new(driver/modern_bpf,userspace/libpman): support multiple programs for each event

[FedeDP]

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area driver-modern-bpf
/area libpman

Does this PR require a change in the driver versions?

What this PR does / why we need it:

Allow to specify multiple program names for each event type and try to inject each of them until success.
This allows us to inject bpf_loop sendmmsg and recvmmsg programs where supported, and fallback at a program just sending first message where it isn't.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

This superseedes #2233

Does this PR introduce a user-facing change?:

new(driver/modern_bpf,userspace/libpman): support multiple programs for each event

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [FedeDP]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Perf diff from master - unit tests

    11.67%     +0.68%  [.] sinsp::next
    10.01%     -0.47%  [.] sinsp_parser::reset
     5.66%     -0.42%  [.] next_event_from_file
     1.43%     +0.40%  [.] libsinsp::sinsp_suppress::process_event
     0.60%     +0.31%  [.] scap_next
     1.48%     +0.24%  [.] scap_event_decode_params
     0.87%     +0.23%  [.] std::_Hashtable<long, std::pair<long const, std::shared_ptr<sinsp_threadinfo> >, std::allocator<std::pair<long const, std::shared_ptr<sinsp_threadinfo> > >, std::__detail::_Select1st, std::equal_to<long>, std::hash<long>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::find
     3.32%     +0.21%  [.] sinsp_evt::load_params
     0.51%     -0.21%  [.] sinsp_evt::is_filtered_out
     8.15%     -0.21%  [.] sinsp_evt::get_type

Heap diff from master - unit tests

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0313         -0.0313           148           143           148           143
BM_sinsp_split_median                                          -0.0301         -0.0301           147           143           147           143
BM_sinsp_split_stddev                                          -0.0793         -0.0794             1             1             1             1
BM_sinsp_split_cv                                              -0.0495         -0.0496             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.1602         -0.1602            61            51            61            51
BM_sinsp_concatenate_paths_relative_path_median                -0.1611         -0.1611            61            51            61            51
BM_sinsp_concatenate_paths_relative_path_stddev                +2.5053         +2.5044             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_cv                    +3.1741         +3.1730             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0600         -0.0600            25            23            25            23
BM_sinsp_concatenate_paths_empty_path_median                   -0.0599         -0.0598            25            23            25            23
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.2278         -0.2281             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       -0.1785         -0.1789             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  -0.1080         -0.1080            63            56            63            56
BM_sinsp_concatenate_paths_absolute_path_median                -0.0975         -0.0975            63            57            63            57
BM_sinsp_concatenate_paths_absolute_path_stddev                -0.6868         -0.6870             1             0             1             0
BM_sinsp_concatenate_paths_absolute_path_cv                    -0.6489         -0.6492             0             0             0             0
BM_sinsp_split_container_image_mean                            -0.0077         -0.0077           388           385           388           385
BM_sinsp_split_container_image_median                          -0.0061         -0.0061           388           385           388           385
BM_sinsp_split_container_image_stddev                          -0.1447         -0.1435             3             2             3             2
BM_sinsp_split_container_image_cv                              -0.1380         -0.1369             0             0             0             0

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 75.17%. Comparing base (6c46ed3) to head (0deb0ff).
Report is 2 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2255   +/-   ##
=======================================
  Coverage   75.16%   75.17%           
=======================================
  Files         278      278           
  Lines       34478    34481    +3     
  Branches     5922     5922           
=======================================
+ Hits        25916    25920    +4     
+ Misses       8562     8561    -1     

Flag	Coverage Δ
libsinsp	75.17% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

X64 kernel testing matrix

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-4.19	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2-5.10	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2-5.15	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2023-6.1	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.0	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.7	🟢	🟢	🟢	🟢	🟢	🟢
centos-3.10	🟢	🟢	🟢	🟡	🟡	🟡
centos-4.18	🟢	🟢	🟢	🟢	🟢	🟢
centos-5.14	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.17	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.8	🟢	🟢	🟢	🟢	🟢	🟢
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-3.10	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-4.14	🟢	🟢	🟢	🟢	🟢	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-5.4	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-4.15	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-5.8	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

ARM64 kernel testing matrix

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	🟢
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-4.14	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	🟢
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

[github-actions]

Please double check driver/API_VERSION file. See versioning.

/hold

[FedeDP]

Removed wip since the impl is complete.
Kernel-testing matrix is now fully green. Only issue remaining are:

• s390x is not seeing BPF_FUNC_loop symbol in events_prog_names.c
• amd64 runner is correctly picking up sendmmsg_x and recvmmsg_x (with bpf_loop) but then it fails with:

libbpf: prog 'sendmmsg_x': BPF program load failed: Permission denied
libbpf: prog 'sendmmsg_x': -- BEGIN PROG LOAD LOG --
combined stack size of 2 calls is 576. Too large

This seems like a bug in the verifier since i cannot repro it locally, neither in arm64 CI, neither in kernel testing matrix.
Arm64 runner uses kernel 6.8.0-1020-azure while amd64 uses 6.5.0-1025-azure. Will try to investigate further.

[FedeDP]

In the last commit i tried to split sendmmsg and recvmmsg programs in case of ret < 0 by chaining a tail call in that case.
Still no luck. I also tried to drop the __always_inline from the handle_exit function and it failed with the same error: https://github.com/falcosecurity/libs/actions/runs/12950456593/job/36123287152

Note also that the exact same code for the 2 bpf programs wasn't failing some weeks ago (ie: at this commit: 67975da).

[FedeDP]

/milestone next-driver