feat(driver-kmod): Add RISC-V kernel module support

Signed-off-by: Xeonacid <[email protected]>
falcosecurity · Jun 29, 2023 · 46013fc · 46013fc
1 parent 05860aa
commit 46013fc
Show file tree

Hide file tree

Showing 13 changed files with 900 additions and 20 deletions.
diff --git a/.gitignore b/.gitignore
@@ -26,4 +26,5 @@ build*
 CMakeUserPresets.json
 cscope.out
 tags
-
+.idea
+cmake-build-debug
diff --git a/README.md b/README.md
@@ -50,11 +50,12 @@ If you build this project from a git working directory, the main [CMakeLists.txt
 
 Right now our drivers officially support the following architectures:
 
-|             | Kernel module                                                                                | eBPF probe | Modern eBPF probe |
-| ----------- |----------------------------------------------------------------------------------------------| ---------- | ----------------- |
-| **x86_64**  | >= 2.6                                                                                       | >= 4.14    | >= 5.8            |
-| **aarch64** | >= [3.16](https://github.com/torvalds/linux/commit/055b1212d141f1f398fca548f8147787c0b6253f) | >= 4.17    | >= 5.8            |
+|             | Kernel module                                                                                | eBPF probe                                                     | Modern eBPF probe |
+|-------------|----------------------------------------------------------------------------------------------|----------------------------------------------------------------|-------------------|
+| **x86_64**  | >= 2.6                                                                                       | >= 4.14                                                        | >= 5.8            |
+| **aarch64** | >= [3.16](https://github.com/torvalds/linux/commit/055b1212d141f1f398fca548f8147787c0b6253f) | >= 4.17                                                        | >= 5.8            |
 | **s390x**   | >= 2.6                                                                                       | >= [5.5](https://github.com/torvalds/linux/commit/6ae08ae3dea) | >= 5.8            |
+| **riscv64** | >= [5.0](https://github.com/torvalds/linux/commit/5aeb1b36cedd3a1dfdbfe368629fed52dee34103)  | N/A                                                            | N/A               |
 
 **For a list of supported syscalls through specific events, please refer to [_report_](./driver/report.md).**
 

diff --git a/driver/CMakeLists.txt b/driver/CMakeLists.txt
@@ -11,7 +11,8 @@ project(driver)
 set(TARGET_ARCH ${CMAKE_HOST_SYSTEM_PROCESSOR})
 if((NOT TARGET_ARCH STREQUAL "x86_64") AND
    (NOT TARGET_ARCH STREQUAL "aarch64") AND
-   (NOT TARGET_ARCH STREQUAL "s390x"))
+   (NOT TARGET_ARCH STREQUAL "s390x") AND
+   (NOT TARGET_ARCH STREQUAL "riscv64"))
 	message(WARNING "Target architecture not officially supported by our drivers!")
 else()
 	# Load current kernel version
@@ -23,6 +24,7 @@ else()
 	set(kmod_min_kver_map_x86_64 2.6)
 	set(kmod_min_kver_map_aarch64 3.16)
 	set(kmod_min_kver_map_s390x 2.6)
+	set(kmod_min_kver_map_riscv64 5.0)
 	if (LINUX_KERNEL_VERSION VERSION_LESS ${kmod_min_kver_map_${TARGET_ARCH}})
 		message(WARNING "[KMOD] To run this driver you need a Linux kernel version >= ${kmod_min_kver_map_${TARGET_ARCH}} but actual kernel version is: ${UNAME_RESULT}")
 	endif()

diff --git a/driver/ppm.h b/driver/ppm.h
@@ -52,7 +52,7 @@ struct ppm_ring_buffer_context {
 	u32 nevents;
 #ifndef UDIG
 	atomic_t preempt_count;
-#endif	
+#endif
 	char *str_storage;	/* String storage. Size is one page. */
 };
 
@@ -88,6 +88,8 @@ long ppm_strncpy_from_user(char *to, const char __user *from, unsigned long n);
   #define SYSCALL_TABLE_ID0 0
 #elif defined CONFIG_ARM64
   #define SYSCALL_TABLE_ID0 0
+#elif defined CONFIG_RISCV
+  #define SYSCALL_TABLE_ID0 0
 #endif
 
 extern const struct syscall_evt_pair g_syscall_table[];

diff --git a/driver/ppm_events_public.h b/driver/ppm_events_public.h
@@ -611,7 +611,7 @@ or GPL2.txt for full copies of the license.
 #define PPM_EXE_WRITABLE		(1 << 0)
 #define PPM_EXE_UPPER_LAYER 	(1 << 1)
 #define PPM_EXE_FROM_MEMFD  	(1 << 2)
-  
+
 /*
  * Execveat flags
  */
@@ -1826,7 +1826,8 @@ enum extra_event_prog_code
 	PPM_SC_X(IDLE, 408) \
 	PPM_SC_X(S390_RUNTIME_INSTR, 409) \
 	PPM_SC_X(SIGRETURN, 410) \
-	PPM_SC_X(S390_GUARDED_STORAGE, 411)
+	PPM_SC_X(S390_GUARDED_STORAGE, 411) \
+    PPM_SC_X(RISCV_FLUSH_ICACHE, 412)
 
 typedef enum {
 #define PPM_SC_X(name, value) PPM_SC_##name = (value),

diff --git a/driver/report.md b/driver/report.md
@@ -5,7 +5,7 @@ This table represents the syscalls supported by our drivers.
 🟢 means that the syscall is fully instrumented so its parameters are available to userspace.
 🟡 means that the syscall is not fully instrumented so the userspace is just notified when the syscall happens but no parameters are available.
 
-|         SYSCALL         | SUPPORTED |
+| SYSCALL                 | SUPPORTED |
 |-------------------------|-----------|
 | _sysctl                 | 🟡        |
 | accept                  | 🟢        |
@@ -256,6 +256,7 @@ This table represents the syscalls supported by our drivers.
 | renameat2               | 🟢        |
 | request_key             | 🟡        |
 | restart_syscall         | 🟡        |
+| riscv_flush_icache      | 🟡        |
 | rmdir                   | 🟢        |
 | rseq                    | 🟡        |
 | rt_sigaction            | 🟡        |