-
Notifications
You must be signed in to change notification settings - Fork 224
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
From the example: ivan@vm:~/projects/ebpf_exporter$ curl -s http://ip6-localhost:9435/metrics | fgrep accessed ebpf_exporter_ebpf_program_info{config="kstack",id="1803",program="mark_page_accessed",tag="4fe6d77dbc5615bc"} 1 # HELP ebpf_exporter_mark_page_accessed_total Total number of calls to mark_page_accessed by kstack # TYPE ebpf_exporter_mark_page_accessed_total counter ebpf_exporter_mark_page_accessed_total{kstack="mark_page_accessed\nfollow_page_pte\nfollow_page_mask\n__get_user_pages\nget_user_pages_remote\nget_arg_page\ncopy_string_kernel\ndo_execveat_common\n__arm64_sys_execve\ninvoke_syscall.constprop.0\ndo_el0_svc\nel0_svc\nel0t_64_sync_handler\nel0t_64_sync"} 5 ebpf_exporter_mark_page_accessed_total{kstack="mark_page_accessed\nfollow_page_pte\nfollow_page_mask\n__get_user_pages\nget_user_pages_remote\nget_arg_page\ncopy_strings\ndo_execveat_common\n__arm64_sys_execve\ninvoke_syscall.constprop.0\ndo_el0_svc\nel0_svc\nel0t_64_sync_handler\nel0t_64_sync"} 10 ebpf_exporter_mark_page_accessed_total{kstack="mark_page_accessed\nunmap_page_range\nunmap_vmas\nexit_mmap\n__mmput\nmmput\nbegin_new_exec\nload_elf_binary\nbprm_execve\ndo_execveat_common\n__arm64_sys_execve\ninvoke_syscall.constprop.0\ndo_el0_svc\nel0_svc\nel0t_64_sync_handler\nel0t_64_sync"} 914 ebpf_exporter_mark_page_accessed_total{kstack="mark_page_accessed\nunmap_page_range\nunmap_vmas\nunmap_region.constprop.0\ndo_vmi_align_munmap\ndo_vmi_munmap\n__vm_munmap\n__arm64_sys_munmap\ninvoke_syscall.constprop.0\ndo_el0_svc\nel0_svc\nel0t_64_sync_handler\nel0t_64_sync"} 15 This isn't as useful in metrics, but it would be more natural in tracing.
- Loading branch information
Showing
11 changed files
with
604 additions
and
37 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,38 @@ | ||
package decoder | ||
|
||
import ( | ||
"strings" | ||
|
||
"github.com/cloudflare/ebpf_exporter/v2/config" | ||
"github.com/cloudflare/ebpf_exporter/v2/kallsyms" | ||
"github.com/cloudflare/ebpf_exporter/v2/util" | ||
) | ||
|
||
// KStack is a decoder that transforms an array of kernel frame addresses to a newline separated stack of symbols | ||
type KStack struct { | ||
decoder *kallsyms.Decoder | ||
} | ||
|
||
// Decode transforms an array of kernel frame addresses to a newline separated stack of symbols | ||
func (k *KStack) Decode(in []byte, _ config.Decoder) ([]byte, error) { | ||
addrs := []uintptr{} | ||
for off := 0; off < len(in); off += 8 { | ||
ptr := util.GetHostByteOrder().Uint64(in[off : off+8]) | ||
if ptr == 0 { | ||
break | ||
} | ||
|
||
addrs = append(addrs, uintptr(ptr)) | ||
} | ||
|
||
stack := make([]string, len(addrs)) | ||
for i, frame := range k.decoder.Stack(addrs) { | ||
if frame.Sym == "" { | ||
stack[i] = "??" | ||
} else { | ||
stack[i] = frame.Sym | ||
} | ||
} | ||
|
||
return []byte(strings.Join(stack, "\n")), nil | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,95 @@ | ||
package decoder | ||
|
||
import ( | ||
"bytes" | ||
"os" | ||
"testing" | ||
|
||
"github.com/cloudflare/ebpf_exporter/v2/config" | ||
"github.com/cloudflare/ebpf_exporter/v2/kallsyms" | ||
) | ||
|
||
func TestKStackDecoder(t *testing.T) { | ||
cases := []struct { | ||
in []byte | ||
out []byte | ||
}{ | ||
{ | ||
in: []byte{ | ||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
}, | ||
out: []byte(""), | ||
}, | ||
{ | ||
in: []byte{ | ||
0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
}, | ||
out: []byte("one\none\ntwo"), | ||
}, | ||
{ | ||
in: []byte{ | ||
0xab, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
}, | ||
out: []byte("three\ntwo\ntwo"), | ||
}, | ||
{ | ||
in: []byte{ | ||
0xab, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
}, | ||
out: []byte("three\nzero"), | ||
}, | ||
{ | ||
in: []byte{ | ||
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
0xac, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
}, | ||
out: []byte("??\nthree\n??"), | ||
}, | ||
} | ||
|
||
fd, err := os.CreateTemp("", "kallsyms") | ||
if err != nil { | ||
t.Fatalf("Error creating temporary file for kallsyms: %v", err) | ||
} | ||
|
||
defer os.Remove(fd.Name()) | ||
|
||
_, err = fd.WriteString("0000000000000004 T one\n0000000000000006 T two\n00000000000000aa T three\n") | ||
if err != nil { | ||
t.Fatalf("Error writing fake kallsyms data to %q: %v", fd.Name(), err) | ||
} | ||
|
||
decoder, err := kallsyms.NewDecoder(fd.Name()) | ||
if err != nil { | ||
t.Fatalf("Error creating ksym decoder for %q: %v", fd.Name(), err) | ||
} | ||
|
||
_, err = fd.WriteString("0000000000000002 T zero\n") | ||
if err != nil { | ||
t.Fatalf("Error writing additional fake kallsyms data to %q: %v", fd.Name(), err) | ||
} | ||
|
||
d := KStack{decoder} | ||
|
||
for _, c := range cases { | ||
out, err := d.Decode(c.in, config.Decoder{}) | ||
if err != nil { | ||
t.Errorf("Error decoding %#v: %s", c.in, err) | ||
} | ||
|
||
if !bytes.Equal(out, c.out) { | ||
t.Errorf("Expected %q, got %q", c.out, out) | ||
} | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,35 @@ | ||
#include <vmlinux.h> | ||
#include <bpf/bpf_tracing.h> | ||
#include "maps.bpf.h" | ||
|
||
#define MAX_STACK_DEPTH 20 | ||
|
||
// Skipping 3 frames off the top as they are just bpf trampoline | ||
#define SKIP_FRAMES (3 & BPF_F_SKIP_FIELD_MASK) | ||
|
||
struct key_t { | ||
u64 kstack[MAX_STACK_DEPTH]; | ||
}; | ||
|
||
struct { | ||
__uint(type, BPF_MAP_TYPE_LRU_HASH); | ||
__uint(max_entries, 128); | ||
__type(key, struct key_t); | ||
__type(value, u64); | ||
} mark_page_accessed_total SEC(".maps"); | ||
|
||
SEC("fentry/mark_page_accessed") | ||
int mark_page_accessed(struct pt_regs *ctx) | ||
{ | ||
struct key_t key = {}; | ||
|
||
if (bpf_get_stack(ctx, &key.kstack, sizeof(key.kstack), SKIP_FRAMES) < 0) { | ||
return 0; | ||
} | ||
|
||
increment_map(&mark_page_accessed_total, &key, 1); | ||
|
||
return 0; | ||
} | ||
|
||
char LICENSE[] SEC("license") = "GPL"; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
metrics: | ||
counters: | ||
- name: mark_page_accessed_total | ||
help: Total number of calls to mark_page_accessed by kstack | ||
labels: | ||
- name: kstack | ||
size: 160 | ||
decoders: | ||
- name: kstack |
Oops, something went wrong.