Skip to content

Commit 6e4ab09

Browse files
olsajiriolsajiri
committed
tetragon: Add support to use tracing program for single kprobe
Signed-off-by: Jiri Olsa <[email protected]>
1 parent 7d0fdde commit 6e4ab09

File tree

4 files changed

+109
-26
lines changed

4 files changed

+109
-26
lines changed

‎pkg/config/config_linux.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,19 @@ func GenericKprobeObjs(multi bool) (string, string) {
7474
return "bpf_generic_kprobe.o", "bpf_generic_retkprobe.o"
7575
}
7676

77+
func GenericTracingObjs() (string, string) {
78+
if EnableV612Progs() {
79+
return "bpf_generic_fentry_v612.o", "bpf_generic_fexit_v612.o"
80+
} else if EnableV61Progs() {
81+
return "bpf_generic_fentry_v61.o", "bpf_generic_fexit_v61.o"
82+
} else if kernels.MinKernelVersion("5.11") {
83+
return "bpf_generic_fentry_v511.o", "bpf_generic_fexit_v511.o"
84+
} else if EnableLargeProgs() {
85+
return "bpf_generic_fentry_v53.o", "bpf_generic_fexit_v53.o"
86+
}
87+
return "bpf_generic_fentry.o", "bpf_generic_fexit.o"
88+
}
89+
7790
func GenericUprobeObjs(multi bool) string {
7891
if multi {
7992
if EnableV612Progs() {

‎pkg/sensors/program/loader_linux.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -378,6 +378,19 @@ func MultiUprobeAttach(load *Program, bpfDir string) AttachFunc {
378378
}
379379
}
380380

381+
func TracingOpen(load *Program) OpenFunc {
382+
return func(coll *ebpf.CollectionSpec) error {
383+
data, ok := load.AttachData.(*TracingAttachData)
384+
if !ok {
385+
return nil
386+
}
387+
for _, spec := range coll.Programs {
388+
spec.AttachTo = data.AttachTo
389+
}
390+
return nil
391+
}
392+
}
393+
381394
func TracingAttach(load *Program, bpfDir string) AttachFunc {
382395
return func(_ *ebpf.Collection, _ *ebpf.CollectionSpec,
383396
prog *ebpf.Program, spec *ebpf.ProgramSpec) (unloader.Unloader, error) {
@@ -632,6 +645,7 @@ func LoadFmodRetProgram(bpfDir string, load *Program, maps []*Map, progName stri
632645
func LoadTracingProgram(bpfDir string, load *Program, maps []*Map, verbose int) error {
633646
opts := &LoadOpts{
634647
Attach: TracingAttach(load, bpfDir),
648+
Open: TracingOpen(load),
635649
Maps: maps,
636650
}
637651
return loadProgram(bpfDir, load, opts, verbose)

‎pkg/sensors/program/program.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,10 @@ type MapLoad struct {
7373
Load func(m *ebpf.Map, pinPathPrefix string) error
7474
}
7575

76+
type TracingAttachData struct {
77+
AttachTo string
78+
}
79+
7680
type MultiKprobeAttachData struct {
7781
Symbols []string
7882
Cookies []uint64

‎pkg/sensors/tracing/generickprobe.go‎

Lines changed: 78 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -939,21 +939,48 @@ func createKprobeSensorFromEntry(polInfo *policyInfo, kprobeEntry *genericKprobe
939939

940940
loadProgName, loadProgRetName := config.GenericKprobeObjs(false)
941941
isSecurityFunc := strings.HasPrefix(kprobeEntry.funcName, "security_")
942+
useFentry := !kprobeEntry.hasOverride && config.EnableV61Progs()
942943

943944
pinProg := kprobeEntry.funcName
944945
if kprobeEntry.instance != 0 {
945946
pinProg = fmt.Sprintf("%s:%d", kprobeEntry.funcName, kprobeEntry.instance)
946947
}
947948

948-
load := program.Builder(
949-
path.Join(option.Config.HubbleLib, loadProgName),
950-
kprobeEntry.funcName,
951-
"kprobe/generic_kprobe",
952-
pinProg,
953-
"generic_kprobe").
954-
SetLoaderData(kprobeEntry.tableId).
955-
SetPolicy(kprobeEntry.policyName)
949+
var load *program.Program
950+
951+
if useFentry {
952+
data := &program.TracingAttachData{
953+
AttachTo: kprobeEntry.funcName,
954+
}
955+
956+
loadProgName, loadProgRetName = config.GenericTracingObjs()
957+
958+
load = program.Builder(
959+
path.Join(option.Config.HubbleLib, loadProgName),
960+
kprobeEntry.funcName,
961+
"fentry/generic_fentry",
962+
pinProg,
963+
"generic_kprobe").
964+
SetAttachData(data)
965+
966+
tailCalls := program.MapBuilderProgram("fentry_calls", load)
967+
maps = append(maps, tailCalls)
968+
} else {
969+
load = program.Builder(
970+
path.Join(option.Config.HubbleLib, loadProgName),
971+
kprobeEntry.funcName,
972+
"kprobe/generic_kprobe",
973+
pinProg,
974+
"generic_kprobe")
975+
976+
tailCalls := program.MapBuilderProgram("kprobe_calls", load)
977+
maps = append(maps, tailCalls)
978+
}
979+
980+
load.SetPolicy(kprobeEntry.policyName)
981+
load.SetLoaderData(kprobeEntry.tableId)
956982
load.Override = kprobeEntry.hasOverride
983+
957984
if load.Override {
958985
load.OverrideFmodRet = isSecurityFunc && bpf.HasModifyReturn()
959986
}
@@ -968,9 +995,6 @@ func createKprobeSensorFromEntry(polInfo *policyInfo, kprobeEntry *genericKprobe
968995
configMap := program.MapBuilderProgram("config_map", load)
969996
maps = append(maps, configMap)
970997

971-
tailCalls := program.MapBuilderProgram("kprobe_calls", load)
972-
maps = append(maps, tailCalls)
973-
974998
filterMap := program.MapBuilderProgram("filter_map", load)
975999
maps = append(maps, filterMap)
9761000

@@ -1041,15 +1065,42 @@ func createKprobeSensorFromEntry(polInfo *policyInfo, kprobeEntry *genericKprobe
10411065
if kprobeEntry.instance != 0 {
10421066
pinRetProg = sensors.PathJoin(fmt.Sprintf("%s_return:%d", kprobeEntry.funcName, kprobeEntry.instance))
10431067
}
1044-
loadret := program.Builder(
1045-
path.Join(option.Config.HubbleLib, loadProgRetName),
1046-
kprobeEntry.funcName,
1047-
"kprobe/generic_retkprobe",
1048-
pinRetProg,
1049-
"generic_kprobe").
1050-
SetRetProbe(true).
1051-
SetLoaderData(kprobeEntry.tableId).
1052-
SetPolicy(kprobeEntry.policyName)
1068+
1069+
var loadret *program.Program
1070+
1071+
if useFentry {
1072+
data := &program.TracingAttachData{
1073+
AttachTo: kprobeEntry.funcName,
1074+
}
1075+
1076+
loadProgName, loadProgRetName = config.GenericTracingObjs()
1077+
1078+
loadret = program.Builder(
1079+
path.Join(option.Config.HubbleLib, loadProgRetName),
1080+
kprobeEntry.funcName,
1081+
"fexit/generic_fexit",
1082+
pinRetProg,
1083+
"generic_kprobe").
1084+
SetAttachData(data)
1085+
1086+
tailCalls := program.MapBuilderProgram("fexit_calls", loadret)
1087+
maps = append(maps, tailCalls)
1088+
} else {
1089+
loadret = program.Builder(
1090+
path.Join(option.Config.HubbleLib, loadProgRetName),
1091+
kprobeEntry.funcName,
1092+
"kprobe/generic_retkprobe",
1093+
pinRetProg,
1094+
"generic_kprobe")
1095+
1096+
tailCalls := program.MapBuilderProgram("retkprobe_calls", loadret)
1097+
maps = append(maps, tailCalls)
1098+
}
1099+
1100+
loadret.SetRetProbe(true)
1101+
loadret.SetLoaderData(kprobeEntry.tableId)
1102+
loadret.SetPolicy(kprobeEntry.policyName)
1103+
10531104
progs = append(progs, loadret)
10541105

10551106
retProbe := program.MapBuilderSensor("retprobe_map", loadret)
@@ -1058,9 +1109,6 @@ func createKprobeSensorFromEntry(polInfo *policyInfo, kprobeEntry *genericKprobe
10581109
retConfigMap := program.MapBuilderProgram("config_map", loadret)
10591110
maps = append(maps, retConfigMap)
10601111

1061-
tailCalls := program.MapBuilderProgram("retkprobe_calls", loadret)
1062-
maps = append(maps, tailCalls)
1063-
10641112
filterMap := program.MapBuilderProgram("filter_map", loadret)
10651113
maps = append(maps, filterMap)
10661114

@@ -1134,10 +1182,14 @@ func loadSingleKprobeSensor(id idtable.EntryID, bpfDir string, load *program.Pro
11341182
}
11351183
load.MapLoad = append(load.MapLoad, config)
11361184

1137-
if err := program.LoadKprobeProgram(bpfDir, load, maps, verbose); err == nil {
1138-
logger.GetLogger().Info(fmt.Sprintf("Loaded generic kprobe program: %s -> %s", load.Name, load.Attach))
1185+
if load.Label == "fentry/generic_fentry" || load.Label == "fexit/generic_fexit" {
1186+
if err = program.LoadTracingProgram(bpfDir, load, maps, verbose); err == nil {
1187+
logger.GetLogger().Info(fmt.Sprintf("Loaded generic fentry program: %s -> %s", load.Name, load.Attach))
1188+
}
11391189
} else {
1140-
return err
1190+
if err = program.LoadKprobeProgram(bpfDir, load, maps, verbose); err == nil {
1191+
logger.GetLogger().Info(fmt.Sprintf("Loaded generic kprobe program: %s -> %s", load.Name, load.Attach))
1192+
}
11411193
}
11421194

11431195
return err

0 commit comments

Comments
 (0)