inspektor-gadget

1
// Copyright 2023 The Inspektor Gadget authors
2
//
3
// Licensed under the Apache License, Version 2.0 (the "License");
4
// you may not use this file except in compliance with the License.
5
// You may obtain a copy of the License at
6
//
7
//     http://www.apache.org/licenses/LICENSE-2.0
8
//
9
// Unless required by applicable law or agreed to in writing, software
10
// distributed under the License is distributed on an "AS IS" BASIS,
11
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
// See the License for the specific language governing permissions and
13
// limitations under the License.
14

15
package kallsyms
16

17
import (
18
	"os"
19
	"strings"
20
	"testing"
21

22
	"github.com/cilium/ebpf"
23
	"github.com/cilium/ebpf/btf"
24
	"github.com/stretchr/testify/require"
25

26
	utilstest "github.com/inspektor-gadget/inspektor-gadget/internal/test"
27
)
28

29
func TestCustomKAllSyms(t *testing.T) {
30
	kAllSymsStr := strings.Join([]string{
31
		"0000000000000000 A fixed_percpu_data",
32
		"ffffffffb4231f40 D bpf_prog_fops",
33
		"ffffffffb43723e0 d socket_file_ops",
34
	}, "\n")
35

36
	kAllSymsReader := strings.NewReader(kAllSymsStr)
37
	kAllSyms, err := NewKAllSymsFromReader(kAllSymsReader)
38
	require.Nil(t, err, "NewKAllSymsFromReader failed: %v", err)
39
	require.True(t, kAllSyms.SymbolExists("bpf_prog_fops"),
40
		"SymbolExists should have found bpf_prog_fops")
41
	require.False(t, kAllSyms.SymbolExists("abcde_bad_name"),
42
		"SymbolExists should not have found abcde_bad_name")
43

44
	lookupByInstructionPointerTests := []struct {
45
		instructionPointer uint64
46
		expectedSymbol     string
47
	}{
48
		{0, "fixed_percpu_data"},
49
		{0xffffffffb4231f39, "fixed_percpu_data"},
50
		{0xffffffffb4231f40, "bpf_prog_fops"},
51
		// TODO: is it correct? should it be bpf_prog_fops?
52
		{0xffffffffb4231f41, "bpf_prog_fops"},
53
		{0xffffffffb43723df, "bpf_prog_fops"},
54
		{0xffffffffb43723e0, "socket_file_ops"},
55
		{0xffffffffb43723e1, "socket_file_ops"},
56
	}
57
	for _, tt := range lookupByInstructionPointerTests {
58
		require.Equal(t, tt.expectedSymbol, kAllSyms.LookupByInstructionPointer(tt.instructionPointer),
59
			"LookupByInstructionPointer(0x%x)", tt.instructionPointer)
60
	}
61
}
62

63
func TestRealKAllSyms(t *testing.T) {
64
	utilstest.RequireRoot(t)
65

66
	kAllSyms, err := NewKAllSyms()
67
	require.Nil(t, err, "NewKAllSyms failed: %v", err)
68
	require.True(t, kAllSyms.SymbolExists("bpf_prog_fops"),
69
		"SymbolExists should have found bpf_prog_fops")
70
	require.False(t, kAllSyms.SymbolExists("abcde_bad_name"),
71
		"SymbolExists should not have found abcde_bad_name")
72

73
	addr, ok := kAllSyms.symbolsMap["bpf_prog_fops"]
74
	require.True(t, ok, "bpf_prog_fops not found in symbolsMap")
75
	// /proc/kallsyms contains the address 0 without CAP_SYSLOG.
76
	// Since we use RequireRoot, it should not happen.
77
	require.NotEqual(t, 0, addr, "bpf_prog_fops has a zero address")
78
}
79

80
func TestSpecRewriteConstants(t *testing.T) {
81
	kAllSymsFactory := func() (*KAllSyms, error) {
82
		kAllSymsStr := strings.Join([]string{
83
			"0000000000000000 A fixed_percpu_data",
84
			"ffffffffb4231f40 D bpf_prog_fops",
85
			"ffffffffb43723e0 d socket_file_ops",
86
		}, "\n")
87

88
		kAllSymsReader := strings.NewReader(kAllSymsStr)
89
		kAllSyms, err := NewKAllSymsFromReader(kAllSymsReader)
90
		require.Nil(t, err, "NewKAllSymsFromReader failed: %v", err)
91
		return kAllSyms, nil
92
	}
93

94
	// Little endian representation of the addresses above:
95
	bpfProgFopsAddr := []byte{0x40, 0x1f, 0x23, 0xb4, 0xff, 0xff, 0xff, 0xff}
96
	socketFileOpsAddr := []byte{0xe0, 0x23, 0x37, 0xb4, 0xff, 0xff, 0xff, 0xff}
97

98
	spec := &ebpf.CollectionSpec{
99
		Maps: map[string]*ebpf.MapSpec{
100
			".rodata": {
101
				Type:       ebpf.Array,
102
				KeySize:    4,
103
				ValueSize:  4,
104
				MaxEntries: 1,
105
				Value: &btf.Datasec{
106
					Vars: []btf.VarSecinfo{
107
						{
108
							Type: &btf.Var{
109
								Name: "bpf_prog_fops_addr",
110
								Type: &btf.Int{Size: 8},
111
							},
112
							Offset: 0,
113
							Size:   8,
114
						},
115
						{
116
							Type: &btf.Var{
117
								Name: "socket_file_ops_addr",
118
								Type: &btf.Int{Size: 8},
119
							},
120
							Offset: 8,
121
							Size:   8,
122
						},
123
					},
124
				},
125
				Contents: []ebpf.MapKV{
126
					{Key: uint32(0), Value: []byte{
127
						0, 0, 0, 0, 0, 0, 0, 0,
128
						0, 0, 0, 0, 0, 0, 0, 0,
129
					}},
130
				},
131
			},
132
		},
133
	}
134

135
	err := specUpdateAddresses(
136
		kAllSymsFactory,
137
		spec,
138
		[]string{"abcde_bad_name"},
139
	)
140
	require.ErrorIs(t, err, os.ErrNotExist, "specRewriteConstantsWithSymbolAddresses should have failed")
141

142
	err = specUpdateAddresses(
143
		kAllSymsFactory,
144
		spec,
145
		[]string{"bpf_prog_fops", "socket_file_ops"},
146
	)
147
	require.Nil(t, err, "specRewriteConstantsWithSymbolAddresses failed: %v", err)
148

149
	expectedContents := []byte{}
150
	expectedContents = append(expectedContents, bpfProgFopsAddr...)
151
	expectedContents = append(expectedContents, socketFileOpsAddr...)
152
	contents := spec.Maps[".rodata"].Contents[0].Value
153
	require.Equal(t, contents, expectedContents, "contents aren't equal")
154
}
155