Add --filter-track-bpf-helpers

go.mod

@@ -12,6 +12,7 @@ require (
  github.com/spf13/pflag v1.0.5
  github.com/tklauser/ps v0.0.3
  github.com/vishvananda/netns v0.0.4
+ golang.org/x/arch v0.8.0
  golang.org/x/net v0.28.0
  golang.org/x/sync v0.8.0
  golang.org/x/sys v0.24.0

go.sum

@@ -54,6 +54,8 @@ github.com/tklauser/ps v0.0.3 h1:mn9T6eaAb0VoWkjFGMhs1LDLiIxIArvDepEQo0CU+zU=
 github.com/tklauser/ps v0.0.3/go.mod h1:Dbtzb3oSPyYLGMPrz2a5mW+CfzEP6aYugfyfvtw5zdU=
 github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
 github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
+golang.org/x/arch v0.8.0 h1:3wRIsP3pM4yUptoR96otTUOXI367OS0+c9eeRi9doIc=
+golang.org/x/arch v0.8.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
 golang.org/x/exp v0.0.0-20240213143201-ec583247a57a h1:HinSgX1tJRX3KsL//Gxynpw5CTOAIPhgL4W8PNiIpVE=
 golang.org/x/exp v0.0.0-20240213143201-ec583247a57a/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
 golang.org/x/net v0.0.0-20210917221730-978cfadd31cf/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=

internal/asm/x86/x86.go

@@ -0,0 +1,70 @@
+package x86
+
+import (
+ "debug/elf"
+ "fmt"
+ "log"
+ "os"
+
+ "golang.org/x/arch/x86/x86asm"
+)
+
+var (
+ kcore *os.File
+ kcoreElf *elf.File
+)
+
+func init() {
+ var err error
+ if kcore, err = os.Open("/proc/kcore"); err != nil {
+ log.Fatalf("failed to open /proc/kcore: %s", err)
+ }
+ if kcoreElf, err = elf.NewFile(kcore); err != nil {
+ log.Fatalf("failed to new kcore elf: %s", err)
+ }
+
+}
+
+func GetCallees(addr uint64, leng int) (callees []uint64, err error) {
+ if leng == 0 {
+ leng = 100000
+ }
+ for _, prog := range kcoreElf.Progs {
+ if prog.Vaddr <= addr && prog.Vaddr+prog.Memsz >= addr {
+ bytes := make([]byte, leng)
+ if _, err = kcore.ReadAt(bytes, int64(prog.Off+addr-prog.Vaddr)); err != nil {
+ fmt.Println(err)
+ }
+ if len(bytes) == 0 {
+ continue
+ }
+ off := 0
+ for {
+ inst, err := x86asm.Decode(bytes, 64)
+ if err != nil {
+ inst = x86asm.Inst{Len: 1}
+ off += 1
+ }
+ if inst.Op == x86asm.CALL {
+ for _, arg := range inst.Args {
+ if arg == nil {
+ break
+ }
+ rel, ok := arg.(x86asm.Rel)
+ if !ok {
+ break
+ }
+ callees = append(callees, addr+uint64(off)+uint64(rel)+uint64(inst.Len))
+ }
+ }
+ bytes = bytes[inst.Len:]
+ off += inst.Len
+ if len(bytes) == 0 {
+ break
+ }
+ }
+ }
+ }
+
+ return
+}

internal/pwru/asm.go

@@ -0,0 +1,29 @@
+package pwru
+
+import (
+ "strings"
+
+ "github.com/cilium/pwru/internal/asm/x86"
+)
+
+func GetBpfHelpers(addr2name Addr2Name) (helpers []string, err error) {
+ total := len(addr2name.Addr2NameSlice)
+ for idx, ksym := range addr2name.Addr2NameSlice {
+ if strings.HasSuffix(ksym.name, "[bpf]") {
+ leng := 0
+ if idx < total-1 {
+ leng = int(addr2name.Addr2NameSlice[idx+1].addr - ksym.addr)
+ }
+ callees, err := x86.GetCallees(ksym.addr, leng)
+ if err != nil {
+ return nil, err
+ }
+ for _, calleeAddr := range callees {
+ if name, ok := addr2name.Addr2NameMap[calleeAddr]; ok {
+ helpers = append(helpers, name.name)
+ }
+ }
+ }
+ }
+ return
+}

internal/pwru/kprobe.go

@@ -9,6 +9,7 @@ import (
  "fmt"
  "log"
  "os"
+ "slices"
  "sync"
  "syscall"
 
@@ -245,6 +246,9 @@ func NewKprober(ctx context.Context, funcs Funcs, coll *ebpf.Collection, a2n Add
 }
 
 func NewNonSkbFuncsKprober(nonSkbFuncs []string, funcs Funcs, coll *ebpf.Collection) *kprober {
+ slices.Sort(nonSkbFuncs)
+ nonSkbFuncs = slices.Compact(nonSkbFuncs)
+
  var k kprober
  k.kprobeBatch = uint(len(nonSkbFuncs))
 
@@ -255,10 +259,13 @@ func NewNonSkbFuncsKprober(nonSkbFuncs []string, funcs Funcs, coll *ebpf.Collect
 
  kp, err := link.Kprobe(fn, coll.Programs["kprobe_skb_by_stackid"], nil)
  if err != nil {
- log.Fatalf("Opening kprobe %s: %s\n", fn, err)
+ if errors.Is(err, os.ErrNotExist) {
+ continue
+ }
+ log.Printf("Opening non-skb-kprobe %s: %s\n", fn, err)
+ } else {
+ k.links = append(k.links, kp)
  }
-
- k.links = append(k.links, kp)
  }
 
  return &k

internal/pwru/ksym.go

@@ -90,18 +90,5 @@ func ParseKallsyms(funcs Funcs, all bool) (Addr2Name, BpfProgName2Addr, error) {
 }
 
 func extractBpfProgName(name string) (string, bool) {
- if !strings.HasPrefix(name, "bpf_prog_") || !strings.HasSuffix(name, "[bpf]") {
- return name, false
- }
-
- // The symbol of bpf prog is "bpf_prog_<tag>_<name>\t[bpf]". We want
- // to get the tag and the name.
-
- items := strings.Split(name, "_")
- if len(items) > 3 {
- name = strings.Join(items[3:], "_")
- name = strings.TrimSpace(name[:len(name)-5])
- }
-
- return name, true
+ return strings.ReplaceAll(name, "\t", ""), strings.HasSuffix(name, "[bpf]")
 }

internal/pwru/types.go

@@ -7,7 +7,6 @@ package pwru
 import (
  "fmt"
  "os"
- "slices"
  "strings"
 
  flag "github.com/spf13/pflag"
@@ -34,6 +33,7 @@ type Flags struct {
  FilterTrackSkbByStackid bool
  FilterTraceTc bool
  FilterTraceXdp bool
+ FilterTrackBpfHelpers bool
  FilterIfname string
  FilterPcap string
  FilterKprobeBatch uint
@@ -71,6 +71,7 @@ func (f *Flags) SetFlags() {
  flag.BoolVar(&f.FilterTrackSkbByStackid, "filter-track-skb-by-stackid", false, "trace a packet even after it is kfreed (e.g., traffic going through bridge)")
  flag.BoolVar(&f.FilterTraceTc, "filter-trace-tc", false, "trace TC bpf progs")
  flag.BoolVar(&f.FilterTraceXdp, "filter-trace-xdp", false, "trace XDP bpf progs")
+ flag.BoolVar(&f.FilterTrackBpfHelpers, "filter-track-bpf-helpers", false, "trace BPF helper functions")
  flag.StringVar(&f.FilterIfname, "filter-ifname", "", "filter skb ifname in --filter-netns (if not specified, use current netns)")
  flag.UintVar(&f.FilterKprobeBatch, "filter-kprobe-batch", 10, "batch size for kprobe attaching/detaching")
  flag.StringVar(&f.OutputTS, "timestamp", "none", "print timestamp per skb (\"current\", \"relative\", \"absolute\", \"none\")")
@@ -107,10 +108,8 @@ func (f *Flags) PrintHelp() {
 func (f *Flags) Parse() {
  flag.Parse()
  f.FilterPcap = strings.Join(flag.Args(), " ")
- if len(f.FilterNonSkbFuncs) > 0 {
+ if len(f.FilterNonSkbFuncs) > 0 || f.FilterTrackBpfHelpers {
  f.FilterTrackSkbByStackid = true
- slices.Sort(f.FilterNonSkbFuncs)
- f.FilterNonSkbFuncs = slices.Compact(f.FilterNonSkbFuncs)
  }
 }
 

main.go

@@ -11,6 +11,7 @@ import (
  "log"
  "os"
  "os/signal"
+ "runtime"
  "syscall"
  "time"
 
@@ -36,6 +37,11 @@ func main() {
  fmt.Printf("pwru %s\n", pwru.Version)
  os.Exit(0)
  }
+ if flags.FilterTrackBpfHelpers {
+ if runtime.GOARCH != "amd64" {
+ log.Fatalf("BPF helpers tracking is only supported on amd64")
+ }
+ }
 
  if err := unix.Setrlimit(unix.RLIMIT_NOFILE, &unix.Rlimit{
  Cur: 8192,
@@ -99,7 +105,7 @@ func main() {
  // prog's name.
  addr2name, name2addr, err := pwru.ParseKallsyms(funcs, flags.OutputStack ||
  len(flags.KMods) != 0 || flags.FilterTraceTc || flags.FilterTraceXdp ||
- len(flags.FilterNonSkbFuncs) > 0 || flags.OutputCaller)
+ len(flags.FilterNonSkbFuncs) > 0 || flags.OutputCaller || flags.FilterTrackBpfHelpers)
  if err != nil {
  log.Fatalf("Failed to get function addrs: %s", err)
  }
@@ -235,6 +241,14 @@ func main() {
  defer t.Detach()
  }
 
+ if flags.FilterTrackBpfHelpers {
+ bpfHelpers, err := pwru.GetBpfHelpers(addr2name)
+ if err != nil {
+ log.Fatalf("Failed to get bpf helpers: %s\n", err)
+ }
+ flags.FilterNonSkbFuncs = append(flags.FilterNonSkbFuncs, bpfHelpers...)
+ }
+
  if nonSkbFuncs := flags.FilterNonSkbFuncs; len(nonSkbFuncs) != 0 {
  k := pwru.NewNonSkbFuncsKprober(nonSkbFuncs, funcs, coll)
  defer k.DetachKprobes()