From a2eed2d37725110db96955c87b5a3ac95fc407f9 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Tue, 19 Dec 2023 22:09:40 +0000 Subject: [PATCH 1/3] tetragon: Use ebpf/cilium feature test for bpf_override_return helper Signed-off-by: Jiri Olsa --- pkg/bpf/detect.go | 25 ++----------------------- 1 file changed, 2 insertions(+), 23 deletions(-) diff --git a/pkg/bpf/detect.go b/pkg/bpf/detect.go index 25085fc65c2..41fa3ce951e 100644 --- a/pkg/bpf/detect.go +++ b/pkg/bpf/detect.go @@ -13,6 +13,7 @@ import ( "github.com/cilium/ebpf" "github.com/cilium/ebpf/asm" + "github.com/cilium/ebpf/features" "github.com/cilium/ebpf/link" "golang.org/x/sys/unix" ) @@ -23,7 +24,6 @@ type Feature struct { } var ( - overrideHelper Feature signalHelper Feature kprobeMulti Feature buildid Feature @@ -31,29 +31,8 @@ var ( largeProgramSize Feature ) -func detectOverrideHelper() bool { - prog, err := ebpf.NewProgram(&ebpf.ProgramSpec{ - Type: ebpf.Kprobe, - Instructions: asm.Instructions{ - asm.LoadImm(asm.R2, 2, asm.DWord), - asm.Instruction{OpCode: asm.OpCode(asm.JumpClass).SetJumpOp(asm.Call), Constant: 58}, - asm.LoadImm(asm.R0, 0, asm.DWord), - asm.Return(), - }, - License: "GPL", - }) - if err != nil { - return false - } - prog.Close() - return true -} - func HasOverrideHelper() bool { - overrideHelper.init.Do(func() { - overrideHelper.detected = detectOverrideHelper() - }) - return overrideHelper.detected + return features.HaveProgramHelper(ebpf.Kprobe, asm.FnOverrideReturn) == nil } func detectSignalHelper() bool { From 8447672617b782551885f81cf80e6ca123ad67bf Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Tue, 19 Dec 2023 22:11:01 +0000 Subject: [PATCH 2/3] tetragon: Use ebpf/cilium feature test for bpf_send_signal Signed-off-by: Jiri Olsa --- pkg/bpf/detect.go | 24 +----------------------- 1 file changed, 1 insertion(+), 23 deletions(-) diff --git a/pkg/bpf/detect.go b/pkg/bpf/detect.go index 41fa3ce951e..4fdb6eab8fa 100644 --- a/pkg/bpf/detect.go +++ b/pkg/bpf/detect.go @@ -24,7 +24,6 @@ type Feature struct { } var ( - signalHelper Feature kprobeMulti Feature buildid Feature modifyReturn Feature @@ -35,29 +34,8 @@ func HasOverrideHelper() bool { return features.HaveProgramHelper(ebpf.Kprobe, asm.FnOverrideReturn) == nil } -func detectSignalHelper() bool { - prog, err := ebpf.NewProgram(&ebpf.ProgramSpec{ - Type: ebpf.Kprobe, - Instructions: asm.Instructions{ - asm.LoadImm(asm.R2, 2, asm.DWord), - asm.Instruction{OpCode: asm.OpCode(asm.JumpClass).SetJumpOp(asm.Call), Constant: 109}, - asm.LoadImm(asm.R0, 0, asm.DWord), - asm.Return(), - }, - License: "GPL", - }) - if err != nil { - return false - } - prog.Close() - return true -} - func HasSignalHelper() bool { - signalHelper.init.Do(func() { - signalHelper.detected = detectSignalHelper() - }) - return signalHelper.detected + return features.HaveProgramHelper(ebpf.Kprobe, asm.FnSendSignal) == nil } func detectKprobeMulti() bool { From c0aa2c9c558a416933b6cfd4d3c7053500ae8777 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Tue, 19 Dec 2023 21:59:05 +0000 Subject: [PATCH 3/3] tetragon: Use ebpf/cilium feature test for large instructions Signed-off-by: Jiri Olsa --- pkg/bpf/detect.go | 33 ++++----------------------------- 1 file changed, 4 insertions(+), 29 deletions(-) diff --git a/pkg/bpf/detect.go b/pkg/bpf/detect.go index 4fdb6eab8fa..e728f78c273 100644 --- a/pkg/bpf/detect.go +++ b/pkg/bpf/detect.go @@ -24,10 +24,9 @@ type Feature struct { } var ( - kprobeMulti Feature - buildid Feature - modifyReturn Feature - largeProgramSize Feature + kprobeMulti Feature + buildid Feature + modifyReturn Feature ) func HasOverrideHelper() bool { @@ -127,32 +126,8 @@ func HasModifyReturn() bool { return modifyReturn.detected } -func detectLargeProgramSize() bool { - insns := asm.Instructions{} - - for i := 0; i < 4096; i++ { - insns = append(insns, asm.Mov.Imm(asm.R0, 1)) - } - insns = append(insns, asm.Return()) - - prog, err := ebpf.NewProgram(&ebpf.ProgramSpec{ - Type: ebpf.Kprobe, - Instructions: insns, - AttachType: ebpf.AttachModifyReturn, - License: "MIT", - }) - if err != nil { - return false - } - prog.Close() - return true -} - func HasProgramLargeSize() bool { - largeProgramSize.init.Do(func() { - largeProgramSize.detected = detectLargeProgramSize() - }) - return largeProgramSize.detected + return features.HaveLargeInstructions() == nil } func LogFeatures() string {