Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rejigged aarch64 port #6612

Merged
merged 18 commits into from
Sep 5, 2020
Merged

Rejigged aarch64 port #6612

merged 18 commits into from
Sep 5, 2020

Conversation

ozbenh
Copy link
Contributor

@ozbenh ozbenh commented Aug 28, 2020

This is a rebased and slightly reworked version of Artemis original aarch64 port:

  • Broken up into smaller commits
  • Reworked some of the osquery core changes a bit for more consistency around
    the use of ifdef's and what I generally feel is a bit cleaner.
  • The libraries updates include Alessandro's updates
  • I've taken out the cpuid table completely on arm rather than make the code return an empty
    one. If we feel strongly about putting that back, I would do it with a different style of
    ifdef'ery than what was used in the original port.

It passes the checks on Ubuntu 18.04 AWS x86_64 and aarch64 instances, with the exception
of tools_tests_testfschangestable which appears to have unrelated docker issues.

@linux-foundation-easycla
Copy link

linux-foundation-easycla bot commented Aug 28, 2020

CLA Check
The committers are authorized under a signed CLA.

@theopolis theopolis added aarch64 build libraries For things referring to osquery third party libraries labels Aug 29, 2020
@theopolis
Copy link
Member

This supersedes #6336

CMakeLists.txt Outdated Show resolved Hide resolved
CMakeLists.txt Outdated Show resolved Hide resolved
ozbenh and others added 18 commits September 4, 2020 09:07
We currenty inclulde unistd_64.h which doesn't work on aarch64. Rather
add #ifdef's around it, let's just use unistd.h which should do the
right thing on all architectures.

Additionally remove the duplicate #include's from the .cpp files
Currently recognizes AMD64 and x86_64 for x86 and aarch64 for ARM.

Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Instead of hard-wiring "x86_64"

Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Some syscalls are deprecated on newer architectures, for example
fork and vfork are all variants of clone now; symlink, unlink, rename
etc... at variants of the *at() versions, dup2 of dup3, etc...

Note about the test events: Because the events are synthetic, we
only really test the parser, as such it doesn't matter if aarch64
doesn't use a snapshot of a real event. To keep things simple we
only replace the arch and syscall fields.

Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
The instruction doesn't exist on other processors, and while there
might be ways to retrieve the equivalent information, none directly
matches the x86 "cpuid". This takes out the table completely on
non-x86_64 architectures.

Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Alessandro Gario <alessandro.gario@gmail.com>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Alessandro Gario <alessandro.gario@gmail.com>
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
@alessandrogario
Copy link
Member

This is great! I was able to build the packages from scratch on Ubuntu 16 (posted in the arm-architecture Slack channel), and play around with audit.

Seems like the first commit in the PR does not contain the co-author tag so if we want to squash and merge we need to make sure to fix it. It's not an issue if we rebase and merge

@theopolis theopolis merged commit ea70cde into osquery:master Sep 5, 2020
@ozbenh
Copy link
Contributor Author

ozbenh commented Sep 7, 2020

This is great! I was able to build the packages from scratch on Ubuntu 16 (posted in the arm-architecture Slack channel), and play around with audit.

Seems like the first commit in the PR does not contain the co-author tag so if we want to squash and merge we need to make sure to fix it. It's not an issue if we rebase and merge

The first commit is entirely mine :-) It cleans up the existing usage of unistd_64.h so we don't need the #ifdef's that were in Artemis patch. That said, if you want to add the co-author tag, be my guest, I don't mind.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
aarch64 build libraries For things referring to osquery third party libraries merge with rebase
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants