arch

Documentation

Index

• func AddSyscallPrefix(symbol string) (string, error)
• func AddSyscallPrefixTestHelper(t *testing.T, symbol string) string
• func CutSyscallPrefix(symbol string) (string, bool)
• func HasSyscallPrefix(symbol string) bool

Functions

func AddSyscallPrefix

func AddSyscallPrefix(symbol string) (string, error)

AddSyscallPrefix detects if the symbol is already prefixed with arch specific prefix in the form of "__x64_" or "__arm64_", and if not, adds it based on provided arch.

Note that cilium/ebpf, retries to attach to an arch specific version of the symbol after a failure thus making possible to attach to "sys_listen" which will fail and retry with the corrected "__arm64_sys_listen" if you are running on arm64. See https://github.com/cilium/ebpf/pull/304. However, this causes Tetragon users to believe that two symbols exist (following the same example) "__arm64_sys_listen" and "sys_listen", which results in differents events. Because we actually know if a call is a syscall, we can pre-format the symbol directly here to allow the user to specify the "sys_listen" version while only registering the real symbol "__arm64_sys_listen".

func AddSyscallPrefixTestHelper

func AddSyscallPrefixTestHelper(t *testing.T, symbol string) string

AddSyscallPrefixTestHelper is like AddSyscallPrefix but calls t.Fatal if the arch is unsupported or if the symbol has already a prefix that doesn't correspond to the running arch.

It's a helper supposed to be used only in testing code.

func CutSyscallPrefix

func CutSyscallPrefix(symbol string) (string, bool)

CutSyscallPrefix removes a potential arch specific prefix from the symbol and returns true in second return argument if the prefix is 32 bits

func HasSyscallPrefix

func HasSyscallPrefix(symbol string) bool