From b994052b3c4740de9cd9b769a4bea0da59e3f458 Mon Sep 17 00:00:00 2001
From: Dave Tucker <dave@dtucker.co.uk>
Date: Sun, 26 Jun 2022 21:35:13 +0100
Subject: [PATCH] aya: Add probe for bpf_get_attach_cookie
Signed-off-by: Dave Tucker <dave@dtucker.co.uk>
---
aya/src/bpf.rs | 12 ++++++++----
aya/src/sys/bpf.rs | 27 +++++++++++++++++++++++++++
2 files changed, 35 insertions(+), 4 deletions(-)
diff --git a/aya/src/bpf.rs b/aya/src/bpf.rs
index 9ed72d3a..a5dc97d8 100644
--- a/aya/src/bpf.rs
+++ b/aya/src/bpf.rs
@@ -28,10 +28,10 @@ use crate::{
SkSkbKind, SockOps, SocketFilter, TracePoint, UProbe, Xdp,
},
sys::{
- bpf_load_btf, bpf_map_freeze, bpf_map_update_elem_ptr, is_btf_datasec_supported,
- is_btf_decl_tag_supported, is_btf_float_supported, is_btf_func_global_supported,
- is_btf_func_supported, is_btf_supported, is_btf_type_tag_supported, is_prog_name_supported,
- retry_with_verifier_logs,
+ bpf_load_btf, bpf_map_freeze, bpf_map_update_elem_ptr, is_bpf_cookie_supported,
+ is_btf_datasec_supported, is_btf_decl_tag_supported, is_btf_float_supported,
+ is_btf_func_global_supported, is_btf_func_supported, is_btf_supported,
+ is_btf_type_tag_supported, is_prog_name_supported, retry_with_verifier_logs,
},
util::{bytes_of, possible_cpus, VerifierLog, POSSIBLE_CPUS},
};
@@ -91,6 +91,7 @@ impl Default for PinningType {
#[derive(Default, Debug)]
pub(crate) struct Features {
pub bpf_name: bool,
+ pub bpf_cookie: bool,
pub btf: bool,
pub btf_func: bool,
pub btf_func_global: bool,
@@ -105,6 +106,9 @@ impl Features {
self.bpf_name = is_prog_name_supported();
debug!("[FEAT PROBE] BPF program name support: {}", self.bpf_name);
+ self.bpf_cookie = is_bpf_cookie_supported();
+ debug!("[FEAT PROBE] BPF cookie support: {}", self.bpf_cookie);
+
self.btf = is_btf_supported();
debug!("[FEAT PROBE] BTF support: {}", self.btf);
diff --git a/aya/src/sys/bpf.rs b/aya/src/sys/bpf.rs
index d26fb5e2..89db5553 100644
--- a/aya/src/sys/bpf.rs
+++ b/aya/src/sys/bpf.rs
@@ -534,6 +534,33 @@ pub(crate) fn is_prog_name_supported() -> bool {
}
}
+pub(crate) fn is_bpf_cookie_supported() -> bool {
+ let mut attr = unsafe { mem::zeroed::<bpf_attr>() };
+ let u = unsafe { &mut attr.__bindgen_anon_3 };
+
+ let prog: &[u8] = &[
+ 0x85, 0x00, 0x00, 0x00, 0xae, 0x00, 0x00, 0x00, // call bpf_get_attach_cookie
+ 0x95, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // exit
+ ];
+
+ let gpl = b"GPL\0";
+ u.license = gpl.as_ptr() as u64;
+
+ let insns = copy_instructions(prog).unwrap();
+ u.insn_cnt = insns.len() as u32;
+ u.insns = insns.as_ptr() as u64;
+ u.prog_type = bpf_prog_type::BPF_PROG_TYPE_KPROBE as u32;
+
+ match sys_bpf(bpf_cmd::BPF_PROG_LOAD, &attr) {
+ Ok(v) => {
+ let fd = v as RawFd;
+ unsafe { close(fd) };
+ true
+ }
+ Err(_) => false,
+ }
+}
+
pub(crate) fn is_btf_supported() -> bool {
let mut btf = Btf::new();
let name_offset = btf.add_string("int".to_string());