Граф коммитов

386 Коммитов

Автор SHA1 Сообщение Дата
Alan Jowett 5983cbf07d
Micro-benchmarks for epoch and hash-table (#443)
* First version of performance tests

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-27 14:01:44 -06:00
Shankar Seal 7be9ef61dc
Fix bugs in kernel platform library. (#447)
Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2021-08-27 11:59:58 -06:00
Alan Jowett f5e18cd4d8
Partition epoch thread list (#436)
* Partition epoch thread list
Perform memory free on epoch_exit

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-26 19:00:15 -06:00
Shankar Seal 86d01a743b
fix typo (#435)
* fix typo
2021-08-25 14:09:08 -07:00
Shankar Seal adfac5ee7d
eBPF extension readme (#430)
* eBPF extension readme

* Apply suggestions from code review

Co-authored-by: Dave Thaler <dthaler@microsoft.com>

* PR feedback.

* PR Feedback.

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2021-08-25 12:50:05 -06:00
Alan Jowett 4be43a7ea1
Include required Clang version (#431)
* Update Getting Started to recommend current release version of Clang/LLVM

Clang-format behaves differently depending on the version of Clang installed.
Update getting started guide to recommend Clang / LLVM 10.0.0.
Update the development guide to indicate that Clang 10 or higher is required for consistent formatting.
Reformat all code using Clang 10.0.0

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-25 09:01:16 -06:00
Alan Jowett c9d40f09c4
Fix bug in epoch rundown and flush timer (#432)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-24 16:17:24 -06:00
Dave Thaler ea3765fc7c
Add tests for libbpf bpf_map_*_elem APIs (#429)
* Add tests for libbpf bpf_map_*_elem APIs

* Return correct error between EBPF_OBJECT_ALREADY_EXISTS (A program or
map is already pinned with the *same* path) vs
EBPF_ALREADY_PINNED (The program or map already pinned to a *different*
path).

* Update vs lookup elem were inconsistent in whether returning
  EBPF_KEY_NOT_FOUND vs EBPF_INVALID_ARGUMENT when passing an array
  index >= max_entries.  Made them be consistent in using
  EBPF_INVALID_ARGUMENT.

Fixes #376

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-24 11:33:00 -07:00
Dave Thaler f45e80d385
Add map-in-map support (#408)
* Add map-in-map support

Replace UM ebpf_map_update/delete_element with libbpf-compliant
bpf_map_update/delete_elem

This adds the basic functionality needed for #375

Not in this PR, but in a subsequent PR:
* ensure that all inner maps match the one specified by inner_map_idx,
  much like prog_types have to match in a prog_array.
* ensure that putting a prog_array in an array of maps adheres to the
  prog_array contract that any associated progs have to match the
  type of the calling program.
* read a map id not fd when UM reads the value (will be done together
  with issue #396 since also affects prog_arrays)

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-23 18:46:24 -07:00
Dave Thaler c029cf21e7
Add note about github discussions (#428)
Also move the Zoom meeting info to an announcement in the discussions area

Fixes #162

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-23 17:51:01 -07:00
Alan Jowett 2035ef7366
Add support for stack unwind on success. (#367)
Signed-off-by: Alan Jowett alanjo@microsoft.com
2021-08-23 17:24:22 -06:00
Alan Jowett 764fd17222
Fully support BPF flags for map operations (#425)
* Fully support BPF flags for map operations

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-23 15:49:50 -06:00
Alan Jowett 024abd4534
PR feedback from #418 (#424)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-23 14:49:26 -06:00
Shankar Seal 5519c26f5b
Register program type specific helper functions to uBPF in interpreted mode (#402)
* Register program type specific helper functions to uBPF in interpreted mode.

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-08-23 12:24:45 -07:00
Alan Jowett b917cc5ba8
Partition epoch free list by CPU (#418)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-23 08:58:59 -06:00
Alan Jowett 9b184645eb
Stop searching once key is matched (#413)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-21 10:13:15 -06:00
Alan Jowett ea821f3f21
Immediately delete memory during rundown (#407)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-08-20 21:41:54 -06:00
Alan Jowett 0560adbffe
Store build output as artifacts (#411)
* Download procdump, accept eula, capture dump on crash and upload

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-20 21:17:49 -06:00
Alan Jowett 16a951c2c3
Switch to hash table from AVL. Lock free in the presence of epoch allocator. (#389)
* Switch to hash table from AVL.
Lock free in the presence of epoch allocator.

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-08-20 18:29:11 -06:00
Shankar Seal d61c905e43
fix epoch bug (#410) 2021-08-20 17:16:24 -07:00
Dave Thaler 98e1696e97
Fix unit tests (#403)
ebpf_server_verify_and_load_program() cleared thread local storage after
calling ebpf_verify_and_load_program() but the mock version did not.
As a result, the tests did not accurately reflect actual behavior.
That is, running all tests would pass by accident since they were
reusing thread local storage of previous tests, but running individual tests
would fail.  This is why the regression in PR #381 was missed by the
CI/CD tests.

Compare code in
https://github.com/microsoft/ebpf-for-windows/blob/master/ebpfsvc/rpc_api.cpp#L36

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-20 12:43:43 -07:00
Dave Thaler c99a43e5e9
Revert "Remove dead code (#381)" (#401)
This reverts commit 7d779cf117.
2021-08-20 12:07:57 -07:00
Alan Jowett 6ac7be59a4
ebpf_program_t.links should be initialized (#395)
* Fix issue #394

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-20 11:04:32 -07:00
Alan Jowett da3b0a0cc1
Fix leak of ebpf_core_map_t.name.value (#393)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-20 11:02:21 -06:00
Dave Thaler 74c456e6b7
Update UM map APIs for libbpf compat (#388)
Since there is a name conflict between KM helpers and UM libbpf APIs,
the end-to-end tests need to _not_ include the KM helper prototypes,
so removed ebpf_helpers.h from ebpf.h and made samples include it
directly.

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-18 21:06:58 -07:00
Alan Jowett 184b1945d6
Adds support for querying per-CPU maps from user mode and returning a merged view of the per-CPU data (#384)
* Implement per-cpu maps using trivial option

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-17 17:22:32 -06:00
Shankar Seal 7d779cf117
Remove dead code (#381)
* Remove dead code

* Address PR feedback

Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2021-08-13 14:56:36 -06:00
Alan Jowett e68dece71d
Explicit key and value lengths passed to map layer (#380)
* Explicit key and value lengths passed to map layer

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-13 13:13:16 -06:00
Alan Jowett 8cc5a7f5be
Add support for per-cpu hash and array maps - Part 1 (#378)
Add support for per-cpu hash and array maps

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-11 16:39:54 -06:00
Dave Thaler 7c12adb067
Prevent mismatched program types in PROG_ARRAY maps (#374)
* Prevent mismatched program types in PROG_ARRAY maps

* Each prog array map has a natural progtype, determined when
  asociating it from a program, or when adding the first program
  to it, if not associated with any program.
* Trying to add a program with mismatching type will fail
* Added libbpf bpf_create_map() API
* Fixed error returns from several libbpf APIs to be negative
* For efficiency, ebpf_program_get_properties now returns a
  pointer rather than copying the data inside the execution
  context, and is renamed to ebpf_program_get_parameters()
  to match what its return type always was.
* Fixed a bug in map size calculation that resulted in a huge
  amount of memory being allocated
* Updated return type of bpf_tail_call to the value meant
  to signal stack unwind needed

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-11 12:17:10 -07:00
saxena-anurag 014ee34392
Add eBPF UM APIs (#368)
* parse map names from elf file
* add apis, change test code

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-08-10 17:04:07 -07:00
Dave Thaler 8f46b4020f
Revert "Add code to propagate flags for helper functions. (#365)" (#366)
This reverts commit e9a565fd0a.
2021-08-09 14:37:40 -07:00
Alan Jowett e9a565fd0a
Add code to propagate flags for helper functions. (#365)
* Add code to propagate flags for helper functions.

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-09 13:33:31 -07:00
Dave Thaler d8fc96683c
Update verifier to latest (#363)
Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-09 11:38:12 -07:00
Dave Thaler 30246d0025
Fix return values from bpf_map_delete_elem etc helpers (#362)
Per https://github.com/iovisor/bpf-docs/blob/master/bpf_helpers.rst
negative numbers indicate failure.

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-09 09:41:15 -06:00
Shankar Seal be67121fda
Test Extension Part 2 (#361)
* Test Extension Part 2

* rename test extension to sample extension and update Getting-started doc.

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-08-07 14:19:00 -07:00
Alan Jowett 0fee94598b
Pull latest ubpf (#360)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-08-06 15:35:36 -07:00
Dave Thaler a321179cee
Add prog array map type and bpf_tail_call() helper (#359)
* Add prog array map type and bpf_tail_call()

This also fixes a bug where bpf_object__find_program_by_name
could only find the first program because program->object
was always null.

Also fixes tests to correctly use a signed int for what hooks return,
instead of an unsigned int.

Not done in this PR, but will be in a separate PR:
* make tail call replace stack frame instead of simply calling into the callee
* limit number of tail calls to 32
* require the same program type for caller and callee
* test with load byte array instead of from a file

Addresses part of #344

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Address PR feedback

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Address PR feedback

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Add missing file

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Disable warning due to C enum types used in C++

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-06 14:18:47 -06:00
Alan Jowett e706d82daa
Change bpf_map_update_elem to return result of insertion (#358)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-05 14:32:44 -06:00
Dave Thaler 2617349903
Remove duplicate public APIs where standard libbpf APIs exist (#356)
* Remove duplicate public APIs where standard libbpf APIs exist

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-03 17:25:50 -07:00
Juraj Vijtiuk 2fe891abf7
Add FS filter hook proposal AV signature based malware detection scenario (#355)
Signed-off-by: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr>
2021-08-03 10:03:40 -07:00
saxena-anurag 14248601d3
Add DETACH operation to detach a program from a hook. (#352)
* add UNLINK operation

* Some fixes:

1. Added attach_lock to synchronize multiple detach calls on same link object.
2. ebpf_extension_unload() should be called from ebpf_link_detach_program()
3. Changed return type of ebpf_program_get_properties to void.

* Update libs/execution_context/ebpf_program.c

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-07-30 17:17:16 -07:00
Dave Thaler 8006f181e0
Libbpf API compatibility (#350)
* Libbpf API compatibility

Libbpf is incorporated as a submodule just for the header file.
As discussed in issue #84, we cannot currently use the implementation
since it is very Linux and GCC specific.

This PR also fixes a bug where the user-mode API was calling
CloseHandle directly instead of Platform::CloseHandle which is needed
to make tests work with the mock platform.

Addresses #84

Some code will be cleaner once issue #81 is done

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-07-30 15:34:21 -07:00
Alan Jowett 4bebd3aaa1
Verify that program type is supported by attach provider (#348)
* Verify that program type is supported by attach provider

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-07-27 16:33:58 -07:00
Dave Thaler 00fc46993d
Update PREVAIL verifier to latest (#347)
Includes support for marking a helper as doing packet reallocation

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2021-07-26 18:05:06 -07:00
Alan Jowett 91879afa7b
Set device type to something _open_osfhandle understands (#346)
* Set device type to something _open_osfhandle understands

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-07-26 17:06:12 -06:00
Dave Thaler ba14644d21
Improve doxygen main page (#340)
This PR addresses two gaps:

https://microsoft.github.io/ebpf-for-windows mentioned the hooks but
didn't mention what header file to include.

And it talked about ebpf programs, but didn't mention the reference for
user-mode apps to interact with them.

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2021-07-26 09:17:54 -07:00
Shankar Seal 18456999b7
move map helper function prototypes to EC (#337)
* move map helper function prototypes to EC
* replace 'generic' by 'general'

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-07-22 15:31:01 -07:00
Dave Thaler 107e28b6e3
Fix doxygen warnings (#338)
Fixes #299

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-07-22 14:42:51 -07:00
Shankar Seal 266578ee63
test extension - Part 1 (#336)
* test extension
2021-07-14 14:40:34 -07:00