Add --filter-track-bpf-helpers #390
Merged
Commits on Sep 2, 2024
-
This commit adds a new API GetBpfHelpers(), which accepts symbols (from /proc/kallsyms) and returns all bpf helper names used at present. The idea is to scan assembly code of each bpf functions (has suffix [bpf]) and gather all callees, which are bpf helpers. The steps are like: 1. Get all bpf progs: ``` # cat /proc/kallsyms | grep '\[bpf\]$' [...] ffffffffc0380af8 t bpf_prog_3cdf7f3879992857_tail_ipv4_to_endpoint [bpf] ffffffffc0382514 t bpf_prog_e214e82dc4b46fca_cil_from_container [bpf] ffffffffc0382870 t bpf_prog_773159d28c0ab73a_cil_to_container [bpf] [...] ``` 2. Get all callee addresses from each bpf prog: ``` # gdb -ex 'x/5000i 0xffffffffc0382870' -ex q vmlinux /proc/kcore | grep call [...] 0xffffffffc03829ee: call 0xffffffff9fb2ee50 0xffffffffc0382a47: call 0xffffffff9fb2fd20 0xffffffffc0382ad4: call 0xffffffffa0649120 [...] ``` 3. Convert addresses to symbols ``` # cat /proc/kallsyms | grep ffffffff9fb2ee50 ffffffff9fb2ee50 t htab_percpu_map_lookup_elem ``` Currently only x64 are taken care of. Signed-off-by: gray <gray.liang@isovalent.com>
-
Add --filter-track-bpf-helpers
When --filter-track-bpf-helpers is set, --filter-track-skb-by-stackid is enabled automatically. Using --filter-track-bpf-helpers and --output-caller together can roughly trace bpf tailcalls, such as: ``` 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) tcf_classify sch_handle_ingress.constprop.0 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_skb_event_output bpf_prog_306e2b9160b2fb74_cil_from_container[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_skb_pull_data bpf_prog_a76cce51ceb41c61_tail_handle_ipv4[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) skb_ensure_writable bpf_skb_pull_data 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_skb_load_bytes bpf_prog_a76cce51ceb41c61_tail_handle_ipv4[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_a76cce51ceb41c61_tail_handle_ipv4[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_skb_load_bytes bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_skb_load_bytes bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_map_lookup_elem bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_map_lookup_elem bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) array_map_update_elem bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) trie_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) percpu_array_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_ktime_get_ns bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_map_update_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) htab_lru_map_update_elem bpf_map_update_elem 0xffff97cdbd7138e8 3 <empty>:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) htab_lru_map_update_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 <empty>:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 <empty>:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) htab_percpu_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 <empty>:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_skb_event_output bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 <empty>:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) ip_rcv __netif_receive_skb_one_core ``` Signed-off-by: gray <gray.liang@isovalent.com>
-
Abort if runtime.GOARCH is not amd64
Signed-off-by: gray <gray.liang@isovalent.com>
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.