Граф коммитов

321 Коммитов

Автор SHA1 Сообщение Дата
Alan Jowett 9b184645eb
Stop searching once key is matched (#413)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-21 10:13:15 -06:00
Alan Jowett ea821f3f21
Immediately delete memory during rundown (#407)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-08-20 21:41:54 -06:00
Alan Jowett 0560adbffe
Store build output as artifacts (#411)
* Download procdump, accept eula, capture dump on crash and upload

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-20 21:17:49 -06:00
Alan Jowett 16a951c2c3
Switch to hash table from AVL. Lock free in the presence of epoch allocator. (#389)
* Switch to hash table from AVL.
Lock free in the presence of epoch allocator.

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-08-20 18:29:11 -06:00
Shankar Seal d61c905e43
fix epoch bug (#410) 2021-08-20 17:16:24 -07:00
Dave Thaler 98e1696e97
Fix unit tests (#403)
ebpf_server_verify_and_load_program() cleared thread local storage after
calling ebpf_verify_and_load_program() but the mock version did not.
As a result, the tests did not accurately reflect actual behavior.
That is, running all tests would pass by accident since they were
reusing thread local storage of previous tests, but running individual tests
would fail.  This is why the regression in PR #381 was missed by the
CI/CD tests.

Compare code in
https://github.com/microsoft/ebpf-for-windows/blob/master/ebpfsvc/rpc_api.cpp#L36

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-20 12:43:43 -07:00
Dave Thaler c99a43e5e9
Revert "Remove dead code (#381)" (#401)
This reverts commit 7d779cf117.
2021-08-20 12:07:57 -07:00
Alan Jowett 6ac7be59a4
ebpf_program_t.links should be initialized (#395)
* Fix issue #394

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-20 11:04:32 -07:00
Alan Jowett da3b0a0cc1
Fix leak of ebpf_core_map_t.name.value (#393)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-20 11:02:21 -06:00
Dave Thaler 74c456e6b7
Update UM map APIs for libbpf compat (#388)
Since there is a name conflict between KM helpers and UM libbpf APIs,
the end-to-end tests need to _not_ include the KM helper prototypes,
so removed ebpf_helpers.h from ebpf.h and made samples include it
directly.

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-18 21:06:58 -07:00
Alan Jowett 184b1945d6
Adds support for querying per-CPU maps from user mode and returning a merged view of the per-CPU data (#384)
* Implement per-cpu maps using trivial option

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-17 17:22:32 -06:00
Shankar Seal 7d779cf117
Remove dead code (#381)
* Remove dead code

* Address PR feedback

Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2021-08-13 14:56:36 -06:00
Alan Jowett e68dece71d
Explicit key and value lengths passed to map layer (#380)
* Explicit key and value lengths passed to map layer

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-13 13:13:16 -06:00
Alan Jowett 8cc5a7f5be
Add support for per-cpu hash and array maps - Part 1 (#378)
Add support for per-cpu hash and array maps

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-11 16:39:54 -06:00
Dave Thaler 7c12adb067
Prevent mismatched program types in PROG_ARRAY maps (#374)
* Prevent mismatched program types in PROG_ARRAY maps

* Each prog array map has a natural progtype, determined when
  asociating it from a program, or when adding the first program
  to it, if not associated with any program.
* Trying to add a program with mismatching type will fail
* Added libbpf bpf_create_map() API
* Fixed error returns from several libbpf APIs to be negative
* For efficiency, ebpf_program_get_properties now returns a
  pointer rather than copying the data inside the execution
  context, and is renamed to ebpf_program_get_parameters()
  to match what its return type always was.
* Fixed a bug in map size calculation that resulted in a huge
  amount of memory being allocated
* Updated return type of bpf_tail_call to the value meant
  to signal stack unwind needed

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-11 12:17:10 -07:00
saxena-anurag 014ee34392
Add eBPF UM APIs (#368)
* parse map names from elf file
* add apis, change test code

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-08-10 17:04:07 -07:00
Dave Thaler 8f46b4020f
Revert "Add code to propagate flags for helper functions. (#365)" (#366)
This reverts commit e9a565fd0a.
2021-08-09 14:37:40 -07:00
Alan Jowett e9a565fd0a
Add code to propagate flags for helper functions. (#365)
* Add code to propagate flags for helper functions.

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-09 13:33:31 -07:00
Dave Thaler d8fc96683c
Update verifier to latest (#363)
Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-09 11:38:12 -07:00
Dave Thaler 30246d0025
Fix return values from bpf_map_delete_elem etc helpers (#362)
Per https://github.com/iovisor/bpf-docs/blob/master/bpf_helpers.rst
negative numbers indicate failure.

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-09 09:41:15 -06:00
Shankar Seal be67121fda
Test Extension Part 2 (#361)
* Test Extension Part 2

* rename test extension to sample extension and update Getting-started doc.

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-08-07 14:19:00 -07:00
Alan Jowett 0fee94598b
Pull latest ubpf (#360)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-08-06 15:35:36 -07:00
Dave Thaler a321179cee
Add prog array map type and bpf_tail_call() helper (#359)
* Add prog array map type and bpf_tail_call()

This also fixes a bug where bpf_object__find_program_by_name
could only find the first program because program->object
was always null.

Also fixes tests to correctly use a signed int for what hooks return,
instead of an unsigned int.

Not done in this PR, but will be in a separate PR:
* make tail call replace stack frame instead of simply calling into the callee
* limit number of tail calls to 32
* require the same program type for caller and callee
* test with load byte array instead of from a file

Addresses part of #344

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Address PR feedback

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Address PR feedback

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Add missing file

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Disable warning due to C enum types used in C++

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-06 14:18:47 -06:00
Alan Jowett e706d82daa
Change bpf_map_update_elem to return result of insertion (#358)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-08-05 14:32:44 -06:00
Dave Thaler 2617349903
Remove duplicate public APIs where standard libbpf APIs exist (#356)
* Remove duplicate public APIs where standard libbpf APIs exist

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-08-03 17:25:50 -07:00
Juraj Vijtiuk 2fe891abf7
Add FS filter hook proposal AV signature based malware detection scenario (#355)
Signed-off-by: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr>
2021-08-03 10:03:40 -07:00
saxena-anurag 14248601d3
Add DETACH operation to detach a program from a hook. (#352)
* add UNLINK operation

* Some fixes:

1. Added attach_lock to synchronize multiple detach calls on same link object.
2. ebpf_extension_unload() should be called from ebpf_link_detach_program()
3. Changed return type of ebpf_program_get_properties to void.

* Update libs/execution_context/ebpf_program.c

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-07-30 17:17:16 -07:00
Dave Thaler 8006f181e0
Libbpf API compatibility (#350)
* Libbpf API compatibility

Libbpf is incorporated as a submodule just for the header file.
As discussed in issue #84, we cannot currently use the implementation
since it is very Linux and GCC specific.

This PR also fixes a bug where the user-mode API was calling
CloseHandle directly instead of Platform::CloseHandle which is needed
to make tests work with the mock platform.

Addresses #84

Some code will be cleaner once issue #81 is done

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-07-30 15:34:21 -07:00
Alan Jowett 4bebd3aaa1
Verify that program type is supported by attach provider (#348)
* Verify that program type is supported by attach provider

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-07-27 16:33:58 -07:00
Dave Thaler 00fc46993d
Update PREVAIL verifier to latest (#347)
Includes support for marking a helper as doing packet reallocation

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2021-07-26 18:05:06 -07:00
Alan Jowett 91879afa7b
Set device type to something _open_osfhandle understands (#346)
* Set device type to something _open_osfhandle understands

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-07-26 17:06:12 -06:00
Dave Thaler ba14644d21
Improve doxygen main page (#340)
This PR addresses two gaps:

https://microsoft.github.io/ebpf-for-windows mentioned the hooks but
didn't mention what header file to include.

And it talked about ebpf programs, but didn't mention the reference for
user-mode apps to interact with them.

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2021-07-26 09:17:54 -07:00
Shankar Seal 18456999b7
move map helper function prototypes to EC (#337)
* move map helper function prototypes to EC
* replace 'generic' by 'general'

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-07-22 15:31:01 -07:00
Dave Thaler 107e28b6e3
Fix doxygen warnings (#338)
Fixes #299

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-07-22 14:42:51 -07:00
Shankar Seal 266578ee63
test extension - Part 1 (#336)
* test extension
2021-07-14 14:40:34 -07:00
Dave Thaler 4d0ac1bd4d
Replace "information" with "info" for consistency (#331)
Previously some places had "info" and some had "information".
Both appear in dictionaries, so guidance to avoid abbreviations does not apply.

Fixes #314

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-07-07 11:16:35 -07:00
Dave Thaler 569da02a8f
Add main API reference page (#329)
Which will fill in content visible at https://microsoft.github.io/ebpf-for-windows/

Fixes #259

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-07-07 10:39:59 -07:00
Dave Thaler e4da7ee04a
Update hook prototypes to be usable by eBPF programs for sanity checking (#327)
Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-07-01 17:21:33 -06:00
Dave Thaler 213620aead
Add doxygen docs on hooks (#326)
This PR is the second of three steps towards fully addressing #259

The doxygen \ref annotation tells doxygen to make the following word
be linked to the appropriate location in the generated docs.

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-07-01 15:27:24 -06:00
Dave Thaler 7d145ebbc5
Add doxygen documentation on ebpf helpers (#325)
Before this change, the API docs at
https://microsoft.github.io/ebpf-for-windows/ebpf__helpers_8h.html
just show the typedefs.  This PR updates the documentation so that the
helpers are documented just like normal public APIs would be.

This is the first step towards addressing #259

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-06-30 14:24:02 -06:00
Alan Jowett 9681a918ad
Fix issues flagged by CodeQL code scan (#324)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-06-30 11:11:27 -06:00
Dave Thaler e825caaa8e
Add doxygen documentation on enum values (#322)
* Make all enum values have a description in the generated API docs
* Also remove SAL annotation from the generated docs, since SAL
  breaks doxygen type detection

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2021-06-30 10:22:40 -06:00
Alan Jowett 959def19c8
Enable C6385 and C6386 rules (#323)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-06-30 09:54:21 -06:00
Shankar Seal f96522ecd4
fix sal on safeint functions (#321)
* fix sal on safeint functions

Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2021-06-29 21:42:40 -07:00
Alan Jowett 0cf75fef7d
Fix C6386 warning in ebpf_epoch_initiate (#320)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-06-29 17:13:13 -06:00
Dave Thaler d8a26f2b6d
Revert C6011 override (#319)
Fixes #309

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2021-06-29 16:39:03 -06:00
Alan Jowett 7870921e02
Additional analysis fixes (#315)
* Fix C26110,C28023,C28193,C6001,C6031,C6054
* Fix C6101

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-06-29 15:51:41 -06:00
Alan Jowett 9f8b1e636e
Add scheduled CodeQL workflow (#318)
* Add scheduled CodeQL workflow
* Add msbuild to path

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-06-29 13:50:01 -07:00
Shankar Seal a93f4ba714
program information serialization (#302)
* program information serialization.

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-06-28 16:47:34 -07:00
Alan Jowett a0801d410c
Suppress C26451 (#312)
* Suppress C26451 and related errors

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-06-28 16:13:29 -07:00