Skip to content

Commit

Permalink
fix(driver): fixed build against linux 6.11.
Browse files Browse the repository at this point in the history 
Signed-off-by: Federico Di Pierro <[email protected]>
  • Loading branch information
@FedeDP @poiana
FedeDP authored and poiana committed Sep 2, 2024
1 parent 5ed00b2 commit 2641e57
Show file tree
Hide file tree
Showing 5 changed files with 83 additions and 10 deletions.
20 changes: 16 additions & 4 deletions driver/bpf/fillers.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2899,7 +2899,10 @@ FILLER(execve_extra_tail_1, true)
struct timespec64 time = {0};

/* Parameter 25: exe_file ctime (last status change time, epoch value in nanoseconds) (type: PT_ABSTIME) */
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 6, 0)
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 11, 0)
time.tv_sec = _READ(inode->i_ctime_sec);
time.tv_nsec = _READ(inode->i_ctime_nsec);
#elif LINUX_VERSION_CODE >= KERNEL_VERSION(6, 6, 0)
time = _READ(inode->__i_ctime);
#else
time = _READ(inode->i_ctime);
Expand All @@ -2908,7 +2911,10 @@ FILLER(execve_extra_tail_1, true)
CHECK_RES(res);

/* Parameter 26: exe_file mtime (last modification time, epoch value in nanoseconds) (type: PT_ABSTIME) */
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 11, 0)
time.tv_sec = _READ(inode->i_mtime_sec);
time.tv_nsec = _READ(inode->i_mtime_nsec);
#elif LINUX_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
time = _READ(inode->__i_mtime);
#else
time = _READ(inode->i_mtime);
Expand Down Expand Up @@ -6863,7 +6869,10 @@ FILLER(sched_prog_exec_4, false)
struct timespec64 time = {0};

/* Parameter 25: exe_file ctime (last status change time, epoch value in nanoseconds) (type: PT_ABSTIME) */
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 6, 0)
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 11, 0)
time.tv_sec = _READ(inode->i_ctime_sec);
time.tv_nsec = _READ((inode->i_ctime_nsec);
#elif LINUX_VERSION_CODE >= KERNEL_VERSION(6, 6, 0)
time = _READ(inode->__i_ctime);
#else
time = _READ(inode->i_ctime);
Expand All @@ -6872,7 +6881,10 @@ FILLER(sched_prog_exec_4, false)
CHECK_RES(res);

/* Parameter 26: exe_file mtime (last modification time, epoch value in nanoseconds) (type: PT_ABSTIME) */
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 11, 0)
time.tv_sec = _READ(inode->i_mtime_sec);
time.tv_nsec = _READ(inode->i_mtime_nsec);
#elif LINUX_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)
time = _READ(inode->__i_mtime);
#else
time = _READ(inode->i_mtime);
Expand Down
7 changes: 7 additions & 0 deletions driver/modern_bpf/definitions/struct_flavors.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,13 @@ struct inode___v6_7 {
struct timespec64 __i_mtime;
};

struct inode___v6_11 {
int64_t i_mtime_sec;
int64_t i_ctime_sec;
uint32_t i_mtime_nsec;
uint32_t i_ctime_nsec;
};

#ifndef BPF_NO_PRESERVE_ACCESS_INDEX
#pragma clang attribute pop
#endif
Expand Down
22 changes: 20 additions & 2 deletions driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,16 @@ int BPF_PROG(t1_sched_p_exec,
else
{
struct inode___v6_6 *exe_inode_v6_6 = (void *)exe_inode;
BPF_CORE_READ_INTO(&time, exe_inode_v6_6, __i_ctime);
if(bpf_core_field_exists(exe_inode_v6_6->__i_ctime))
{
BPF_CORE_READ_INTO(&time, exe_inode_v6_6, __i_ctime);
}
else
{
struct inode___v6_11 *exe_inode_v6_11 = (void *)exe_inode;
BPF_CORE_READ_INTO(&time.tv_sec, exe_inode_v6_11, i_ctime_sec);
BPF_CORE_READ_INTO(&time.tv_nsec, exe_inode_v6_11, i_ctime_nsec);
}
}
auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time));

Expand All @@ -224,7 +233,16 @@ int BPF_PROG(t1_sched_p_exec,
else
{
struct inode___v6_7 *exe_inode_v6_7 = (void *)exe_inode;
BPF_CORE_READ_INTO(&time, exe_inode_v6_7, __i_mtime);
if(bpf_core_field_exists(exe_inode_v6_7->__i_mtime))
{
BPF_CORE_READ_INTO(&time, exe_inode_v6_7, __i_mtime);
}
else
{
struct inode___v6_11 *exe_inode_v6_11 = (void *)exe_inode;
BPF_CORE_READ_INTO(&time.tv_sec, exe_inode_v6_11, i_mtime_sec);
BPF_CORE_READ_INTO(&time.tv_nsec, exe_inode_v6_11, i_mtime_nsec);
}
}
auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time));

Expand Down
22 changes: 20 additions & 2 deletions driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -272,7 +272,16 @@ int BPF_PROG(t1_execve_x,
else
{
struct inode___v6_6 *exe_inode_v6_6 = (void *)exe_inode;
BPF_CORE_READ_INTO(&time, exe_inode_v6_6, __i_ctime);
if(bpf_core_field_exists(exe_inode_v6_6->__i_ctime))
{
BPF_CORE_READ_INTO(&time, exe_inode_v6_6, __i_ctime);
}
else
{
struct inode___v6_11 *exe_inode_v6_11 = (void *)exe_inode;
BPF_CORE_READ_INTO(&time.tv_sec, exe_inode_v6_11, i_ctime_sec);
BPF_CORE_READ_INTO(&time.tv_nsec, exe_inode_v6_11, i_ctime_nsec);
}
}
auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time));

Expand All @@ -284,7 +293,16 @@ int BPF_PROG(t1_execve_x,
else
{
struct inode___v6_7 *exe_inode_v6_7 = (void *)exe_inode;
BPF_CORE_READ_INTO(&time, exe_inode_v6_7, __i_mtime);
if(bpf_core_field_exists(exe_inode_v6_7->__i_mtime))
{
BPF_CORE_READ_INTO(&time, exe_inode_v6_7, __i_mtime);
}
else
{
struct inode___v6_11 *exe_inode_v6_11 = (void *)exe_inode;
BPF_CORE_READ_INTO(&time.tv_sec, exe_inode_v6_11, i_mtime_sec);
BPF_CORE_READ_INTO(&time.tv_nsec, exe_inode_v6_11, i_mtime_nsec);
}
}
auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time));

Expand Down
22 changes: 20 additions & 2 deletions driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -285,7 +285,16 @@ int BPF_PROG(t1_execveat_x,
else
{
struct inode___v6_6 *exe_inode_v6_6 = (void *)exe_inode;
BPF_CORE_READ_INTO(&time, exe_inode_v6_6, __i_ctime);
if(bpf_core_field_exists(exe_inode_v6_6->__i_ctime))
{
BPF_CORE_READ_INTO(&time, exe_inode_v6_6, __i_ctime);
}
else
{
struct inode___v6_11 *exe_inode_v6_11 = (void *)exe_inode;
BPF_CORE_READ_INTO(&time.tv_sec, exe_inode_v6_11, i_ctime_sec);
BPF_CORE_READ_INTO(&time.tv_nsec, exe_inode_v6_11, i_ctime_nsec);
}
}
auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time));

Expand All @@ -297,7 +306,16 @@ int BPF_PROG(t1_execveat_x,
else
{
struct inode___v6_7 *exe_inode_v6_7 = (void *)exe_inode;
BPF_CORE_READ_INTO(&time, exe_inode_v6_7, __i_mtime);
if(bpf_core_field_exists(exe_inode_v6_7->__i_mtime))
{
BPF_CORE_READ_INTO(&time, exe_inode_v6_7, __i_mtime);
}
else
{
struct inode___v6_11 *exe_inode_v6_11 = (void *)exe_inode;
BPF_CORE_READ_INTO(&time.tv_sec, exe_inode_v6_11, i_mtime_sec);
BPF_CORE_READ_INTO(&time.tv_nsec, exe_inode_v6_11, i_mtime_nsec);
}
}
auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time));

Expand Down

0 comments on commit 2641e57

Please sign in to comment.