wcbpf

package
v1.0.0-beta.24 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 3, 2026 License: Apache-2.0 Imports: 10 Imported by: 0

Documentation

Overview

Package wcbpf runs eBPF programs that feed wcprof's profiles. Each program is compiled into the engine and registered by name. It is loaded into the kernel and attached only while a recording asks for it by name (a profiled session's, or engine-wide recording's), and detached once no recording asks for it and no exec it measures is left. Every profiled exec that starts while programs are attached is measured by each of them, and what they measured is recorded on its exec.run op as it ends; an exec that started before a program was attached isn't measured by it.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Acquire

func Acquire(names []string) (release func(), err error)

Acquire asks for the named programs on behalf of a recording until release is called, attaching those not attached yet. An unknown name is an error. A program that can't be loaded (a kernel without BTF, say) is logged and noted in the profile's header, and the recording goes on without it.

func EngineWide

func EngineWide() []string

EngineWide returns the programs engine-wide recording asks for.

func KernelClock

func KernelClock() func(ns uint64) int64

KernelClock returns a conversion of times read by eBPF's bpf_ktime_get_ns, on the kernel's monotonic clock, to wcprof's clock, as wcprof.NowNS reads it. It's calibrated once, so converted times keep their kernel order and intervals. It converts 0 to 0, and every time to 0 when nothing is recorded.

func Names

func Names() []string

Names returns the registered programs' names, sorted.

func Register

func Register(p Program)

Register adds a program. Programs are registered at engine start.

func SetEngineWide

func SetEngineWide(names []string) error

SetEngineWide makes names the programs engine-wide recording asks for, in place of those it asked for before; none releases them. Programs in both stay attached.

Types

type Exec

type Exec struct {
	// contains filtered or unexported fields
}

Exec is an exec measured by the programs attached when it started.

func WatchExec

func WatchExec(resourceCgroup string, init bool) *Exec

WatchExec starts measuring a profiled exec by every program a recording asks for, given the path of its resource cgroup, before any of its processes (mount helpers included) starts; init is whether the engine's init starts its workload. It creates the cgroup, which the mount helpers' accounting and the runtime adopt, so the programs know it before the exec's first process. Nil when no program is attached.

func (*Exec) Finish

func (e *Exec) Finish(ctx context.Context, opID uint64)

Finish records what each program measured on the exec's op opID, once all the exec's processes have exited, and stops measuring it. A nil Exec does nothing.

type ExecInfo

type ExecInfo struct {
	// CgroupID is the ID of the exec's resource cgroup, which holds every
	// process of the exec: its container's, in the "container" child, and
	// its mount helpers', in leaves under the "sshfs" child.
	CgroupID uint64
	// Init is whether the engine's init (/.init) is the container's first
	// process and starts the workload; when it isn't, the first process is
	// the workload.
	Init bool
}

ExecInfo describes an exec a program measures.

type ExecWatch

type ExecWatch interface {
	// Finish stops measuring the exec, once all its processes have exited,
	// and records what was measured on its op opID.
	Finish(ctx context.Context, opID uint64)
}

ExecWatch is one exec measured by one program.

type Loaded

type Loaded interface {
	// WatchExec starts measuring an exec, before any of its processes
	// starts.
	WatchExec(e ExecInfo) (ExecWatch, error)
	// Close detaches the program and releases what it holds.
	Close() error
}

Loaded is a program attached to the kernel.

type Program

type Program struct {
	// Name is how recordings ask for the program.
	Name string
	// Load loads the program into the kernel and attaches it.
	Load func() (Loaded, error)
}

Program is an eBPF program that feeds wcprof.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL