WIP: Introduce Ftrace in the syscall section by nickchen120235 · Pull Request #180 · sysprog21/lkmpg

nickchen120235 · 2022-11-21T08:02:05Z

Closes #175

Write the syscall stealing example using Ftrace
Add contents into the book

linD026

I suggest we should also provide a user script to work with this example.
It can be located at /lkmpg/example/other directory.

examples/syscall-ftrace.c

- uid should be initialized - update comments - add uid check in our_sys_openat - format

examples/syscall-ftrace.c

jserv · 2022-12-01T16:21:46Z

lkmpg.tex

+
+\begin{figure}[h]
+  \centering
+  \includegraphics[width=\textwidth]{assets/syscall/flow.jpg}


Utilize TikZ for drawing. See https://texample.net/tikz/examples/pgf-umlsd/
Avoid putting bitmap files.

TikZ examples: https://texample.net/tikz/examples/

This is the best I got so far. Unfortunately pgf-umlsd doesn't support returning to functions other than the caller, so the hooking part isn't accurately represented.

Also, I have to rotate the figure by 90 degrees to minimize the overflow ~~although it overflows anyway~~. Will it affect the output of the website or should I rotate it back and let it overflow?

Alternatively, you can just render the partial sequences.

I don't think I can rework this diagram in latex because it lacks features I need, like returning to functions other than caller (this is the most important one), annotation. (I'm not the creator of this sequence diagram so obtaining the "original" file is not possible either.)

I think the resolution of that jpeg is good enough for even printing, so I think I may left it as is.

The latex code I've written and the result

\begin{sequencediagram} \newthread{do_syscall_64}{do\_syscall\_64} \newinst[1.5]{sys_execve}{sys\_execve} \newinst[1.5]{ftrace}{[ftrace]} \newinst[1]{fh_ftrace_thunk}{fh\_ftrace\_thunk} \newinst[1]{fh_sys_execve}{fh\_sys\_execve} \postlevel \postlevel \postlevel \begin{call}{do_syscall_64}{\shortstack{ \cpp|regs-ax=|\\ \cpp|sys_call_table[nr]|\\ \cpp|(regs->di,regs->si|\\ \cpp|regs->dx,regs->r10|\\ \cpp|regs->r8,regs->r9)| }}{sys_execve}{} \begin{call}{sys_execve}{call \cpp|__fentry__|}{ftrace}{} \begin{call}{ftrace}{}{fh_ftrace_thunk}{} \postlevel \end{call} \end{call} \begin{call}{sys_execve}{hooking}{fh_sys_execve}{\cpp|real_sys_execve()|} \postlevel \end{call} \postlevel \begin{call}{sys_execve}{call \cpp|__fentry__|}{ftrace}{} \begin{call}{ftrace}{}{fh_ftrace_thunk}{} \postlevel \end{call} \end{call} \begin{call}{sys_execve}{}{fh_sys_execve}{} \end{call} \end{call} \end{sequencediagram}

lkmpg.tex

examples/syscall-ftrace.c

linD026

Here is the warning, please fix it too.

/home/runner/work/lkmpg/lkmpg/examples/syscall-ftrace.c:190:9: warning: ignoring return value of ‘copy_from_user’, declared with attribute warn_unused_result [-Wunused-result]
  190 |     if (copy_from_user(kfilename, (char __user *)regs->si, MAX_FILENAME_SIZE) < 0) {
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

nickchen120235 · 2022-12-05T06:56:22Z

syscall-ftrace.c should be good to go.

- remove obsolete comments - use `pr_fmt` to clean kprintf - remove clang-format comments - `static` declarations - fix ignored return value warning correct the comment `nr` refers to syscall "number", not "name"

lkmpg.tex

examples/syscall-ftrace.c

lkmpg.tex

examples/syscall-ftrace.c

- fix comment style - new line after declaration - fix incorrect parameter order of kmalloc

linD026 · 2022-12-06T04:46:16Z

examples/syscall-ftrace.c

+    char *kfilename;
+    int errcode = 0;
+
+    if (current->cred->uid.val != uid)


Still have the warning.

/home/runner/work/lkmpg/lkmpg/examples/syscall-ftrace.c:180:16: warning: dereference of noderef expression

linD026 · 2022-12-06T04:48:47Z

lkmpg.tex

+We need both \cpp|FTRACE_OPS_FL_SAVE_REGS| and \cpp|FTRACE_OPS_FL_IPMODIFY| because we're modifying \cpp|ip|.
+Inside \cpp|ftrace_thunk| is what the magic happens.
+We check if it is called from within the module,
+if not then it modifies the instruction pointer to our ``spying'' function.


Ditto.
Don't separate the line with comma.

linD026 · 2022-12-06T04:49:15Z

lkmpg.tex

+Alright let's write some code.
+Below is the source code of the example from above, but rewritten using \verb|ftrace|.
+The main difference is the \cpp|install_hook| function,
+which prepares our tracee function (\cpp|sys_openat|),


Don't separate the line with comma.

linD026 · 2022-12-06T04:50:20Z

lkmpg.tex

+if not then it modifies the instruction pointer to our ``spying'' function.
+The check is performed by checking whether \cpp|parent_ip| is within this module.
+During the first call, \cpp|parent_ip| points to somewhere within the kernel,
+while during the second call it points to somewhere in our ``spying'' function, which is within the module.


Ditto, the comma.

I didn't point out all of the cases. Please check again.

linD026 · 2022-12-06T04:56:02Z

lkmpg.tex

+and we have access to CPU registers,
+maybe we can ``hijack'' the traced function by modifying the instruction pointer?
+Yes, this is possible by enabling \cpp|FTRACE_OPS_FL_IPMODIFY| flag when registering a trace.
+It will allow us to modify the instruction pointer register, which will become an unconditional jump after the \verb|ftrace| function.


The clause introduced by which is restrictive. So, omit the comma.

linD026 · 2022-12-06T04:59:24Z

lkmpg.tex

+  Do notice that in kernel version later than v5.11, this is replaced with \cpp|struct ftrace_regs *fregs|, with the original \cpp|pt_regs| accessible by \cpp|fregs->regs|.
+\end{itemize}
+
+Internally, there's a 5-byte \cpp|call| to \cpp|__fentry__| at the beginning (BEFORE function prologue) of a traceable kernel function, which is converted to \cpp|nop| during boot to prevent overhead. When a trace is registered, it is changed back to \cpp|__fentry__| and the registered callback will be executed accordingly.


Separate the line with sentences.

nickchen120235 · 2022-12-08T06:00:50Z

Changing this back to draft since I won't be able to work on this for a while. Reviews are still welcomed, though they won't be resolved until I come back.

jserv

Rebase the latest 'master` branch.

nickchen120235 force-pushed the master branch from a17514c to 2ad67b4 Compare November 21, 2022 08:09

Create Ftrace syscall hooking example

f7cc340

nickchen120235 force-pushed the master branch from 2ad67b4 to f7cc340 Compare November 21, 2022 08:10

linD026 requested changes Nov 21, 2022

View reviewed changes

examples/syscall-ftrace.c Outdated Show resolved Hide resolved

jserv changed the title ~~Draft: Introduce Ftrace in the syscall chapter~~ WIP: Introduce Ftrace in the syscall section Nov 22, 2022

nickchen120235 added 3 commits November 22, 2022 15:20

Update ftrace example

9b7be18

- uid should be initialized - update comments - add uid check in our_sys_openat - format

Complete ftrace part

6626ce8

inhibit some sections of code that breaks when rendering

7486076

nickchen120235 marked this pull request as ready for review November 22, 2022 07:37

jserv requested a review from linD026 December 1, 2022 16:16

jserv reviewed Dec 1, 2022

View reviewed changes

examples/syscall-ftrace.c Outdated Show resolved Hide resolved

jserv reviewed Dec 1, 2022

View reviewed changes

examples/syscall-ftrace.c Outdated Show resolved Hide resolved

jserv reviewed Dec 1, 2022

View reviewed changes

linD026 requested changes Dec 1, 2022

View reviewed changes

nickchen120235 added 2 commits December 5, 2022 15:18

requested changes

b44bf10

- remove obsolete comments - use `pr_fmt` to clean kprintf - remove clang-format comments - `static` declarations - fix ignored return value warning correct the comment `nr` refers to syscall "number", not "name"

all ftrace should use verb

2df343f

nickchen120235 force-pushed the master branch from 6821a2b to 2df343f Compare December 5, 2022 07:19

change callback func description

7f5cf1f

jserv reviewed Dec 5, 2022

View reviewed changes

lkmpg.tex Outdated Show resolved Hide resolved

jserv reviewed Dec 5, 2022

View reviewed changes

examples/syscall-ftrace.c Outdated Show resolved Hide resolved

jserv reviewed Dec 5, 2022

View reviewed changes

examples/syscall-ftrace.c Outdated Show resolved Hide resolved

nickchen120235 added 2 commits December 5, 2022 16:15

shorten the code

5a71f73

split lines

3b0cc7d

jserv reviewed Dec 5, 2022

View reviewed changes

lkmpg.tex Show resolved Hide resolved

provide usage example

8cf0d6d

jserv requested a review from linD026 December 5, 2022 09:31

linD026 requested changes Dec 5, 2022

View reviewed changes

examples/syscall-ftrace.c Outdated Show resolved Hide resolved

examples/syscall-ftrace.c Show resolved Hide resolved

examples/syscall-ftrace.c Show resolved Hide resolved

fix example

beb9272

- fix comment style - new line after declaration - fix incorrect parameter order of kmalloc

nickchen120235 requested a review from linD026 December 6, 2022 01:11

linD026 requested changes Dec 6, 2022

View reviewed changes

nickchen120235 marked this pull request as draft December 8, 2022 05:58

jserv force-pushed the master branch from eee8c61 to 1d38d2e Compare April 15, 2024 21:18

jserv requested changes Aug 6, 2025

View reviewed changes

Comments

Conversation

nickchen120235 commented Nov 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linD026 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

linD026 left a comment

Choose a reason for hiding this comment

Uh oh!

nickchen120235 commented Dec 5, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nickchen120235 commented Dec 8, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jserv left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nickchen120235 commented Nov 21, 2022 •

edited

Loading

nickchen120235 commented Dec 8, 2022 •

edited

Loading