/*
 * eset_rtp (ESET Real-time file system protection module)
 * Copyright (C) 1992-2023 ESET, spol. s r.o.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * In case of any questions, you can contact us at ESET, spol. s r.o., Einsteinova 24, 851 01 Bratislava, Slovakia.
 */

#include "ertp_ftrace_hook.h"
#include "ertp.h"
#include "ertp_ftrace_utils.h"
#include "ertp_handlers.h"
#include "ertp_logs.h"

#include <linux/compiler.h>
#include <linux/kernel.h>
#include <linux/version.h>

#define ERTP_SYMBOL_NAME_SIZE 128

static char *compute_symbol_name(struct ertp_ftrace_hook *hook,
                                 const char *prefix) {
  char *symbol_name = kmalloc(ERTP_SYMBOL_NAME_SIZE, GFP_KERNEL);
  if (unlikely(!symbol_name)) {
    return NULL;
  }
  symbol_name[0] = '\0';
  strlcat(symbol_name, prefix, ERTP_SYMBOL_NAME_SIZE);
  strlcat(symbol_name, hook->name, ERTP_SYMBOL_NAME_SIZE);

  return symbol_name;
}
static int resolve_hook_address(struct ertp_ftrace_hook *hook) {
  const char *symbol_name = NULL;
  switch (hook->syscall_type) {
    case ERTP_SYSCALL_TYPE_NATIVE_64:
      symbol_name = compute_symbol_name(hook, "");
      break;

    case ERTP_SYSCALL_TYPE_NATIVE_32:
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0))
      symbol_name = compute_symbol_name(hook, "__ia32_sys_");
#else

      goto error;
#endif
      break;

    case ERTP_SYSCALL_TYPE_COMPAT_32:
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0))
      symbol_name = compute_symbol_name(hook, "__ia32_compat_sys_");
#else
      symbol_name = compute_symbol_name(hook, "compat_sys_");
#endif
      break;

    default:
      BUG();
  }

  if (unlikely(!symbol_name)) {
    goto error;
  }

  hook->address = ertp_lookup_address(symbol_name);
  kfree(symbol_name);
  if (unlikely(!hook->address)) {
    goto error;
  }

  *((unsigned long *)hook->original) = hook->address + MCOUNT_INSN_SIZE;

  return 0;

error:
  ertp_pr_error("cannot resolve symbol: %s\n", hook->name);
  return -ENOENT;
}

#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0))
#define ertp_ftrace_regs_t struct ftrace_regs
#define ERTP_GET_PT_REGS(fregs) ftrace_get_regs(fregs)
#else
#define ertp_ftrace_regs_t struct pt_regs
#define ERTP_GET_PT_REGS(fregs) (fregs)
#endif

static void notrace ertp_ftrace_thunk(unsigned long ip, unsigned long parent_ip,
                                      struct ftrace_ops *ops,
                                      ertp_ftrace_regs_t *fregs) {
  struct pt_regs *regs = ERTP_GET_PT_REGS(fregs);
  struct ertp_ftrace_hook *hook =
      container_of(ops, struct ertp_ftrace_hook, ops);

  ertp_handler_start();
  regs->ip = (unsigned long)hook->handler;
}

#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 11, 0))
#define ERTP_FTRACE_FLAGS                             \
  (FTRACE_OPS_FL_SAVE_REGS | FTRACE_OPS_FL_IPMODIFY | \
   FTRACE_OPS_FL_RECURSION_SAFE)
#else
#define ERTP_FTRACE_FLAGS (FTRACE_OPS_FL_SAVE_REGS | FTRACE_OPS_FL_IPMODIFY)
#endif

int ertp_ftrace_hook_register(struct ertp_ftrace_hook *hook) {
  int err;

  err = resolve_hook_address(hook);
  if (unlikely(err)) {
    return err;
  }

  hook->ops.func = ertp_ftrace_thunk;
  hook->ops.flags = ERTP_FTRACE_FLAGS;

  err = ftrace_set_filter_ip(&hook->ops, hook->address, 0, 0);
  if (unlikely(err)) {
    ertp_pr_log(ERTP_LOG_ERRORS, "ftrace_set_filter_ip() for %s failed: %d\n",
                hook->name, err);
    return err;
  }

  err = register_ftrace_function(&hook->ops);
  if (unlikely(err)) {
    ertp_pr_log(ERTP_LOG_ERRORS,
                "register_ftrace_function() for %s failed: %d\n", hook->name,
                err);
    ftrace_set_filter_ip(&hook->ops, hook->address, 1, 0);
    return err;
  }

  ertp_pr_log(
      ERTP_LOG_HOOKS, "registered ftrace hook for %s%s",
      hook->syscall_type == ERTP_SYSCALL_TYPE_COMPAT_32 ? "compat " : "",
      hook->name);

  return 0;
}

void ertp_ftrace_hook_unregister(struct ertp_ftrace_hook *hook) {
  int err;

  err = unregister_ftrace_function(&hook->ops);
  if (err) {
    ertp_pr_log(ERTP_LOG_ERRORS,
                "unregister_ftrace_function() for %s failed: %d\n", hook->name,
                err);
  }

  err = ftrace_set_filter_ip(&hook->ops, hook->address, 1, 0);
  if (err) {
    ertp_pr_log(ERTP_LOG_ERRORS, "ftrace_set_filter_ip() for %s failed: %d\n",
                hook->name, err);
  }
}