1 // SPDX-License-Identifier: GPL-2.0
3 * Augment the raw_syscalls tracepoints with the contents of the pointer arguments.
7 * perf trace -e tools/perf/examples/bpf/augmented_raw_syscalls.c cat /etc/passwd > /dev/null
9 * This exactly matches what is marshalled into the raw_syscall:sys_enter
10 * payload expected by the 'perf trace' beautifiers.
12 * For now it just uses the existing tracepoint augmentation code in 'perf
13 * trace', in the next csets we'll hook up these with the sys_enter/sys_exit
14 * code that will combine entry/exit in a strace like way.
18 #include <linux/limits.h>
19 #include <pid_filter.h>
21 /* bpf-output associated map */
22 bpf_map(__augmented_syscalls__, PERF_EVENT_ARRAY, int, u32, __NR_CPUS__);
28 bpf_map(syscalls, ARRAY, int, struct syscall, 512);
30 struct syscall_enter_args {
31 unsigned long long common_tp_fields;
33 unsigned long args[6];
36 struct syscall_exit_args {
37 unsigned long long common_tp_fields;
42 struct augmented_filename {
48 /* syscalls where the first arg is a string */
54 #define SYS_TRUNCATE 76
62 #define SYS_SYMLINK 88
63 #define SYS_READLINK 89
68 #define SYS_STATFS 137
69 #define SYS_PIVOT_ROOT 155
70 #define SYS_CHROOT 161
72 #define SYS_SWAPON 167
73 #define SYS_SWAPOFF 168
74 #define SYS_DELETE_MODULE 176
75 #define SYS_SETXATTR 188
76 #define SYS_LSETXATTR 189
77 #define SYS_GETXATTR 191
78 #define SYS_LGETXATTR 192
79 #define SYS_LISTXATTR 194
80 #define SYS_LLISTXATTR 195
81 #define SYS_REMOVEXATTR 197
82 #define SYS_LREMOVEXATTR 198
83 #define SYS_MQ_OPEN 240
84 #define SYS_MQ_UNLINK 241
85 #define SYS_ADD_KEY 248
86 #define SYS_REQUEST_KEY 249
87 #define SYS_SYMLINKAT 266
88 #define SYS_MEMFD_CREATE 319
90 /* syscalls where the first arg is a string */
92 #define SYS_PWRITE64 18
95 #define SYS_QUOTACTL 179
96 #define SYS_FSETXATTR 190
97 #define SYS_FGETXATTR 193
98 #define SYS_FREMOVEXATTR 199
99 #define SYS_MQ_TIMEDSEND 242
100 #define SYS_REQUEST_KEY 249
101 #define SYS_INOTIFY_ADD_WATCH 254
102 #define SYS_OPENAT 257
103 #define SYS_MKDIRAT 258
104 #define SYS_MKNODAT 259
105 #define SYS_FCHOWNAT 260
106 #define SYS_FUTIMESAT 261
107 #define SYS_NEWFSTATAT 262
108 #define SYS_UNLINKAT 263
109 #define SYS_RENAMEAT 264
110 #define SYS_LINKAT 265
111 #define SYS_READLINKAT 267
112 #define SYS_FCHMODAT 268
113 #define SYS_FACCESSAT 269
114 #define SYS_UTIMENSAT 280
115 #define SYS_NAME_TO_HANDLE_AT 303
116 #define SYS_FINIT_MODULE 313
117 #define SYS_RENAMEAT2 316
118 #define SYS_EXECVEAT 322
119 #define SYS_STATX 332
121 pid_filter(pids_filtered);
123 struct augmented_args_filename {
124 struct syscall_enter_args args;
125 struct augmented_filename filename;
128 bpf_map(augmented_filename_map, PERCPU_ARRAY, int, struct augmented_args_filename, 1);
130 SEC("raw_syscalls:sys_enter")
131 int sys_enter(struct syscall_enter_args *args)
133 struct augmented_args_filename *augmented_args;
134 unsigned int len = sizeof(*augmented_args);
135 const void *filename_arg = NULL;
136 struct syscall *syscall;
139 augmented_args = bpf_map_lookup_elem(&augmented_filename_map, &key);
140 if (augmented_args == NULL)
143 if (pid_filter__has(&pids_filtered, getpid()))
146 probe_read(&augmented_args->args, sizeof(augmented_args->args), args);
148 syscall = bpf_map_lookup_elem(&syscalls, &augmented_args->args.syscall_nr);
149 if (syscall == NULL || !syscall->enabled)
152 * Yonghong and Edward Cree sayz:
154 * https://www.spinics.net/lists/netdev/msg531645.html
156 * >> R0=inv(id=0) R1=inv2 R6=ctx(id=0,off=0,imm=0) R7=inv64 R10=fp0,call_-1
157 * >> 10: (bf) r1 = r6
158 * >> 11: (07) r1 += 16
159 * >> 12: (05) goto pc+2
160 * >> 15: (79) r3 = *(u64 *)(r1 +0)
161 * >> dereference of modified ctx ptr R1 off=16 disallowed
162 * > Aha, we at least got a different error message this time.
163 * > And indeed llvm has done that optimisation, rather than the more obvious
164 * > 11: r3 = *(u64 *)(r1 +16)
165 * > because it wants to have lots of reads share a single insn. You may be able
166 * > to defeat that optimisation by adding compiler barriers, idk. Maybe someone
167 * > with llvm knowledge can figure out how to stop it (ideally, llvm would know
168 * > when it's generating for bpf backend and not do that). -O0? ¯\_(ツ)_/¯
170 * The optimization mostly likes below:
183 * The compiler tries to merge common loads. There is no easy way to
184 * stop this compiler optimization without turning off a lot of other
185 * optimizations. The easiest way is to add barriers:
187 * __asm__ __volatile__("": : :"memory")
189 * after the ctx memory access to prevent their down stream merging.
192 * This table of what args are strings will be provided by userspace,
193 * in the syscalls map, i.e. we will already have to do the lookup to
194 * see if this specific syscall is filtered, so we can as well get more
195 * info about what syscall args are strings or pointers, and how many
196 * bytes to copy, per arg, etc.
198 * For now hard code it, till we have all the basic mechanisms in place
199 * to automate everything and make the kernel part be completely driven
200 * by information obtained in userspace for each kernel version and
201 * processor architecture, making the kernel part the same no matter what
202 * kernel version or processor architecture it runs on.
204 switch (augmented_args->args.syscall_nr) {
212 case SYS_DELETE_MODULE:
220 case SYS_LREMOVEXATTR:
223 case SYS_MEMFD_CREATE:
230 case SYS_REMOVEXATTR:
232 case SYS_REQUEST_KEY:
244 case SYS_OPEN: filename_arg = (const void *)args->args[0];
245 __asm__ __volatile__("": : :"memory");
252 case SYS_FINIT_MODULE:
253 case SYS_FREMOVEXATTR:
256 case SYS_INOTIFY_ADD_WATCH:
260 case SYS_MQ_TIMEDSEND:
261 case SYS_NAME_TO_HANDLE_AT:
271 case SYS_OPENAT: filename_arg = (const void *)args->args[1];
275 if (filename_arg != NULL) {
276 augmented_args->filename.reserved = 0;
277 augmented_args->filename.size = probe_read_str(&augmented_args->filename.value,
278 sizeof(augmented_args->filename.value),
280 if (augmented_args->filename.size < sizeof(augmented_args->filename.value)) {
281 len -= sizeof(augmented_args->filename.value) - augmented_args->filename.size;
282 len &= sizeof(augmented_args->filename.value) - 1;
285 len = sizeof(augmented_args->args);
288 /* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */
289 return perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, augmented_args, len);
292 SEC("raw_syscalls:sys_exit")
293 int sys_exit(struct syscall_exit_args *args)
295 struct syscall_exit_args exit_args;
296 struct syscall *syscall;
298 if (pid_filter__has(&pids_filtered, getpid()))
301 probe_read(&exit_args, sizeof(exit_args), args);
303 syscall = bpf_map_lookup_elem(&syscalls, &exit_args.syscall_nr);
304 if (syscall == NULL || !syscall->enabled)