elastic / quark

https://elastic.github.io/quark/index.html
Other
14 stars 2 forks source link

Implement matching btfhub files with uname, makes centos7 work \o/ #72

Closed haesbaert closed 1 month ago

haesbaert commented 1 month ago

This looks like a big scary diff but it isnt really, it just regenerates the table and docs.

--

The major change is being able to finally work on systems that don't have BPF and don't have BTF, like good'ol centos7.

In quark_btf_open_hub() we try to match what we get from uname(2) with an existing kernel in our pre-compiled btfhub database. The matching is a bit crude, but good enough to work on centos7 and hopefully every other system that falls into the same case.

We have a dumb score system that tries to match the characters from the beginning and the end of uname -r, like:

$ ./quark-btf -l 3.10.0-123.el7.x86_64 3.10.0-1062.4.3.el7.x86_64

This matches the characters 3.10.0-1 from the beginning, it then scores one point for every character matched. Then it does the same from the end of the string, matching 3.el7.x86_64, scoring more one point for every character.

We do this for every kernel in the database and choose the highest scoring one.

--

In order to get it all working nicely some refactoring was needed in quark-btf.c and btf.c:

--

Testing on centos7, my VM has:

[haesbaert@centos7 ~]$ uname -r
3.10.0-123.el7.x86_64

We don't really have that, but it matches something close:

[haesbaert@centos7 ~]$ ./quark-btf -l $(uname -r)
3.10.0-1062.4.3.el7.x86_64

And it works \o/, there is some erroneous printing that has to be cleanup, but not in dis diff:

[haesbaert@centos7 ~]$ sudo ./quark-mon -ks
quark-mon: open: /sys/kernel/tracing: No such file or directory
libbpf: kernel BTF is missing at '/sys/kernel/btf/vmlinux', was
CONFIG_DEBUG_INFO_BTF enabled?
libbpf: failed to find valid kernel BTF
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
quark-mon: open: /sys/kernel/tracing: No such file or directory
->1068 (FORK+EXEC+EXIT+SETPROCTITLE)
  COMM  comm=echo
  CMDL  cmdline=[ /bin/echo, hi, from, centos7 ]
  PROC  ppid=1045
  PROC  uid=1000 gid=1000 suid=1000 sgid=1000 euid=1000 egid=1000 pgid=1068 sid=1045
  PROC  cap_inheritable=0x0 cap_permitted=0x0 cap_effective=0x0
  PROC  cap_bset=0xffffffffffffffff cap_ambient=0x0
  PROC  time_boot=1727420639000617449 tty_major=136 tty_minor=1
  PROC  entry_leader_type=UNKNOWN entry_leader=0
  CWD   cwd=/home/haesbaert
  FILE  filename=/bin/echo
  EXIT  exit_code=0 exit_time=1728038088089740243