Add --filter-track-bpf-helpers #390
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
f761547 to
2ae87e9
Compare
|
@jschwinger233 👋 could you rebase? |
2ae87e9 to
b64a3c0
Compare
brb
approved these changes
Aug 30, 2024
This commit adds a new API GetBpfHelpers(), which accepts symbols (from /proc/kallsyms) and returns all bpf helper names used at present. The idea is to scan assembly code of each bpf functions (has suffix [bpf]) and gather all callees, which are bpf helpers. The steps are like: 1. Get all bpf progs: ``` # cat /proc/kallsyms | grep '\[bpf\]$' [...] ffffffffc0380af8 t bpf_prog_3cdf7f3879992857_tail_ipv4_to_endpoint [bpf] ffffffffc0382514 t bpf_prog_e214e82dc4b46fca_cil_from_container [bpf] ffffffffc0382870 t bpf_prog_773159d28c0ab73a_cil_to_container [bpf] [...] ``` 2. Get all callee addresses from each bpf prog: ``` # gdb -ex 'x/5000i 0xffffffffc0382870' -ex q vmlinux /proc/kcore | grep call [...] 0xffffffffc03829ee: call 0xffffffff9fb2ee50 0xffffffffc0382a47: call 0xffffffff9fb2fd20 0xffffffffc0382ad4: call 0xffffffffa0649120 [...] ``` 3. Convert addresses to symbols ``` # cat /proc/kallsyms | grep ffffffff9fb2ee50 ffffffff9fb2ee50 t htab_percpu_map_lookup_elem ``` Currently only x64 are taken care of. Signed-off-by: gray <gray.liang@isovalent.com>
When --filter-track-bpf-helpers is set, --filter-track-skb-by-stackid is enabled automatically. Using --filter-track-bpf-helpers and --output-caller together can roughly trace bpf tailcalls, such as: ``` 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) tcf_classify sch_handle_ingress.constprop.0 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_skb_event_output bpf_prog_306e2b9160b2fb74_cil_from_container[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_skb_pull_data bpf_prog_a76cce51ceb41c61_tail_handle_ipv4[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) skb_ensure_writable bpf_skb_pull_data 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_skb_load_bytes bpf_prog_a76cce51ceb41c61_tail_handle_ipv4[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_a76cce51ceb41c61_tail_handle_ipv4[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_skb_load_bytes bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_skb_load_bytes bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_map_lookup_elem bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_map_lookup_elem bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) array_map_update_elem bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) trie_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) percpu_array_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 ~bin/curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_ktime_get_ns bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_map_update_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 curl:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) htab_lru_map_update_elem bpf_map_update_elem 0xffff97cdbd7138e8 3 <empty>:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) htab_lru_map_update_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 <empty>:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 <empty>:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) htab_percpu_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 <empty>:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_skb_event_output bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf] 0xffff97cdbd7138e8 3 <empty>:227116 10.244.1.141:45000->10.244.3.20:8080(tcp) ip_rcv __netif_receive_skb_one_core ``` Signed-off-by: gray <gray.liang@isovalent.com>
Signed-off-by: gray <gray.liang@isovalent.com>
Signed-off-by: gray <gray.liang@isovalent.com>
b64a3c0 to
6464a4d
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Please see commit messages for implementation details.
Using --filter-track-bpf-helpers and --output-caller together can roughly trace bpf tailcalls, such as: