support raw_syscalls tracepoint #160
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Kornilios Kourtis <[email protected]>
Signed-off-by: Kornilios Kourtis <[email protected]>
in some cases, we do not want an error in validation to be printed by the json checker (e.g., when there are many events that will not match). For these cases, introduce a DebugError that, when encountered by JsonCheck, is logged at the Debug (rather than the Info) level. Signed-off-by: Kornilios Kourtis <[email protected]>
Signed-off-by: Kornilios Kourtis <[email protected]>
This patch adds a long type for generic kprobe arguments. Signed-off-by: Kornilios Kourtis <[email protected]>
Signed-off-by: Kornilios Kourtis <[email protected]>
Currently, the meta argument is used as an index to existing arguments. Subsequent patches will change this to other uses, so rename metaTpIndex to metaTp. (No functional changes.) Signed-off-by: Kornilios Kourtis <[email protected]>
kkourt
force-pushed
the
pr/kkourt/raw_syscalls
branch
7 times, most recently
from
b65fd09 to
65c6ae9
Compare
It seems that our clang-format is incompatible with checkpatch. Here's why: the next patch wants to add a new entry to an enum in bpf/process/types/basic.h. Specifically, adding the following lines: > /* const_buf_type is a type for buffers with static size that is passed > * in the meta argument > */ > const_buf_type = 18, > By doing so, checkpatch complains with the following error: Error: ERROR:CODE_INDENT: code indent should use tabs where possible #36: FILE: bpf/process/types/basic.h:33: + * in the meta argument$ I tried to just switch the modified line to use tabs but this made clang-format unhappy. Why clang-format uses spaces even if we have specified to alwyas use tabs? (UseTab: Always) Good question! I think it's because clang-format thinks it's OK to add the first enum value into the first line. To avoid the above problem, we can fix clang-format and update the files so that enums are indented with tabs. To do this we need to specify: AllowShortEnumsOnASingleLine: false The above was introduced in clang-format-11, so we need to bump the version. But bumping it to clang-format-11, will not work due to this bug: https://reviews.llvm.org/D99840. So we need to use clang-format-14 that fixes this bug. Above means we need to base our docker image on a later ubuntu version. NB: The new clang-format results in updates in some assembly code as well, but this seems minimal, so I think is fine. Signed-off-by: Kornilios Kourtis <[email protected]>
This patch adds a new generic type: const_buf_type. This type represents a constant-sized buffer. Its size is passed directly into the meta argument. It will be used in susbsequent patches. Signed-off-by: Kornilios Kourtis <[email protected]>
This patch adds support for array types. The idea is to copy all data from the bpf side, and let user-space figure things out. To this end, we use the GenericConstBuffer type introduced in the previous patch, and pass the size of the buffer as the metadata argument. Currently, only arrays of longs are supported. Support for other types will be added as needed. Signed-off-by: Kornilios Kourtis <[email protected]>
Previous patches added support for longs and arrays as a generic argument type. This means that we now have all the support needed for the raw_syscalls tracepoint. This patch adds a simpe test for it. Signed-off-by: Kornilios Kourtis <[email protected]>
This patch moves the functionality for getting syscall information from pkg/btf to its own package. It also adds some additional functionality for getting the syscall name from the syscall id. Signed-off-by: Kornilios Kourtis <[email protected]>
This patch adds a raw_syscalls handler in the encoder. The code retrieves static syscall information and tries to recreate the syscall arguments from the raw_syscalls/sys_enter tracepoint. Sample output: ☎ syscall /home/kkourt/src/tetragon/tetra sched_yield ☎ syscall /home/kkourt/src/tetragon/tetra futex(u32 *uaddr=0xea3278, int op=128, u32 val=2, struct __kernel_timespec *utime=0x0, u32 *uaddr2=0x0, u32 val3=0) ☎ syscall /home/kkourt/src/tetragon/tetra futex(u32 *uaddr=0xea3370, int op=129, u32 val=1, struct __kernel_timespec *utime=0x0, u32 *uaddr2=0x0, u32 val3=0) ☎ syscall /home/kkourt/src/tetragon/tetra futex(u32 *uaddr=0xea3278, int op=129, u32 val=1, struct __kernel_timespec *utime=0x0, u32 *uaddr2=0x0, u32 val3=0) ☎ syscall /home/kkourt/src/tetragon/tetra futex(u32 *uaddr=0xc000100148, int op=129, u32 val=1, struct __kernel_timespec *utime=0x0, u32 *uaddr2=0x0, u32 val3=0) ☎ syscall /home/kkourt/src/tetragon/tetra write(unsigned int fd=1, const char *buf=0xc0006d0780, size_t count=174) ☎ syscall /home/kkourt/src/tetragon/tetra write(unsigned int fd=1, const char *buf=0xc0006d0780, size_t count=174) The commit also adds a sample CRD to enable the above tracepoint. Signed-off-by: Kornilios Kourtis <[email protected]>
kkourt
force-pushed
the
pr/kkourt/raw_syscalls
branch
from
65c6ae9 to
f56c0f5
Compare
|
LGTM lets ship it. |
jrfastab
approved these changes
Jun 14, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds support for the raw_syscalls/sys_enter tracepoint. We need two things for doing so:
For the second, we add a constant buffer type, where its size is passed as the metadata argument. Please see individual commits.