Merge branch 'main' into verifier

.github/workflows/dependency-review.yml

@@ -22,6 +22,6 @@ jobs:
           egress-policy: audit
 
       - name: 'Checkout Repository'
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1

.github/workflows/nuget_update.yaml

@@ -44,7 +44,7 @@ jobs:
 
 
     - name: Cache nuget packages
-      uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2
+      uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319
       env:
         cache-name: cache-nuget-modules
       with:
@@ -61,7 +61,7 @@ jobs:
         nuget update -noninteractive -verbosity detailed ${{env.SOLUTION_FILE_PATH}}
 
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@b1ddad2c994a25fbc81a28b3ec0e368bb2021c50
+      uses: peter-evans/create-pull-request@a4f52f8033a6168103c2538976c07b467e8163bc
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         commit-message: Update NuGet packages

.github/workflows/ossar-scan.yml

@@ -55,7 +55,7 @@ jobs:
 
     - name: Download build artifact
       if: (steps.skip_check.outputs.should_skip != 'true') && success()
-      uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe
+      uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427
       id: download_artifact
       with:
         name: ${{inputs.build_artifact}}-${{matrix.configurations}}

.github/workflows/reusable-build.yml

@@ -121,7 +121,7 @@ jobs:
       # Add cache entry for any choco packages that are installed.
       # The cache key is based on the hash of this file so if any choco packages are added or removed, the cache will be invalidated.
       if: steps.skip_check.outputs.should_skip != 'true'
-      uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2
+      uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319
       env:
         cache-name: cache-choco-packages
       with:
@@ -138,7 +138,7 @@ jobs:
 
     - name: Cache nuget packages
       if: steps.skip_check.outputs.should_skip != 'true'
-      uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2
+      uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319
       env:
         cache-name: cache-nuget-modules
       with:
@@ -148,7 +148,7 @@ jobs:
     - name: Cache verifier project
       # The hash is based on the HEAD of the ebpf-verifier submodule, the Directory.Build.props file, and the build variant.
       if: steps.skip_check.outputs.should_skip != 'true'
-      uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2
+      uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319
       env:
         cache-name: cache-verifier-project
       with:

.github/workflows/reusable-test.yml

@@ -141,7 +141,7 @@ jobs:
 
     - name: Download build artifact
       if: (steps.skip_check.outputs.should_skip != 'true') && success()
-      uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe
+      uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427
       id: download_artifact
       with:
         name: ${{inputs.build_artifact}}-${{matrix.configurations}}
@@ -280,7 +280,7 @@ jobs:
 
     - name: Upload Report to Codecov attempt 1
       if: (steps.skip_check.outputs.should_skip != 'true') && (steps.check_coverage.outputs.files_exists == 'true')
-      uses: codecov/codecov-action@0cfda1dd0a4ad9efc75517f399d859cd1ea4ced1
+      uses: codecov/codecov-action@54bcd8715eee62d40e33596ef5e8f0f48dbbccab
       id: upload_code_coverage_report_1
       continue-on-error: true
       with:
@@ -295,7 +295,7 @@ jobs:
 
     - name: Upload Report to Codecov attempt 2
       if: (steps.skip_check.outputs.should_skip != 'true') && (steps.upload_code_coverage_report_1.outcome == 'failure')
-      uses: codecov/codecov-action@0cfda1dd0a4ad9efc75517f399d859cd1ea4ced1
+      uses: codecov/codecov-action@54bcd8715eee62d40e33596ef5e8f0f48dbbccab
       id: upload_code_coverage_report_2
       continue-on-error: true
       with:
@@ -310,7 +310,7 @@ jobs:
 
     - name: Upload Report to Codecov attempt 3
       if: (steps.skip_check.outputs.should_skip != 'true') && (steps.upload_code_coverage_report_2.outcome == 'failure')
-      uses: codecov/codecov-action@0cfda1dd0a4ad9efc75517f399d859cd1ea4ced1
+      uses: codecov/codecov-action@54bcd8715eee62d40e33596ef5e8f0f48dbbccab
       id: upload_code_coverage_report_3
       continue-on-error: true
       with:
@@ -325,7 +325,7 @@ jobs:
 
     - name: Upload Report to Codecov attempt 4
       if: (steps.skip_check.outputs.should_skip != 'true') && (steps.upload_code_coverage_report_3.outcome == 'failure')
-      uses: codecov/codecov-action@0cfda1dd0a4ad9efc75517f399d859cd1ea4ced1
+      uses: codecov/codecov-action@54bcd8715eee62d40e33596ef5e8f0f48dbbccab
       id: upload_code_coverage_report_4
       continue-on-error: true
       with:

.github/workflows/upload-perf-results.yml

@@ -35,7 +35,7 @@ jobs:
         egress-policy: audit
 
     - name: Download performance result artifacts
-      uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe
+      uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427
       with:
         name: Test-Logs-${{inputs.result_artifact}}
         path: ${{github.workspace}}/results_artifact

include/bpf_helper_defs.h

@@ -339,3 +339,78 @@ EBPF_HELPER(int32_t, bpf_is_current_admin, (const void* ctx));
 #ifndef __doxygen
 #define bpf_is_current_admin ((bpf_is_current_admin_t)BPF_FUNC_is_current_admin)
 #endif
+
+/**
+ * @brief Copy memory from one location to another.
+ *
+ * @param[in] destination Destination buffer.
+ * @param[in] destination_size Size of the destination buffer.
+ * @param[in] source Source buffer.
+ * @param[in] source_size Size of the source buffer.
+ *
+ * @retval 0 The operation was successful.
+ * @retval -EINVAL One or more parameters are invalid.
+ */
+EBPF_HELPER(long, bpf_memcpy, (void* destination, uint32_t destination_size, const void* source, uint32_t source_size));
+#ifndef __doxygen
+#define bpf_memcpy ((bpf_memcpy_t)BPF_FUNC_memcpy)
+#endif
+
+/**
+ * @brief Compare two memory regions.
+ *
+ * @param[in] memory1 First memory region.
+ * @param[in] memory1_size Size of the first memory region.
+ * @param[in] memory2 Second memory region.
+ * @param[in] memory2_size Size of the second memory region.
+ *
+ * @returns 0 if the contents of memory regions are equal, a negative value if the contents of memory1 is less than the
+ * contents memory2, or a positive value if the contents memory1 is greater than the contents memory2.
+ */
+
+EBPF_HELPER(int, bpf_memcmp, (const void* memory1, uint32_t memory1_size, const void* memory2, uint32_t memory2_size));
+#ifndef __doxygen
+#define bpf_memcmp ((bpf_memcmp_t)BPF_FUNC_memcmp)
+#endif
+
+/**
+ * @brief Set memory to a specific value.
+ *
+ * @param[in] memory Memory region to set.
+ * @param[in] size Size of the memory region.
+ * @param[in] value Value to set the memory region to.
+ *
+ * @returns Pointer to the memory region, or a negative error in case of failure.
+ */
+
+EBPF_HELPER(long, bpf_memset, (void* memory, uint32_t size, int value));
+#ifndef __doxygen
+#define bpf_memset ((bpf_memset_t)BPF_FUNC_memset)
+#endif
+
+/**
+ * @brief Copy memory from one location to another, handling overlapping regions.
+ *
+ * @param[in] destination Destination buffer.
+ * @param[in] destination_size Size of the destination buffer.
+ * @param[in] source Source buffer.
+ * @param[in] source_size Size of the source buffer.
+ *
+ * @retval 0 The operation was successful.
+ * @retval -EINVAL One or more parameters are invalid.
+ */
+
+EBPF_HELPER(
+    long, bpf_memmove, (void* destination, uint32_t destination_size, const void* source, uint32_t source_size));
+#ifndef __doxygen
+#define bpf_memmove ((bpf_memmove_t)BPF_FUNC_memmove)
+#endif
+
+#if __clang__
+#define memcpy(dest, src, dest_size) bpf_memcpy(dest, dest_size, src, dest_size)
+#define memcmp(mem1, mem2, mem1_size) bpf_memcmp(mem1, mem1_size, mem2, mem1_size)
+#define memset(mem, mem_size, value) bpf_memset(mem, mem_size, value)
+#define memmove(dest, src, dest_size) bpf_memmove(dest, dest_size, src, dest_size)
+#define memcpy_s bpf_memcpy
+#define memmove_s bpf_memmove
+#endif

include/ebpf_structs.h

@@ -166,6 +166,10 @@ typedef enum
     BPF_FUNC_get_current_pid_tgid = 19,      ///< \ref bpf_get_current_pid_tgid
     BPF_FUNC_get_current_logon_id = 20,      ///< \ref bpf_get_current_logon_id
     BPF_FUNC_is_current_admin = 21,          ///< \ref bpf_is_current_admin
+    BPF_FUNC_memcpy = 22,                    ///< \ref bpf_memcpy
+    BPF_FUNC_memcmp = 23,                    ///< \ref bpf_memcmp
+    BPF_FUNC_memset = 24,                    ///< \ref bpf_memset
+    BPF_FUNC_memmove = 25,                   ///< \ref bpf_memmove
 } ebpf_helper_id_t;
 
 // Cross-platform BPF program types.

libs/execution_context/ebpf_core.c

@@ -75,6 +75,29 @@ static uint64_t
 _ebpf_core_get_current_logon_id(_In_ const void* ctx);
 static int32_t
 _ebpf_core_is_current_admin(_In_ const void* ctx);
+static int32_t
+_ebpf_core_memcpy(
+    _Out_writes_(destination_size) void* destination,
+    size_t destination_size,
+    _In_reads_(source_size) const void* source,
+    size_t source_size);
+
+static int32_t
+_ebpf_core_memcmp(
+    _In_reads_(buffer1_length) const void* buffer1,
+    size_t buffer1_length,
+    _In_reads_(buffer2_length) const void* buffer2,
+    size_t buffer2_length);
+
+static uintptr_t
+_ebpf_core_memset(_Out_writes_(length) void* buffer, size_t length, int value);
+
+static int32_t
+_ebpf_core_memmove(
+    _Out_writes_(destination_length) void* destination,
+    size_t destination_length,
+    _In_reads_(source_length) const void* source,
+    size_t source_length);
 
 #define EBPF_CORE_GLOBAL_HELPER_EXTENSION_VERSION 0
 
@@ -107,6 +130,10 @@ static const void* _ebpf_general_helpers[] = {
     (void*)&_ebpf_core_get_pid_tgid,
     (void*)&_ebpf_core_get_current_logon_id,
     (void*)&_ebpf_core_is_current_admin,
+    (void*)&_ebpf_core_memcpy,
+    (void*)&_ebpf_core_memcmp,
+    (void*)&_ebpf_core_memset,
+    (void*)&_ebpf_core_memmove,
 };
 
 static const ebpf_helper_function_addresses_t _ebpf_global_helper_function_dispatch_table = {
@@ -2340,6 +2367,59 @@ _ebpf_core_map_peek_elem(_Inout_ ebpf_map_t* map, _Out_ uint8_t* value)
     return -ebpf_map_peek_entry(map, 0, value, EBPF_MAP_FLAG_HELPER);
 }
 
+static int32_t
+_ebpf_core_memcpy(
+    _Out_writes_(destination_size) void* destination,
+    size_t destination_size,
+    _In_reads_(source_size) const void* source,
+    size_t source_size)
+{
+    if (source_size > destination_size) {
+        return -EINVAL;
+    }
+    return memcpy_s(destination, destination_size, source, source_size);
+}
+
+static uintptr_t
+_ebpf_core_memset(_Out_writes_(length) void* buffer, size_t length, int value)
+{
+    return (uintptr_t)memset(buffer, value, length);
+}
+
+static int32_t
+_ebpf_core_memcmp(
+    _In_reads_(buffer1_length) const void* buffer1,
+    size_t buffer1_length,
+    _In_reads_(buffer2_length) const void* buffer2,
+    size_t buffer2_length)
+{
+    int32_t result = memcmp(buffer1, buffer2, buffer1_length < buffer2_length ? buffer1_length : buffer2_length);
+
+    if (result == 0) {
+        if (buffer1_length < buffer2_length) {
+            result = -1;
+        } else if (buffer1_length > buffer2_length) {
+            result = 1;
+        }
+    } else {
+        result = result < 0 ? -1 : 1;
+    }
+    return result;
+}
+
+static int32_t
+_ebpf_core_memmove(
+    _Out_writes_(destination_length) void* destination,
+    size_t destination_length,
+    _In_reads_(source_length) const void* source,
+    size_t source_length)
+{
+    if (source_length > destination_length) {
+        return -EINVAL;
+    }
+    return memmove_s(destination, destination_length, source, source_length);
+}
+
 typedef enum _ebpf_protocol_call_type
 {
     EBPF_PROTOCOL_FIXED_REQUEST_NO_REPLY,

libs/execution_context/ebpf_general_helpers.c

@@ -94,6 +94,37 @@ ebpf_helper_function_prototype_t ebpf_core_helper_function_prototype_array[] = {
      EBPF_RETURN_TYPE_INTEGER,
      {EBPF_ARGUMENT_TYPE_PTR_TO_CTX}},
     {BPF_FUNC_is_current_admin, "bpf_is_current_admin", EBPF_RETURN_TYPE_INTEGER, {EBPF_ARGUMENT_TYPE_PTR_TO_CTX}},
+    {BPF_FUNC_memcpy,
+     "bpf_memcpy",
+     EBPF_RETURN_TYPE_INTEGER,
+     {
+         EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+         EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+         EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+         EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+     }},
+    {BPF_FUNC_memcmp,
+     "bpf_memcmp",
+     EBPF_RETURN_TYPE_INTEGER,
+     {
+         EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+         EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+         EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+         EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+     }},
+    {BPF_FUNC_memset,
+     "bpf_memset",
+     EBPF_RETURN_TYPE_INTEGER,
+     {EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM, EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO, EBPF_ARGUMENT_TYPE_ANYTHING}},
+    {BPF_FUNC_memmove,
+     "bpf_memmove",
+     EBPF_RETURN_TYPE_INTEGER,
+     {
+         EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+         EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+         EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+         EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+     }},
 };
 
 #ifdef __cplusplus