Add an action to build cilium bpf programs

Add an action that clones the upstream cilium repo and builds the bpf
programs inside it. The build script modifies some files in the bpf .c
and .h files to make it work with veristat.

Signed-off-by: Puranjay Mohan <puranjay@kernel.org>

Author: puranjaymohan

build-cilium/README.md

@@ -0,0 +1,12 @@
+# Build cilium bpf programs
+
+This action builds programs in bpf/ directory from https://github.com/cilium/cilium
+
+## Required inputs
+
+* `output-dir` - Path to the output directory, where built artifacts will be placed.
+
+## Environment variables
+
+* `LLVM_VERSION` - LLVM (clang) version. Default: `20`.
+* `CILIUM_ROOT` - Path to the cilium repository. If not set (default), the action will clone the main branch of https://github.com/cilium/cilium to a temporary directory.

build-cilium/action.yml

@@ -0,0 +1,19 @@
+name: 'Build cilium/cilium bpf programs'
+inputs:
+  output-dir:
+    description: 'Path to the output of cilium build'
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+
+    - name: Install cilium dependencies
+      shell: bash
+      run: ${GITHUB_ACTION_PATH}/install-dependencies.sh
+
+    - name: Build cilium/cilium bpf programs
+      env:
+        OUTPUT_DIR: ${{ inputs.output-dir }}
+      shell: bash
+      run: ${GITHUB_ACTION_PATH}/build-cilium.sh

build-cilium/build-cilium.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+
+set -euo pipefail
+
+export CILIUM_ROOT=${CILIUM_ROOT:-}
+export CILIUM_REVISION=${CILIUM_REVISION:-main}
+
+if [[ -z "$CILIUM_ROOT" ]]; then
+    export CILIUM_ROOT=$(mktemp -d scx.XXXX)
+    git clone --depth=1 --branch="${CILIUM_REVISION}" https://github.com/cilium/cilium.git $CILIUM_ROOT
+    pushd $CILIUM_ROOT
+    git reset --hard $CILIUM_REVISION
+    popd
+fi
+
+pushd $CILIUM_ROOT
+
+rm -rf $OUTPUT_DIR && mkdir -p $OUTPUT_DIR/bpf
+
+extract_bpf_progs() {
+    build_dir=$1
+    pattern=$2
+    bpf_dir=$3
+    find "${build_dir}" -type f -name "$pattern" -printf '%P\0' | \
+    while IFS= read -r -d '' prog; do
+        obj_name=$(echo "${prog}" | tr / _)
+        cp -v "${build_dir}/${prog}" "${bpf_dir}/${obj_name}"
+    done
+}
+
+# Cilium needs some hacks to work properly with upstream kernel and libbpf
+pushd bpf
+sed -i 's/CILIUM_PIN_REPLACE 1 << 4/CILIUM_PIN_REPLACE 1/' include/bpf/loader.h
+sed -i 's/__section(PROG_TYPE "\/entry")/__section(PROG_TYPE)/' include/bpf/section.h
+sed -i 's/__section(PROG_TYPE "\/tail")/__section(PROG_TYPE)/' lib/tailcall.h
+sed -i '/__declare_tail/{n;/^static __always_inline$/d;}' bpf_host.c bpf_lxc.c lib/nodeport.h lib/nodeport_egress.h
+sed -i '/^static __always_inline.*\\$/d' bpf_lxc.c
+make -j$(nproc)
+popd
+
+extract_bpf_progs bpf "*.o" $OUTPUT_DIR/bpf
+
+popd

build-cilium/install-dependencies.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+
+set -xeuo pipefail
+
+export LLVM_VERSION=${LLVM_VERSION:-21}
+export LIBBPF_REVISION=${LIBBPF_REVISION:-master}
+export BPFTOOL_REVISION=${BPFTOOL_REVISION:-main}
+
+# Assume Ubuntu/Debian
+export DEBIAN_FRONTEND=noninteractive
+sudo -E apt-get -y update
+
+# Install LLVM
+sudo -E apt-get --no-install-recommends -y install \
+        curl git gnupg lsb-release software-properties-common wget
+wget https://apt.llvm.org/llvm.sh
+chmod +x llvm.sh
+sudo -E ./llvm.sh ${LLVM_VERSION}
+rm llvm.sh
+
+sudo update-alternatives --install \
+    /usr/bin/clang clang /usr/bin/clang-${LLVM_VERSION} 10
+sudo update-alternatives --set clang /usr/bin/clang-${LLVM_VERSION}
+sudo update-alternatives --install \
+    /usr/bin/llvm-strip llvm-strip /usr/bin/llvm-strip-${LLVM_VERSION} 10
+sudo update-alternatives --set llvm-strip /usr/bin/llvm-strip-${LLVM_VERSION}
+sudo update-alternatives --install \
+    /usr/bin/llvm-ar llvm-ar /usr/bin/llvm-ar-${LLVM_VERSION} 10
+sudo update-alternatives --set llvm-ar /usr/bin/llvm-ar-${LLVM_VERSION}
+
+# Install Go
+export GO_VERSION=${GO_VERSION:-1.25.3}
+ARCH=$(uname -m)
+case $ARCH in
+    x86_64) GO_ARCH=amd64 ;;
+    aarch64) GO_ARCH=arm64 ;;
+    *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
+esac
+curl -fsSL https://go.dev/dl/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz | sudo tar -C /usr/local -xzf -
+echo 'export PATH=$PATH:/usr/local/go/bin' | sudo tee /etc/profile.d/go.sh
+export PATH=$PATH:/usr/local/go/bin
+# Persist Go PATH for subsequent GitHub Actions steps
+echo "/usr/local/go/bin" >> $GITHUB_PATH
+
+# Install libs and other deps
+sudo -E apt-get --no-install-recommends -y install \
+    build-essential libssl-dev libelf-dev libzstd-dev libseccomp-dev \
+    libbfd-dev libcap-dev jq pkg-config protobuf-compiler
+
+# Build and install libbpf
+export LIBBPF_ROOT=$(mktemp -d libbpf.XXXX)
+git clone https://github.com/libbpf/libbpf.git $LIBBPF_ROOT
+pushd $LIBBPF_ROOT
+git reset --hard $LIBBPF_REVISION
+make -C src -j$(nproc)
+make -C src install
+sudo ln -s /usr/lib64/pkgconfig/libbpf.pc /usr/lib/pkgconfig/libbpf.pc
+popd
+rm -rf $LIBBPF_ROOT
+
+# Build and install bpftool
+export BPFTOOL_ROOT=$(mktemp -d bpftool.XXXX)
+git clone --recurse-submodules https://github.com/libbpf/bpftool.git $BPFTOOL_ROOT
+pushd $BPFTOOL_ROOT
+git reset --hard $BPFTOOL_REVISION
+git submodule update --init
+make LLVM=1 LLVM_VERSION=-${LLVM_VERSION} -C src -j$(nproc)
+make LLVM=1 LLVM_VERSION=-${LLVM_VERSION} -C src install
+popd
+rm -rf $BPFTOOL_ROOT

ci/vmtest/configs/run_veristat.cilium.cfg

@@ -0,0 +1,3 @@
+VERISTAT_OBJECTS_DIR="${CILIUM_PROGS}"
+VERISTAT_OBJECTS_GLOB="*.o"
+VERISTAT_OUTPUT="veristat-cilium"