fix : add enum support for resolve

[tdaudi]

Fixes #4799

Description

Enums are uint32. Currently, because of the way integer are handled on BPF, we need to add an extra dereferencing in the resolve algo to have it working properly. For this reason I did not add tests as this little hack won't be necessary after a fix will be done.

[11] ENUM 'test_enum' encoding=UNSIGNED size=4 vlen=3

[andrewstrohman]

Enums are uint32.

I don't think this is always true. I think they can be other integer types too. I think that's why the definition of Enum specifies Size and Signed:

// Enum lists possible values.
type Enum struct {
	Name string
	// Size of the enum value in bytes.
	Size uint32
	// True if the values should be interpreted as signed integers.
	Signed bool
	Values []EnumValue
}

But given your debug output:

[11] ENUM 'test_enum' encoding=UNSIGNED size=4 vlen=3

I agree the user would configure the type as uint32 in their policy for this case. I'm just pointing out that the correct type to configure in the policy seems to be situational.

[olsajiri]

lgtm, thanks

[kkourt]

Enums are uint32. Currently, because of the way integer are handled on
BPF, we need to add an extra dereferencing in the resolve algo to have
it working properly.

That's the most common case, but it's not universal as Andy pointed out.

sudo bpftool btf dump file /sys/kernel/btf/vmlinux | grep 'ENUM ' | grep -v 'size=4'
[1148] ENUM 'rw_hint' encoding=UNSIGNED size=1 vlen=6
[2359] ENUM 'blk_integrity_checksum' encoding=UNSIGNED size=1 vlen=4
[4871] ENUM '_cache_table_type' encoding=UNSIGNED size=1 vlen=4
[4872] ENUM '_tlb_table_type' encoding=UNSIGNED size=1 vlen=15
[23364] ENUM 'scsi_cmnd_submitter' encoding=UNSIGNED size=1 vlen=3
[115702] ENUM 'hub_led_mode' encoding=UNSIGNED size=1 vlen=8

Shouldn't we check the enum size and act appropriately?

[netlify]

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	e1aa561
🔍 Latest deploy log	https://app.netlify.com/projects/tetragon/deploys/69d16abc6fa47f0008e50845
😎 Deploy Preview	https://deploy-preview-4800--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[tdaudi]

Thank you for your clarifications. I think it's better this way indeed.

Changes includes :

• One commit for the type: transformation when lastBTFType is an *btf.Enum. (I give details in the commit message)
• I "recycle" the v32 field in TestUprobeResolve to validate the enum with uint32 format.

[kkourt]

LGTM, but can you please rephrase the first commit message that still mentions:

Enums are uint32.

[tdaudi]

Sorry, it should be better now. Thanks