feat: Support DWARF unwinding from kernel context

agent/crates/trace-utils/Cargo.toml

@@ -5,6 +5,7 @@ edition = "2021"
 
 [dependencies]
 ahash = "0.8"
+btf-rs = "1.1"
 gimli = "0.31"
 libc = "0.2"
 log = "0.4"

agent/crates/trace-utils/src/btf.rs

@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2024 Yunshan Networks
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use btf_rs::{Btf, Type};
+
+use log::warn;
+
+pub fn read_offset_of_stack_in_task_struct() -> Option<u32> {
+    read_offset("task_struct", "stack")
+}
+
+const BTF_PATH: &'static str = "/sys/kernel/btf/vmlinux";
+
+fn read_offset(struct_name: &str, field_name: &str) -> Option<u32> {
+    let btf = match Btf::from_file(BTF_PATH) {
+        Ok(btf) => btf,
+        Err(e) => {
+            warn!("Failed to read {BTF_PATH} for BTF info: {e}");
+            return None;
+        }
+    };
+    let Ok(ts) = btf.resolve_types_by_name(struct_name) else {
+        warn!("Failed to find {struct_name} in {BTF_PATH}");
+        return None;
+    };
+    for t in ts {
+        match t {
+            Type::Struct(s) => {
+                for m in s.members.iter() {
+                    match btf.resolve_name(m) {
+                        Ok(name) if name == field_name => {
+                            return Some(m.bit_offset() >> 3);
+                        }
+                        _ => (),
+                    }
+                }
+            }
+            _ => (),
+        }
+    }
+    warn!("Failed to find field {field_name} of {struct_name} in {BTF_PATH}");
+    None
+}

agent/crates/trace-utils/src/lib.rs

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+pub mod btf;
 pub mod error;
 pub mod unwind;
 
@@ -84,3 +85,11 @@ pub unsafe extern "C" fn rustc_demangle(
         Err(_) => return 0,
     }
 }
+
+#[no_mangle]
+pub unsafe extern "C" fn read_offset_of_stack_in_task_struct() -> i32 {
+    match btf::read_offset_of_stack_in_task_struct() {
+        Some(offset) => offset as i32,
+        None => -1,
+    }
+}

agent/crates/trace-utils/src/trace_utils.h

@@ -74,6 +74,8 @@ typedef struct {
 
 bool frame_pointer_heuristic_check(uint32_t pid);
 
+int32_t read_offset_of_stack_in_task_struct(void);
+
 int rustc_demangle(const char *mangled, char *out, size_t out_size);
 
 unwind_table_t *unwind_table_create(int32_t process_shard_list_map_fd,

agent/src/ebpf/.clang-format

@@ -11,7 +11,7 @@ BreakBeforeBinaryOperators: false
 BreakBeforeTernaryOperators: true
 BreakConstructorInitializersBeforeComma: false
 BinPackParameters: true
-ColumnLimit:     100
+ColumnLimit:     120
 ConstructorInitializerAllOnOneLineOrOnePerLine: false
 DerivePointerBinding: false
 ExperimentalAutoDetectBinPacking: false

agent/src/ebpf/kernel/include/bpf_base.h

@@ -202,6 +202,10 @@ struct pt_regs {
 #define PT_REGS_RC(x) ((x)->regs[0])
 #define PT_REGS_SP(x) ((x)->sp)
 #define PT_REGS_IP(x) ((x)->pc)
+
+#define PSR_MODE32_BIT 0x00000010
+#define PSR_MODE_MASK  0x0000000f
+#define PSR_MODE_EL0t  0x00000000
 #else
 _Pragma("GCC error \"Must specify a BPF target arch\"");
 #endif

agent/src/ebpf/kernel/include/perf_profiler.h

@@ -72,4 +72,8 @@ struct stack_trace_key_t {
 	} ext_data;
 };
 
+typedef struct {
+	__u32 task_struct_stack_offset;
+} unwind_sysinfo_t;
+
 #endif /* DF_BPF_PERF_PROFILER_H */