Merge pull request #7 from runloopai/adam/add-bpf-kvm

Add eBPF support (tracing/observability)

Author: adam-rl

.github/workflows/build-kernel.yaml

@@ -6,7 +6,7 @@ on:
       kernel_version:
         description: 'Kernel version to build'
         required: false
-        default: '6.18.6'
+        default: '6.18.32'
   push:
     branches:
       - main
@@ -16,23 +16,32 @@ permissions:
   contents: read
 
 env:
-  KERNEL_VERSION: ${{ inputs.kernel_version || '6.18.6' }}
+  KERNEL_VERSION: ${{ inputs.kernel_version || '6.18.32' }}
 
 jobs:
   build-kernel:
-    name: Build Kernel (${{ matrix.arch }})
+    name: Build Kernel (${{ matrix.arch }} / ${{ matrix.flavor }})
     runs-on:
       group: Default Larger Runners
     strategy:
       fail-fast: false
       matrix:
+        arch: [x86_64, arm64]
+        # base = pre-eBPF kernel; ebpf = eBPF tracing stack + BTF (for Tetragon).
+        flavor: [base, ebpf]
         include:
           - arch: x86_64
             build_arch: x86_64
             cross_compile_pkgs: ""
           - arch: arm64
             build_arch: aarch64
             cross_compile_pkgs: gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu
+          - flavor: base
+            build_type_arg: ""
+            tarball_suffix: ""
+          - flavor: ebpf
+            build_type_arg: "-b ebpf"
+            tarball_suffix: "-ebpf"
 
     steps:
       - name: Checkout
@@ -47,6 +56,7 @@ jobs:
             build-essential \
             cpio \
             curl \
+            dwarves \
             flex \
             git \
             libelf-dev \
@@ -71,22 +81,45 @@ jobs:
 
       - name: Setup kernel source
         working-directory: packaging/kernel
-        run: ./build-kernel.sh -a ${{ matrix.build_arch }} -v ${{ env.KERNEL_VERSION }} -f -s setup
+        run: ./build-kernel.sh -a ${{ matrix.build_arch }} -v ${{ env.KERNEL_VERSION }} ${{ matrix.build_type_arg }} -f -s setup
 
       - name: Build kernel
         working-directory: packaging/kernel
-        run: ./build-kernel.sh -a ${{ matrix.build_arch }} -v ${{ env.KERNEL_VERSION }} build
+        run: ./build-kernel.sh -a ${{ matrix.build_arch }} -v ${{ env.KERNEL_VERSION }} ${{ matrix.build_type_arg }} build
+
+      - name: Verify BTF symbols are present
+        if: matrix.flavor == 'ebpf'
+        working-directory: packaging/kernel
+        run: |
+          # setup runs with -s (skip config checks), so a dropped BTF option
+          # would not fail the build — it would silently ship a BTF-less kernel
+          # that crashes Tetragon and other CO-RE agents at startup. Guard both
+          # the config and the generated .BTF section in vmlinux.
+          kernel_dir=$(find . -maxdepth 1 -type d -name 'kata-linux-*' | head -n1)
+          [ -n "${kernel_dir}" ] || { echo "ERROR: kernel build dir not found" >&2; exit 1; }
+          echo "Checking BTF in ${kernel_dir}"
+          if ! grep -q '^CONFIG_DEBUG_INFO_BTF=y' "${kernel_dir}/.config"; then
+            echo "ERROR: CONFIG_DEBUG_INFO_BTF was dropped from .config" >&2
+            echo "--- DEBUG_KERNEL / DEBUG_INFO / PAHOLE / BTF state ---" >&2
+            grep -E 'DEBUG_KERNEL|DEBUG_INFO|PAHOLE|BTF' "${kernel_dir}/.config" >&2 || true
+            exit 1
+          fi
+          if ! readelf -S "${kernel_dir}/vmlinux" | grep -q '\.BTF'; then
+            echo "ERROR: vmlinux has no .BTF section; BTF symbols were not generated" >&2
+            exit 1
+          fi
+          echo "OK: BTF symbols present in vmlinux"
 
       - name: Install kernel artifacts
         working-directory: packaging/kernel
         run: |
           mkdir -p ${{ github.workspace }}/artifacts
-          DESTDIR=${{ github.workspace }}/artifacts ./build-kernel.sh -a ${{ matrix.build_arch }} -v ${{ env.KERNEL_VERSION }} install
+          DESTDIR=${{ github.workspace }}/artifacts ./build-kernel.sh -a ${{ matrix.build_arch }} -v ${{ env.KERNEL_VERSION }} ${{ matrix.build_type_arg }} install
 
       - name: Create tarball
         id: tarball
         run: |
-          TARBALL_NAME="${{ steps.version.outputs.version_string }}-${{ matrix.arch }}.tar.gz"
+          TARBALL_NAME="${{ steps.version.outputs.version_string }}-${{ matrix.arch }}${{ matrix.tarball_suffix }}.tar.gz"
           echo "tarball_name=${TARBALL_NAME}" >> $GITHUB_OUTPUT
           cd ${{ github.workspace }}/artifacts/usr/share/kata-containers
           echo "Creating tarball with:"
@@ -111,7 +144,7 @@ jobs:
       - name: Upload artifacts to GitHub
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
         with:
-          name: kernel-${{ matrix.arch }}-${{ steps.version.outputs.version_string }}
+          name: kernel-${{ matrix.arch }}-${{ matrix.flavor }}-${{ steps.version.outputs.version_string }}
           path: ${{ github.workspace }}/${{ steps.tarball.outputs.tarball_name }}
           retention-days: 7
 
@@ -129,7 +162,7 @@ jobs:
         run: |
           DATE=$(date +%Y%m%d)
           SHORT_SHA=$(git rev-parse --short=7 HEAD)
-          KERNEL_VERSION="${{ inputs.kernel_version || '6.18.6' }}"
+          KERNEL_VERSION="${{ inputs.kernel_version || '6.18.32' }}"
           VERSION_STRING="linux-${KERNEL_VERSION}-runloop-${DATE}-${SHORT_SHA}"
           echo "version_string=${VERSION_STRING}" >> $GITHUB_OUTPUT
 

packaging/kernel/configs/fragments/build-type/ebpf/bpf.conf

@@ -0,0 +1,58 @@
+# eBPF (extended Berkeley Packet Filter) — scoped to observability/tracing
+# use cases (bcc, bpftrace, libbpf-based agents). Networking BPF (tc cls/act,
+# XDP, sockmap, lwt) is intentionally left off to keep the kernel small.
+#
+# This is an opt-in build-type fragment: it is merged only when the kernel is
+# built with `-b ebpf`. The default build omits it, producing a smaller kernel
+# without the eBPF tracing stack or BTF.
+#
+# CONFIG_BPF_SYSCALL and CONFIG_CGROUP_BPF are already enabled in cgroup.conf.
+# CONFIG_HAVE_EBPF_JIT is already enabled in network.conf.
+
+CONFIG_BPF=y
+CONFIG_BPF_JIT=y
+CONFIG_BPF_JIT_ALWAYS_ON=y
+CONFIG_BPF_JIT_DEFAULT_ON=y
+CONFIG_BPF_EVENTS=y
+
+# Default kernel.unprivileged_bpf_disabled=2 (require CAP_BPF for bpf()).
+CONFIG_BPF_UNPRIV_DEFAULT_OFF=y
+
+# Tracing primitives that BPF programs attach to.
+CONFIG_KPROBES=y
+CONFIG_UPROBES=y
+CONFIG_KPROBE_EVENTS=y
+CONFIG_UPROBE_EVENTS=y
+CONFIG_TRACING=y
+CONFIG_FTRACE=y
+CONFIG_FUNCTION_TRACER=y
+CONFIG_DYNAMIC_FTRACE=y
+CONFIG_FTRACE_SYSCALLS=y
+
+# fprobe enables kprobe_multi (mass-attach kprobes) — big perf win for tools
+# that hook many functions (bpftrace, retsnoop, etc.).
+CONFIG_FPROBE=y
+
+# bpf_override_return — lets BPF programs override return values of kprobed
+# functions (fault injection, debugging). Pulls in FUNCTION_ERROR_INJECTION.
+CONFIG_FUNCTION_ERROR_INJECTION=y
+CONFIG_BPF_KPROBE_OVERRIDE=y
+
+# BTF (BPF Type Format) — required for kfunc:/fentry/fexit probes, BTF-typed
+# args, and CO-RE programs used by libbpf, bpftrace tools/*.bt, Tetragon, and
+# most modern eBPF tooling. CO-RE agents read /sys/kernel/btf/vmlinux, which the
+# kernel only exposes when CONFIG_DEBUG_INFO_BTF=y; without it Tetragon crashes
+# at startup. Requires pahole (dwarves) at kernel build time.
+#
+# CONFIG_DEBUG_KERNEL gates the whole "Debug information" choice: the DWARF
+# options below `depend on DEBUG_KERNEL`. The kata fragment merge starts from
+# allnoconfig (DEBUG_KERNEL=n), so without this line the DWARF choice is
+# unavailable, DEBUG_INFO never gets selected, and `make oldconfig` silently
+# drops DEBUG_INFO_BTF. DEBUG_KERNEL only unlocks debug options — it does not
+# enable any on its own — so it adds no image bloat by itself.
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
+CONFIG_DEBUG_INFO_BTF=y
+
+# CONFIG_DEBUG_INFO_BTF_MODULES is intentionally omitted: CONFIG_MODULES=n
+# (base.conf) makes this kernel monolithic, so there is no module BTF to emit.