Add support for aarch64 (#240)

* Add support for aarch64

* Update version year to 2026

* Use make for building openssl

* Require at least SysinternalsEBPF 1.6.1 for Debian

Author: foxmsft

.container/install-ubuntu-dependencies.sh

@@ -23,7 +23,6 @@ sudo apt-get install -y --no-install-recommends \
         clang \
         libzstd1 \
         libgtest-dev \
-        libc6-dev-i386 \
         apt-transport-https \
         dirmngr \
         googletest \

BUILD.md

@@ -78,6 +78,51 @@ cmake ..
 make
 ```
 
+## Cross-build for aarch64 on Ubuntu
+
+First cross-build and stage SysinternalsEBPF as described in its `BUILD.md`.
+The commands below assume its staged installation is in
+`../SysinternalsEBPF/build-arm64/staging`.
+
+Install the cross compiler and target development libraries:
+
+```shell
+sudo dpkg --add-architecture arm64
+sudo apt update
+sudo apt install crossbuild-essential-arm64 binutils-aarch64-linux-gnu \
+    libc6-dev-arm64-cross linux-libc-dev-arm64-cross \
+    libelf-dev:arm64 zlib1g-dev:arm64 libzstd-dev:arm64 \
+    libjson-glib-dev:arm64 libgtest-dev:arm64 libgmock-dev:arm64
+```
+
+Build the eBPF size checker for the build host. It inspects architecture-neutral
+eBPF objects during the cross-build and avoids executing aarch64 programs on
+the build host:
+
+```shell
+cmake -S . -B build-host
+cmake --build build-host --target checkEBPFsizes
+```
+
+Configure and build the aarch64 targets:
+
+```shell
+EBPF_STAGE="$(realpath ../SysinternalsEBPF/build-arm64/staging)"
+
+cmake -S . -B build-arm64 \
+    -DCMAKE_TOOLCHAIN_FILE=cmake/aarch64-linux-gnu.cmake \
+    -DOPENSSL_CROSS_COMPILE=aarch64-linux-gnu- \
+    -DSYSINTERNALS_EBPF_ROOT="$EBPF_STAGE/opt/sysinternalsEBPF" \
+    -DSYSINTERNALS_EBPF_INCLUDE_DIR="$EBPF_STAGE/usr/local/include" \
+    -DSYSINTERNALS_EBPF_LIBRARY="$EBPF_STAGE/usr/local/lib/libsysinternalsEBPF.so" \
+    -DSYSMON_HOST_CHECK_EBPF_SIZES="$PWD/build-host/checkEBPFsizes"
+cmake --build build-arm64 --parallel
+```
+
+The resulting `sysmon`, `sysmonLogView`, `sysmonUnitTests`, and
+`checkEBPFsizes` executables target aarch64. Run those executables and all
+runtime tests on an aarch64 Linux host; QEMU is not required.
+
 ## Test
 ```
 ./sysmonUnitTests

CMakeLists.txt

@@ -0,0 +1,20 @@
+set(CMAKE_SYSTEM_NAME Linux)
+set(CMAKE_SYSTEM_PROCESSOR aarch64)
+
+set(CMAKE_C_COMPILER aarch64-linux-gnu-gcc)
+set(CMAKE_CXX_COMPILER aarch64-linux-gnu-g++)
+set(CMAKE_AR aarch64-linux-gnu-ar)
+set(CMAKE_LINKER aarch64-linux-gnu-ld)
+set(CMAKE_NM aarch64-linux-gnu-nm)
+set(CMAKE_OBJCOPY aarch64-linux-gnu-objcopy)
+set(CMAKE_OBJDUMP aarch64-linux-gnu-objdump)
+set(CMAKE_RANLIB aarch64-linux-gnu-ranlib)
+set(CMAKE_STRIP aarch64-linux-gnu-strip)
+
+set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
+set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY BOTH)
+set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE BOTH)
+set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE BOTH)
+
+set(ENV{PKG_CONFIG_LIBDIR}
+    "/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/share/pkgconfig")

cmake/aarch64-linux-gnu.cmake

@@ -49,10 +49,12 @@
 #endif
 
 #include <sysinternalsEBPF_common.h>
+#ifndef EBPF_CO_RE
 #include <stdint.h>
+#endif
 #include <bpf_helpers.h>
 #include <bpf_core_read.h>
-#include <asm/unistd_64.h>
+#include <asm/unistd.h>
 #include <sysinternalsEBPFshared.h>
 #include "sysmon_defs.h"
 

ebpfKern/sysmonEBPF_common.h

@@ -42,9 +42,13 @@ int FileCreateRawExit(struct bpf_our_raw_tracepoint_args *ctx)
     }
 
     // only handle file creation events
+#ifdef __NR_creat
     if (eventArgs->syscallId != __NR_creat) {
         return 0;
     }
+#else
+    return 0;
+#endif
 
     // set the return code
     if (bpf_probe_read(&eventArgs->returnCode, sizeof(int64_t), (void *)&SYSCALL_PT_REGS_RC(regs)) != 0){
@@ -66,4 +70,3 @@ int FileCreateRawExit(struct bpf_our_raw_tracepoint_args *ctx)
 
     return 0;
 }
-

ebpfKern/sysmonFileCreate_rawtp.c

@@ -41,9 +41,13 @@ int FileDeleteRawExit(struct bpf_our_raw_tracepoint_args *ctx)
         return 0;
 
     // only handle unlink events
+#ifdef __NR_unlink
     if (eventArgs->syscallId != __NR_unlink) {
         return 0;
     }
+#else
+    return 0;
+#endif
 
     // set the return code
     if (bpf_probe_read(&eventArgs->returnCode, sizeof(int64_t), (void *)&SYSCALL_PT_REGS_RC(regs)) != 0){
@@ -64,4 +68,3 @@ int FileDeleteRawExit(struct bpf_our_raw_tracepoint_args *ctx)
 
     return 0;
 }
-

ebpfKern/sysmonFileDelete_rawtp.c

@@ -78,11 +78,15 @@ static inline char* set_FileOpen_info(
     // store event time in nanoseconds for comparison
     eventTimeNs = bpf_ktime_get_ns() + config->bootNsSinceEpoch;
 
+#ifdef __NR_open
     if (eventArgs->syscallId == __NR_open) {
         event->m_Flags = (uint32_t)eventArgs->a[1];
     } else {
         event->m_Flags = (uint32_t)eventArgs->a[2];
     }
+#else
+    event->m_Flags = (uint32_t)eventArgs->a[2];
+#endif
 
     ptr = (char *)(event + 1);
     memset(event->m_Extensions, 0, sizeof(event->m_Extensions));
@@ -211,4 +215,3 @@ static inline char* set_FileOpen_info(
         return (char *)eventHdr;
     }
 }
-

ebpfKern/sysmonFileOpen.c

@@ -41,7 +41,11 @@ int FileOpenRawExit(struct bpf_our_raw_tracepoint_args *ctx)
         return 0;
 
     // only handle open and openat events
+#ifdef __NR_open
     if (eventArgs->syscallId != __NR_open && eventArgs->syscallId != __NR_openat) {
+#else
+    if (eventArgs->syscallId != __NR_openat) {
+#endif
         return 0;
     }
 
@@ -64,4 +68,3 @@ int FileOpenRawExit(struct bpf_our_raw_tracepoint_args *ctx)
 
     return 0;
 }
-

ebpfKern/sysmonFileOpen_rawtp.c

@@ -28,8 +28,6 @@
 //
 //====================================================================
 
-#include <inttypes.h>
-
 __attribute__((always_inline))
 static inline char* set_process_ext(
     PSYSMON_PROCESS_CREATE event,
@@ -191,4 +189,3 @@ static inline char* set_ProcCreate_info(
 
     return set_process_ext(event, config, task);
 }
-