Merge pull request #71 from kubescape/bugfix/ebpf

Bugfix/ebpf

Author: amitschendel

.vscode/settings.json

@@ -5,6 +5,7 @@
         "mntns_filter.h": "c",
         "randomx.h": "c",
         "macros.h": "c",
-        "buffer.h": "c"
+        "buffer.h": "c",
+        "bpf_helpers.h": "c"
     }
 }

pkg/ebpf/gadgets/randomx/tracer/bpf/randomx.bpf.c

@@ -47,8 +47,21 @@ int tracepoint__x86_fpu_regs_deactivated(struct trace_event_raw_x86_fpu *ctx) {
         return 0;
     }
 
-    uint mxcsr = BPF_CORE_READ(ctx, fpu, fpstate, regs.xsave.i387.mxcsr);
+    void *fpu = BPF_CORE_READ(ctx, fpu);
+    if (fpu == NULL) {
+        return 0;
+    }
 
+    u32 mxcsr;
+    // Since kernel 5.15, the fpu struct has been changed and CO-RE isn't able to read it.
+    // We need to use the bpf_probe_read_kernel helper to read the mxcsr value.
+    // The old_fpu struct is used for kernels <= 5.15.
+    #if LINUX_KERNEL_VERSION <= KERNEL_VERSION(5, 15, 0)
+        bpf_probe_read_kernel(&mxcsr, sizeof(mxcsr), &((struct old_fpu*)fpu)->state.xsave.i387.mxcsr);
+    #else
+        mxcsr = BPF_CORE_READ((struct fpu*)fpu, fpstate, regs.xsave.i387.mxcsr);
+    #endif
+    
     int fpcr = (mxcsr & 0x6000) >> 13;
     if (fpcr != 0) {
         __u32 ppid = BPF_CORE_READ(current_task, real_parent, pid);

pkg/ebpf/gadgets/randomx/tracer/bpf/randomx.h

@@ -2,11 +2,30 @@
 
 #include "../../../../include/types.h"
 
+// Utilize the kernel version provided by libbpf. (kconfig must be present).
+extern int LINUX_KERNEL_VERSION __kconfig;
+
 #ifndef TASK_COMM_LEN
 #define TASK_COMM_LEN 16
 #endif
 #define INVALID_UID ((uid_t)-1)
 
+#if LINUX_KERNEL_VERSION <= KERNEL_VERSION(5, 15, 0)
+struct old_fpu {
+	unsigned int last_cpu;
+	unsigned char initialized;
+	long: 24;
+	long: 64;
+	long: 64;
+	long: 64;
+	long: 64;
+	long: 64;
+	long: 64;
+	long: 64;
+	union fpregs_state state;
+};
+#endif
+
 struct event {
     gadget_timestamp timestamp;
     gadget_mntns_id mntns_id;

pkg/ebpf/gadgets/randomx/tracer/randomx_bpfel.go pkg/ebpf/gadgets/randomx/tracer/randomx_bpf.go

@@ -18,7 +18,7 @@ import (
 	"github.com/kubescape/kapprofiler/pkg/ebpf/gadgets/randomx/types"
 )
 
-//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -no-global-types -target bpfel -cc clang -cflags "-g -O2" -type event randomx bpf/randomx.bpf.c -- -I./bpf/
+//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -no-global-types -target bpf -cc clang -cflags "-g -O2 -Wall" -type event randomx bpf/randomx.bpf.c -- -I./bpf/
 
 const (
 	TargetRandomxEventsCount = 50

pkg/ebpf/gadgets/randomx/tracer/randomx_bpfel.o pkg/ebpf/gadgets/randomx/tracer/randomx_bpf.o

@@ -3,7 +3,6 @@ package tracing
 import (
 	"fmt"
 	"log"
-	"os"
 	"runtime"
 
 	"github.com/cilium/ebpf"
@@ -89,7 +88,7 @@ func (t *Tracer) startAppBehaviorTracing() error {
 	}
 
 	// Start tracing randomx
-	if runtime.GOARCH == "amd64" && os.Getenv("KAPROFILER_ENABLE_RANDOMX") == "true" {
+	if runtime.GOARCH == "amd64" || runtime.GOARCH == "x86_64" {
 		err = t.startRandomxTracing()
 		if err != nil {
 			log.Printf("error starting randomx tracing: %s\n", err)