ebpf

Documentation

Overview

Package ebpf contains general eBPF related types and functions

Index

• Variables
• func AddIgnoredProgramID(id ebpf.ProgramID)
• func AddNameMappings(mgr *manager.Manager, module string)
• func AddNameMappingsCollection(coll *ebpf.Collection, module string)
• func AddProgramNameMapping(progid uint32, name string, module string)
• func GetKernelSymbolsAddressesNoCache(ksymsReader io.Reader, ksyms ...string) (map[string]uint64, error)
• func GetMapNameFromMapID(id uint32) (string, error)
• func GetModuleFromMapID(id uint32) (string, error)
• func GetModuleFromProgID(id uint32) (string, error)
• func GetProgNameFromProgID(id uint32) (string, error)
• func IsProgramIDIgnored(id ebpf.ProgramID) bool
• func NowNanoseconds() (int64, error)
• func PreprocessFile(bpfDir, fileName string) (*bytes.Buffer, error)
• func RemoveIgnoredProgramID(id ebpf.ProgramID)
• func RemoveNameMappings(mgr *manager.Manager)
• func RemoveNameMappingsCollection(coll *ebpf.Collection)
• func VerifyKernelFuncs(requiredKernelFuncs ...string) (map[string]struct{}, error)
• type Config
  • func NewConfig() *Config
• type ContentionData
• type LockContentionCollector
  • func NewLockContentionCollector() *LockContentionCollector
  • func (l *LockContentionCollector) Collect(_ chan<- prometheus.Metric)
  • func (l *LockContentionCollector) Describe(_ chan<- *prometheus.Desc)
• type LockRange
• type LockType

Variables

var (
	// CIncludePattern is the regex for #include headers of C files
	CIncludePattern = `^\s*#\s*include\s+"(.*)"$`
)

var (
	// ErrNotImplemented will be returned on non-linux environments like Windows and Mac OSX
	ErrNotImplemented = errors.New("BPF-based system probe not implemented on non-linux systems")
)

Functions

func AddIgnoredProgramID

func AddIgnoredProgramID(id ebpf.ProgramID)

AddIgnoredProgramID adds a program ID to the list of ignored programs

func AddNameMappings

func AddNameMappings(mgr *manager.Manager, module string)

AddNameMappings adds the full name mappings for ebpf maps in the manager

func AddNameMappingsCollection

func AddNameMappingsCollection(coll *ebpf.Collection, module string)

AddNameMappingsCollection adds the full name mappings for ebpf maps in the collection

func AddProgramNameMapping

func AddProgramNameMapping(progid uint32, name string, module string)

AddProgramNameMapping manually adds a program name mapping

func GetKernelSymbolsAddressesNoCache

func GetKernelSymbolsAddressesNoCache(ksymsReader io.Reader, ksyms ...string) (map[string]uint64, error)

GetKernelSymbolsAddressesNoCache returns the requested kernel symbols and addresses without using the cache It expects a reader from which to read the kernel symbols.

func GetMapNameFromMapID

func GetMapNameFromMapID(id uint32) (string, error)

GetMapNameFromMapID returns the map name for the given id

func GetModuleFromMapID

func GetModuleFromMapID(id uint32) (string, error)

GetModuleFromMapID returns the module name for the map with the given id

func GetModuleFromProgID

func GetModuleFromProgID(id uint32) (string, error)

GetModuleFromProgID returns the module name for the program with the given id

func GetProgNameFromProgID

func GetProgNameFromProgID(id uint32) (string, error)

GetProgNameFromProgID returns the program name for the given id

func IsProgramIDIgnored

func IsProgramIDIgnored(id ebpf.ProgramID) bool

IsProgramIDIgnored returns true if this program ID should be ignored

func NowNanoseconds

func NowNanoseconds() (int64, error)

NowNanoseconds returns a time that can be compared to bpf_ktime_get_ns()

func PreprocessFile

func PreprocessFile(bpfDir, fileName string) (*bytes.Buffer, error)

PreprocessFile pre-processes the `#include` of embedded headers. It will only replace top-level includes for files that exist and does not evaluate the content of included files for #include directives.

func RemoveIgnoredProgramID

func RemoveIgnoredProgramID(id ebpf.ProgramID)

RemoveIgnoredProgramID removes a program ID from the list of ignored programs

func RemoveNameMappings

func RemoveNameMappings(mgr *manager.Manager)

RemoveNameMappings removes the full name mappings for ebpf maps in the manager

func RemoveNameMappingsCollection

func RemoveNameMappingsCollection(coll *ebpf.Collection)

RemoveNameMappingsCollection removes the full name mappings for ebpf maps in the collection

func VerifyKernelFuncs

func VerifyKernelFuncs(requiredKernelFuncs ...string) (map[string]struct{}, error)

VerifyKernelFuncs ensures all kernel functions exist in ksyms located at provided path.

Types

type Config

type Config struct {
	// BPFDebug enables bpf debug logs
	BPFDebug bool

	// BPFDir is the directory to load the eBPF program from
	BPFDir string

	// ExcludedBPFLinuxVersions lists Linux kernel versions that should not use BPF features
	ExcludedBPFLinuxVersions []string

	// ProcRoot is the root path to the proc filesystem
	ProcRoot string

	// InternalTelemetryEnabled indicates whether internal prometheus telemetry is enabled
	InternalTelemetryEnabled bool

	// EnableTracepoints enables use of tracepoints instead of kprobes for probing syscalls (if available on system)
	EnableTracepoints bool

	// EnableCORE enables the use of CO-RE to load eBPF programs
	EnableCORE bool

	// BTFPath is the path to BTF data for the current kernel
	BTFPath string

	// EnableRuntimeCompiler enables the use of the embedded compiler to build eBPF programs on-host
	EnableRuntimeCompiler bool

	// EnableKernelHeaderDownload enables the use of the automatic kernel header downloading
	EnableKernelHeaderDownload bool

	// KernelHeadersDir is the directories of the kernel headers to use for runtime compilation
	KernelHeadersDirs []string

	// KernelHeadersDownloadDir is the directory where the system-probe will attempt to download kernel headers, if necessary
	KernelHeadersDownloadDir string

	// RuntimeCompilerOutputDir is the directory where the runtime compiler will store compiled programs
	RuntimeCompilerOutputDir string

	// AptConfigDir is the path to the apt config directory
	AptConfigDir string

	// YumReposDir is the path to the yum repository directory
	YumReposDir string

	// ZypperReposDir is the path to the zypper repository directory
	ZypperReposDir string

	// AllowPrecompiledFallback indicates whether we are allowed to fallback to the prebuilt probes if runtime compilation fails.
	AllowPrecompiledFallback bool

	// AllowRuntimeCompiledFallback indicates whether we are allowed to fallback to runtime compilation if CO-RE fails.
	AllowRuntimeCompiledFallback bool

	// AttachKprobesWithKprobeEventsABI uses the kprobe_events ABI to attach kprobes rather than the newer perf ABI.
	AttachKprobesWithKprobeEventsABI bool

	// BypassEnabled is used in tests only.
	// It enables a ebpf-manager feature to bypass programs on-demand for controlled visibility.
	BypassEnabled bool
}

Config stores all common flags used by system-probe

func NewConfig

func NewConfig() *Config

NewConfig creates a config with ebpf-related settings

type ContentionData

type ContentionData struct {
	Total_time uint64
	Min_time   uint64
	Max_time   uint64
	Count      uint32
	Flags      uint32
}

type LockContentionCollector

type LockContentionCollector struct{}

LockContentionCollector is just a placeholder

func NewLockContentionCollector

func NewLockContentionCollector() *LockContentionCollector

NewLockContentionCollector returns nil

func (*LockContentionCollector) Collect

func (l *LockContentionCollector) Collect(_ chan<- prometheus.Metric)

Collect does nothing

func (*LockContentionCollector) Describe

func (l *LockContentionCollector) Describe(_ chan<- *prometheus.Desc)

Describe does nothing

type LockRange

type LockRange struct {
	Start uint64
	Range uint64
	Type  uint32
}

type LockType

type LockType uint32