ebpf

Documentation

Index

• Variables
• func NowNanoseconds() (int64, error)
• func PreprocessFile(bpfDir, fileName string) (*bytes.Buffer, error)
• func VerifyKernelFuncs(path string, requiredKernelFuncs []string) ([]string, error)
• type Config
  • func NewConfig() *Config

Variables

var (
	// CIncludePattern is the regex for #include headers of C files
	CIncludePattern = `^\s*#\s*include\s+"(.*)"$`
)

var (
	// ErrNotImplemented will be returned on non-linux environments like Windows and Mac OSX
	ErrNotImplemented = errors.New("BPF-based system probe not implemented on non-linux systems")
)

Functions

func NowNanoseconds

func NowNanoseconds() (int64, error)

NowNanoseconds returns a time that can be compared to bpf_ktime_get_ns()

func PreprocessFile

func PreprocessFile(bpfDir, fileName string) (*bytes.Buffer, error)

PreprocessFile pre-processes the `#include` of embedded headers. It will only replace top-level includes for files that exist and does not evaluate the content of included files for #include directives.

func VerifyKernelFuncs

func VerifyKernelFuncs(path string, requiredKernelFuncs []string) ([]string, error)

VerifyKernelFuncs ensures all kernel functions exist in ksyms located at provided path.

Types

type Config

type Config struct {
	// BPFDebug enables bpf debug logs
	BPFDebug bool

	// BPFDir is the directory to load the eBPF program from
	BPFDir string

	// ExcludedBPFLinuxVersions lists Linux kernel versions that should not use BPF features
	ExcludedBPFLinuxVersions []string

	// ProcRoot is the root path to the proc filesystem
	ProcRoot string

	// EnableTracepoints enables use of tracepoints instead of kprobes for probing syscalls (if available on system)
	EnableTracepoints bool

	// EnableRuntimeCompiler enables the use of the embedded compiler to build eBPF programs on-host
	EnableRuntimeCompiler bool

	// KernelHeadersDir is the directories of the kernel headers to use for runtime compilation
	KernelHeadersDirs []string

	// RuntimeCompilerOutputDir is the directory where the runtime compiler will store compiled programs
	RuntimeCompilerOutputDir string

	// AllowPrecompiledFallback indicates whether we are allowed to fallback to the prebuilt probes if runtime compilation fails.
	AllowPrecompiledFallback bool
}

Config stores all common flags used by system-probe

func NewConfig

func NewConfig() *Config

NewConfig creates a config with ebpf-related settings