Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for symbolizing BPF kernel program addresses #854

Merged
merged 13 commits into from
Oct 22, 2024
Merged

Add support for symbolizing BPF kernel program addresses #854

merged 13 commits into from
Oct 22, 2024

Commits on Oct 22, 2024

  1. Add infrastructure for building BPF test programs 

    Add the infrastructure necessary for building BPF programs that we
intend to use for testing purposes. Also, add a first test program that
that will attach to the getpid system call and which provides the means
for conveying the address of a function that is part of this program to
user space, where it will eventually act as symbolization input.

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    ac0762d View commit details
    Browse the repository at this point in the history

  2. Add test infrastructure for loading and triggering BPF program 

    Add infrastructure for loading and then triggering a BPF program from a
test. This will form the basis for testing of BPF kernel program
symbolization.

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    ad7e128 View commit details
    Browse the repository at this point in the history

  3. Rename Ksym type to Kfunc 

    Rename the Ksym type to Kfunc. This will allow us to repurpose Ksym with
upcoming changes.

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    a25f6f8 View commit details
    Browse the repository at this point in the history

  4. Make Kfunc to ResolvedSym conversion fallible 

    Adjust the functionality for converting from Kfunc to ResolvedSym to be
fallible and stop relying on the From trait for that purpose. We will
eventually end up including a bit more information in the conversion and
so let's instead roll with a dedicated conversion method on the Kfunc
type itself. We need fallibility because this new method acts as an
"abstract interface" for additional implementations coming in the future
and which will be fallible.

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    89e7c1e View commit details
    Browse the repository at this point in the history

  5. Make Kfunc to SymInfo conversion fallible 

    Similar to what we did earlier for the conversion from Kfunc to
ResolvedSym, make the conversion from Kfunc to SymInfo fallible.

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    1cf58b7 View commit details
    Browse the repository at this point in the history

  6. Introduce Ksym enum 

    Introduce the Ksym enumeration, which currently only has a single
variant containing a Kfunc. With upcoming changes it will also provide
support for BPF programs.

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    c2bcdae View commit details
    Browse the repository at this point in the history

  7. Recognize and parse BPF programs in kallsyms 

    Add support for parsing BPF programs listed in kallsyms. Currently,
while parsed specially, they don't provide more symbol information than
regular kernel functions, but the BPF sub-system provides the means for
retrieving symbol and even source code information about each. This will
be tapped into subsequently. As a first step towards exposing this
functionality, make sure to parse them as first-class entities.

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    62bea64 View commit details
    Browse the repository at this point in the history

  8. Add bindings for querying BPF program information 

    Add low-level system call bindings for querying BPF program information
from the kernel. We need this logic to iterate over available programs
and for retrieving meta-data such as the program's tag. The alternative
of relying on libbpf-rs and higher level primitives was discarded given
the minimal nature of support we require here. There is simply no
justification for all the dependency bloat that libbpf-sys et al pull
in.

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    36d9dae View commit details
    Browse the repository at this point in the history

  9. Add basic BTF support 

    This change adds basic BTF support, as later required. Specifically, we
add the means for opening BTF information via a system call, as well as
the means for parsing a BTF blob and extracting strings at given offsets.

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    cdf61c2 View commit details
    Browse the repository at this point in the history

  10. Introduce BPF program info cache 

    The kernel does not seem to allow us to query BPF program information
given a BPF program tag. Rather, the workflow is to iterate over all BPF
programs and find the one with a given tag this way. Because there could
potentially be many programs active, this can be a costly operation that
we may not want to execute all the time.
To make the result of BPF program iteration reusable, this change
introduces an easy to use cache for this data.

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    d11a94d View commit details
    Browse the repository at this point in the history

  11. Add support for symbolizing BPF program kernel addresses 

    This change adds the remaining plumbing for symbolizing BPF program
kernel addresses. When a kernel address falls into a BPF program, we
query all the necessary information to see if the kernel is able to
provide us with source code information about said address and furnish
up the corresponding CodeInfo object to include it in the symbolization
result.

Closes: libbpf#826

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    2f0529d View commit details
    Browse the repository at this point in the history

  12. Enable kernel options for necessary BPF support 

    Enable necessary kernel options for us to run our BPF based testing
infrastructure.

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    4469eee View commit details
    Browse the repository at this point in the history

  13. Install necessary dependencies in CI 

    With the introduction of libbpf-rs as a dev-dependency we require
additional system dependencies as part of various CI jobs. Install them.

Signed-off-by: Daniel Müller <[email protected]>
    @d-e-s-o
    d-e-s-o committed Oct 22, 2024
    Configuration menu
    Copy the full SHA
    acee209 View commit details
    Browse the repository at this point in the history