[RFE] Inspect a gadget in details

[alban]

https://mentorship.lfx.linuxfoundation.org/project/a6d66c40-3d12-4fa4-88bf-18574f6b4ec0

---

Current situation

A gadget can be inspected with the ig image inspect command (implemented in #3382). But it does not give all possible details.

See #3382 (review)

Impact

When gadget developers are trying to debug their gadgets, they cannot easily inspect the different layers, decompile, list the ebpf programs and ebpf maps etc.

Ideal future situation

It should be possible to get the following information from a gadget:

• list of architectures supported by the gadget
• list of layers
• information from gadget.yaml:
  • list of ebpf params
  • list of data sources with the list of fields
• information from the ebpf module
  • list of sections (so I can see kprobe/sys_mount)
  • list of ebpf maps with their types (so I don't have to use readelf and objdump)
  • show bpf bytecode + source (when available in ELF sections) of requested ebpf programs
• information from the wasm module
  • what gadgetAPIVersion does it use?
  • which wasm upcalls does it make?

Implementation options

Additionally, it would be nice to have an implementation both in ig and in a wasm module to be reusable on websites. For the second case, this probably means we can't use the cilium/ebpf package.

Additional information

I gave it a try with wasm and came up with the following website:

https://github.com/alban/bpfanalyser
https://alban.github.io/bpfanalyser/

Useful changes in cilium/ebpf: cilium/ebpf#1552

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity.
It will be closed in 14 days if no further activity occurs.

[github-actions]

This issue has been automatically closed due to inactivity.
If you believe this was closed in error, please feel free to reopen it.

[sukhman-sukh]

Hello,
My name is Sukhman Singh. I am a low-level software engineer and open-source contributor at @sdslabs. I was also a Google Summer of Code '24 fellow at Qaul.net.
I have extensive experience with Rust, Golang, and C and hands-on experience in eBPF development using both C and Rust. I am highly interested in the project's vision and the above issue. I also have some ideas on how ig image inspect can be used for more verbose and detailed information and layers-by-layer analysis
I am planning to apply for LFX'25 Spring and would love to contribute to this issue. Are there any pre-tests or prerequisite contributions required to qualify for LFX for this project?
Thank you.

[alban]

Hi,

Thanks for your interest!

There is no mandatory pre-tests or pre-requisite contributions, but we'll be looking to evaluate the candidates in the relevant skills for the project (Go, ebpf, wasm). So links to relevant github issues or PRs are welcome in your application (on the LFX platform, not here). It can be other projects than Inspektor Gadget. If you want to contribute something to Inspektor Gadget now, it is better to pick up a task that is not directly related to the mentorship project (for ideas, search for the good first issue label). While the application review period is still ongoing (until Tuesday, February 25, 2025), we'll refrain from reviewing PRs directly related to the mentorship project.

But we can discuss the goal of the project. Further ideas, in addition to what is listed in this issue:

• Statically analyse the ebpf bytecode to automatically create diagrams representing interactions between ebpf maps and ebpf programs. Example of such diagrams in the fsnotify gadget and trace_tcp gadget.
• Integration with Makefile/CI to automatically update gadget documentation
• Integration with gadget-template so third-party gadgets can make use of it
• Listing ebpf relocations (would be useful for debugging this issue) and annotating bpf bytecode. Visual helpers with the kernel BTF.
• Add feature in gadgetctl & kubectl-gadget (sending info through grpc)