feat: Add vmlinux for kernel 5.15 for arm & amd

[MikeGoldsmith]

Which problem is this PR solving?

Adds complete vmlinux.h files for both arm and amd platforms.

• Closes Figure out vmlinux.h stuff #4

Short description of changes

• add vmlinux-arm64.h and vmlinux-x86_64.h header files generated from linux
• update vmlinux.h to use appropriate header file based on architecture
• add Makefile targets specifically for building and running on Mac

How to verify this has the expected result

Make sure your HONEYCOMB_API_KEY env var is set

# For Kubernetes in EKS or other BTF-enabled Kernel:
make docker-build
make apply-ebpf-agent

# For Kubernetes on Docker Desktop for Mac:
make mac-docker-build
make apply-ebpf-agent

• confirmed building with make docker-build on arm64 laptop runs in EKS with Amazon Linux 2 OS, 5.10.184-175.731.amzn2.aarch64
• confirmed building with make mac-docker-build on arm64 laptop runs in Kubernetes for Docker Desktop, Host kernel version: 5.15.49
• confirmed building with make mac-docker-build on x86_64 laptop runs in Kubernetes for Docker Desktop, Host kernel version: 5.15.49

[JamieDanielson]

The original vmlinux.h file is still in there because removing it causes errors with the bpf_helpers.h file, which makes sense with this specific note in there:

/*
 * Note that bpf programs need to include either
 * vmlinux.h (auto-generated from BTF) or linux/types.h
 * in advance since bpf_helper_defs.h uses such types
 * as __u64.
 */

EDIT: We now just have the vmlinux.h file including the arch-specific vmlinux files.

[vreynolds]

getting CrashLoopBackOff on the agent pod with this error:

loading objects: field KprobeTcpConnect: program kprobe__tcp_connect: apply CO-RE relocations: load kernel spec: no BTF found for kernel version 5.15.49-linuxkit-pr: not supported

[JamieDanielson]

getting CrashLoopBackOff on the agent pod with this error:

loading objects: field KprobeTcpConnect: program kprobe__tcp_connect: apply CO-RE relocations: load kernel spec: no BTF found for kernel version 5.15.49-linuxkit-pr: not supported

Hm, same here on local arm 🤔 Will look into this a bit more.

[JamieDanielson]

@vreynolds can you try again when you get a moment? I've added a flag to the Makefile -DBPF_NO_PRESERVE_ACCESS_INDEX which avoids CO-RE relocation.

[vreynolds]

It works! 🎉

@JamieDanielson are there any gotchas with including the BPF_NO_PRESERVE_ACCESS_INDEX?

[JamieDanielson]

It works! 🎉

@JamieDanielson are there any gotchas with including the BPF_NO_PRESERVE_ACCESS_INDEX?

As I understand it, this flag disables CO-RE relocation entirely with a flag, which means we can run it on our Mac or similar devices that do not have BTF or BPF CO-RE support. Using the generated vmlinux.h file means automatically generating BPF CO-RE relocations by default. There is a section near the top of the vmlinux files that enables the preserve_access_index unless this environment variable is added:

#ifndef BPF_NO_PRESERVE_ACCESS_INDEX
#pragma clang attribute push (__attribute__((preserve_access_index)), apply_to = record)
#endif

From this post:

All the types in vmlinux.h come with extra __attribute__((preserve_access_index)) applied, which makes Clang generate BPF CO-RE relocations, allowing libbpf to adapt your BPF code to the specific memory layout of the host kernel, even if it differs from the one that vmlinux.h was originally generated from. This is a crucial aspect of building portable pre-compiled BPF application that doesn't require entire Clang/LLVM toolchain to be deployed alongside it to the target system.

So if/when we decide to use BPF CO-RE, we'll want to remove this flag and/or add extra conditional logic checking for existence of BTF. And until BTF is available on our local workstations, we'll have to build on BTF-enabled devices to use the CO-RE macros (probably colima or EC2 instance).

An alternative is to add the conditional logic now 🤔

[vreynolds]

make it work ™️