new(driver/modern_bpf,userspace/libpman): support multiple programs for each event #2255

FedeDP · 2025-01-23T09:17:53Z

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area driver-modern-bpf
/area libpman

Does this PR require a change in the driver versions?

What this PR does / why we need it:

Allow to specify multiple program names for each event type and try to inject each of them until success.
This allows us to inject bpf_loop sendmmsg and recvmmsg programs where supported, and fallback at a program just sending first message where it isn't.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

This superseedes #2233

Does this PR introduce a user-facing change?:

new(driver/modern_bpf,userspace/libpman): support multiple programs for each event

github-actions · 2025-01-23T09:27:03Z

Perf diff from master - unit tests

    11.88%     +0.85%  [.] sinsp::next
    10.35%     -0.52%  [.] sinsp_parser::reset
     3.20%     +0.46%  [.] sinsp_evt::load_params
     1.90%     -0.41%  [.] scap_event_decode_params
     1.62%     +0.39%  [.] std::_Hashtable<long, std::pair<long const, std::shared_ptr<sinsp_threadinfo> >, std::allocator<std::pair<long const, std::shared_ptr<sinsp_threadinfo> > >, std::__detail::_Select1st, std::equal_to<long>, std::hash<long>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_find_before_node
     1.60%     -0.32%  [.] libsinsp::sinsp_suppress::process_event
     2.45%     -0.30%  [.] is_conversion_needed
     5.66%     +0.26%  [.] next_event_from_file
     2.53%     +0.25%  [.] sinsp_thread_manager::find_thread
     1.66%     +0.23%  [.] sinsp_evt_filter::sinsp_evt_filter

Heap diff from master - unit tests

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            +0.0181         +0.0181           147           149           147           149
BM_sinsp_split_median                                          +0.0220         +0.0220           146           150           146           150
BM_sinsp_split_stddev                                          -0.0582         -0.0586             1             1             1             1
BM_sinsp_split_cv                                              -0.0749         -0.0753             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.0821         -0.0821            61            56            61            56
BM_sinsp_concatenate_paths_relative_path_median                -0.0836         -0.0836            61            56            61            56
BM_sinsp_concatenate_paths_relative_path_stddev                -0.6035         -0.6031             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_cv                    -0.5681         -0.5677             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     +0.0013         +0.0013            24            24            24            24
BM_sinsp_concatenate_paths_empty_path_median                   +0.0013         +0.0013            24            24            24            24
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.4496         -0.4485             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       -0.4503         -0.4492             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  -0.1678         -0.1678            67            56            67            56
BM_sinsp_concatenate_paths_absolute_path_median                -0.1715         -0.1715            67            55            67            55
BM_sinsp_concatenate_paths_absolute_path_stddev                +0.4800         +0.4792             0             1             0             1
BM_sinsp_concatenate_paths_absolute_path_cv                    +0.7785         +0.7774             0             0             0             0
BM_sinsp_split_container_image_mean                            +0.0002         +0.0002           391           391           391           391
BM_sinsp_split_container_image_median                          +0.0006         +0.0007           391           392           391           392
BM_sinsp_split_container_image_stddev                          -0.2278         -0.2283             3             2             3             2
BM_sinsp_split_container_image_cv                              -0.2279         -0.2284             0             0             0             0

codecov · 2025-01-23T09:30:44Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 75.29%. Comparing base (6c46ed3) to head (3e0e122).
Report is 58 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2255      +/-   ##
==========================================
+ Coverage   75.16%   75.29%   +0.12%     
==========================================
  Files         278      279       +1     
  Lines       34478    34389      -89     
  Branches     5922     5878      -44     
==========================================
- Hits        25916    25893      -23     
+ Misses       8562     8496      -66

Flag	Coverage Δ
libsinsp	`75.29% <ø> (+0.12%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2025-01-23T09:59:58Z

X64 kernel testing matrix

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-4.19	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2-5.10	🟢	🟢	🟢	🟢	🟢	❌
amazonlinux2-5.15	🟢	🟢	🟢	🟢	🟢	❌
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	❌
amazonlinux2023-6.1	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.0	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.7	🟢	🟢	🟢	🟢	🟢	🟢
centos-3.10	🟢	🟢	🟢	🟡	🟡	🟡
centos-4.18	🟢	🟢	🟢	🟢	🟢	❌
centos-5.14	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.17	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.8	🟢	🟢	🟢	🟢	🟢	❌
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-3.10	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-4.14	🟢	🟢	🟢	🟢	🟢	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	❌
oraclelinux-5.4	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-4.15	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-5.8	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

ARM64 kernel testing matrix

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	❌
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-4.14	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	❌
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

github-actions · 2025-01-23T14:10:41Z

Please double check driver/API_VERSION file. See versioning.

/hold

…or each event. Try to inject each of them until success. This allows us to inject `bpf_loop` sendmmsg and recvmmsg programs where supported, and fallback at just sending first message where it isn't. Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP · 2025-01-24T13:47:49Z

Removed wip since the impl is complete.
Kernel-testing matrix is now fully green. Only issue remaining are:

s390x is not seeing BPF_FUNC_loop symbol in events_prog_names.c
amd64 runner is correctly picking up sendmmsg_x and recvmmsg_x (with bpf_loop) but then it fails with:

libbpf: prog 'sendmmsg_x': BPF program load failed: Permission denied
libbpf: prog 'sendmmsg_x': -- BEGIN PROG LOAD LOG --
combined stack size of 2 calls is 576. Too large

This seems like a bug in the verifier since i cannot repro it locally, neither in arm64 CI, neither in kernel testing matrix.
Arm64 runner uses kernel 6.8.0-1020-azure while amd64 uses 6.5.0-1025-azure. Will try to investigate further.

FedeDP · 2025-01-24T15:30:22Z

In the last commit i tried to split sendmmsg and recvmmsg programs in case of ret < 0 by chaining a tail call in that case.
Still no luck. I also tried to drop the __always_inline from the handle_exit function and it failed with the same error: https://github.com/falcosecurity/libs/actions/runs/12950456593/job/36123287152

Note also that the exact same code for the 2 bpf programs wasn't failing some weeks ago (ie: at this commit: 67975da).

FedeDP · 2025-01-24T15:53:57Z

/milestone next-driver

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP · 2025-01-31T14:36:42Z

Which libbpf version are you using?

Apteryks · 2025-02-01T16:22:47Z

These are the dependencies I tested with:

[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
+ [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] re2@2022-12-01 [email protected]
+ [email protected] [email protected] [email protected]

FedeDP · 2025-02-03T07:55:09Z

That's weird, you are using correct versions; it seems like the build is using an older libbpf version though since its headers do not contain BPF_FUNC_loop symbol.
The same happened in the s390x CI: d4e2e2a

…back. Signed-off-by: Federico Di Pierro <[email protected]>

Signed-off-by: Federico Di Pierro <[email protected]>

…_dynamic_snaplen at each bpf_loop iteration for sendmmsg and recvmmsg. This also fixes a verifier issue on clang 14, related to stack length. Signed-off-by: Federico Di Pierro <[email protected]>

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP · 2025-02-03T15:47:40Z

.github/workflows/driverkit.yml

@@ -55,7 +55,7 @@ jobs:
            kernelrelease: 6.4.1-1.el9.elrepo.aarch64
            target: centos
            kernelurls: https://download.falco.org/fixtures/libs/kernel-ml-devel-6.4.1-1.el9.elrepo.aarch64.rpm
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm


Improvement: run driverkit arm64 CI on arm64 gh runners.

FedeDP · 2025-02-03T15:48:01Z

.github/workflows/drivers_ci.yml

@@ -220,8 +220,9 @@ jobs:
            cd src && make install
            cd ../../
            git clone https://github.com/libbpf/libbpf.git --branch v1.3.0 --single-branch
-            cd libbpf/src && BUILD_STATIC_ONLY=y DESTDIR=/ make install
+            cd libbpf/src && BUILD_STATIC_ONLY=y DESTDIR=/ make install install_uapi_headers 


Fix: s390x was using system libbpf headers, not the one built by us in the CI.

FedeDP · 2025-02-03T15:48:17Z

driver/modern_bpf/helpers/store/auxmap_store_params.h

@@ -676,6 +676,7 @@ static __always_inline void auxmap__store_socktuple_param(struct auxiliary_map *
 	switch(socket_family) {
 	case AF_INET: {
 		struct inet_sock *inet = (struct inet_sock *)sk;
+		struct sockaddr_in usrsockaddr_in = {};


Multiple similar fixes: do not keep a reference to an out-of-scope variable.

maybe i'm missing something but why is this a fix? it seems to be used only inside the below if to read some data from the kernel

Yep i totally mislooked that; will revert the change to minimize the diff. Same goes for inet6 below :/

FedeDP · 2025-02-03T15:48:43Z

driver/modern_bpf/helpers/store/auxmap_store_params.h

@@ -1556,6 +1558,13 @@ static __always_inline void apply_dynamic_snaplen(struct pt_regs *regs,
 	 */
 	unsigned long args[5] = {0};
 	struct sockaddr *sockaddr = NULL;
+	typedef union {


Multiple similar improvements: don't waste lots of stack space while we just need one of these.

FedeDP · 2025-02-03T15:50:11Z

driver/modern_bpf/helpers/store/auxmap_store_params.h

+		// in dynamic_snaplen_args.
+		// This also gives a small perf boost while using `bpf_loop` because we don't need
+		// to re-fetch first 3 syscall args at every iteration.
+		__builtin_memcpy(args, input_args->mm_args, 3 * sizeof(unsigned long));


sendmmsg/recvmmsg improvement: since we are going to call apply_dynamic_snaplen for each bpf_loop iteration, just call extract__network_args once (in the sendmmsg/recvmmsg main program) and then reference it.
This also fixes a verifier issue on clang-14 about stack size too large.

FedeDP · 2025-02-03T16:25:17Z

/cc @Molter73 @Andreagit97

Molter73

Hey @FedeDP! PR is looking really good! Just have a couple minor comments and questions.

driver/modern_bpf/helpers/store/auxmap_store_params.h

userspace/libpman/src/lifecycle.c

Use anonymous unions in modern bpf driver. Moreover, add some debug prints to `pman_prepare_progs_before_loading`, and always disable all unused programs autoload. Signed-off-by: Federico Di Pierro <[email protected]> Co-authored-by: Mauro Ezequiel Moltrasio <[email protected]>

FedeDP · 2025-02-05T08:24:32Z

Ehy @Molter73 should've addressed everything! Let me know :) Thanks for the in-depth review btw!

Molter73

There's just one more tiny comment, but it is more of a readability thing, everything else looks good.

/lgtm

Molter73 · 2025-02-05T11:38:57Z

userspace/libpman/src/lifecycle.c

+					         progs[idx].name,
+					         progs[idx].feat);
+					pman_print_msg(FALCOSECURITY_LOG_SEV_DEBUG, (const char *)msg);
+					chosen_idx = idx;


Could we just break out of the inner loop here and use idx directly in the next block? It would also mean we don't need should_disable because the final block in the loop will only be reached from the other branch of this if-else block.

Mmmh if we break somewhere, we would lose the ability to disable all unused programs, right?

Andreagit97

Great job, thanks!

Andreagit97 · 2025-02-05T21:17:27Z

driver/modern_bpf/helpers/store/auxmap_store_params.h

@@ -676,6 +676,7 @@ static __always_inline void auxmap__store_socktuple_param(struct auxiliary_map *
 	switch(socket_family) {
 	case AF_INET: {
 		struct inet_sock *inet = (struct inet_sock *)sk;
+		struct sockaddr_in usrsockaddr_in = {};


maybe i'm missing something but why is this a fix? it seems to be used only inside the below if to read some data from the kernel

userspace/libpman/src/lifecycle.c

…PE_TRACING` in `pman_prepare_progs_before_loading`. Signed-off-by: Federico Di Pierro <[email protected]> Co-authored-by: Andrea Terzolo <[email protected]>

FedeDP · 2025-02-06T07:48:42Z

@Andreagit97 done! Thanks for the review!

Andreagit97

/approve

poiana · 2025-02-06T08:12:09Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, Molter73

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Andreagit97,FedeDP,Molter73]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

poiana added release-note kind/feature New feature or request dco-signoff: yes area/driver-modern-bpf area/libpman approved labels Jan 23, 2025

poiana requested review from hbrueckner and mstemm January 23, 2025 09:17

poiana added the size/XXL label Jan 23, 2025

FedeDP changed the title ~~new(driver/modern_bpf,userspace/libpman): support multiple programs for each event~~ wip: new(driver/modern_bpf,userspace/libpman): support multiple programs for each event Jan 23, 2025

poiana added the do-not-merge/work-in-progress label Jan 23, 2025

FedeDP force-pushed the new/support_recvmmsg_sendmmsg_bpf_loop branch from 6096d33 to 92df24d Compare January 23, 2025 14:10

poiana added the do-not-merge/hold label Jan 23, 2025

FedeDP force-pushed the new/support_recvmmsg_sendmmsg_bpf_loop branch from 3bbfcfd to aa354b6 Compare January 24, 2025 10:46

FedeDP force-pushed the new/support_recvmmsg_sendmmsg_bpf_loop branch from aa354b6 to 24581f6 Compare January 24, 2025 10:54

FedeDP mentioned this pull request Jan 24, 2025

wip: new(driver/modern_bpf): home-made bpf_loop for sendmmsg and recvmmsg. #2233

Closed

FedeDP changed the title ~~wip: new(driver/modern_bpf,userspace/libpman): support multiple programs for each event~~ new(driver/modern_bpf,userspace/libpman): support multiple programs for each event Jan 24, 2025

poiana removed the do-not-merge/work-in-progress label Jan 24, 2025

FedeDP force-pushed the new/support_recvmmsg_sendmmsg_bpf_loop branch from 0323c41 to 24581f6 Compare January 24, 2025 15:47

poiana added this to the next-driver milestone Jan 24, 2025

FedeDP force-pushed the new/support_recvmmsg_sendmmsg_bpf_loop branch from b000c6f to d930932 Compare January 30, 2025 13:48

chore(ci): fix s390x drivers ci by symlimking libbpf headers.

d4e2e2a

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP added 3 commits February 3, 2025 11:02

chore(driver/modern_ebpf): avoid passing unused data to bpf_loop call…

57280e1

…back. Signed-off-by: Federico Di Pierro <[email protected]>

fix(driver/modern_bpf): avoid referencing out of scope variables.

7edb2f5

Signed-off-by: Federico Di Pierro <[email protected]>

fix(driver/modern_bpf): avoid calling extract_network_args in apply…

3ab30fc

…_dynamic_snaplen at each bpf_loop iteration for sendmmsg and recvmmsg. This also fixes a verifier issue on clang 14, related to stack length. Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP force-pushed the new/support_recvmmsg_sendmmsg_bpf_loop branch from e83a441 to 3ab30fc Compare February 3, 2025 14:11

chore(ci): run arm64 driverkit workflow on arm64 runner.

acbd21c

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP force-pushed the new/support_recvmmsg_sendmmsg_bpf_loop branch from cdd8980 to acbd21c Compare February 3, 2025 15:27

FedeDP commented Feb 3, 2025

View reviewed changes

poiana requested review from Andreagit97 and Molter73 February 3, 2025 16:25

Molter73 reviewed Feb 4, 2025

View reviewed changes

Molter73 previously approved these changes Feb 5, 2025

View reviewed changes

poiana assigned Molter73 Feb 5, 2025

poiana added the lgtm label Feb 5, 2025

Andreagit97 reviewed Feb 5, 2025

View reviewed changes

chore(driver/modern_bpf,userspace/libpman): properly use `BPF_PROG_TY…

3e0e122

…PE_TRACING` in `pman_prepare_progs_before_loading`. Signed-off-by: Federico Di Pierro <[email protected]> Co-authored-by: Andrea Terzolo <[email protected]>

FedeDP dismissed Molter73’s stale review via 3e0e122 February 6, 2025 07:47

Andreagit97 approved these changes Feb 6, 2025

View reviewed changes

poiana assigned Andreagit97 Feb 6, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

new(driver/modern_bpf,userspace/libpman): support multiple programs for each event #2255

new(driver/modern_bpf,userspace/libpman): support multiple programs for each event #2255

FedeDP commented Jan 23, 2025 •

edited

Loading

github-actions bot commented Jan 23, 2025 •

edited

Loading

codecov bot commented Jan 23, 2025 •

edited

Loading

github-actions bot commented Jan 23, 2025 •

edited

Loading

github-actions bot commented Jan 23, 2025

FedeDP commented Jan 24, 2025

FedeDP commented Jan 24, 2025

FedeDP commented Jan 24, 2025

FedeDP commented Jan 31, 2025

Apteryks commented Feb 1, 2025

FedeDP commented Feb 3, 2025

FedeDP Feb 3, 2025

FedeDP Feb 3, 2025

FedeDP Feb 3, 2025

Andreagit97 Feb 5, 2025

FedeDP Feb 6, 2025

FedeDP Feb 3, 2025

FedeDP Feb 3, 2025

FedeDP commented Feb 3, 2025

Molter73 left a comment

FedeDP commented Feb 5, 2025

Molter73 left a comment

Molter73 Feb 5, 2025

FedeDP Feb 6, 2025

Andreagit97 left a comment

Andreagit97 Feb 5, 2025

FedeDP commented Feb 6, 2025 •

edited

Loading

Andreagit97 left a comment

poiana commented Feb 6, 2025

new(driver/modern_bpf,userspace/libpman): support multiple programs for each event #2255

Are you sure you want to change the base?

new(driver/modern_bpf,userspace/libpman): support multiple programs for each event #2255

Conversation

FedeDP commented Jan 23, 2025 • edited Loading

github-actions bot commented Jan 23, 2025 • edited Loading

Perf diff from master - unit tests

Heap diff from master - unit tests

Heap diff from master - scap file

Benchmarks diff from master

codecov bot commented Jan 23, 2025 • edited Loading

Codecov Report

github-actions bot commented Jan 23, 2025 • edited Loading

X64 kernel testing matrix

ARM64 kernel testing matrix

github-actions bot commented Jan 23, 2025

FedeDP commented Jan 24, 2025

FedeDP commented Jan 24, 2025

FedeDP commented Jan 24, 2025

FedeDP commented Jan 31, 2025

Apteryks commented Feb 1, 2025

FedeDP commented Feb 3, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FedeDP commented Feb 3, 2025

Molter73 left a comment

Choose a reason for hiding this comment

FedeDP commented Feb 5, 2025

Molter73 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Andreagit97 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FedeDP commented Feb 6, 2025 • edited Loading

Andreagit97 left a comment

Choose a reason for hiding this comment

poiana commented Feb 6, 2025

FedeDP commented Jan 23, 2025 •

edited

Loading

github-actions bot commented Jan 23, 2025 •

edited

Loading

codecov bot commented Jan 23, 2025 •

edited

Loading

github-actions bot commented Jan 23, 2025 •

edited

Loading

FedeDP commented Feb 6, 2025 •

edited

Loading