BTF kernel code support

CMakeLists.txt

@@ -87,6 +87,8 @@ if(${LLVM_VERSION_MAJOR} VERSION_LESS 5)
   message(SEND_ERROR "Specify an LLVM major version using LLVM_REQUESTED_VERSION=<major version>")
 endif()
 
+find_package(LibBpf)
+
 include(CheckIncludeFile)
 check_include_file("sys/sdt.h" HAVE_SYSTEMTAP_SYS_SDT_H)
 

cmake/FindLibBpf.cmake

@@ -0,0 +1,57 @@
+# - Try to find libbpf
+# Once done this will define
+#
+#  LIBBPF_FOUND - system has libbpf
+#  LIBBPF_INCLUDE_DIRS - the libbpf include directory
+#  LIBBPF_LIBRARIES - Link these to use libbpf
+#  LIBBPF_DEFINITIONS - Compiler switches required for using libbpf
+
+#if (LIBBPF_LIBRARIES AND LIBBPF_INCLUDE_DIRS)
+#  set (LibBpf_FIND_QUIETLY TRUE)
+#endif (LIBBPF_LIBRARIES AND LIBBPF_INCLUDE_DIRS)
+
+find_path (LIBBPF_INCLUDE_DIRS
+  NAMES
+    bpf/bpf.h
+    bpf/btf.h
+    bpf/libbpf.h
+  PATHS
+    /usr/include
+    /usr/local/include
+    /opt/local/include
+    /sw/include
+    ENV CPATH)
+
+find_library (LIBBPF_LIBRARIES
+  NAMES
+    bpf
+  PATHS
+    /usr/lib
+    /usr/local/lib
+    /opt/local/lib
+    /sw/lib
+    ENV LIBRARY_PATH
+    ENV LD_LIBRARY_PATH)
+
+include (FindPackageHandleStandardArgs)
+
+# handle the QUIETLY and REQUIRED arguments and set LIBBPF_FOUND to TRUE if all listed variables are TRUE
+FIND_PACKAGE_HANDLE_STANDARD_ARGS(LibBpf "Please install the libbpf development package"
+  LIBBPF_LIBRARIES
+  LIBBPF_INCLUDE_DIRS)
+
+mark_as_advanced(LIBBPF_INCLUDE_DIRS LIBBPF_LIBRARIES)
+
+# We need btf_dump support, set LIBBPF_BTF_DUMP_FOUND
+# when it's found.
+if (LIBBPF_FOUND)
+  include(CheckSymbolExists)
+  # adding also elf for static build check
+  SET(CMAKE_REQUIRED_LIBRARIES ${LIBBPF_LIBRARIES} elf)
+  # libbpf quirk, needs upstream fix
+  SET(CMAKE_REQUIRED_DEFINITIONS -include stdbool.h)
+  check_symbol_exists(btf_dump__new "${LIBBPF_INCLUDE_DIRS}/bpf/btf.h" HAVE_BTF_DUMP)
+  if (HAVE_BTF_DUMP)
+    set(LIBBPF_BTF_DUMP_FOUND TRUE)
+  endif()
+endif()

man/man8/bpftrace.8

@@ -73,6 +73,10 @@ Enable unsafe builtin functions. By default, bpftrace runs in safe mode. Safe mo
 Unsafe builtin functions are marked as such in \fBBUILTINS (functions)\fR.
 .
 .TP
+\fB\--btf\fR
+Force BTF data processing if it's available. By default it's enabled only if the user does not specify any types/includes.
+.
+.TP
 \fB\-v\fR
 Verbose messages.
 .

src/CMakeLists.txt

@@ -1,6 +1,7 @@
 add_executable(bpftrace
   attached_probe.cpp
   bpftrace.cpp
+  btf.cpp
   clang_parser.cpp
   driver.cpp
   fake_map.cpp
@@ -31,6 +32,12 @@ endif(HAVE_BCC_ELF_FOREACH_SYM)
 if(HAVE_GET_CURRENT_CGROUP_ID)
   target_compile_definitions(bpftrace PRIVATE HAVE_GET_CURRENT_CGROUP_ID)
 endif(HAVE_GET_CURRENT_CGROUP_ID)
+if (LIBBPF_BTF_DUMP_FOUND)
+  target_compile_definitions(bpftrace PRIVATE HAVE_LIBBPF_BTF_DUMP)
+  target_include_directories(bpftrace PUBLIC ${LIBBPF_INCLUDE_DIRS})
+  target_link_libraries(bpftrace ${LIBBPF_LIBRARIES})
+endif(LIBBPF_BTF_DUMP_FOUND)
+
 target_link_libraries(bpftrace arch ast parser resources)
 
 if (STATIC_LINKING)

src/ast/ast.cpp

@@ -5,6 +5,11 @@
 namespace bpftrace {
 namespace ast {
 
+std::unordered_set<std::string>& Expression::getResolve() {
+  static std::unordered_set<std::string> s;
+  return s;
+}
+
 void Integer::accept(Visitor &v) {
   v.visit(*this);
 }

src/ast/ast.h

@@ -5,6 +5,7 @@
 #include <map>
 #include <string>
 #include <vector>
+#include <unordered_set>
 
 #include "types.h"
 
@@ -34,6 +35,7 @@ class Expression : public Node {
   bool is_map = false;
   Expression() : Node(){};
   Expression(location loc) : Node(loc){};
+  static std::unordered_set<std::string>& getResolve();
 };
 using ExpressionList = std::vector<Expression *>;
 
@@ -86,12 +88,22 @@ class Identifier : public Expression {
 
 class Builtin : public Expression {
 public:
-  explicit Builtin(std::string ident) : ident(is_deprecated(ident)) {}
-  explicit Builtin(std::string ident, location loc) : Expression(loc), ident(is_deprecated(ident)) {}
+  explicit Builtin(std::string ident) : ident(is_deprecated(ident)) {
+    resolve_curtask(ident);
+  }
+  explicit Builtin(std::string ident, location loc) : Expression(loc), ident(is_deprecated(ident)) {
+    resolve_curtask(ident);
+  }
   std::string ident;
   int probe_id;
 
   void accept(Visitor &v) override;
+
+private:
+  void resolve_curtask(std::string& ident) {
+    if (ident == "curtask")
+      getResolve().insert("task_struct");
+  }
 };
 
 class Call : public Expression {
@@ -174,9 +186,13 @@ class ArrayAccess : public Expression {
 class Cast : public Expression {
 public:
   Cast(const std::string &type, bool is_pointer, Expression *expr)
-    : cast_type(type), is_pointer(is_pointer), expr(expr) { }
+    : cast_type(type), is_pointer(is_pointer), expr(expr) {
+    getResolve().insert(type);
+  }
   Cast(const std::string &type, bool is_pointer, Expression *expr, location loc)
-    : Expression(loc), cast_type(type), is_pointer(is_pointer), expr(expr) { }
+    : Expression(loc), cast_type(type), is_pointer(is_pointer), expr(expr) {
+    getResolve().insert(type);
+  }
   std::string cast_type;
   bool is_pointer;
   Expression *expr;

src/ast/semantic_analyser.cpp

@@ -109,6 +109,14 @@ void SemanticAnalyser::visit(Builtin &builtin)
       buf << "BPF_FUNC_get_current_cgroup_id is not available for your kernel version";
       #endif
     }
+    else if (builtin.ident == "curtask") {
+      /*
+      * Retype curtask to its original type: struct task_truct.
+      */
+      builtin.type.type = Type::cast;
+      builtin.type.cast_type = "task_struct";
+      builtin.type.is_pointer = true;
+    }
   }
   else if (builtin.ident == "retval") {
     for (auto &attach_point : *probe_->attach_points)

src/bpftrace.h

@@ -137,6 +137,7 @@ class BPFtrace
   bool demangle_cpp_symbols_ = true;
   bool resolve_user_symbols_ = true;
   bool safe_mode_ = true;
+  bool force_btf_ = false;
 
   static void sort_by_key(
       std::vector<SizedType> key_args,