tools/perf/examples/bpf/augmented_syscalls.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Augment syscalls with the contents of the pointer arguments.
   4  *
   5  * Test it with:
   6  *
   7  * perf trace -e tools/perf/examples/bpf/augmented_syscalls.c cat /etc/passwd > /dev/null
   8  *
   9  * It'll catch some openat syscalls related to the dynamic linked and
  10  * the last one should be the one for '/etc/passwd'.
  11  *
  12  * This matches what is marshalled into the raw_syscall:sys_enter payload
  13  * expected by the 'perf trace' beautifiers, and can be used by them, that will
  14  * check if perf_sample->raw_data is more than what is expected for each
  15  * syscalls:sys_{enter,exit}_SYSCALL tracepoint, uing the extra data as the
  16  * contents of pointer arguments.
  17  */
  18
  19 #include <stdio.h>
  20 #include <linux/socket.h>
  21
  22 struct bpf_map SEC("maps") __augmented_syscalls__ = {
  23        .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
  24        .key_size = sizeof(int),
  25        .value_size = sizeof(u32),
  26        .max_entries = __NR_CPUS__,
  27 };
  28
  29 struct syscall_exit_args {
  30         unsigned long long common_tp_fields;
  31         long               syscall_nr;
  32         long               ret;
  33 };
  34
  35 struct augmented_filename {
  36         unsigned int    size;
  37         int             reserved;
  38         char            value[256];
  39 };
  40
  41 #define augmented_filename_syscall(syscall)                                                     \
  42 struct augmented_enter_##syscall##_args {                                                       \
  43         struct syscall_enter_##syscall##_args   args;                                           \
  44         struct augmented_filename               filename;                                       \
  45 };                                                                                              \
  46 int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args)                         \
  47 {                                                                                               \
  48         struct augmented_enter_##syscall##_args augmented_args = { .filename.reserved = 0, };   \
  49         unsigned int len = sizeof(augmented_args);                                              \
  50         probe_read(&augmented_args.args, sizeof(augmented_args.args), args);                    \
  51         augmented_args.filename.size = probe_read_str(&augmented_args.filename.value,           \
  52                                                       sizeof(augmented_args.filename.value),    \
  53                                                       args->filename_ptr);                      \
  54         if (augmented_args.filename.size < sizeof(augmented_args.filename.value)) {             \
  55                 len -= sizeof(augmented_args.filename.value) - augmented_args.filename.size;    \
  56                 len &= sizeof(augmented_args.filename.value) - 1;                               \
  57         }                                                                                       \
  58         perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU,                     \
  59                           &augmented_args, len);                                                \
  60         return 0;                                                                               \
  61 }                                                                                               \
  62 int syscall_exit(syscall)(struct syscall_exit_args *args)                                       \
  63 {                                                                                               \
  64        return 1; /* 0 as soon as we start copying data returned by the kernel, e.g. 'read' */   \
  65 }
  66
  67 struct syscall_enter_openat_args {
  68         unsigned long long common_tp_fields;
  69         long               syscall_nr;
  70         long               dfd;
  71         char               *filename_ptr;
  72         long               flags;
  73         long               mode;
  74 };
  75
  76 augmented_filename_syscall(openat);
  77
  78 struct syscall_enter_open_args {
  79         unsigned long long common_tp_fields;
  80         long               syscall_nr;
  81         char               *filename_ptr;
  82         long               flags;
  83         long               mode;
  84 };
  85
  86 augmented_filename_syscall(open);
  87
  88 struct syscall_enter_inotify_add_watch_args {
  89         unsigned long long common_tp_fields;
  90         long               syscall_nr;
  91         long               fd;
  92         char               *filename_ptr;
  93         long               mask;
  94 };
  95
  96 augmented_filename_syscall(inotify_add_watch);
  97
  98 struct statbuf;
  99
 100 struct syscall_enter_newstat_args {
 101         unsigned long long common_tp_fields;
 102         long               syscall_nr;
 103         char               *filename_ptr;
 104         struct stat        *statbuf;
 105 };
 106
 107 augmented_filename_syscall(newstat);
 108
 109 #ifndef _K_SS_MAXSIZE
 110 #define _K_SS_MAXSIZE 128
 111 #endif
 112
 113 #define augmented_sockaddr_syscall(syscall)                                             \
 114 struct augmented_enter_##syscall##_args {                                                       \
 115         struct syscall_enter_##syscall##_args   args;                                           \
 116         struct sockaddr_storage                 addr;                                           \
 117 };                                                                                              \
 118 int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args)                         \
 119 {                                                                                               \
 120         struct augmented_enter_##syscall##_args augmented_args;                                 \
 121         unsigned long addrlen = sizeof(augmented_args.addr);                                    \
 122         probe_read(&augmented_args.args, sizeof(augmented_args.args), args);                    \
 123 /* FIXME_CLANG_OPTIMIZATION_THAT_ACCESSES_USER_CONTROLLED_ADDRLEN_DESPITE_THIS_CHECK */         \
 124 /*      if (addrlen > augmented_args.args.addrlen)                                   */         \
 125 /*              addrlen = augmented_args.args.addrlen;                               */         \
 126 /*                                                                                   */         \
 127         probe_read(&augmented_args.addr, addrlen, args->addr_ptr);                              \
 128         perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU,                     \
 129                           &augmented_args,                                                      \
 130                           sizeof(augmented_args) - sizeof(augmented_args.addr) + addrlen);      \
 131         return 0;                                                                               \
 132 }                                                                                               \
 133 int syscall_exit(syscall)(struct syscall_exit_args *args)                                       \
 134 {                                                                                               \
 135        return 1; /* 0 as soon as we start copying data returned by the kernel, e.g. 'read' */   \
 136 }
 137
 138 struct sockaddr;
 139
 140 struct syscall_enter_bind_args {
 141         unsigned long long common_tp_fields;
 142         long               syscall_nr;
 143         long               fd;
 144         struct sockaddr    *addr_ptr;
 145         unsigned long      addrlen;
 146 };
 147
 148 augmented_sockaddr_syscall(bind);
 149
 150 struct syscall_enter_connect_args {
 151         unsigned long long common_tp_fields;
 152         long               syscall_nr;
 153         long               fd;
 154         struct sockaddr    *addr_ptr;
 155         unsigned long      addrlen;
 156 };
 157
 158 augmented_sockaddr_syscall(connect);
 159
 160 struct syscall_enter_sendto_args {
 161         unsigned long long common_tp_fields;
 162         long               syscall_nr;
 163         long               fd;
 164         void               *buff;
 165         long               len;
 166         unsigned long      flags;
 167         struct sockaddr    *addr_ptr;
 168         long               addr_len;
 169 };
 170
 171 augmented_sockaddr_syscall(sendto);
 172
 173 license(GPL);