Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

new(driver): ia32 emulation bpf drivers support #1196

Merged
merged 39 commits into from
Oct 11, 2023
Merged

new(driver): ia32 emulation bpf drivers support #1196

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
39 commits
Select commit Hold shift + click to select a range
d86f095
new(driver/bpf): initial ia32 support for old bpf probe.
FedeDP Jul 11, 2023
1df7e28
new(driver/modern_bpf): initial ia32 support for modern bpf.
FedeDP Jul 11, 2023
6500840
new(driver/bpf): added a syscalls-bumper generated ia32 to x64 map ta…
FedeDP Jul 11, 2023
db015c7
new(driver/modern_bpf): implemented new map converting ia32 syscall n…
FedeDP Jul 11, 2023
818ff7a
new(driver): ported kmod to new design for ia32 support.
FedeDP Jul 11, 2023
99619a8
cleanup(driver): dropped unused syscall_table32.c.
FedeDP Jul 11, 2023
9652b06
chore(driver): properly only support ia32 for x86_64 architecture.
FedeDP Jul 11, 2023
a1e7f9e
fix(driver): added back x86_64 ia32 socketcall support for kmod.
FedeDP Jul 11, 2023
72f6bd6
fix(driver): implemented execve and execveat logic to bpf and modern …
FedeDP Jul 12, 2023
59c6ab8
fix(driver/bpf): implemented proper x86 ia32 socketcall support.
FedeDP Jul 12, 2023
cf92c79
chore(driver,userspace): properly generate ia32 mapping table filled …
FedeDP Jul 12, 2023
17eb43a
clenup(driver,driver/bpf): socketcall_to_syscall file can now use 64b…
FedeDP Jul 12, 2023
fffa482
cleanup(driver): made socketcall support fully dynamic.
FedeDP Jul 12, 2023
526c584
chore(driver): bumped maj API version.
FedeDP Oct 3, 2023
308b65b
fix(userspace/libscap): bumped SCAP_MINIMUM_DRIVER_API_VERSION.
FedeDP Oct 3, 2023
6a9772f
new(test): added initial driver tests for ia32.
FedeDP Oct 3, 2023
003812b
chore(ci): install gcc-multilib.
FedeDP Oct 3, 2023
a171af1
chore: only build ia32 test on x86_64 arch.
FedeDP Oct 3, 2023
0703106
chore(driver,test): update ia32 script to call SYS_SEND and SYS_ACCEP…
FedeDP Oct 3, 2023
56286ea
chore(test): send an unexistent SYS_ code too.
FedeDP Oct 3, 2023
cfbe153
fix(driver/bpf): reassure bpf verifier about read length.
FedeDP Oct 5, 2023
7ea7f00
fix(bpf): initialize some variables
Andreagit97 Oct 5, 2023
857aca7
chore(test/drivers): properly test that execve exit is received even …
FedeDP Oct 5, 2023
8ed4cdb
fix(driver): handle id == __NR_ia32_socketcall case in old bpf and kmod.
FedeDP Oct 5, 2023
4f9b915
chore(test/drivers): add specific test for execve exit behavior.
FedeDP Oct 5, 2023
c93fbe0
chore(test/drivers): add cmake option to skip ia32 tests, skipping ne…
FedeDP Oct 5, 2023
54c2f43
chore(test/drivers): added new tests for ia32 to check pushed params.
FedeDP Oct 6, 2023
8e3ec73
chore(test/drivers): allow ia32 helper build even on system without o…
FedeDP Oct 6, 2023
0bfd34d
chore(driver/modern_bpf): try to simplify `extract__network_args`.
FedeDP Oct 6, 2023
3d31efa
chore(test/drivers): move to use openat2 exit event to test at least …
FedeDP Oct 6, 2023
4e2819a
chore(test/drivers): do not assert openat2 exit return code in ia32, …
FedeDP Oct 6, 2023
9f7e31b
cleanup(bpf): add some comments and clean some code paths
Andreagit97 Oct 6, 2023
f97b1ca
cleanup(driver): add some comments and clean some code paths
Andreagit97 Oct 6, 2023
31a142b
cleanup(modern): add some comments and clean some code paths
Andreagit97 Oct 6, 2023
2ec5079
chore(test/drivers): updated test name.
FedeDP Oct 6, 2023
e80a900
fix(modern): move some code to fix verifier on old kernels <5.11
Andreagit97 Oct 10, 2023
ade13ea
fix(driver): do not support socketcall on old ebpf when raw tracepoin…
FedeDP Oct 11, 2023
8e74d5e
chore(test/drivers): add mmap test to ia32 tests.
FedeDP Oct 11, 2023
b23c48e
chore(driver): regenerated ia32_64 map with latest syscalls-bumper fi…
FedeDP Oct 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ jobs:
name: Install deps ⛓️
command: |
sudo apt update -y
sudo DEBIAN_FRONTEND=noninteractive apt install -y --no-install-recommends ca-certificates git make build-essential clang-7 libelf-dev libcap-dev cmake linux-headers-$(uname -r)
sudo DEBIAN_FRONTEND=noninteractive apt install -y --no-install-recommends ca-certificates git make build-essential clang-7 libelf-dev libcap-dev cmake linux-headers-$(uname -r) gcc-multilib g++-multilib
ls /usr/bin/ | grep clang
ls /usr/bin/ | grep llc
sudo ln -s /usr/bin/clang-7 /usr/bin/clang
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,7 +233,7 @@ jobs:
- name: Install deps ⛓️
run: |
sudo apt update
sudo apt install -y --no-install-recommends ca-certificates cmake build-essential git pkg-config autoconf automake libelf-dev libcap-dev linux-headers-$(uname -r) clang-14 llvm-14 libtool
sudo apt install -y --no-install-recommends ca-certificates cmake build-essential git pkg-config autoconf automake libelf-dev libcap-dev linux-headers-$(uname -r) clang-14 llvm-14 libtool gcc-multilib g++-multilib
sudo update-alternatives --install /usr/bin/clang clang /usr/bin/clang-14 90
sudo update-alternatives --install /usr/bin/llvm-strip llvm-strip /usr/bin/llvm-strip-14 90
sudo update-alternatives --install /usr/bin/llc llc /usr/bin/llc-14 90
Expand Down
2 changes: 1 addition & 1 deletion driver/API_VERSION
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
5.0.0
6.0.0
3 changes: 1 addition & 2 deletions driver/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,6 @@ set(DRIVER_SOURCES
ppm_flag_helpers.h
ppm_ringbuffer.h
syscall_table.c
syscall_table32.c
syscall_table64.c
ppm_cputime.c
ppm_version.h
Expand All @@ -119,7 +118,7 @@ set(DRIVER_SOURCES
ppm_consumer.h
capture_macro.h
socketcall_to_syscall.h
socketcall_to_syscall.c
syscall_ia32_64_map.c
)

foreach(FILENAME IN LISTS DRIVER_SOURCES)
Expand Down
2 changes: 1 addition & 1 deletion driver/Makefile.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
# MIT.txt or GPL.txt for full copies of the license.
#

@DRIVER_NAME@-y += main.o dynamic_params_table.o fillers_table.o flags_table.o ppm_events.o ppm_fillers.o event_table.o syscall_table32.o syscall_table64.o ppm_cputime.o ppm_tp.o socketcall_to_syscall.o
@DRIVER_NAME@-y += main.o dynamic_params_table.o fillers_table.o flags_table.o ppm_events.o ppm_fillers.o event_table.o syscall_table64.o ppm_cputime.o ppm_tp.o syscall_ia32_64_map.o
obj-m += @[email protected]
ccflags-y := @KBUILD_FLAGS@

Expand Down
46 changes: 0 additions & 46 deletions driver/bpf/filler_helpers.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1465,50 +1465,4 @@ static __always_inline int bpf_val_to_ring_type(struct filler_data *data,
return __bpf_val_to_ring(data, val, 0, type, -1, false, param_type_to_mem(type));
}

static __always_inline bool bpf_in_ia32_syscall()
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just moved to plumbing_helpers

{
struct task_struct *task = (struct task_struct *)bpf_get_current_task();
u32 status = 0;

#ifdef CONFIG_X86_64

#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 18)
status = _READ(task->thread.status);
#elif LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
status = _READ(task->thread_info.status);
#elif LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 2)
status = _READ(task->thread.status);
#else
status = _READ(task->thread_info.status);
#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 18) */

/* See here for the definition:
* https://github.com/torvalds/linux/blob/69cb6c6556ad89620547318439d6be8bb1629a5a/arch/x86/include/asm/thread_info.h#L212
*/
return status & TS_COMPAT;

#elif defined(CONFIG_ARM64)

/* See here for the definition:
* https://github.com/torvalds/linux/blob/69cb6c6556ad89620547318439d6be8bb1629a5a/arch/arm64/include/asm/thread_info.h#L99
*/
status = _READ(task->thread_info.flags);
return status & _TIF_32BIT;

#elif defined(CONFIG_S390)

/* See here for the definition:
* https://github.com/torvalds/linux/blob/69cb6c6556ad89620547318439d6be8bb1629a5a/arch/s390/include/asm/thread_info.h#L101
*/
status = _READ(task->thread_info.flags);
return status & _TIF_31BIT;

#else

/* Unknown architecture. */
return false;

#endif /* CONFIG_X86_64 */
}

#endif
8 changes: 8 additions & 0 deletions driver/bpf/maps.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,14 @@ struct bpf_map_def __bpf_section("maps") interesting_syscalls_table = {
.max_entries = SYSCALL_TABLE_SIZE,
};

// The key is the 32-bit syscall code while the value is 64-bit one
struct bpf_map_def __bpf_section("maps") ia32_64_map = {
.type = BPF_MAP_TYPE_ARRAY,
.key_size = sizeof(u32),
.value_size = sizeof(u32),
.max_entries = SYSCALL_TABLE_SIZE,
};

#ifndef BPF_SUPPORTS_RAW_TRACEPOINTS
struct bpf_map_def __bpf_section("maps") stash_map = {
.type = BPF_MAP_TYPE_HASH,
Expand Down
Loading
Loading