Share bpf maps internally and remove pinning / bpffs requirement (#1251)

grafana · Oct 15, 2024 · c9d2647 · c9d2647
1 parent ac3b137
commit c9d2647
Show file tree

Hide file tree

Showing 50 changed files with 152 additions and 360 deletions.
diff --git a/bpf/bpf_dbg.h b/bpf/bpf_dbg.h
@@ -14,6 +14,7 @@
 
 #include "vmlinux.h"
 #include "bpf_core_read.h"
+#include "pin_internal.h"
 
 #ifdef BPF_DEBUG
 
@@ -26,7 +27,7 @@ typedef struct log_info {
 struct {
     __uint(type, BPF_MAP_TYPE_RINGBUF);
     __uint(max_entries, 1 << 12);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } debug_events SEC(".maps");
 
 enum bpf_func_id___x { BPF_FUNC_snprintf___x = 42 /* avoid zero */ };

diff --git a/bpf/go_common.h b/bpf/go_common.h
@@ -21,6 +21,7 @@
 #include "trace_util.h"
 #include "go_offsets.h"
 #include "go_traceparent.h"
+#include "pin_internal.h"
 
 char __license[] SEC("license") = "Dual MIT/GPL";
 
@@ -47,15 +48,15 @@ struct {
     __type(key, go_addr_key_t);        // key: pointer to the goroutine
     __type(value, goroutine_metadata); // value: timestamp of the goroutine creation
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } ongoing_goroutines SEC(".maps");
 
 struct {
     __uint(type, BPF_MAP_TYPE_LRU_HASH);
     __type(key, go_addr_key_t); // key: pointer to the request goroutine
     __type(value, connection_info_t);
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } ongoing_server_connections SEC(".maps");
 
 struct {
@@ -70,7 +71,7 @@ struct {
     __type(key, go_addr_key_t); // key: pointer to the goroutine
     __type(value, tp_info_t);   // value: traceparent info
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } go_trace_map SEC(".maps");
 
 static __always_inline void go_addr_key_from_id(go_addr_key_t *current, void *addr) {

diff --git a/bpf/http_ssl_defs.h b/bpf/http_ssl_defs.h
@@ -9,6 +9,7 @@
 #include "pid.h"
 #include "sockaddr.h"
 #include "tcp_info.h"
+#include "pin_internal.h"
 
 // We use this map to track ssl handshake enter/exit, it should be only
 // temporary
@@ -17,7 +18,7 @@ struct {
     __type(key, u64);   // the pid_tid
     __type(value, u64); // the SSL struct pointer
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } active_ssl_handshakes SEC(".maps");
 
 // LRU map, we don't clean-it up at the moment, which holds onto the mapping
@@ -28,7 +29,7 @@ struct {
     __type(key, u64);                         // the SSL struct pointer
     __type(value, ssl_pid_connection_info_t); // the pointer to the file descriptor matching ssl
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } ssl_to_conn SEC(".maps");
 
 // LRU map, we don't clean-it up at the moment, which holds onto the mapping
@@ -39,7 +40,7 @@ struct {
     __type(key, u64);                         // the pid-tid pair
     __type(value, ssl_pid_connection_info_t); // the pointer to the file descriptor matching ssl
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } pid_tid_to_conn SEC(".maps");
 
 // LRU map which holds onto the mapping of an ssl pointer to pid-tid,
@@ -67,15 +68,15 @@ struct {
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
     __type(key, u64);
     __type(value, ssl_args_t);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } active_ssl_read_args SEC(".maps");
 
 struct {
     __uint(type, BPF_MAP_TYPE_LRU_HASH);
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
     __type(key, u64);
     __type(value, ssl_args_t);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } active_ssl_write_args SEC(".maps");
 
 static __always_inline void cleanup_ssl_trace_info(http_info_t *info, void *ssl) {

diff --git a/bpf/k_tracer.h b/bpf/k_tracer.h
@@ -8,6 +8,7 @@
 #include "k_tracer_defs.h"
 #include "http_ssl_defs.h"
 #include "tc_ip.h"
+#include "pin_internal.h"
 
 // Temporary tracking of accept arguments
 struct {
@@ -64,7 +65,7 @@ struct {
         partial_connection_info_t); // key: the connection info without the destination address, but with the tcp sequence
     __type(value, connection_info_t); // value: traceparent info
     __uint(max_entries, 1024);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } tcp_connection_map SEC(".maps");
 
 // Used by accept to grab the sock details
@@ -767,4 +768,4 @@ int app_egress(struct __sk_buff *skb) {
     }
 
     return 0;
-}
+}
diff --git a/bpf/nodejs.h b/bpf/nodejs.h
@@ -7,21 +7,22 @@
 #include "pid.h"
 #include "ringbuf.h"
 #include "map_sizing.h"
+#include "pin_internal.h"
 
 struct {
     __uint(type, BPF_MAP_TYPE_LRU_HASH);
     __type(key, u64);          // the pid_tid
     __type(value, u64);        // the last active async_id
     __uint(max_entries, 1000); // 1000 nodejs services, small number, nodejs is single threaded
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } active_nodejs_ids SEC(".maps");
 
 struct {
     __uint(type, BPF_MAP_TYPE_LRU_HASH);
     __type(key, u64);   // child async_id
     __type(value, u64); // parent async_id
     __uint(max_entries, MAX_CONCURRENT_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } nodejs_parent_map SEC(".maps");
 
 volatile const s32 async_wrap_async_id_off = 0;
@@ -32,7 +33,7 @@ struct {
     __type(key, u64);          // the pid_tid
     __type(value, u64);        // the last AsyncWrap *
     __uint(max_entries, 1000); // 1000 nodejs services, small number, nodejs is single threaded
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } async_reset_args SEC(".maps");
 
 SEC("uprobe/node:AsyncReset")
@@ -109,4 +110,4 @@ int emit_async_init(struct pt_regs *ctx) {
     return 0;
 }
 
-#endif // NODE_JS_H
+#endif // NODE_JS_H
diff --git a/bpf/pid.h b/bpf/pid.h
@@ -6,6 +6,7 @@
 #include "bpf_core_read.h"
 #include "pid_types.h"
 #include "bpf_dbg.h"
+#include "pin_internal.h"
 
 #define MAX_CONCURRENT_PIDS                                                                        \
     3001 // estimate: 1000 concurrent processes (including children) * 3 namespaces per pid
@@ -18,15 +19,15 @@ struct {
     __uint(max_entries, MAX_CONCURRENT_PIDS);
     __type(key, u32);
     __type(value, u64); // using 8 bytes, because array elements are 8 bytes aligned anyway
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } valid_pids SEC(".maps");
 
 struct {
     __uint(type, BPF_MAP_TYPE_LRU_HASH);
     __uint(max_entries, MAX_CONCURRENT_PIDS);
     __type(key, u32);
     __type(value, u32);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } pid_cache SEC(".maps");
 
 static __always_inline u8 pid_matches(pid_key_t *p) {
@@ -93,4 +94,4 @@ static __always_inline u32 valid_pid(u64 id) {
     return 0;
 }
 
-#endif
+#endif
diff --git a/bpf/pin_internal.h b/bpf/pin_internal.h
@@ -0,0 +1,6 @@
+#ifndef PIN_INTERNAL_H
+#define PIN_INTERNAL_H
+
+enum { BEYLA_PIN_INTERNAL = 100 };
+
+#endif
diff --git a/bpf/protocol_common.h b/bpf/protocol_common.h
@@ -7,6 +7,7 @@
 #include "ringbuf.h"
 #include "pid.h"
 #include "bpf_dbg.h"
+#include "pin_internal.h"
 
 #define MIN_HTTP_SIZE 12      // HTTP/1.1 CCC is the smallest valid request we can have
 #define RESPONSE_STATUS_POS 9 // HTTP/1.1 <--
@@ -45,7 +46,7 @@ struct {
     __type(key, pid_connection_info_t); // connection that's SSL
     __type(value, u64);                 // ssl
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } active_ssl_connections SEC(".maps");
 
 static __always_inline http_connection_metadata_t *empty_connection_meta() {

diff --git a/bpf/protocol_http.h b/bpf/protocol_http.h
@@ -9,6 +9,7 @@
 #include "runtime.h"
 #include "protocol_common.h"
 #include "trace_common.h"
+#include "pin_internal.h"
 
 volatile const u32 high_request_volume;
 
@@ -27,15 +28,15 @@ struct {
     __type(key, pid_connection_info_t);
     __type(value, http_info_t);
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } ongoing_http SEC(".maps");
 
 struct {
     __uint(type, BPF_MAP_TYPE_LRU_HASH);
     __type(key, connection_info_t);
     __type(value, http_info_t);
     __uint(max_entries, 1024);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } ongoing_http_fallback SEC(".maps");
 
 // empty_http_info zeroes and return the unique percpu copy in the map

diff --git a/bpf/protocol_http2.h b/bpf/protocol_http2.h
@@ -8,6 +8,7 @@
 #include "pid.h"
 #include "protocol_common.h"
 #include "http2_grpc.h"
+#include "pin_internal.h"
 
 struct {
     __uint(type, BPF_MAP_TYPE_LRU_HASH);
@@ -21,7 +22,7 @@ struct {
     __type(key, http2_conn_stream_t);
     __type(value, http2_grpc_request_t);
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } ongoing_http2_grpc SEC(".maps");
 
 // We want to be able to collect larger amount of data for the grpc/http headers
@@ -220,4 +221,4 @@ int protocol_http2(void *ctx) {
     return 0;
 }
 
-#endif
+#endif
diff --git a/bpf/protocol_tcp.h b/bpf/protocol_tcp.h
@@ -8,14 +8,15 @@
 #include "pid.h"
 #include "protocol_common.h"
 #include "trace_common.h"
+#include "pin_internal.h"
 
 // Keeps track of tcp buffers for unknown protocols
 struct {
     __uint(type, BPF_MAP_TYPE_LRU_HASH);
     __type(key, pid_connection_info_t);
     __type(value, tcp_req_t);
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } ongoing_tcp_req SEC(".maps");
 
 struct {

diff --git a/bpf/ringbuf.h b/bpf/ringbuf.h
@@ -2,6 +2,7 @@
 #define RINGBUF_H
 
 #include "utils.h"
+#include "pin_internal.h"
 
 // These need to line up with some Go identifiers:
 // EventTypeHTTP, EventTypeGRPC, EventTypeHTTPClient, EventTypeGRPCClient, EventTypeSQLClient, EventTypeKHTTPRequest
@@ -28,7 +29,7 @@
 struct {
     __uint(type, BPF_MAP_TYPE_RINGBUF);
     __uint(max_entries, 1 << 16);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } events SEC(".maps");
 
 // To be Injected from the user space during the eBPF program load & initialization

diff --git a/bpf/trace_common.h b/bpf/trace_common.h
@@ -8,6 +8,7 @@
 #include "pid_types.h"
 #include "runtime.h"
 #include "ringbuf.h"
+#include "pin_internal.h"
 
 typedef struct trace_key {
     pid_key_t p_key; // pid key as seen by the userspace (for example, inside its container)
@@ -19,7 +20,7 @@ struct {
     __type(key, trace_key_t);     // key: pid_tid
     __type(value, tp_info_pid_t); // value: traceparent info
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } server_traces SEC(".maps");
 
 struct {
@@ -41,7 +42,7 @@ struct {
     __type(key, pid_key_t);   // key: the child pid
     __type(value, pid_key_t); // value: the parent pid
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } clone_map SEC(".maps");
 
 static __always_inline unsigned char *tp_char_buf() {

diff --git a/bpf/tracing.h b/bpf/tracing.h
@@ -3,6 +3,7 @@
 #include "vmlinux.h"
 #include "trace_util.h"
 #include "http_types.h"
+#include "pin_internal.h"
 
 #define NANOSECONDS_PER_EPOCH (15LL * 1000000000LL) // 15 seconds
 #define NANOSECONDS_PER_IMM_EPOCH (100000000LL)     // 100 ms
@@ -12,7 +13,7 @@ struct {
     __type(key, connection_info_t); // key: the connection info
     __type(value, tp_info_pid_t);   // value: traceparent info
     __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
-    __uint(pinning, LIBBPF_PIN_BY_NAME);
+    __uint(pinning, BEYLA_PIN_INTERNAL);
 } trace_map SEC(".maps");
 
 struct {
@@ -110,4 +111,4 @@ static __always_inline void new_trace_id(tp_info_t *tp) {
     //clear_upper_trace_id(tp);
 }
 
-#endif
+#endif