/*
 * eset_wap (ESET Web Access Protection module)
 * Copyright (C) 1992-2025 ESET, spol. s r.o.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * In case of any questions, you can contact us at ESET, spol. s r.o., Einsteinova 24, 851 01 Bratislava, Slovakia.
 */

#include "ewap_ftrace.h"

#include <linux/compiler.h>
#include <linux/kallsyms.h>
#include <linux/kernel.h>
#include <linux/kprobes.h>
#include <linux/version.h>

#include "ewap_helpers.h"

static unsigned long ewap_lookup_address(const char *symbol_name)
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0))
{
  struct kprobe probe = {.symbol_name = symbol_name};
  unsigned long ret;
  int kprobe_ret;

  ewap_pr_log(EWAP_LOG_HOOKS,
              "looking up address of symbol %s (through kprobes)", symbol_name);

  kprobe_ret = register_kprobe(&probe);
  if (unlikely(kprobe_ret < 0)) {
    ewap_pr_log(EWAP_LOG_ERRORS, "address lookup failed with return: %d",
                kprobe_ret);
    return 0;
  }

  ewap_pr_log(EWAP_LOG_HOOKS, "address lookup succeeded");

  ret = (unsigned long)probe.addr;
  unregister_kprobe(&probe);
  return ret;
}
#else
{
  unsigned long ret;

  ewap_pr_log(EWAP_LOG_HOOKS,
              "looking up address of symbol %s (through kallsyms_lookup_name)",
              symbol_name);

  ret = kallsyms_lookup_name(symbol_name);
  if (unlikely(ret == 0)) {
    ewap_pr_log(EWAP_LOG_ERRORS, "address lookup failed");
  }

  ewap_pr_log(EWAP_LOG_HOOKS, "address lookup succeeded");

  return ret;
}
#endif
static int resolve_hook_address(struct ewap_ftrace_hook *hook) {
  hook->address = ewap_lookup_address(hook->name);
  if (unlikely(!hook->address)) {
    ewap_pr_log(EWAP_LOG_ERRORS, "unresolved symbol: %s\n", hook->name);
    return -ENOENT;
  }

  *((unsigned long *)hook->original) = hook->address + MCOUNT_INSN_SIZE;
  ewap_pr_log(EWAP_LOG_HOOKS, "addr 0x%08lx", hook->address);
  ewap_pr_log(EWAP_LOG_HOOKS, "orig 0x%08lx",
              *((unsigned long *)hook->original));

  return 0;
}

#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0))
#define ewap_ftrace_regs_t struct ftrace_regs
#define EWAP_GET_PT_REGS(fregs) ftrace_get_regs(fregs)
#else
#define ewap_ftrace_regs_t struct pt_regs
#define EWAP_GET_PT_REGS(fregs) (fregs)
#endif

static void notrace ewap_ftrace_thunk(unsigned long ip, unsigned long parent_ip,
                                      struct ftrace_ops *ops,
                                      ewap_ftrace_regs_t *fregs) {
  struct pt_regs *regs = EWAP_GET_PT_REGS(fregs);
  struct ewap_ftrace_hook *hook =
      container_of(ops, struct ewap_ftrace_hook, ops);

  regs->ip = (unsigned long)hook->handler;
}

#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 11, 0))
#define EWAP_FTRACE_FLAGS                             \
  (FTRACE_OPS_FL_SAVE_REGS | FTRACE_OPS_FL_IPMODIFY | \
   FTRACE_OPS_FL_RECURSION_SAFE)
#else
#define EWAP_FTRACE_FLAGS (FTRACE_OPS_FL_SAVE_REGS | FTRACE_OPS_FL_IPMODIFY)
#endif

int ewap_ftrace_register(struct ewap_ftrace_hook *hook) {
  int err;

  err = resolve_hook_address(hook);
  if (unlikely(err)) {
    return err;
  }

  hook->ops.func = ewap_ftrace_thunk;
  hook->ops.flags = EWAP_FTRACE_FLAGS;

  err = ftrace_set_filter_ip(&hook->ops, hook->address, 0, 0);
  if (err) {
    ewap_pr_log(EWAP_LOG_ERRORS, "ftrace_set_filter_ip() for %s failed: %d\n",
                hook->name, err);
    return err;
  }

  err = register_ftrace_function(&hook->ops);
  if (err) {
    ewap_pr_log(EWAP_LOG_ERRORS,
                "register_ftrace_function() for %s failed: %d\n", hook->name,
                err);
    ftrace_set_filter_ip(&hook->ops, hook->address, 1, 0);
    return err;
  }

  ewap_pr_log(EWAP_LOG_HOOKS, "registered ftrace hook for %s", hook->name);

  return 0;
}

void ewap_ftrace_unregister(struct ewap_ftrace_hook *hook) {
  int err;

  err = unregister_ftrace_function(&hook->ops);
  if (err) {
    ewap_pr_log(EWAP_LOG_ERRORS,
                "unregister_ftrace_function() for %s failed: %d\n", hook->name,
                err);
  }

  err = ftrace_set_filter_ip(&hook->ops, hook->address, 1, 0);
  if (err) {
    ewap_pr_log(EWAP_LOG_ERRORS, "ftrace_set_filter_ip() for %s failed: %d\n",
                hook->name, err);
  }
}