ebpf

Documentation

Index

• type EbpfHandler
  • func LoadMaps(ctx context.Context, maps map[string]*cebpf.Map) (EbpfHandler, error)
• type StackDeltaEBPF

Types

type EbpfHandler

type EbpfHandler interface {
	// Embed interpreter.EbpfHandler as subset of this interface.
	interpreter.EbpfHandler

	// RemoveReportedPID removes a PID from the reported_pids eBPF map.
	RemoveReportedPID(pid libpf.PID)

	// UpdateUnwindInfo writes UnwindInfo to given unwind info array index
	UpdateUnwindInfo(index uint16, info sdtypes.UnwindInfo) error

	// UpdateExeIDToStackDeltas defines a function that updates the eBPF map exe_id_to_stack_deltas
	// for host.FileID with the elements of StackDeltaEBPF. It returns the mapID used.
	UpdateExeIDToStackDeltas(fileID host.FileID, deltas []StackDeltaEBPF) (uint16, error)

	// DeleteExeIDToStackDeltas defines a function that removes the entries from the outer eBPF
	// map exe_id_to_stack_deltas and its associated inner map entries.
	DeleteExeIDToStackDeltas(fileID host.FileID, mapID uint16) error

	// UpdateStackDeltaPages defines a function that updates the mapping in a eBPF map from
	// a FileID and page to its stack delta lookup information.
	UpdateStackDeltaPages(fileID host.FileID, numDeltasPerPage []uint16,
		mapID uint16, firstPageAddr uint64) error

	// DeleteStackDeltaPage defines a function that removes the element specified by fileID and page
	// from the eBPF map.
	DeleteStackDeltaPage(fileID host.FileID, page uint64) error

	// UpdatePidPageMappingInfo defines a function that updates the eBPF map
	// pid_page_to_mapping_info with the given pidAndPage and fileIDAndOffset encoded values
	// as key/value pair.
	UpdatePidPageMappingInfo(pid libpf.PID, prefix lpm.Prefix, fileID, bias uint64) error

	// DeletePidPageMappingInfo removes the elements specified by prefixes from eBPF map
	// pid_page_to_mapping_info and returns the number of elements removed.
	DeletePidPageMappingInfo(pid libpf.PID, prefixes []lpm.Prefix) (int, error)

	// CollectMetrics returns gathered errors for changes to eBPF maps.
	CollectMetrics() []metrics.Metric

	// SupportsGenericBatchOperations returns true if the kernel supports eBPF batch operations
	// on hash and array maps.
	SupportsGenericBatchOperations() bool

	// SupportsLPMTrieBatchOperations returns true if the kernel supports eBPF batch operations
	// on LPM trie maps.
	SupportsLPMTrieBatchOperations() bool
}

EbpfHandler provides the functionality to interact with eBPF maps.

func LoadMaps

func LoadMaps(ctx context.Context, maps map[string]*cebpf.Map) (EbpfHandler, error)

LoadMaps checks if the needed maps for the process manager are available and loads their references into a package-internal structure.

It further spawns background workers for deferred map updates; the given context can be used to terminate them on shutdown.

type StackDeltaEBPF

type StackDeltaEBPF struct {
	AddressLow uint16
	UnwindInfo uint16
}

StackDeltaEBPF represents stack deltas preprocessed by the ProcessManager which are then loaded to the eBPF map. This is Go equivalent of 'struct StackDelta' in eBPF types.h. See the eBPF header file for details.