8000 Humble beginnings of quark-test(8) by haesbaert · Pull Request #87 · elastic/quark · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Humble beginnings of quark-test(8 10000 ) #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 23, 2024
Merged

Humble beginnings of quark-test(8) #87

merged 1 commit into from
Oct 23, 2024

Conversation

haesbaert
Copy link
Collaborator

quark-test(8) is a testing binary, the idea is for all the tests to reside in one single binary that we can run selected tests or all.

Currently we test that we can install the probes, it then forks and execs and checks if it got an event with all the required attributes.

Changes were made to init.c to be able to properly run quark-test and halt after, we can run quark-test locally or in a qemu instance:

$ sudo ./quark-test
t_probe @ ebpf: ok
t_probe @ kprobe: ok
t_fork_exec_exit @ ebpf: ok
t_fork_exec_exit @ kprobe: ok
failed tests 0

or in qemu:

$ make initramfs.gz && qemu-system-x86_64 -initrd initramfs.gz \
  -kernel /d/e/ebpf/kernel-images/debian/x86_64/linux-image-x86_64-5.10.46-5 \
  -nographic --append "console=ttyS0 quark-test"
....
....
....
[    1.337177] Run /init as init process
[    2.052140] tsc: Refined TSC clocksource calibration: 2803.152 MHz
[    2.052956] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x2867e297e4e, max_idle_ns: 440795313952 ns
[    2.053860] clocksource: Switched to clocksource tsc
[    5.916017] random: fast init done
t_probe @ ebpf: ok
t_probe @ kprobe: ok
t_fork_exec_exit @ ebpf: ok
t_fork_exec_exit @ kprobe: ok
failed tests 0
quark-test exited with 0
[    7.701678] ACPI: Preparing to enter system sleep state S5
[    7.702269] reboot: Power down

More importantly, spinning wheels! Party like it's the 90s!

Screencast.from.2024-10-23.15-51-58.webm

@haesbaert haesbaert requested a review from a team as a code owner October 23, 2024 15:32
init.c Outdated
Comment on lines 71 to 72
execv(argv[0], argv);
/* NOTREACHED */
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if argv[0] is not present?

Suggested change
execv(argv[0], argv);
/* NOTREACHED */
return execv(argv[0], argv);
/* NOTREACHED */

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

argc is checked above:

	if (argc < 2) {
		warnx("no binary to execute");
		powerdown();
	}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, I mean if the path doesn't exist. As in we forgot to add a binary to the initrd or something like that.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you're absolutely right, I somehow had it right and then screwed up, I'll fix another case of the same mistake.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

zefixed

quark-test(8) is a testing binary, the idea is for all the tests to reside in
one single binary that we can run selected tests or all.

Currently we test that we can install the probes, it then forks and execs and
checks if it got an event with all the required attributes.

Changes were made to init.c to be able to properly run quark-test and halt
after, we can run quark-test locally or in a qemu instance:

```
$ sudo ./quark-test
t_probe @ ebpf: ok
t_probe @ kprobe: ok
t_fork_exec_exit @ ebpf: ok
t_fork_exec_exit @ kprobe: ok
failed tests 0
```

or in qemu:

```
$ make initramfs.gz && qemu-system-x86_64 -initrd initramfs.gz \
  -kernel /d/e/ebpf/kernel-images/debian/x86_64/linux-image-x86_64-5.10.46-5 \
  -nographic --append "console=ttyS0 quark-test"
....
....
....
[    1.337177] Run /init as init process
[    2.052140] tsc: Refined TSC clocksource calibration: 2803.152 MHz
[    2.052956] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x2867e297e4e, max_idle_ns: 440795313952 ns
[    2.053860] clocksource: Switched to clocksource tsc
[    5.916017] random: fast init done
t_probe @ ebpf: ok
t_probe @ kprobe: ok
t_fork_exec_exit @ ebpf: ok
t_fork_exec_exit @ kprobe: ok
failed tests 0
quark-test exited with 0
[    7.701678] ACPI: Preparing to enter system sleep state S5
[    7.702269] reboot: Power down
```

More importantly, spinning wheels! Party like it's the 90s!
/* child */
if (pid == 0) {

if (mkdir("/proc", 0666) != 0)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just curious, is there a reason these are done in the child?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason 8000 will be displayed to describe this comment to others. Learn more.

a tiny one, it's mostly so that I can call err(3) normally, since the parent (the actual init/pid=1) can't just err(1, "oh noes").

If we just exit in init, the kernel panics and the VM busyloops.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TIL, thanks

@haesbaert haesbaert merged commit b431f7f into main Oct 23, 2024
2 checks passed
@haesbaert haesbaert deleted the quark-test branch November 12, 2024 07:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants
0