The new CO-RE code added to prevail isn't getting tested

[Alan-Jowett]

Checking code coverage it shows that this new code isn't being covered:
https://coveralls.io/builds/76269414/source?filename=src%2Felf_loader.cpp#L795

I also ran it under the debugger and it never gets hit.

Do we know how to get an ebpf-sample with this type of relocation?

[coderabbitai]

A summary of the changes CodeRabbit can apply:

• Add a CO-RE test sample and build scripts (ebpf-samples/core-test/{core_reloc_test.c,Makefile,build.sh,README.md}), add project docs (docs/CORE_RELOCATIONS.md), and enable the test in the test runner (add PRINT_CASE("core_reloc_test") to src/test/test_print.cpp) and CI (build CO-RE samples before tests) so that the previously untested CO-RE relocation code in src/elf_loader.cpp is exercised and coverage verified.

• Add CO-RE testing assets and documentation: introduce CO-RE_TESTING_SOLUTION.md and docs/CORE_RELOCATIONS.md (documenting the coverage gap and solution), add a new minimal CO-RE test sample under ebpf-samples/core-test/ (core_reloc_test.c, Makefile, build.sh, README.md) and instructions to copy core_reloc_test.o into the test build, update src/test/test_print.cpp to include PRINT_CASE("core_reloc_test"), and add CI steps to .github/workflows/coverage.yml to install BPF build tools and build/copy the CO-RE sample so prevails' process_core_relocations paths are exercised and covered.

• ✅ Create PR with these edits
• 📋 Get copyable edits

[Alan-Jowett]

Root Cause Analysis

After investigating the code and test samples, I found the fundamental issue: the current process_core_relocations implementation is looking in the wrong place for CO-RE data.

What the current code does (incorrectly):

// src/elf_loader.cpp:772-828
void ProgramReader::process_core_relocations(const libbtf::btf_type_data& btf_data) {
    const ELFIO::section* relo_sec = reader.sections[".rel.BTF"];
    // ...
    for (ELFIO::Elf_Xword i = 0; i < relocs.get_entries_num(); i++) {
        if (type != R_BPF_64_NODYLD32) continue;
        const auto sym = get_symbol_details(symbols, sym_idx);
        // Expects sym.value to point to bpf_core_relo in .BTF.ext
        const auto* relo = reinterpret_cast<const bpf_core_relo*>(btf_ext_data + sym.value);
        // ...
    }
}

The code expects ELF relocations in .rel.BTF to have symbols whose value points to bpf_core_relo structures in .BTF.ext.

What the samples actually contain:

I checked cilium-core/bpf_lxc.o (which is in the test suite):

$ llvm-readobj --relocations bpf_lxc.o | grep -A5 ".rel.BTF"
Section (22) .rel.BTF {
    0x4968 R_BPF_64_NODYLD32 cilium_events
    0x4974 R_BPF_64_NODYLD32 cilium_ipcache_v2
    ...
}

These relocations reference map symbols (cilium_events, etc.), not CO-RE relocation records. The sym.value for these symbols is the map's offset in .maps, not an offset into .BTF.ext.

How CO-RE relocations actually work:

CO-RE field access relocations are encoded inside the .BTF.ext section data itself, not as ELF relocations. The .BTF.ext header contains:

struct btf_ext_header {
    __u16 magic;           // 0xEB9F
    __u8 version;
    __u8 flags;
    __u32 hdr_len;
    __u32 func_info_off;   // Offset to func_info subsection
    __u32 func_info_len;
    __u32 line_info_off;   // Offset to line_info subsection  
    __u32 line_info_len;
    __u32 core_relo_off;   // Offset to core_relo subsection <-- HERE
    __u32 core_relo_len;   // Length of core_relo data
};

The core_relo subsection contains btf_ext_info_sec structures, one per ELF section with relocations:

struct btf_ext_info_sec {
    __u32 sec_name_off;    // Section name offset in BTF string table
    __u32 num_info;        // Number of bpf_core_relo records for this section
    // struct bpf_core_relo records[num_info]; follows
};

Reference: libbpf btf.c and relo_core.c

---

Implementation Plan

1. Rewrite process_core_relocations in src/elf_loader.cpp

Replace the current ELF relocation-based parsing with proper .BTF.ext parsing:

void ProgramReader::process_core_relocations(const libbtf::btf_type_data& btf_data) {
    const ELFIO::section* btf_ext_sec = reader.sections[".BTF.ext"];
    if (!btf_ext_sec || btf_ext_sec->get_size() < sizeof(btf_ext_header)) {
        return; // No CO-RE data
    }
    
    const auto* hdr = reinterpret_cast<const btf_ext_header*>(btf_ext_sec->get_data());
    
    // Check magic and version
    if (hdr->magic != 0xEB9F) {
        throw UnmarshalError("Invalid BTF.ext magic");
    }
    
    // Check if core_relo subsection exists (added in BTF.ext v1.1)
    if (hdr->hdr_len < offsetof(btf_ext_header, core_relo_len) + sizeof(hdr->core_relo_len)) {
        return; // Old BTF.ext without core_relo
    }
    
    if (hdr->core_relo_len == 0) {
        return; // No core relocations
    }
    
    const char* data = btf_ext_sec->get_data();
    const char* core_relo_data = data + hdr->hdr_len + hdr->core_relo_off;
    const char* core_relo_end = core_relo_data + hdr->core_relo_len;
    
    // First 4 bytes of subsection is record_size
    uint32_t record_size = *reinterpret_cast<const uint32_t*>(core_relo_data);
    core_relo_data += sizeof(uint32_t);
    
    // Iterate over btf_ext_info_sec structures
    while (core_relo_data < core_relo_end) {
        const auto* sec_info = reinterpret_cast<const btf_ext_info_sec*>(core_relo_data);
        const char* sec_name = /* get from BTF string table using sec_info->sec_name_off */;
        
        // Find matching program by section name
        RawProgram* prog = find_program_by_section(sec_name);
        
        // Process each bpf_core_relo in this section
        const char* relo_ptr = core_relo_data + sizeof(btf_ext_info_sec);
        for (uint32_t i = 0; i < sec_info->num_info; i++) {
            const auto* relo = reinterpret_cast<const bpf_core_relo*>(relo_ptr);
            apply_core_relocation(*prog, *relo, btf_data);
            relo_ptr += record_size;
        }
        
        core_relo_data = relo_ptr;
    }
}

2. Add btf_ext_header structure

Add to src/elf_loader.cpp near the existing bpf_core_relo struct:

struct btf_ext_header {
    uint16_t magic;
    uint8_t version;
    uint8_t flags;
    uint32_t hdr_len;
    uint32_t func_info_off;
    uint32_t func_info_len;
    uint32_t line_info_off;
    uint32_t line_info_len;
    uint32_t core_relo_off;
    uint32_t core_relo_len;
};

struct btf_ext_info_sec {
    uint32_t sec_name_off;
    uint32_t num_info;
};

3. Add tests to verify CO-RE code is exercised

In src/test/test_verify.cpp or a new test_core.cpp:

TEST_CASE("CO-RE relocations are applied", "[core]") {
    // cilium-core samples have CO-RE relocations
    auto raw_progs = read_elf(
        "ebpf-samples/cilium-core/bpf_lxc.o", 
        "tc/entry", "", {}, &g_ebpf_platform_linux);
    
    // If CO-RE parsing works, the program loads without error
    REQUIRE(!raw_progs.empty());
    
    // Optionally: check that specific instruction immediates were patched
}

4. Add a minimal CO-RE test sample (optional but recommended)

Create ebpf-samples/src/core_test.c:

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_core_read.h>

struct my_struct {
    int a;
    int b;
    long c;
};

SEC("xdp")
int core_test(struct xdp_md *ctx) {
    struct my_struct s = {0};
    // This generates a CO-RE relocation for field offset
    return BPF_CORE_READ(&s, b);
}

char LICENSE[] SEC("license") = "GPL";

Compile with: clang -g -O2 -target bpf -c core_test.c -o core_test.o

---

Files to modify:

File	Change
src/elf_loader.cpp	Rewrite process_core_relocations to parse .BTF.ext directly
src/elf_loader.cpp	Add btf_ext_header and btf_ext_info_sec structs
src/test/test_verify.cpp or new file	Add test case for CO-RE
ebpf-samples/src/core_test.c (new)	Minimal CO-RE sample
ebpf-samples/CMakeLists.txt	Add build rule for core_test.o

---

Verification

After the fix, run:

cmake --build build && ./bin/tests "[cilium-core]"

Then check coverage to confirm process_core_relocations and apply_core_relocation are hit.