Load cgroup_{device,sysctl}, flow_dissector, lirc_mode2, sk_msg,
sock_ops programs with their fixed expected attach types instead of
omitting them.
These program types already use the same constants when attaching.
Pass the kernel attach type into the shared loader from each typed
wrapper instead of storing a second mutable copy in `ProgramData`.
This removes the from_pin repair pattern, avoids stale shadow state, and
keeps attach paths driven by wrapper-owned typed attach metadata or
fixed constants.
Also simplify `{sk,cgroup}_skb` section parsing by representing all
variants as `ProgramSection::SkSkb { kind }` and
`ProgramSection::CgroupSkb { attach_type }` respectively, with the
attach type enums shared from aya-obj.
Add documentation and integration test for SchedClassifier link pinning,
which enables zero-downtime program updates in production environments.
- Add link pinning example to SchedClassifier::attach_with_options()
showing atomic replacement workflow for TCX mode (kernel >= 6.6).
- Add pin_tcx_link() integration test verifying link persistence
across program unload and atomic replacement capability.
There are various oddities in how the kernel prints path including
"(deleted)" suffix, bracketed properties e.g. "[vdso]", ashmem and memfd
paths, and possibly others. Rather than try to handle these in
`ProcMapEntry::parse` just leave them as they appear and let the caller
deal with them.
Change splitting behavior to any number of consecutive whitespace
characters between columns to account for padding.
This allows uprobe attachment to succeed in the presence of deleted
mapped files and in more cases of android special attributes.
Rewrite tests using `test_case`.
Co-authored-by: Tamir Duberstein <tamird@gmail.com>
Signed-off-by: cyril <multya77@gmail.com>
This follows the #1417 review discussion: by bundling location
+ cookie into a UProbeAttachPoint we get a more idiomatic Into<_>
entry point, keep the one-to-one relationship enforced by the type
system, and make it easier to extend attach with multi-location
support without introducing parallel arrays or a brand new API.
Implement `PerfEventConfig::Breakpoint`, allowing users to attach
hardware breakpoints. Generate `HW_BREAKPOINT_*` and `struct
bpf_perf_event_data` in support of this feature and update the type of
`PerfEventContext` accordingly.
Add a test exercising R, W, RW, and X breakpoints. Note that R
breakpoints are unsupported on x86, and this is asserted in the test.
Extend the VM integration test harness and supporting infrastructure
(e.g. `download_kernel_images.sh`) to download kernel debug packages and
mount `System.map` in initramfs. This is needed (at least) on the aarch
6.1 Debian kernel which was not compiled with `CONFIG_KALLSYMS_ALL=y`
for some reason, and the locations of globals are not available in
kallsyms. To attach breakpoints to these symbols in the test pipeline,
we need to read them from System.map and apply the KASLR offset to get
their real address. The `System.map` file is not provided in the kernel
package by default, so we need to extract it from the corresponding
debug package. The KASLR offset is computed using `gunzip` which appears
in kallsyms on all Debian kernels tested.
Co-authored-by: Tamir Duberstein <tamird@gmail.com>
This makes it more difficult to mishandle callers of `perf_event_open`.
Change `wakeup_events = 0` to 1; per `man 2 perf_event_open`:
Prior to Linux 3.0, setting wakeup_events to 0 resulted in
no overflow notifications; more recent kernels treat 0 the
same as 1.
Proc maps terminate with a newline so split(b'\n') yields an empty
slice at the end. Filter it out before parsing so the absolute-path
fallback for pid-scoped attach doesn't get short-circuited by a
ProcMap::ParseLine error.
Add guardrails for when setting event type and config for perf_event
programs. The `PerfEventConfig` enum now defines the event `type` and
`config` of interest.
Remove public re-exports, and add idiomatic Rust types for:
- perf_hw_id => HardwareEvent
- perf_sw_ids => SoftwareEvent
- perf_hw_cache_id => HwCacheEvent
- perf_hw_cache_op_id => HwCacheOp
- perf_hw_cache_op_result_id => HwCacheResult
The motivation behind this is mainly for the `type` and `config` fields
of `bpf_link_info.perf_event.event`. The newly added enums are planned
to also be used in the `bpf_link_info` metadata.
Although `Breakpoint`/`PERF_TYPE_BREAKPOINT` variant exists, it is not
fully implemented. It's only usage at the moment is in link info.
`construct_debuglink_path()` returns a `Result`, but it doesn't actually
do anything that can fail. This means callers must do a useless
`unwrap()` to get at the return value.
This fixes the signature to reflect that the function is infallible.
Implements TryFrom for FdLink for CgroupSkb, CgroupSock, CgroupSockAddr
and SockOps program types. This allows support for link pinning for
these program types, aligning with the documentation for FdLink.
Fixes: #739
Co-authored-by: Benjamin Barzen <bbarzen@amazon.com>
Short-circuits `CACHE` to true if the field is non-zero.
This saves from executing the probing logic since the logic essentially
checks if the field can process (or doesn't error) non-zero value.
Cached probed for ProgramInfo fields instead of exposing it through
global FEATURE. Probing occurs on cache miss, which happens when first
accessing the field, *and* if the field is 0.
We have had loaded_links in the API as `#[doc(hidden)]` for a while.
I've been using it in bpfman and it's been fine. This commit does the
minimal work required to make the API stable.
We expose a `LinkInfo` type - similar to `ProgInfo` - which wraps the
generated type. In this case, `bpf_link_info`.
A few accessor functions have been added for `id`, `link_type` and
`program_id`. There are many more fields that could be (eventually)
made public.
As a convenience, `LinkInfo` can be retrieved from an existing FdLink
by using `FdLink::info()`.
Signed-off-by: Dave Tucker <dave@dtucker.co.uk>
Allow for a ProgramInfo to be converted into one of the program types
that we support. This allows for a user of Aya access to reattach,
pin or unload a program that was either, previously loaded, or was
loaded by another process.
Signed-off-by: Dave Tucker <dave@dtucker.co.uk>
Tamir Duberstein
Alessandro Decina
Sven Cowart
cyril
swananan
Friday Ortiz
Tyrone Wu
Altug Bozkurt
Thomas Bertschinger
Mehnaz Yunus
Dave Tucker
Omri Steiner