osi_linux: Support kernel version 6.7 (#1429)

Author: be32826

panda/plugins/osi_linux/default_profile.cpp

@@ -43,6 +43,11 @@ target_ptr_t default_get_current_task_struct(CPUState *cpu)
         // We need to expose that as a part of the OSI config - See issue #651
         target_ptr_t task_thread_info = kernel_sp & ~(0x2000 -1);
 
+        //for kernel versions >= 5.18.0
+        if (PROFILE_KVER_GE(ki, 5, 18, 0)) {
+            return task_thread_info;
+        }
+
         current_task_addr=task_thread_info+0xC;
 
         //because some kernel versions use both per_cpu variables AND access the task_struct 
@@ -60,6 +65,13 @@ target_ptr_t default_get_current_task_struct(CPUState *cpu)
     current_task_addr = get_id(cpu); // HWID returned by hw_proc_id is the cached r28 value
     OG_printf("Got current task struct at " TARGET_FMT_lx "\n", current_task_addr);
 
+    //because some kernel versions use both per_cpu variables AND access the task_struct
+    //via the thread_info struct, the default call to struct_get with the per_cpu_offset_0_addr can be incorrect
+    err = struct_get(cpu, &ts, current_task_addr, 0);
+    assert(err == struct_get_ret_t::SUCCESS && "failed to get current task struct");
+    fixupendian2(ts);
+    return ts;
+
 #else // x86/64
     current_task_addr = ki.task.current_task_addr;
 #endif

panda/plugins/osi_linux/utils/kernelinfo/kernelinfo_read.c

@@ -145,7 +145,7 @@ int read_kernelinfo(gchar const *file, gchar const *group, struct kernelinfo *ki
 		READ_INFO_INT(ki, fs.f_vfsmnt_offset, gerr, err.fs, &errbmp);
 	}
 
-	READ_INFO_INT(ki, task.thread_group_offset, gerr, err.task, &errbmp);
+	OPTIONAL_READ_INFO_INT(ki, task.thread_group_offset, gerr, err.task, &errbmp);
 	READ_INFO_INT(ki, task.pid_offset, gerr, err.task, &errbmp);
 	READ_INFO_INT(ki, task.tgid_offset, gerr, err.task, &errbmp);
 	READ_INFO_INT(ki, task.mm_offset, gerr, err.task, &errbmp);
@@ -157,7 +157,7 @@ int read_kernelinfo(gchar const *file, gchar const *group, struct kernelinfo *ki
 
 	/* read mm information */
 	READ_INFO_INT(ki, mm.size, gerr, err.mm, &errbmp);
-	READ_INFO_INT(ki, mm.mmap_offset, gerr, err.mm, &errbmp);
+	OPTIONAL_READ_INFO_INT(ki, mm.mmap_offset, gerr, err.mm, &errbmp);
 	READ_INFO_INT(ki, mm.pgd_offset, gerr, err.mm, &errbmp);
 	READ_INFO_INT(ki, mm.arg_start_offset, gerr, err.mm, &errbmp);
 	READ_INFO_INT(ki, mm.start_brk_offset, gerr, err.mm, &errbmp);
@@ -169,7 +169,7 @@ int read_kernelinfo(gchar const *file, gchar const *group, struct kernelinfo *ki
 	READ_INFO_INT(ki, vma.vm_mm_offset, gerr, err.vma, &errbmp);
 	READ_INFO_INT(ki, vma.vm_start_offset, gerr, err.vma, &errbmp);
 	READ_INFO_INT(ki, vma.vm_end_offset, gerr, err.vma, &errbmp);
-	READ_INFO_INT(ki, vma.vm_next_offset, gerr, err.vma, &errbmp);
+	OPTIONAL_READ_INFO_INT(ki, vma.vm_next_offset, gerr, err.vma, &errbmp);
 	READ_INFO_INT(ki, vma.vm_file_offset, gerr, err.vma, &errbmp);
 	READ_INFO_INT(ki, vma.vm_flags_offset, gerr, err.vma, &errbmp);
 

panda/plugins/osi_linux/utils/kernelinfo_gdb/extract_kernelinfo.py

@@ -37,6 +37,7 @@ def invoke(self, arg, from_tty):
         versions = release.split(".")
         # version.c can have a bunch of junk - just extract a number
         versions[2] = re.search("\d+",versions[2]).group(0)
+        versions = tuple(int(ver) for ver in versions)
         print(f"version.a = {versions[0]}",file=file_out)
         print(f"version.b = {versions[1]}",file=file_out)
         print(f"version.c = {versions[2]}",file=file_out)
@@ -75,7 +76,8 @@ def invoke(self, arg, from_tty):
         print_offset("struct task_struct",      "pid",          "task");
         print_offset("struct task_struct",      "tgid",         "task");
         print_offset("struct task_struct",      "group_leader", "task");
-        print_offset("struct task_struct",      "thread_group", "task");
+        if versions < (6, 7, 0):
+            print_offset("struct task_struct",      "thread_group", "task");
         print_offset("struct task_struct",      "real_parent",  "task");
         print_offset("struct task_struct",      "parent",           "task");
         print_offset("struct task_struct",      "mm",               "task");
@@ -91,7 +93,8 @@ def invoke(self, arg, from_tty):
         print_offset("struct cred",             "euid",         "cred");
         print_offset("struct cred",             "egid",         "cred");
         print_size("struct mm_struct",          "size",         "mm");
-        print_offset("struct mm_struct",            "mmap",         "mm");
+        if versions < (6, 1, 0):
+            print_offset("struct mm_struct",            "mmap",         "mm");
         print_offset("struct mm_struct",            "pgd",          "mm");
         print_offset("struct mm_struct",            "arg_start",        "mm");
         print_offset("struct mm_struct",            "start_brk",        "mm");
@@ -102,7 +105,8 @@ def invoke(self, arg, from_tty):
         print_offset("struct vm_area_struct",       "vm_mm",            "vma");
         print_offset("struct vm_area_struct",       "vm_start",     "vma");
         print_offset("struct vm_area_struct",       "vm_end",           "vma");
-        print_offset("struct vm_area_struct",       "vm_next",      "vma");
+        if versions < (6, 1, 0):
+            print_offset("struct vm_area_struct",       "vm_next",      "vma");
         print_offset("struct vm_area_struct",       "vm_flags",     "vma");
         print_offset("struct vm_area_struct",       "vm_file",      "vma");
 
@@ -128,7 +132,7 @@ def invoke(self, arg, from_tty):
         print_offset("struct dentry",               "d_op",                 "path");
         print_offset("struct dentry_operations",    "d_dname",              "path");
         print_offset("struct vfsmount",         "mnt_root",             "path");
-        if int(versions[0]) >= 3:
+        if versions[0] >= 3:
             # fields in struct mount 
             print_offset_from_member("struct mount",    "mnt", "mnt_parent",        "path");
             print_offset_from_member("struct mount",    "mnt", "mnt_mountpoint",    "path");