1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * Augment syscalls with the contents of the pointer arguments.
  4 *
  5 * Test it with:
  6 *
  7 * perf trace -e tools/perf/examples/bpf/augmented_syscalls.c cat /etc/passwd > /dev/null
  8 *
  9 * It'll catch some openat syscalls related to the dynamic linked and
 10 * the last one should be the one for '/etc/passwd'.
 11 *
 12 * This matches what is marshalled into the raw_syscall:sys_enter payload
 13 * expected by the 'perf trace' beautifiers, and can be used by them, that will
 14 * check if perf_sample->raw_data is more than what is expected for each
 15 * syscalls:sys_{enter,exit}_SYSCALL tracepoint, uing the extra data as the
 16 * contents of pointer arguments.
 17 */
 18
 19#include <stdio.h>
 20#include <linux/socket.h>
 21
 22/* bpf-output associated map */
 23bpf_map(__augmented_syscalls__, PERF_EVENT_ARRAY, int, u32, __NR_CPUS__);
 24
 25struct syscall_exit_args {
 26	unsigned long long common_tp_fields;
 27	long		   syscall_nr;
 28	long		   ret;
 29};
 30
 31struct augmented_filename {
 32	unsigned int	size;
 33	int		reserved;
 34	char		value[256];
 35};
 36
 37#define augmented_filename_syscall(syscall)							\
 38struct augmented_enter_##syscall##_args {			 				\
 39	struct syscall_enter_##syscall##_args	args;				 		\
 40	struct augmented_filename		filename;				 	\
 41};												\
 42int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args)				\
 43{												\
 44	struct augmented_enter_##syscall##_args augmented_args = { .filename.reserved = 0, }; 	\
 45	unsigned int len = sizeof(augmented_args);						\
 46	probe_read(&augmented_args.args, sizeof(augmented_args.args), args);			\
 47	augmented_args.filename.size = probe_read_str(&augmented_args.filename.value, 		\
 48						      sizeof(augmented_args.filename.value), 	\
 49						      args->filename_ptr); 			\
 50	if (augmented_args.filename.size < sizeof(augmented_args.filename.value)) {		\
 51		len -= sizeof(augmented_args.filename.value) - augmented_args.filename.size;	\
 52		len &= sizeof(augmented_args.filename.value) - 1;				\
 53	}											\
 54	/* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */	\
 55	return perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, 		\
 56				 &augmented_args, len);						\
 57}												\
 58int syscall_exit(syscall)(struct syscall_exit_args *args)					\
 59{												\
 60       return 1; /* 0 as soon as we start copying data returned by the kernel, e.g. 'read' */	\
 61}
 62
 63struct syscall_enter_openat_args {
 64	unsigned long long common_tp_fields;
 65	long		   syscall_nr;
 66	long		   dfd;
 67	char		   *filename_ptr;
 68	long		   flags;
 69	long		   mode;
 70};
 71
 72augmented_filename_syscall(openat);
 73
 74struct syscall_enter_open_args {
 75	unsigned long long common_tp_fields;
 76	long		   syscall_nr;
 77	char		   *filename_ptr;
 78	long		   flags;
 79	long		   mode;
 80};
 81
 82augmented_filename_syscall(open);
 83
 84struct syscall_enter_inotify_add_watch_args {
 85	unsigned long long common_tp_fields;
 86	long		   syscall_nr;
 87	long		   fd;
 88	char		   *filename_ptr;
 89	long		   mask;
 90};
 91
 92augmented_filename_syscall(inotify_add_watch);
 93
 94struct statbuf;
 95
 96struct syscall_enter_newstat_args {
 97	unsigned long long common_tp_fields;
 98	long		   syscall_nr;
 99	char		   *filename_ptr;
100	struct stat	   *statbuf;
101};
102
103augmented_filename_syscall(newstat);
104
105#ifndef _K_SS_MAXSIZE
106#define _K_SS_MAXSIZE 128
107#endif
108
109#define augmented_sockaddr_syscall(syscall)						\
110struct augmented_enter_##syscall##_args {			 				\
111	struct syscall_enter_##syscall##_args	args;				 		\
112	struct sockaddr_storage			addr;						\
113};												\
114int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args)				\
115{												\
116	struct augmented_enter_##syscall##_args augmented_args;				 	\
117	unsigned long addrlen = sizeof(augmented_args.addr);					\
118	probe_read(&augmented_args.args, sizeof(augmented_args.args), args);			\
119/* FIXME_CLANG_OPTIMIZATION_THAT_ACCESSES_USER_CONTROLLED_ADDRLEN_DESPITE_THIS_CHECK */		\
120/*	if (addrlen > augmented_args.args.addrlen)				     */		\
121/*		addrlen = augmented_args.args.addrlen;				     */		\
122/*										     */		\
123	probe_read(&augmented_args.addr, addrlen, args->addr_ptr); 				\
124	/* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */	\
125	return perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, 		\
126				 &augmented_args, 						\
127				sizeof(augmented_args) - sizeof(augmented_args.addr) + addrlen);\
128}												\
129int syscall_exit(syscall)(struct syscall_exit_args *args)					\
130{												\
131       return 1; /* 0 as soon as we start copying data returned by the kernel, e.g. 'read' */	\
132}
133
134struct sockaddr;
135
136struct syscall_enter_bind_args {
137	unsigned long long common_tp_fields;
138	long		   syscall_nr;
139	long		   fd;
140	struct sockaddr	   *addr_ptr;
141	unsigned long	   addrlen;
142};
143
144augmented_sockaddr_syscall(bind);
145
146struct syscall_enter_connect_args {
147	unsigned long long common_tp_fields;
148	long		   syscall_nr;
149	long		   fd;
150	struct sockaddr	   *addr_ptr;
151	unsigned long	   addrlen;
152};
153
154augmented_sockaddr_syscall(connect);
155
156struct syscall_enter_sendto_args {
157	unsigned long long common_tp_fields;
158	long		   syscall_nr;
159	long		   fd;
160	void		   *buff;
161	long		   len;
162	unsigned long	   flags;
163	struct sockaddr	   *addr_ptr;
164	long		   addr_len;
165};
166
167augmented_sockaddr_syscall(sendto);
168
169license(GPL);