_TYPE,
492 .define_fields = syscall_enter_define_fields },
496 struct trace_event_functions enter_syscall_print_funcs = {
497 .trace = print_syscall_enter,
500 struct trace_event_functions exit_syscall_print_funcs = {
501 .trace = print_syscall_exit,
504 struct trace_event_class __refdata event_class_syscall_enter = {
505 .system = "syscalls",
506 .reg = syscall_enter_register,
507 .fields_array = syscall_enter_fields_array,
508 .get_fields = syscall_get_enter_fields,
509 .raw_init = init_syscall_trace,
512 struct trace_event_class __refdata event_class_syscall_exit = {
513 .system = "syscalls",
514 .reg = syscall_exit_register,
515 .fields_array = (struct trace_event_fields[]){
516 SYSCALL_FIELD(int, __syscall_nr),
517 SYSCALL_FIELD(long, ret),
520 .fields = LIST_HEAD_INIT(event_class_syscall_exit.fields),
521 .raw_init = init_syscall_trace,
524 unsigned long __init __weak arch_syscall_addr(int nr)
526 return (unsigned long)sys_call_table[nr];
529 void __init init_ftrace_syscalls(void)
531 struct syscall_metadata *meta;
536 if (!IS_ENABLED(CONFIG_HAVE_SPARSE_SYSCALL_NR)) {
537 syscalls_metadata = kcalloc(NR_syscalls,
538 sizeof(*syscalls_metadata),
540 if (!syscalls_metadata) {
546 for (i = 0; i < NR_syscalls; i++) {
547 addr = arch_syscall_addr(i);
548 meta = find_syscall_meta(addr);
552 meta->syscall_nr = i;
554 if (!IS_ENABLED(CONFIG_HAVE_SPARSE_SYSCALL_NR)) {
555 syscalls_metadata[i] = meta;
557 ret = xa_store(&syscalls_metadata_sparse, i, meta,
560 "Syscall memory allocation failed\n");
566 #ifdef CONFIG_PERF_EVENTS
568 static DECLARE_BITMAP(enabled_perf_enter_syscalls, NR_syscalls);
569 static DECLARE_BITMAP(enabled_perf_exit_syscalls, NR_syscalls);
570 static int sys_perf_refcount_enter;
571 static int sys_perf_refcount_exit;
573 static int perf_call_bpf_enter(struct trace_event_call *call, struct pt_regs *regs,
574 struct syscall_metadata *sys_data,
575 struct syscall_trace_enter *rec)
577 struct syscall_tp_t {
578 unsigned long long regs;
579 unsigned long syscall_nr;
580 unsigned long args[SYSCALL_DEFINE_MAXARGS];
584 *(struct pt_regs **)¶m = regs;
585 param.syscall_nr = rec->nr;
586 for (i = 0; i < sys_data->nb_args; i++)
587 param.args[i] = rec->args[i];
588 return trace_call_bpf(call, ¶m);
591 static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
593 struct syscall_metadata *sys_data;
594 struct syscall_trace_enter *rec;
595 struct hlist_head *head;
596 unsigned long args[6];
597 bool valid_prog_array;
602 syscall_nr = trace_get_syscall_nr(current, regs);
603 if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
605 if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
608 sys_data = syscall_nr_to_meta(syscall_nr);
612 head = this_cpu_ptr(sys_data->enter_event->perf_events);
613 valid_prog_array = bpf_prog_array_valid(sys_data->enter_event);
614 if (!valid_prog_array && hlist_empty(head))
617 /* get the size after alignment with the u32 buffer size field */
618 size = sizeof(unsigned long) * sys_data->nb_args + sizeof(*rec);
619 size = ALIGN(size + sizeof(u32), sizeof(u64));
622 rec = perf_trace_buf_alloc(size, NULL, &rctx);
626 rec->nr = syscall_nr;
627 syscall_get_arguments(current, regs, args);
628 memcpy(&rec->args, args, sizeof(unsigned long) * sys_data->nb_args);
630 if ((valid_prog_array &&
631 !perf_call_bpf_enter(sys_data->enter_event, regs, sys_data, rec)) ||
633 perf_swevent_put_recursion_context(rctx);
637 perf_trace_buf_submit(rec, size, rctx,
638 sys_data->enter_event->event.type, 1, regs,
642 static int perf_sysenter_enable(struct trace_event_call *call)
647 num = ((struct syscall_metadata *)call->data)->syscall_nr;
649 mutex_lock(&syscall_trace_lock);
650 if (!sys_perf_refcount_enter)
651 ret = register_trace_sys_enter(perf_syscall_enter, NULL);
653 pr_info("event trace: Could not activate syscall entry trace point");
655 set_bit(num, enabled_perf_enter_syscalls);
656 sys_perf_refcount_enter++;
658 mutex_unlock(&syscall_trace_lock);
662 static void perf_sysenter_disable(struct trace_event_call *call)
666 num = ((struct syscall_metadata *)call->data)->syscall_nr;
668 mutex_lock(&syscall_trace_lock);
669 sys_perf_refcount_enter--;
670 clear_bit(num, enabled_perf_enter_syscalls);
671 if (!sys_perf_refcount_enter)
672 unregister_trace_sys_enter(perf_syscall_enter, NULL);
673 mutex_unlock(&syscall_trace_lock);
676 static int perf_call_bpf_exit(struct trace_event_call *call, struct pt_regs *regs,
677 struct syscall_trace_exit *rec)
679 struct syscall_tp_t {
680 unsigned long long regs;
681 unsigned long syscall_nr;
685 *(struct pt_regs **)¶m = regs;
686 param.syscall_nr = rec->nr;
687 param.ret = rec->ret;
688 return trace_call_bpf(call, ¶m);
691 static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
693 struct syscall_metadata *sys_data;
694 struct syscall_trace_exit *rec;
695 struct hlist_head *head;
696 bool valid_prog_array;
701 syscall_nr = trace_get_syscall_nr(current, regs);
702 if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
704 if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
707 sys_data = syscall_nr_to_meta(syscall_nr);
711 head = this_cpu_ptr(sys_data->exit_event->perf_events);
712 valid_prog_array = bpf_prog_array_valid(sys_data->exit_event);
713 if (!valid_prog_array && hlist_empty(head))
716 /* We can probably do that at build time */
717 size = ALIGN(sizeof(*rec) + sizeof(u32), sizeof(u64));
720 rec = perf_trace_buf_alloc(size, NULL, &rctx);
724 rec->nr = syscall_nr;
725 rec->ret = syscall_get_return_value(current, regs);
727 if ((valid_prog_array &&
728 !perf_call_bpf_exit(sys_data->exit_event, regs, rec)) ||
730 perf_swevent_put_recursion_context(rctx);
734 perf_trace_buf_submit(rec, size, rctx, sys_data->exit_event->event.type,
735 1, regs, head, NULL);
738 static int perf_sysexit_enable(struct trace_event_call *call)
743 num = ((struct syscall_metadata *)call->data)->syscall_nr;
745 mutex_lock(&syscall_trace_lock);
746 if (!sys_perf_refcount_exit)
747 ret = register_trace_sys_exit(perf_syscall_exit, NULL);
749 pr_info("event trace: Could not activate syscall exit trace point");
751 set_bit(num, enabled_perf_exit_syscalls);
752 sys_perf_refcount_exit++;
754 mutex_unlock(&syscall_trace_lock);
758 static void perf_sysexit_disable(struct trace_event_call *call)
762 num = ((struct syscall_metadata *)call->data)->syscall_nr;
764 mutex_lock(&syscall_trace_lock);
765 sys_perf_refcount_exit--;
766 clear_bit(num, enabled_perf_exit_syscalls);
767 if (!sys_perf_refcount_exit)
768 unregister_trace_sys_exit(perf_syscall_exit, NULL);
769 mutex_unlock(&syscall_trace_lock);
772 #endif /* CONFIG_PERF_EVENTS */
774 static int syscall_enter_register(struct trace_event_call *event,
775 enum trace_reg type, void *data)
777 struct trace_event_file *file = data;
780 case TRACE_REG_REGISTER:
781 return reg_event_syscall_enter(file, event);
782 case TRACE_REG_UNREGISTER:
783 unreg_event_syscall_enter(file, event);
786 #ifdef CONFIG_PERF_EVENTS
787 case TRACE_REG_PERF_REGISTER:
788 return perf_sysenter_enable(event);
789 case TRACE_REG_PERF_UNREGISTER:
790 perf_sysenter_disable(event);
792 case TRACE_REG_PERF_OPEN:
793 case TRACE_REG_PERF_CLOSE:
794 case TRACE_REG_PERF_ADD:
795 case TRACE_REG_PERF_DEL:
802 static int syscall_exit_register(struct trace_event_call *event,
803 enum trace_reg type, void *data)
805 struct trace_event_file *file = data;
808 case TRACE_REG_REGISTER:
809 return reg_event_syscall_exit(file, event);
810 case TRACE_REG_UNREGISTER:
811 unreg_event_syscall_exit(file, event);
814 #ifdef CONFIG_PERF_EVENTS
815 case TRACE_REG_PERF_REGISTER:
816 return perf_sysexit_enable(event);
817 case TRACE_REG_PERF_UNREGISTER:
818 perf_sysexit_disable(event);
820 case TRACE_REG_PERF_OPEN:
821 case TRACE_REG_PERF_CLOSE:
822 case TRACE_REG_PERF_ADD:
823 case TRACE_REG_PERF_DEL: