diff --git a/.container/install-ubuntu-dependencies.sh b/.container/install-ubuntu-dependencies.sh index 7febb44..55a8ed4 100644 --- a/.container/install-ubuntu-dependencies.sh +++ b/.container/install-ubuntu-dependencies.sh @@ -30,7 +30,6 @@ sudo apt-get install -y --no-install-recommends \ libxml2-dev \ libzstd1 \ libgtest-dev \ - libc6-dev-i386 \ apt-transport-https \ dirmngr \ googletest \ @@ -47,6 +46,11 @@ sudo apt-get install -y --no-install-recommends \ clang-tools \ libssl-dev +# libc6-dev-i386 is only available/needed on x86_64 +if [ "$(uname -m)" = "x86_64" ]; then + sudo apt-get install -y --no-install-recommends libc6-dev-i386 +fi + sudo wget https://raw.githubusercontent.com/torvalds/linux/master/include/uapi/linux/openat2.h -O /usr/include/linux/openat2.h # install debbuild diff --git a/BUILD.md b/BUILD.md index 4e345a5..57ecec7 100644 --- a/BUILD.md +++ b/BUILD.md @@ -41,6 +41,37 @@ cmake .. make ``` +## Cross-building for aarch64 (on x86_64) + +### Prerequisites +Install cross-compilation toolchain and target-architecture libraries: +``` +sudo apt -y install crossbuild-essential-arm64 binutils-aarch64-linux-gnu \ + libc6-dev-arm64-cross linux-libc-dev-arm64-cross \ + libelf-dev:arm64 libjson-glib-dev:arm64 zlib1g-dev:arm64 libzstd-dev:arm64 +``` + +You may need to enable the arm64 architecture first: +``` +sudo dpkg --add-architecture arm64 +sudo apt update +``` + +### Cross-build +``` +cd SysinternalsEBPF +mkdir build-arm64 +cd build-arm64 +cmake .. \ + -DCMAKE_TOOLCHAIN_FILE=../cmake/aarch64-linux-gnu.cmake +cmake --build . --parallel +``` + +### Install (staged) +``` +DESTDIR=$(pwd)/staging cmake --install . +``` + ## (Build from Sysmon ADO internally) *This is only required when cloning from the Sysmon ADO. Most users can ignore this.* @@ -69,14 +100,15 @@ Or: sudo make install sudo ldconfig ``` -The shared library will be installed to /lib/x86_64-linux-gnu (Debian) or -/lib64 (Fedora) or /usr/lib (pre multi arch Debian).; the header to /usr/include; -the offsets database and EBPF objects to /opt/sysinternalsEBPF. The libsysinternalsEBPFinstaller - binary will also be installed in /opt/sysinternalsEBPF (which can be copied to another - system and run to install sysinternalsEBPF there). *Note:* 'sudo make install' will use -the binary, include, and lib directories that cmake prefers or you have -overridden, whereas the installer and the packages (see below) use the paths -specified above. +The shared library will be installed to the appropriate multiarch library +directory (e.g. /lib/x86\_64-linux-gnu on Debian x86\_64, +/lib/aarch64-linux-gnu on Debian arm64, or /lib64 on Fedora); the header to +/usr/include; the offsets database and EBPF objects to /opt/sysinternalsEBPF. +The libsysinternalsEBPFinstaller binary will also be installed in +/opt/sysinternalsEBPF (which can be copied to another system and run to install +sysinternalsEBPF there). *Note:* 'sudo make install' will use the binary, +include, and lib directories that cmake prefers or you have overridden, whereas +the installer and the packages (see below) use the paths specified above. ## Make Packages Packages can be generated with: @@ -90,5 +122,5 @@ make rpm The directories build/deb and build/rpm will be populated with the required files. If dpkg-deb is available, the build/deb directory will be used to create a deb package. Similarly if rpmbuild is available, the build/rpm directory will -be used to create an rpm package. - +be used to create an rpm package. Package architecture is set automatically +based on the target platform. diff --git a/CMakeLists.txt b/CMakeLists.txt index 720a8fe..35ae87a 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -54,9 +54,6 @@ if ("${PROJECT_VERSION_TWEAK}" STREQUAL "") set(PROJECT_VERSION_TWEAK 0) endif() -configure_file(package/DEBIAN.in/control.in DEBIANcontrol) -configure_file(package/SPECS.in/spec.in SPECS.spec) - # # enable Debug while pre-release; re-enable it post-release to add symbols to binary # @@ -64,9 +61,46 @@ configure_file(package/SPECS.in/spec.in SPECS.spec) #option(DEBUG_K "Enter debug mode" On) # -# external programs used by this build +# external programs used by this build - respect cross-compilation toolchain +# +if(CMAKE_LINKER) + set(LD "${CMAKE_LINKER}") +else() + set(LD "/usr/bin/ld") +endif() + +include(GNUInstallDirs) + +# +# Architecture detection — reject unsupported targets early # -set(LD "/usr/bin/ld") +if(NOT DEFINED TARGET_ARCH) + if(CMAKE_SYSTEM_PROCESSOR MATCHES "aarch64|arm64|ARM64") + set(TARGET_ARCH "arm64") + elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64|AMD64|amd64") + set(TARGET_ARCH "x86") + else() + message(FATAL_ERROR "Unsupported target architecture: ${CMAKE_SYSTEM_PROCESSOR}") + endif() +endif() + +message(STATUS "Target architecture: ${TARGET_ARCH}") + +# Derive multiarch tuple for system includes +if(TARGET_ARCH STREQUAL "arm64") + set(TARGET_MULTIARCH "aarch64-linux-gnu") + set(DEB_ARCH "arm64") + set(RPM_ARCH "aarch64") +elseif(TARGET_ARCH STREQUAL "x86") + set(TARGET_MULTIARCH "x86_64-linux-gnu") + set(DEB_ARCH "amd64") + set(RPM_ARCH "x86_64") +else() + message(FATAL_ERROR "Unsupported TARGET_ARCH: ${TARGET_ARCH} (expected 'x86' or 'arm64')") +endif() + +configure_file(package/DEBIAN.in/control.in DEBIANcontrol) +configure_file(package/SPECS.in/spec.in SPECS.spec) # # package name @@ -112,13 +146,20 @@ include(ExternalProject) # Fetch libbpf # FIX this so that it clones libbpf when the project is cloned +# Build libbpf with the correct compiler for the target architecture +if(CMAKE_CROSSCOMPILING) + set(LIBBPF_BUILD_CMD "CC=${CMAKE_C_COMPILER} AR=${CMAKE_AR} RANLIB=${CMAKE_RANLIB} CFLAGS=\"-g -O2 -Werror -Wall -fPIC\" make") +else() + set(LIBBPF_BUILD_CMD "CFLAGS=\"-g -O2 -Werror -Wall -fPIC\" make") +endif() + ExternalProject_Add(libbpf GIT_REPOSITORY https://github.com/libbpf/libbpf.git # GIT_TAG master GIT_TAG v1.7.0 PREFIX ./libbpf CONFIGURE_COMMAND "" - BUILD_COMMAND cd ../libbpf/src && bash -c "CFLAGS=\"-g -O2 -Werror -Wall -fPIC\" make" + BUILD_COMMAND cd ../libbpf/src && bash -c "${LIBBPF_BUILD_CMD}" INSTALL_COMMAND "" ) @@ -187,12 +228,12 @@ add_executable(libsysinternalsEBPFinstaller ) add_custom_target(deb - COMMAND "${CMAKE_SOURCE_DIR}/makePackages.sh" "${CMAKE_SOURCE_DIR}" "${PROJECT_BINARY_DIR}" "${PACKAGE_NAME}" "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}" "0" "deb" + COMMAND "${CMAKE_SOURCE_DIR}/makePackages.sh" "${CMAKE_SOURCE_DIR}" "${PROJECT_BINARY_DIR}" "${PACKAGE_NAME}" "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}" "0" "deb" "${DEB_ARCH}" DEPENDS "${CMAKE_SOURCE_DIR}/package" "${PROJECT_BINARY_DIR}/libsysinternalsEBPFinstaller" ) add_custom_target(rpm - COMMAND "${CMAKE_SOURCE_DIR}/makePackages.sh" "${CMAKE_SOURCE_DIR}" "${PROJECT_BINARY_DIR}" "${PACKAGE_NAME}" "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}" "0" "rpm" + COMMAND "${CMAKE_SOURCE_DIR}/makePackages.sh" "${CMAKE_SOURCE_DIR}" "${PROJECT_BINARY_DIR}" "${PACKAGE_NAME}" "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}" "0" "rpm" "${RPM_ARCH}" DEPENDS "${CMAKE_SOURCE_DIR}/package" "${PROJECT_BINARY_DIR}/libsysinternalsEBPFinstaller" ) @@ -343,8 +384,8 @@ set_target_properties(sysinternalsEBPF PROPERTIES ) install(TARGETS sysinternalsEBPF - LIBRARY DESTINATION lib ${CMAKE_INSTALL_LIBDIR} - PUBLIC_HEADER DESTINATION include ${CMAKE_INSTALL_INCLUDEDIR} + LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} + PUBLIC_HEADER DESTINATION ${CMAKE_INSTALL_INCLUDEDIR} RESOURCE DESTINATION /opt/sysinternalsEBPF/ PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ ) @@ -402,8 +443,21 @@ add_custom_command(OUTPUT unameOffsets.c # # set binaries and options for clang and llc -set(CLANG "clang") -set(LLC "llc") +find_program(CLANG clang) +if(NOT CLANG) + message(FATAL_ERROR "clang is required to build eBPF programs") +endif() +find_program(LLC llc) + +# Derive the compiler's built-in include directory at configure time +# so we do not backtick the host gcc at build time during cross-compilation. +execute_process( + COMMAND ${CMAKE_C_COMPILER} -print-file-name=include + OUTPUT_VARIABLE GCC_BUILTIN_INCLUDE + OUTPUT_STRIP_TRAILING_WHITESPACE +) +message(STATUS "GCC built-in include: ${GCC_BUILTIN_INCLUDE}") + set(CLANG_OPTIONS -Wno-unused-value -Wno-pointer-sign -Wno-compare-distinct-pointer-types @@ -415,7 +469,7 @@ set(CLANG_OPTIONS -Wno-unused-value ) set(CLANG_DEFINES -D __KERNEL__ -D __BPF_TRACING__ - -D __TARGET_ARCH_x86 + -D __TARGET_ARCH_${TARGET_ARCH} ) if (DEBUG_K) message("Using DEBUG_K Option...") @@ -439,7 +493,13 @@ set(CLANG_INCLUDES function(build_ebpf ebpfsrc) add_custom_command(TARGET sysinternalsEBPF PRE_BUILD - COMMAND "${CLANG}" -nostdinc ${CLANG_INCLUDES} -isystem "/usr/include" -isystem "/usr/include/x86_64-linux-gnu" -isystem `gcc -print-file-name=include` ${CLANG_DEFINES} -O2 ${CLANG_OPTIONS} -target bpf -c "${CMAKE_SOURCE_DIR}/ebpfKern/${ebpfsrc}.c" -o "${ebpfsrc}.o" + COMMAND "${CLANG}" -nostdinc ${CLANG_INCLUDES} + -isystem "/usr/include/${TARGET_MULTIARCH}" + -isystem "/usr/include" + -isystem "${GCC_BUILTIN_INCLUDE}" + ${CLANG_DEFINES} -O2 ${CLANG_OPTIONS} -target bpf + -c "${CMAKE_SOURCE_DIR}/ebpfKern/${ebpfsrc}.c" + -o "${ebpfsrc}.o" COMMENT "Building EBPF object ${ebpfsrc}.o" DEPENDS ebpfKern/${ebpfsrc}.c ${EBPF_DEPENDS} ) @@ -456,5 +516,3 @@ foreach(EBPF_PROG IN LISTS EBPF_PROGS) # add ebpf programs to clean set_directory_properties(PROPERTIES ADDITIONAL_MAKE_CLEAN_FILES ${EBPF_PROG}.o) endforeach(EBPF_PROG) - - diff --git a/cmake/aarch64-linux-gnu.cmake b/cmake/aarch64-linux-gnu.cmake new file mode 100644 index 0000000..a65c0c2 --- /dev/null +++ b/cmake/aarch64-linux-gnu.cmake @@ -0,0 +1,19 @@ +# CMake toolchain file for cross-compiling to aarch64-linux-gnu +set(CMAKE_SYSTEM_NAME Linux) +set(CMAKE_SYSTEM_PROCESSOR aarch64) + +set(CMAKE_C_COMPILER aarch64-linux-gnu-gcc) +set(CMAKE_CXX_COMPILER aarch64-linux-gnu-g++) +set(CMAKE_LINKER aarch64-linux-gnu-ld) +set(CMAKE_AR aarch64-linux-gnu-ar) +set(CMAKE_RANLIB aarch64-linux-gnu-ranlib) +set(CMAKE_STRIP aarch64-linux-gnu-strip) + +set(CMAKE_FIND_ROOT_PATH /usr/aarch64-linux-gnu) +set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER) +set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY) +set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY) +set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY) + +set(ENV{PKG_CONFIG_LIBDIR} + "/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/share/pkgconfig") diff --git a/ebpfKern/sysinternalsEBPF_common.h b/ebpfKern/sysinternalsEBPF_common.h index d3d5c54..01e8e35 100644 --- a/ebpfKern/sysinternalsEBPF_common.h +++ b/ebpfKern/sysinternalsEBPF_common.h @@ -41,9 +41,11 @@ #define PATH_MAX 4096 // Missing def #endif +#ifndef EBPF_CO_RE #include +#endif #include -#include +#include #include // debug tracing can be found using: @@ -62,7 +64,65 @@ #define true 1 #define false 0 -// x64 syscall macros +// Architecture-dependent syscall pt_regs access macros. +// +// On arm64 the UAPI header (asm/ptrace.h) only exposes struct user_pt_regs +// (regs[31], sp, pc, pstate) — there is no UAPI struct pt_regs. The kernel- +// internal struct pt_regs starts with user_pt_regs followed by orig_x0 +// (the preserved first syscall argument, because the kernel overwrites +// regs[0] with the return value). +// +// CO-RE path – define a pt_regs___arm64 "flavor" struct with +// __attribute__((preserve_access_index)) so CO-RE relocations +// resolve orig_x0 against the target kernel's real pt_regs. +// Non-CO-RE – define struct pt_regs ourselves (arm64 UAPI omits it) so +// the macros compile. Layout must match the kernel. + +#if defined(__TARGET_ARCH_arm64) + +#ifdef EBPF_CO_RE +// CO-RE flavor type matching the kernel's struct pt_regs on arm64. +// The triple-underscore suffix is the libbpf CO-RE naming convention. +struct pt_regs___arm64 { + unsigned long regs[31]; + unsigned long sp; + unsigned long pc; + unsigned long pstate; + unsigned long orig_x0; +} __attribute__((preserve_access_index)); + +#define SYSCALL_PT_REGS_PARM1(x) (((const struct pt_regs___arm64 *)(x))->orig_x0) +#define SYSCALL_PT_REGS_PARM2(x) (((const struct pt_regs___arm64 *)(x))->regs[1]) +#define SYSCALL_PT_REGS_PARM3(x) (((const struct pt_regs___arm64 *)(x))->regs[2]) +#define SYSCALL_PT_REGS_PARM4(x) (((const struct pt_regs___arm64 *)(x))->regs[3]) +#define SYSCALL_PT_REGS_PARM5(x) (((const struct pt_regs___arm64 *)(x))->regs[4]) +#define SYSCALL_PT_REGS_PARM6(x) (((const struct pt_regs___arm64 *)(x))->regs[5]) +#define SYSCALL_PT_REGS_RC(x) (((const struct pt_regs___arm64 *)(x))->regs[0]) + +#else /* non-CO-RE arm64 */ + +// arm64 UAPI only exposes struct user_pt_regs. Define the kernel-internal +// struct pt_regs layout so the macros below can access orig_x0. +struct pt_regs { + __u64 regs[31]; + __u64 sp; + __u64 pc; + __u64 pstate; + __u64 orig_x0; +}; + +#define SYSCALL_PT_REGS_PARM1(x) ((x)->orig_x0) +#define SYSCALL_PT_REGS_PARM2(x) ((x)->regs[1]) +#define SYSCALL_PT_REGS_PARM3(x) ((x)->regs[2]) +#define SYSCALL_PT_REGS_PARM4(x) ((x)->regs[3]) +#define SYSCALL_PT_REGS_PARM5(x) ((x)->regs[4]) +#define SYSCALL_PT_REGS_PARM6(x) ((x)->regs[5]) +#define SYSCALL_PT_REGS_RC(x) ((x)->regs[0]) + +#endif /* EBPF_CO_RE */ + +#else /* x86_64 */ + #ifdef EBPF_CO_RE #define SYSCALL_PT_REGS_PARM1(x) ((x)->di) #define SYSCALL_PT_REGS_PARM2(x) ((x)->si) @@ -78,6 +138,8 @@ #define SYSCALL_PT_REGS_PARM5(x) ((x)->r8) #define SYSCALL_PT_REGS_PARM6(x) ((x)->r9) +#endif /* __TARGET_ARCH_arm64 */ + #define CMDLINE_MAX_LEN 16384 // must be power of 2 #define MAX_FDS 65535 @@ -105,18 +167,18 @@ struct bpf_our_raw_tracepoint_args { // arguments a syscall expects; attempts to do so will cause the verifier // to reject it. struct tracepoint__syscalls__sys_enter { - __uint64_t pad; - __uint32_t __syscall_nr; - __uint32_t pad2; - __uint64_t a[6]; + __u64 pad; + __u32 __syscall_nr; + __u32 pad2; + __u64 a[6]; }; // all sys_exit arguments are the same for traditional tracepoints. struct tracepoint__syscalls__sys_exit { - __uint64_t pad; - __uint32_t __syscall_nr; - __uint32_t pad2; + __u64 pad; + __u32 __syscall_nr; + __u32 pad2; long ret; }; diff --git a/installer.c b/installer.c index 85fa2f7..f6d50d7 100644 --- a/installer.c +++ b/installer.c @@ -28,7 +28,7 @@ // //==================================================================== -#include "/usr/include/fcntl.h" +#include #include #include #include diff --git a/libsysinternalsEBPF.h b/libsysinternalsEBPF.h index 60fcb87..114d932 100644 --- a/libsysinternalsEBPF.h +++ b/libsysinternalsEBPF.h @@ -38,7 +38,10 @@ #include -#define SYSCALL_MAX 335 +#ifndef SYSCALL_ARRAY_SIZE +#define SYSCALL_ARRAY_SIZE 512 +#endif +#define SYSCALL_MAX (SYSCALL_ARRAY_SIZE - 1) #define EBPF_GENERIC_SYSCALL 0xFFFF // error codes diff --git a/libsysinternalsEBPFinstaller.c b/libsysinternalsEBPFinstaller.c index 7c56cb2..8aede52 100644 --- a/libsysinternalsEBPFinstaller.c +++ b/libsysinternalsEBPFinstaller.c @@ -41,6 +41,7 @@ #include #include #include +#include #include "libsysinternalsEBPF.h" #define SYSINTERNALSEBPF_DIR "/opt/sysinternalsEBPF" @@ -56,6 +57,7 @@ #define MEM_DUMP_OBJ "sysinternalsEBPFmemDump.o" #define RAW_SOCK_OBJ "sysinternalsEBPFrawSock.o" #define DEB_x86_64 "/x86_64-linux-gnu" +#define DEB_aarch64 "/aarch64-linux-gnu" #define LIB_SYM_LNK "/lib" #define LIB64_SYM_LNK "/lib64" @@ -184,6 +186,15 @@ char* getLibInstallPath() { char libPath[PATH_MAX] = {0}; char fullPath[PATH_MAX] = {0}; + struct utsname uts; + const char *deb_multiarch = DEB_x86_64; + + // Detect architecture at runtime + if (uname(&uts) == 0) { + if (strncmp(uts.machine, "aarch64", 7) == 0) { + deb_multiarch = DEB_aarch64; + } + } fullPath[0]='/'; @@ -201,8 +212,8 @@ char* getLibInstallPath() } else { - // check if debian based - strcat(libPath, DEB_x86_64); + // check if debian based (try arch-appropriate multiarch dir) + strcat(libPath, deb_multiarch); strcat(fullPath, libPath); if (!dirExists(fullPath)) diff --git a/makePackages.sh b/makePackages.sh index 0404354..9c3b57b 100755 --- a/makePackages.sh +++ b/makePackages.sh @@ -31,7 +31,7 @@ if [ "$5" = "" ]; then - echo "Usage: $0 " + echo "Usage: $0 [arch]" exit 1 fi @@ -42,8 +42,18 @@ PACKAGE_NAME=$3 PACKAGE_VER=$4 PACKAGE_REL=$5 PACKAGE_TYPE=$6 - -DEB_PACKAGE_NAME="${PACKAGE_NAME}_${PACKAGE_VER}_amd64" +PKG_ARCH=${7:-$(dpkg --print-architecture 2>/dev/null || uname -m)} + +# Map architecture names for deb/rpm +case "$PKG_ARCH" in + aarch64) DEB_ARCH="arm64"; RPM_ARCH="aarch64" ;; + arm64) DEB_ARCH="arm64"; RPM_ARCH="aarch64" ;; + x86_64) DEB_ARCH="amd64"; RPM_ARCH="x86_64" ;; + amd64) DEB_ARCH="amd64"; RPM_ARCH="x86_64" ;; + *) DEB_ARCH="$PKG_ARCH"; RPM_ARCH="$PKG_ARCH" ;; +esac + +DEB_PACKAGE_NAME="${PACKAGE_NAME}_${PACKAGE_VER}_${DEB_ARCH}" RPM_PACKAGE_NAME="${PACKAGE_NAME}-${PACKAGE_VER}-${PACKAGE_REL}" if [ "$PACKAGE_TYPE" = "deb" ]; then @@ -73,7 +83,7 @@ if [ "$PACKAGE_TYPE" = "deb" ]; then RET=1 fi - exit 0; + exit $RET; fi if [ "$PACKAGE_TYPE" = "rpm" ]; then @@ -91,9 +101,9 @@ if [ "$PACKAGE_TYPE" = "rpm" ]; then if [ "$RPMBUILD" != "" ]; then cd "${PROJECT_BINARY_DIR}/rpm/${RPM_PACKAGE_NAME}" - "$RPMBUILD" --define "_topdir `pwd`" -v -bb "SPECS/${RPM_PACKAGE_NAME}.spec" + "$RPMBUILD" --target "${RPM_ARCH}" --define "_topdir `pwd`" -v -bb "SPECS/${RPM_PACKAGE_NAME}.spec" RET=$? - cp RPMS/x86_64/*.rpm .. + cp RPMS/${RPM_ARCH}/*.rpm .. else echo "No rpmbuild found" RET=1 diff --git a/package/DEBIAN.in/control.in b/package/DEBIAN.in/control.in index f5ae17d..79caa7a 100644 --- a/package/DEBIAN.in/control.in +++ b/package/DEBIAN.in/control.in @@ -1,10 +1,10 @@ Package: sysinternalsebpf Version: @PROJECT_VERSION_MAJOR@.@PROJECT_VERSION_MINOR@.@PROJECT_VERSION_PATCH@ -Architecture: amd64 +Architecture: @DEB_ARCH@ Maintainer: Sysinternals Description: A shared library and code library for making eBPF programs. SysinternalsEBPF is a shared library that provides control over eBPF programs, and an eBPF code library that eBPF programs can include to interact with the library. -Depends: libc6 (>= 2.26), libelf1 (>= 0.131), libglib2.0-0 (>= 2.12.0), libjson-glib-1.0-0 (>= 0.13.2), zlib1g (>= 1:1.2.3.3) +Depends: libc6 (>= 2.26), libelf1t64 | libelf1, libglib2.0-0t64 | libglib2.0-0, libjson-glib-1.0-0 (>= 0.13.2), zlib1g (>= 1:1.2.3.3) Installed-Size: 22072 diff --git a/syscalls.h b/syscalls.h index 3480fa8..972f868 100644 --- a/syscalls.h +++ b/syscalls.h @@ -25,13 +25,16 @@ // syscalls.h // // Linux syscall names and number of arguments, indexed by syscall -// number. +// number. Uses designated initializers with __NR_* constants so the +// table is correct for both x86_64 and aarch64 without maintaining +// separate numeric tables. // //==================================================================== #ifndef SYSCALLS_H #define SYSCALLS_H +#include #include "sysinternalsEBPF.h" typedef struct { @@ -40,342 +43,453 @@ typedef struct { } syscallNames; const syscallNames syscallNumToName[SYSCALL_MAX+1] = { - {"read",3}, - {"write",3}, - {"open",3}, - {"close",1}, - {"stat",2}, - {"fstat",2}, - {"lstat",2}, - {"poll",3}, - {"lseek",3}, - {"mmap",6}, - {"mprotect",3}, - {"munmap",2}, - {"brk",1}, - {"rt_sigaction",4}, - {"rt_sigprocmask",4}, - {"rt_sigreturn",1}, - {"ioctl",3}, - {"pread64",4}, - {"pwrite64",4}, - {"readv",3}, - {"writev",3}, - {"access",2}, - {"pipe",1}, - {"select",5}, - {"sched_yield",0}, - {"mremap",5}, - {"msync",3}, - {"mincore",3}, - {"madvise",3}, - {"shmget",3}, - {"shmat",3}, - {"shmctl",3}, - {"dup",1}, - {"dup2",2}, - {"pause",0}, - {"nanosleep",2}, - {"getitimer",2}, - {"alarm",1}, - {"setitimer",3}, - {"getpid",0}, - {"sendfile",4}, - {"socket",3}, - {"connect",3}, - {"accept",3}, - {"sendto",6}, - {"recvfrom",6}, - {"sendmsg",3}, - {"recvmsg",3}, - {"shutdown",2}, - {"bind",3}, - {"listen",2}, - {"getsockname",3}, - {"getpeername",3}, - {"socketpair",4}, - {"setsockopt",5}, - {"getsockopt",5}, - {"clone",5}, - {"fork",0}, - {"vfork",0}, - {"execve",3}, - {"exit",1}, - {"wait4",4}, - {"kill",2}, - {"uname",1}, - {"semget",3}, - {"semop",3}, - {"semctl",4}, - {"shmdt",1}, - {"msgget",2}, - {"msgsnd",4}, - {"msgrcv",5}, - {"msgctl",3}, - {"fcntl",3}, - {"flock",2}, - {"fsync",1}, - {"fdatasync",1}, - {"truncate",2}, - {"ftruncate",2}, - {"getdents",3}, - {"getcwd",2}, - {"chdir",1}, - {"fchdir",1}, - {"rename",2}, - {"mkdir",2}, - {"rmdir",1}, - {"creat",2}, - {"link",2}, - {"unlink",1}, - {"symlink",2}, - {"readlink",3}, - {"chmod",2}, - {"fchmod",2}, - {"chown",3}, - {"fchown",3}, - {"lchown",3}, - {"umask",1}, - {"gettimeofday",2}, - {"getrlimit",2}, - {"getrusage",2}, - {"sysinfo",1}, - {"times",1}, - {"ptrace",4}, - {"getuid",0}, - {"syslog",3}, - {"getgid",0}, - {"setuid",1}, - {"setgid",1}, - {"geteuid",0}, - {"getegid",0}, - {"setpgid",2}, - {"getppid",0}, - {"getpgrp",0}, - {"setsid",0}, - {"setreuid",2}, - {"setregid",2}, - {"getgroups",2}, - {"setgroups",2}, - {"setresuid",3}, - {"getresuid",3}, - {"setresgid",3}, - {"getresgid",3}, - {"getpgid",1}, - {"setfsuid",1}, - {"setfsgid",1}, - {"getsid",1}, - {"capget",2}, - {"capset",2}, - {"rt_sigpending",2}, - {"rt_sigtimedwait",4}, - {"rt_sigqueueinfo",3}, - {"rt_sigsuspend",2}, - {"sigaltstack",2}, - {"utime",2}, - {"mknod",3}, - {"uselib",0}, - {"personality",1}, - {"ustat",2}, - {"statfs",2}, - {"fstatfs",2}, - {"sysfs",3}, - {"getpriority",2}, - {"setpriority",3}, - {"sched_setparam",2}, - {"sched_getparam",2}, - {"sched_setscheduler",3}, - {"sched_getscheduler",1}, - {"sched_get_priority_max",1}, - {"sched_get_priority_min",1}, - {"sched_rr_get_interval",2}, - {"mlock",2}, - {"munlock",2}, - {"mlockall",1}, - {"munlockall",0}, - {"vhangup",0}, - {"modify_ldt",3}, - {"pivot_root",2}, - {"_sysctl",1}, - {"prctl",5}, - {"arch_prctl",3}, - {"adjtimex",1}, - {"setrlimit",2}, - {"chroot",1}, - {"sync",0}, - {"acct",1}, - {"settimeofday",2}, - {"mount",5}, - {"umount2",2}, - {"swapon",2}, - {"swapoff",1}, - {"reboot",4}, - {"sethostname",2}, - {"setdomainname",2}, - {"iopl",2}, - {"ioperm",3}, - {"create_module",0}, - {"init_module",3}, - {"delete_module",2}, - {"get_kernel_syms",0}, - {"query_module",0}, - {"quotactl",4}, - {"nfsservctl",0}, - {"getpmsg",0}, - {"putpmsg",0}, - {"afs_syscall",0}, - {"tuxcall",0}, - {"security",0}, - {"gettid",0}, - {"readahead",3}, - {"setxattr",5}, - {"lsetxattr",5}, - {"fsetxattr",5}, - {"getxattr",4}, - {"lgetxattr",4}, - {"fgetxattr",4}, - {"listxattr",3}, - {"llistxattr",3}, - {"flistxattr",3}, - {"removexattr",2}, - {"lremovexattr",2}, - {"fremovexattr",2}, - {"tkill",2}, - {"time",1}, - {"futex",6}, - {"sched_setaffinity",3}, - {"sched_getaffinity",3}, - {"set_thread_area",0}, - {"io_setup",2}, - {"io_destroy",1}, - {"io_getevents",4}, - {"io_submit",3}, - {"io_cancel",3}, - {"get_thread_area",0}, - {"lookup_dcookie",3}, - {"epoll_create",1}, - {"epoll_ctl_old",0}, - {"epoll_wait_old",0}, - {"remap_file_pages",5}, - {"getdents64",3}, - {"set_tid_address",1}, - {"restart_syscall",0}, - {"semtimedop",4}, - {"fadvise64",4}, - {"timer_create",3}, - {"timer_settime",4}, - {"timer_gettime",2}, - {"timer_getoverrun",1}, - {"timer_delete",1}, - {"clock_settime",2}, - {"clock_gettime",2}, - {"clock_getres",2}, - {"clock_nanosleep",4}, - {"exit_group",1}, - {"epoll_wait",4}, - {"epoll_ctl",4}, - {"tgkill",3}, - {"utimes",2}, - {"vserver",0}, - {"mbind",6}, - {"set_mempolicy",3}, - {"get_mempolicy",5}, - {"mq_open",4}, - {"mq_unlink",1}, - {"mq_timedsend",5}, - {"mq_timedreceive",5}, - {"mq_notify",2}, - {"mq_getsetattr",3}, - {"kexec_load",4}, - {"waitid",5}, - {"add_key",4}, - {"request_key",4}, - {"keyctl",5}, - {"ioprio_set",3}, - {"ioprio_get",2}, - {"inotify_init",0}, - {"inotify_add_watch",3}, - {"inotify_rm_watch",2}, - {"migrate_pages",4}, - {"openat",4}, - {"mkdirat",3}, - {"mknodat",4}, - {"fchownat",5}, - {"futimesat",3}, - {"newfstatat",4}, - {"unlinkat",3}, - {"renameat",4}, - {"linkat",5}, - {"symlinkat",3}, - {"readlinkat",4}, - {"fchmodat",3}, - {"faccessat",3}, - {"pselect6",6}, - {"ppoll",5}, - {"unshare",1}, - {"set_robust_list",2}, - {"get_robust_list",3}, - {"splice",6}, - {"tee",4}, - {"sync_file_range",4}, - {"vmsplice",4}, - {"move_pages",6}, - {"utimensat",4}, - {"epoll_pwait",6}, - {"signalfd",3}, - {"timerfd_create",2}, - {"eventfd",1}, - {"fallocate",4}, - {"timerfd_settime",4}, - {"timerfd_gettime",2}, - {"accept4",4}, - {"signalfd4",4}, - {"eventfd2",2}, - {"epoll_create1",1}, - {"dup3",3}, - {"pipe2",2}, - {"inotify_init1",1}, - {"preadv",5}, - {"pwritev",5}, - {"rt_tgsigqueueinfo",4}, - {"perf_event_open",5}, - {"recvmmsg",5}, - {"fanotify_init",2}, - {"fanotify_mark",5}, - {"prlimit64",4}, - {"name_to_handle_at",5}, - {"open_by_handle_at",5}, - {"clock_adjtime",2}, - {"syncfs",1}, - {"sendmmsg",4}, - {"setns",2}, - {"getcpu",3}, - {"process_vm_readv",6}, - {"process_vm_writev",6}, - {"kcmp",5}, - {"finit_module",3}, - {"sched_setattr",3}, - {"sched_getattr",4}, - {"renameat2",5}, - {"seccomp",3}, - {"getrandom",3}, - {"memfd_create",2}, - {"kexec_file_load",5}, - {"bpf",3}, - {"execveat",5}, - {"userfaultfd",1}, - {"membarrier",2}, - {"mlock2",3}, - {"copy_file_range",6}, - {"preadv2",6}, - {"pwritev2",6}, - {"pkey_mprotect",0}, - {"pkey_alloc",0}, - {"pkey_free",0}, - {"statx",0}, - {"io_pgetevents",0}, - {"rseq",0} + [__NR_read] = {"read", 3}, + [__NR_write] = {"write", 3}, +#ifdef __NR_open + [__NR_open] = {"open", 3}, +#endif + [__NR_close] = {"close", 1}, +#ifdef __NR_stat + [__NR_stat] = {"stat", 2}, +#endif + [__NR_fstat] = {"fstat", 2}, +#ifdef __NR_lstat + [__NR_lstat] = {"lstat", 2}, +#endif +#ifdef __NR_poll + [__NR_poll] = {"poll", 3}, +#endif + [__NR_lseek] = {"lseek", 3}, + [__NR_mmap] = {"mmap", 6}, + [__NR_mprotect] = {"mprotect", 3}, + [__NR_munmap] = {"munmap", 2}, + [__NR_brk] = {"brk", 1}, + [__NR_rt_sigaction] = {"rt_sigaction", 4}, + [__NR_rt_sigprocmask] = {"rt_sigprocmask", 4}, + [__NR_rt_sigreturn] = {"rt_sigreturn", 1}, + [__NR_ioctl] = {"ioctl", 3}, + [__NR_pread64] = {"pread64", 4}, + [__NR_pwrite64] = {"pwrite64", 4}, + [__NR_readv] = {"readv", 3}, + [__NR_writev] = {"writev", 3}, +#ifdef __NR_access + [__NR_access] = {"access", 2}, +#endif +#ifdef __NR_pipe + [__NR_pipe] = {"pipe", 1}, +#endif +#ifdef __NR_select + [__NR_select] = {"select", 5}, +#endif + [__NR_sched_yield] = {"sched_yield", 0}, + [__NR_mremap] = {"mremap", 5}, + [__NR_msync] = {"msync", 3}, + [__NR_mincore] = {"mincore", 3}, + [__NR_madvise] = {"madvise", 3}, + [__NR_shmget] = {"shmget", 3}, + [__NR_shmat] = {"shmat", 3}, + [__NR_shmctl] = {"shmctl", 3}, + [__NR_dup] = {"dup", 1}, +#ifdef __NR_dup2 + [__NR_dup2] = {"dup2", 2}, +#endif +#ifdef __NR_pause + [__NR_pause] = {"pause", 0}, +#endif + [__NR_nanosleep] = {"nanosleep", 2}, + [__NR_getitimer] = {"getitimer", 2}, +#ifdef __NR_alarm + [__NR_alarm] = {"alarm", 1}, +#endif + [__NR_setitimer] = {"setitimer", 3}, + [__NR_getpid] = {"getpid", 0}, + [__NR_sendfile] = {"sendfile", 4}, + [__NR_socket] = {"socket", 3}, + [__NR_connect] = {"connect", 3}, + [__NR_accept] = {"accept", 3}, + [__NR_sendto] = {"sendto", 6}, + [__NR_recvfrom] = {"recvfrom", 6}, + [__NR_sendmsg] = {"sendmsg", 3}, + [__NR_recvmsg] = {"recvmsg", 3}, + [__NR_shutdown] = {"shutdown", 2}, + [__NR_bind] = {"bind", 3}, + [__NR_listen] = {"listen", 2}, + [__NR_getsockname] = {"getsockname", 3}, + [__NR_getpeername] = {"getpeername", 3}, + [__NR_socketpair] = {"socketpair", 4}, + [__NR_setsockopt] = {"setsockopt", 5}, + [__NR_getsockopt] = {"getsockopt", 5}, + [__NR_clone] = {"clone", 5}, +#ifdef __NR_fork + [__NR_fork] = {"fork", 0}, +#endif +#ifdef __NR_vfork + [__NR_vfork] = {"vfork", 0}, +#endif + [__NR_execve] = {"execve", 3}, + [__NR_exit] = {"exit", 1}, + [__NR_wait4] = {"wait4", 4}, + [__NR_kill] = {"kill", 2}, + [__NR_uname] = {"uname", 1}, + [__NR_semget] = {"semget", 3}, + [__NR_semop] = {"semop", 3}, + [__NR_semctl] = {"semctl", 4}, + [__NR_shmdt] = {"shmdt", 1}, + [__NR_msgget] = {"msgget", 2}, + [__NR_msgsnd] = {"msgsnd", 4}, + [__NR_msgrcv] = {"msgrcv", 5}, + [__NR_msgctl] = {"msgctl", 3}, + [__NR_fcntl] = {"fcntl", 3}, + [__NR_flock] = {"flock", 2}, + [__NR_fsync] = {"fsync", 1}, + [__NR_fdatasync] = {"fdatasync", 1}, + [__NR_truncate] = {"truncate", 2}, + [__NR_ftruncate] = {"ftruncate", 2}, +#ifdef __NR_getdents + [__NR_getdents] = {"getdents", 3}, +#endif + [__NR_getcwd] = {"getcwd", 2}, + [__NR_chdir] = {"chdir", 1}, + [__NR_fchdir] = {"fchdir", 1}, +#ifdef __NR_rename + [__NR_rename] = {"rename", 2}, +#endif +#ifdef __NR_mkdir + [__NR_mkdir] = {"mkdir", 2}, +#endif +#ifdef __NR_rmdir + [__NR_rmdir] = {"rmdir", 1}, +#endif +#ifdef __NR_creat + [__NR_creat] = {"creat", 2}, +#endif +#ifdef __NR_link + [__NR_link] = {"link", 2}, +#endif +#ifdef __NR_unlink + [__NR_unlink] = {"unlink", 1}, +#endif +#ifdef __NR_symlink + [__NR_symlink] = {"symlink", 2}, +#endif +#ifdef __NR_readlink + [__NR_readlink] = {"readlink", 3}, +#endif +#ifdef __NR_chmod + [__NR_chmod] = {"chmod", 2}, +#endif + [__NR_fchmod] = {"fchmod", 2}, +#ifdef __NR_chown + [__NR_chown] = {"chown", 3}, +#endif + [__NR_fchown] = {"fchown", 3}, +#ifdef __NR_lchown + [__NR_lchown] = {"lchown", 3}, +#endif + [__NR_umask] = {"umask", 1}, + [__NR_gettimeofday] = {"gettimeofday", 2}, + [__NR_getrlimit] = {"getrlimit", 2}, + [__NR_getrusage] = {"getrusage", 2}, + [__NR_sysinfo] = {"sysinfo", 1}, + [__NR_times] = {"times", 1}, + [__NR_ptrace] = {"ptrace", 4}, + [__NR_getuid] = {"getuid", 0}, + [__NR_syslog] = {"syslog", 3}, + [__NR_getgid] = {"getgid", 0}, + [__NR_setuid] = {"setuid", 1}, + [__NR_setgid] = {"setgid", 1}, + [__NR_geteuid] = {"geteuid", 0}, + [__NR_getegid] = {"getegid", 0}, + [__NR_setpgid] = {"setpgid", 2}, + [__NR_getppid] = {"getppid", 0}, +#ifdef __NR_getpgrp + [__NR_getpgrp] = {"getpgrp", 0}, +#endif + [__NR_setsid] = {"setsid", 0}, + [__NR_setreuid] = {"setreuid", 2}, + [__NR_setregid] = {"setregid", 2}, + [__NR_getgroups] = {"getgroups", 2}, + [__NR_setgroups] = {"setgroups", 2}, + [__NR_setresuid] = {"setresuid", 3}, + [__NR_getresuid] = {"getresuid", 3}, + [__NR_setresgid] = {"setresgid", 3}, + [__NR_getresgid] = {"getresgid", 3}, + [__NR_getpgid] = {"getpgid", 1}, + [__NR_setfsuid] = {"setfsuid", 1}, + [__NR_setfsgid] = {"setfsgid", 1}, + [__NR_getsid] = {"getsid", 1}, + [__NR_capget] = {"capget", 2}, + [__NR_capset] = {"capset", 2}, + [__NR_rt_sigpending] = {"rt_sigpending", 2}, + [__NR_rt_sigtimedwait] = {"rt_sigtimedwait", 4}, + [__NR_rt_sigqueueinfo] = {"rt_sigqueueinfo", 3}, + [__NR_rt_sigsuspend] = {"rt_sigsuspend", 2}, + [__NR_sigaltstack] = {"sigaltstack", 2}, +#ifdef __NR_utime + [__NR_utime] = {"utime", 2}, +#endif +#ifdef __NR_mknod + [__NR_mknod] = {"mknod", 3}, +#endif +#ifdef __NR_uselib + [__NR_uselib] = {"uselib", 0}, +#endif + [__NR_personality] = {"personality", 1}, +#ifdef __NR_ustat + [__NR_ustat] = {"ustat", 2}, +#endif + [__NR_statfs] = {"statfs", 2}, + [__NR_fstatfs] = {"fstatfs", 2}, +#ifdef __NR_sysfs + [__NR_sysfs] = {"sysfs", 3}, +#endif + [__NR_getpriority] = {"getpriority", 2}, + [__NR_setpriority] = {"setpriority", 3}, + [__NR_sched_setparam] = {"sched_setparam", 2}, + [__NR_sched_getparam] = {"sched_getparam", 2}, + [__NR_sched_setscheduler] = {"sched_setscheduler", 3}, + [__NR_sched_getscheduler] = {"sched_getscheduler", 1}, + [__NR_sched_get_priority_max] = {"sched_get_priority_max", 1}, + [__NR_sched_get_priority_min] = {"sched_get_priority_min", 1}, + [__NR_sched_rr_get_interval] = {"sched_rr_get_interval", 2}, + [__NR_mlock] = {"mlock", 2}, + [__NR_munlock] = {"munlock", 2}, + [__NR_mlockall] = {"mlockall", 1}, + [__NR_munlockall] = {"munlockall", 0}, + [__NR_vhangup] = {"vhangup", 0}, +#ifdef __NR_modify_ldt + [__NR_modify_ldt] = {"modify_ldt", 3}, +#endif + [__NR_pivot_root] = {"pivot_root", 2}, +#ifdef __NR__sysctl + [__NR__sysctl] = {"_sysctl", 1}, +#endif + [__NR_prctl] = {"prctl", 5}, +#ifdef __NR_arch_prctl + [__NR_arch_prctl] = {"arch_prctl", 3}, +#endif + [__NR_adjtimex] = {"adjtimex", 1}, + [__NR_setrlimit] = {"setrlimit", 2}, + [__NR_chroot] = {"chroot", 1}, + [__NR_sync] = {"sync", 0}, + [__NR_acct] = {"acct", 1}, + [__NR_settimeofday] = {"settimeofday", 2}, + [__NR_mount] = {"mount", 5}, + [__NR_umount2] = {"umount2", 2}, + [__NR_swapon] = {"swapon", 2}, + [__NR_swapoff] = {"swapoff", 1}, + [__NR_reboot] = {"reboot", 4}, + [__NR_sethostname] = {"sethostname", 2}, + [__NR_setdomainname] = {"setdomainname", 2}, +#ifdef __NR_iopl + [__NR_iopl] = {"iopl", 2}, +#endif +#ifdef __NR_ioperm + [__NR_ioperm] = {"ioperm", 3}, +#endif +#ifdef __NR_create_module + [__NR_create_module] = {"create_module", 0}, +#endif + [__NR_init_module] = {"init_module", 3}, + [__NR_delete_module] = {"delete_module", 2}, +#ifdef __NR_get_kernel_syms + [__NR_get_kernel_syms] = {"get_kernel_syms", 0}, +#endif +#ifdef __NR_query_module + [__NR_query_module] = {"query_module", 0}, +#endif + [__NR_quotactl] = {"quotactl", 4}, + [__NR_nfsservctl] = {"nfsservctl", 0}, +#ifdef __NR_getpmsg + [__NR_getpmsg] = {"getpmsg", 0}, +#endif +#ifdef __NR_putpmsg + [__NR_putpmsg] = {"putpmsg", 0}, +#endif +#ifdef __NR_afs_syscall + [__NR_afs_syscall] = {"afs_syscall", 0}, +#endif +#ifdef __NR_tuxcall + [__NR_tuxcall] = {"tuxcall", 0}, +#endif +#ifdef __NR_security + [__NR_security] = {"security", 0}, +#endif + [__NR_gettid] = {"gettid", 0}, + [__NR_readahead] = {"readahead", 3}, + [__NR_setxattr] = {"setxattr", 5}, + [__NR_lsetxattr] = {"lsetxattr", 5}, + [__NR_fsetxattr] = {"fsetxattr", 5}, + [__NR_getxattr] = {"getxattr", 4}, + [__NR_lgetxattr] = {"lgetxattr", 4}, + [__NR_fgetxattr] = {"fgetxattr", 4}, + [__NR_listxattr] = {"listxattr", 3}, + [__NR_llistxattr] = {"llistxattr", 3}, + [__NR_flistxattr] = {"flistxattr", 3}, + [__NR_removexattr] = {"removexattr", 2}, + [__NR_lremovexattr] = {"lremovexattr", 2}, + [__NR_fremovexattr] = {"fremovexattr", 2}, + [__NR_tkill] = {"tkill", 2}, +#ifdef __NR_time + [__NR_time] = {"time", 1}, +#endif + [__NR_futex] = {"futex", 6}, + [__NR_sched_setaffinity] = {"sched_setaffinity", 3}, + [__NR_sched_getaffinity] = {"sched_getaffinity", 3}, +#ifdef __NR_set_thread_area + [__NR_set_thread_area] = {"set_thread_area", 0}, +#endif + [__NR_io_setup] = {"io_setup", 2}, + [__NR_io_destroy] = {"io_destroy", 1}, + [__NR_io_getevents] = {"io_getevents", 4}, + [__NR_io_submit] = {"io_submit", 3}, + [__NR_io_cancel] = {"io_cancel", 3}, +#ifdef __NR_get_thread_area + [__NR_get_thread_area] = {"get_thread_area", 0}, +#endif + [__NR_lookup_dcookie] = {"lookup_dcookie", 3}, +#ifdef __NR_epoll_create + [__NR_epoll_create] = {"epoll_create", 1}, +#endif +#ifdef __NR_epoll_ctl_old + [__NR_epoll_ctl_old] = {"epoll_ctl_old", 0}, +#endif +#ifdef __NR_epoll_wait_old + [__NR_epoll_wait_old] = {"epoll_wait_old", 0}, +#endif + [__NR_remap_file_pages] = {"remap_file_pages", 5}, + [__NR_getdents64] = {"getdents64", 3}, + [__NR_set_tid_address] = {"set_tid_address", 1}, + [__NR_restart_syscall] = {"restart_syscall", 0}, + [__NR_semtimedop] = {"semtimedop", 4}, + [__NR_fadvise64] = {"fadvise64", 4}, + [__NR_timer_create] = {"timer_create", 3}, + [__NR_timer_settime] = {"timer_settime", 4}, + [__NR_timer_gettime] = {"timer_gettime", 2}, + [__NR_timer_getoverrun] = {"timer_getoverrun", 1}, + [__NR_timer_delete] = {"timer_delete", 1}, + [__NR_clock_settime] = {"clock_settime", 2}, + [__NR_clock_gettime] = {"clock_gettime", 2}, + [__NR_clock_getres] = {"clock_getres", 2}, + [__NR_clock_nanosleep] = {"clock_nanosleep", 4}, + [__NR_exit_group] = {"exit_group", 1}, +#ifdef __NR_epoll_wait + [__NR_epoll_wait] = {"epoll_wait", 4}, +#endif + [__NR_epoll_ctl] = {"epoll_ctl", 4}, + [__NR_tgkill] = {"tgkill", 3}, +#ifdef __NR_utimes + [__NR_utimes] = {"utimes", 2}, +#endif +#ifdef __NR_vserver + [__NR_vserver] = {"vserver", 0}, +#endif + [__NR_mbind] = {"mbind", 6}, + [__NR_set_mempolicy] = {"set_mempolicy", 3}, + [__NR_get_mempolicy] = {"get_mempolicy", 5}, + [__NR_mq_open] = {"mq_open", 4}, + [__NR_mq_unlink] = {"mq_unlink", 1}, + [__NR_mq_timedsend] = {"mq_timedsend", 5}, + [__NR_mq_timedreceive] = {"mq_timedreceive", 5}, + [__NR_mq_notify] = {"mq_notify", 2}, + [__NR_mq_getsetattr] = {"mq_getsetattr", 3}, + [__NR_kexec_load] = {"kexec_load", 4}, + [__NR_waitid] = {"waitid", 5}, + [__NR_add_key] = {"add_key", 4}, + [__NR_request_key] = {"request_key", 4}, + [__NR_keyctl] = {"keyctl", 5}, + [__NR_ioprio_set] = {"ioprio_set", 3}, + [__NR_ioprio_get] = {"ioprio_get", 2}, +#ifdef __NR_inotify_init + [__NR_inotify_init] = {"inotify_init", 0}, +#endif + [__NR_inotify_add_watch] = {"inotify_add_watch", 3}, + [__NR_inotify_rm_watch] = {"inotify_rm_watch", 2}, + [__NR_migrate_pages] = {"migrate_pages", 4}, + [__NR_openat] = {"openat", 4}, + [__NR_mkdirat] = {"mkdirat", 3}, + [__NR_mknodat] = {"mknodat", 4}, + [__NR_fchownat] = {"fchownat", 5}, +#ifdef __NR_futimesat + [__NR_futimesat] = {"futimesat", 3}, +#endif + [__NR_newfstatat] = {"newfstatat", 4}, + [__NR_unlinkat] = {"unlinkat", 3}, + [__NR_renameat] = {"renameat", 4}, + [__NR_linkat] = {"linkat", 5}, + [__NR_symlinkat] = {"symlinkat", 3}, + [__NR_readlinkat] = {"readlinkat", 4}, + [__NR_fchmodat] = {"fchmodat", 3}, + [__NR_faccessat] = {"faccessat", 3}, + [__NR_pselect6] = {"pselect6", 6}, + [__NR_ppoll] = {"ppoll", 5}, + [__NR_unshare] = {"unshare", 1}, + [__NR_set_robust_list] = {"set_robust_list", 2}, + [__NR_get_robust_list] = {"get_robust_list", 3}, + [__NR_splice] = {"splice", 6}, + [__NR_tee] = {"tee", 4}, + [__NR_sync_file_range] = {"sync_file_range", 4}, + [__NR_vmsplice] = {"vmsplice", 4}, + [__NR_move_pages] = {"move_pages", 6}, + [__NR_utimensat] = {"utimensat", 4}, + [__NR_epoll_pwait] = {"epoll_pwait", 6}, +#ifdef __NR_signalfd + [__NR_signalfd] = {"signalfd", 3}, +#endif + [__NR_timerfd_create] = {"timerfd_create", 2}, +#ifdef __NR_eventfd + [__NR_eventfd] = {"eventfd", 1}, +#endif + [__NR_fallocate] = {"fallocate", 4}, + [__NR_timerfd_settime] = {"timerfd_settime", 4}, + [__NR_timerfd_gettime] = {"timerfd_gettime", 2}, + [__NR_accept4] = {"accept4", 4}, + [__NR_signalfd4] = {"signalfd4", 4}, + [__NR_eventfd2] = {"eventfd2", 2}, + [__NR_epoll_create1] = {"epoll_create1", 1}, + [__NR_dup3] = {"dup3", 3}, + [__NR_pipe2] = {"pipe2", 2}, + [__NR_inotify_init1] = {"inotify_init1", 1}, + [__NR_preadv] = {"preadv", 5}, + [__NR_pwritev] = {"pwritev", 5}, + [__NR_rt_tgsigqueueinfo] = {"rt_tgsigqueueinfo", 4}, + [__NR_perf_event_open] = {"perf_event_open", 5}, + [__NR_recvmmsg] = {"recvmmsg", 5}, + [__NR_fanotify_init] = {"fanotify_init", 2}, + [__NR_fanotify_mark] = {"fanotify_mark", 5}, + [__NR_prlimit64] = {"prlimit64", 4}, + [__NR_name_to_handle_at] = {"name_to_handle_at", 5}, + [__NR_open_by_handle_at] = {"open_by_handle_at", 5}, + [__NR_clock_adjtime] = {"clock_adjtime", 2}, + [__NR_syncfs] = {"syncfs", 1}, + [__NR_sendmmsg] = {"sendmmsg", 4}, + [__NR_setns] = {"setns", 2}, + [__NR_getcpu] = {"getcpu", 3}, + [__NR_process_vm_readv] = {"process_vm_readv", 6}, + [__NR_process_vm_writev] = {"process_vm_writev", 6}, + [__NR_kcmp] = {"kcmp", 5}, + [__NR_finit_module] = {"finit_module", 3}, + [__NR_sched_setattr] = {"sched_setattr", 3}, + [__NR_sched_getattr] = {"sched_getattr", 4}, + [__NR_renameat2] = {"renameat2", 5}, + [__NR_seccomp] = {"seccomp", 3}, + [__NR_getrandom] = {"getrandom", 3}, + [__NR_memfd_create] = {"memfd_create", 2}, + [__NR_kexec_file_load] = {"kexec_file_load", 5}, + [__NR_bpf] = {"bpf", 3}, + [__NR_execveat] = {"execveat", 5}, + [__NR_userfaultfd] = {"userfaultfd", 1}, + [__NR_membarrier] = {"membarrier", 2}, + [__NR_mlock2] = {"mlock2", 3}, + [__NR_copy_file_range] = {"copy_file_range", 6}, + [__NR_preadv2] = {"preadv2", 6}, + [__NR_pwritev2] = {"pwritev2", 6}, + [__NR_pkey_mprotect] = {"pkey_mprotect", 0}, + [__NR_pkey_alloc] = {"pkey_alloc", 0}, + [__NR_pkey_free] = {"pkey_free", 0}, + [__NR_statx] = {"statx", 0}, + [__NR_io_pgetevents] = {"io_pgetevents", 0}, + [__NR_rseq] = {"rseq", 0}, }; #endif - diff --git a/sysinternalsEBPF.h b/sysinternalsEBPF.h index d2b77a7..78d5586 100644 --- a/sysinternalsEBPF.h +++ b/sysinternalsEBPF.h @@ -53,7 +53,7 @@ #define SYSINTERNALS_EBPF_UMASK 077 -#define SYSCALL_MAX 335 +#define SYSCALL_MAX (SYSCALL_ARRAY_SIZE - 1) #define SYSCALL_NAME_LEN 64 #define MAX_MEM_DUMP 32768 diff --git a/sysinternalsEBPFshared.h b/sysinternalsEBPFshared.h index aa571f3..2bc1605 100644 --- a/sysinternalsEBPFshared.h +++ b/sysinternalsEBPFshared.h @@ -32,7 +32,9 @@ #define SYSINTERNALS_EBPF_SHARED_H #include +#ifndef EBPF_CO_RE #include +#endif #include // diff --git a/telemetryLoader.c b/telemetryLoader.c index bbacd66..963f843 100644 --- a/telemetryLoader.c +++ b/telemetryLoader.c @@ -980,6 +980,8 @@ bool linkTPprogs(const ebpfTelemetryObject *obj, // attach this to all active syscall enter tracepoints for (syscall=0; syscall<=SYSCALL_MAX; syscall++) { if (activeSyscalls[syscall]) { + if (syscallNumToName[syscall].name[0] == '\0') + continue; #pragma GCC diagnostic push #pragma GCC diagnostic ignored "-Wformat-truncation" snprintf(tp, SYSCALL_NAME_LEN * 2, "sys_enter_%s", syscallNumToName[syscall].name); @@ -990,7 +992,9 @@ bool linkTPprogs(const ebpfTelemetryObject *obj, return false; } } - } else if (activeSyscalls[p->syscall]) { + } else if (p->syscall <= SYSCALL_MAX && + activeSyscalls[p->syscall] && + syscallNumToName[p->syscall].name[0] != '\0') { snprintf(tp, SYSCALL_NAME_LEN * 2, "sys_enter_%s", syscallNumToName[p->syscall].name); s->link[0] = bpf_program__attach_tracepoint(s->prog[0], "syscalls", tp); if (libbpf_get_error(s->link[0])) @@ -1006,6 +1010,8 @@ bool linkTPprogs(const ebpfTelemetryObject *obj, // attach this to all active syscall exit tracepoints for (syscall=0; syscall<=SYSCALL_MAX; syscall++) { if (activeSyscalls[syscall]) { + if (syscallNumToName[syscall].name[0] == '\0') + continue; #pragma GCC diagnostic push #pragma GCC diagnostic ignored "-Wformat-truncation" snprintf(tp, SYSCALL_NAME_LEN * 2, "sys_exit_%s", syscallNumToName[syscall].name); @@ -1015,7 +1021,9 @@ bool linkTPprogs(const ebpfTelemetryObject *obj, return false; } } - } else if (activeSyscalls[p->syscall]) { + } else if (p->syscall <= SYSCALL_MAX && + activeSyscalls[p->syscall] && + syscallNumToName[p->syscall].name[0] != '\0') { snprintf(tp, SYSCALL_NAME_LEN * 2, "sys_exit_%s", syscallNumToName[p->syscall].name); s->link[0] = bpf_program__attach_tracepoint(s->prog[0], "syscalls", tp); if (libbpf_get_error(s->link[0])) @@ -1056,7 +1064,9 @@ bool linkRTPprogs(const ebpfTelemetryObject *obj, if (prev != NULL && strcmp(prev, cur) != 0) { alreadyAttached = false; } - if ((prev == NULL || !alreadyAttached) && (p->syscall == EBPF_GENERIC_SYSCALL || activeSyscalls[p->syscall])) { + if ((prev == NULL || !alreadyAttached) && + (p->syscall == EBPF_GENERIC_SYSCALL || + (p->syscall <= SYSCALL_MAX && activeSyscalls[p->syscall]))) { bpfRawSysEnterLink[i] = bpf_program__attach_raw_tracepoint(bpfRawSysEnter[i], "sys_enter"); if (libbpf_get_error(bpfRawSysEnterLink[i])) { logMessage("Cannot link\n"); @@ -1074,7 +1084,9 @@ bool linkRTPprogs(const ebpfTelemetryObject *obj, if (prev != NULL && strcmp(prev, cur) != 0) { alreadyAttached = false; } - if ((prev == NULL || !alreadyAttached) && (p->syscall == EBPF_GENERIC_SYSCALL || activeSyscalls[p->syscall])) { + if ((prev == NULL || !alreadyAttached) && + (p->syscall == EBPF_GENERIC_SYSCALL || + (p->syscall <= SYSCALL_MAX && activeSyscalls[p->syscall]))) { bpfRawSysExitLink[i] = bpf_program__attach_raw_tracepoint(bpfRawSysExit[i], "sys_exit"); if (libbpf_get_error(bpfRawSysExitLink[i])) { logMessage("Cannot link\n"); @@ -1124,8 +1136,10 @@ bool linkOtherTPprogs(const ebpfTelemetryObject *obj, strcmp(prevTP, curTP) != 0)) { alreadyAttached = false; } - if ((prevProg == NULL || !alreadyAttached) && (p->pseudoSyscall == EBPF_GENERIC_SYSCALL || - activeSyscalls[p->pseudoSyscall])) { + if ((prevProg == NULL || !alreadyAttached) && + (p->pseudoSyscall == EBPF_GENERIC_SYSCALL || + (p->pseudoSyscall <= SYSCALL_MAX && + activeSyscalls[p->pseudoSyscall]))) { bpfOtherTpLink[i] = bpf_program__attach_tracepoint(bpfOtherTp[i], p->family, p->tracepoint); if (libbpf_get_error(bpfOtherTpLink[i])) { logMessage("Cannot link\n"); @@ -1616,4 +1630,3 @@ int telemetryStart( return E_EBPF_SUCCESS; } -