feat: Add ebpf exporter

* Refactor cgroup detection into separate file. We should be able to use the struct in different collectors

* Use go routines in perf collector to update

Signed-off-by: Mahendra Paipuri <mahendra.paipuri@gmail.com>

Author: mahendrapaipuri

Makefile

@@ -40,6 +40,9 @@ else
 	test-docker := test-docker
 endif
 
+# Base test flags
+test-flags := -covermode=atomic -race
+
 # Use CGO for api and GO for ceems_exporter.
 PROMU_TEST_CONF ?= .promu-go-test.yml
 ifeq ($(CGO_BUILD), 1)
@@ -67,8 +70,13 @@ else
 
 	# go test flags
 	coverage-file := coverage-go.out
+
+	# If running in CI add -exec sudo flags to run tests that require privileges
+	ifeq ($(CI), true)
+		test-flags := $(test-flags) -exec sudo
+	endif
 endif
-test-flags := -covermode=atomic -coverprofile=$(coverage-file).tmp -race
+test-flags := $(test-flags) -coverprofile=$(coverage-file).tmp
 
 ifeq ($(GOHOSTOS), linux)
 	test-e2e := test-e2e

Makefile.common

@@ -193,6 +193,11 @@ ifeq ($(CGO_BUILD), 1)
 endif
 	@echo ">> building test binaries"
 	$(PROMU_TEST) build --prefix $(PREFIX) $(PROMU_BINARIES)
+endif
+ifeq ($(CGO_BUILD), 0)
+	@echo ">> building bpf assets"
+	$(MAKE) -C ./pkg/collector/bpf clean
+	$(MAKE) -C ./pkg/collector/bpf
 endif
 	@echo ">> building binaries"
 	$(PROMU) build --prefix $(PREFIX) $(PROMU_BINARIES)

README.md

@@ -3,7 +3,7 @@
 
 |         |                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| CI/CD   | [![ci](https://github.com/mahendrapaipuri/ceems/workflows/CI/badge.svg)](https://github.com/mahendrapaipuri/ceems) [![CircleCI](https://dl.circleci.com/status-badge/img/circleci/8jSYT1wyKY8mKQRTqNLThX/TzM1Mr3AEAqmehnoCde19R/tree/main.svg?style=svg&circle-token=28db7268f3492790127da28e62e76b0991d59c8b)](https://dl.circleci.com/status-badge/redirect/circleci/8jSYT1wyKY8mKQRTqNLThX/TzM1Mr3AEAqmehnoCde19R/tree/main)  [![Coverage](https://img.shields.io/badge/Coverage-76.0%25-brightgreen)](https://github.com/mahendrapaipuri/ceems/actions/workflows/ci.yml?query=branch%3Amain)                                                                                          |
+| CI/CD   | [![ci](https://github.com/mahendrapaipuri/ceems/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/mahendrapaipuri/ceems/actions/workflows/ci.yml?query=branch%3Amain) [![CircleCI](https://dl.circleci.com/status-badge/img/circleci/8jSYT1wyKY8mKQRTqNLThX/TzM1Mr3AEAqmehnoCde19R/tree/main.svg?style=svg&circle-token=28db7268f3492790127da28e62e76b0991d59c8b)](https://dl.circleci.com/status-badge/redirect/circleci/8jSYT1wyKY8mKQRTqNLThX/TzM1Mr3AEAqmehnoCde19R/tree/main)  [![Coverage](https://img.shields.io/badge/Coverage-76.0%25-brightgreen)](https://github.com/mahendrapaipuri/ceems/actions/workflows/ci.yml?query=branch%3Amain)                                                                                          |
 | Docs    | [![docs](https://img.shields.io/badge/docs-passing-green?style=flat&link=https://mahendrapaipuri.github.io/ceems/docs/)](https://mahendrapaipuri.github.io/ceems/)                                                                                                                                                                                                                               |
 | Package | [![Release](https://img.shields.io/github/v/release/mahendrapaipuri/ceems.svg?include_prereleases)](https://github.com/mahendrapaipuri/ceems/releases/latest)                                                                                                                                                                     |
 | Meta    | [![GitHub License](https://img.shields.io/github/license/mahendrapaipuri/ceems)](https://github.com/mahendrapaipuri/ceems) [![Go Report Card](https://goreportcard.com/badge/github.com/mahendrapaipuri/ceems)](https://goreportcard.com/report/github.com/mahendrapaipuri/ceems) [![code style](https://img.shields.io/badge/code%20style-gofmt-blue.svg)](https://pkg.go.dev/cmd/gofmt) |

go.mod

@@ -4,6 +4,7 @@ go 1.22.5
 
 require (
 	github.com/alecthomas/kingpin/v2 v2.4.0
+	github.com/cilium/ebpf v0.11.0
 	github.com/containerd/cgroups/v3 v3.0.4-0.20240117155926-c00d22e55fef
 	github.com/go-chi/httprate v0.14.1
 	github.com/go-kit/log v0.2.1
@@ -30,7 +31,6 @@ require (
 	github.com/alecthomas/units v0.0.0-20231202071711-9a357b53e9c9 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cilium/ebpf v0.11.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/docker/go-units v0.5.0 // indirect

pkg/collector/bpf/.gitignore

@@ -0,0 +1,3 @@
+# Ignore objs and deps 
+objs/
+deps/ 

pkg/collector/bpf/Makefile

@@ -0,0 +1,105 @@
+.PHONY: all clean
+.SUFFIXES:
+
+include ./Makefile.common
+
+VFSDIR := vfs/
+NETWORKDIR := network/
+BPFTESTDIR := test/
+
+NETWORK = bpf_network.o
+VFS = bpf_vfs.o bpf_vfs_v511.o bpf_vfs_v62.o
+# BPFTEST = bpf_lseek.o
+
+OBJSDIR       := objs/
+DEPSDIR       := deps/
+
+VFSOBJ        := $(addprefix $(OBJSDIR),$(VFS))
+NETWORKOBJ    := $(addprefix $(OBJSDIR),$(NETWORK))
+TESTOBJ       := $(addprefix $(OBJSDIR),$(BPFTEST))
+OBJS          := $(VFSOBJ) $(NETWORKOBJ) $(TESTOBJ)
+LLOBJS        := $(patsubst $(OBJSDIR)%.o,$(OBJSDIR)%.ll,$(OBJS))
+DEPS          := $(patsubst $(OBJSDIR)%.ll,$(DEPSDIR)%.d,$(LLOBJS))
+
+all: $(OBJS) $(DEPS)
+
+# NB: https://www.gnu.org/software/make/manual/html_node/Prerequisite-Types.html
+$(OBJS): | $(OBJSDIR)
+$(DEPS): | $(DEPSDIR)
+$(LLOBJS): | $(OBJSDIR)
+
+$(OBJSDIR):
+	mkdir $(OBJSDIR)
+
+$(DEPSDIR):
+	mkdir $(DEPSDIR)
+
+define DEFINE_VARIANT
+VAR := $1
+deps/bpf_vfs_$$(VAR).d: vfs/bpf_vfs.c
+endef
+
+# Generic build targets for each sub-dir
+
+$(eval $(call DEFINE_VARIANT,v511))
+$(eval $(call DEFINE_VARIANT,v62))
+
+# Build only for relevant architectures
+ifeq ($(BPF_TARGET_COMPILE),1)
+
+# VFSDIR
+objs/%.ll: $(VFSDIR)%.c
+	$(CLANG) $(CLANG_FLAGS) -D__KERNEL_POST_v62 -c $< -o $@
+
+objs/%_v511.ll:
+	$(CLANG) $(CLANG_FLAGS) -D__KERNEL_PRE_v511 -c $< -o $@
+
+objs/%_v62.ll:
+	$(CLANG) $(CLANG_FLAGS) -D__KERNEL_POST_v512_PRE_v62 -c $< -o $@
+
+$(DEPSDIR)%.d: $(VFSDIR)%.c
+	$(CLANG) $(CLANG_FLAGS) -D__KERNEL_POST_v62 -MM -MP -MT $(patsubst $(DEPSDIR)%.d, $(OBJSDIR)%.ll, $@)   $< > $@
+
+$(DEPSDIR)%_v511.d:
+	$(CLANG) $(CLANG_FLAGS) -D__KERNEL_PRE_v511 -MM -MP -MT $(patsubst $(DEPSDIR)%.d, $(OBJSDIR)%.ll, $@)   $< > $@
+
+$(DEPSDIR)%_v62.d:
+	$(CLANG) $(CLANG_FLAGS) -D__KERNEL_POST_v512_PRE_v62 -MM -MP -MT $(patsubst $(DEPSDIR)%.d, $(OBJSDIR)%.ll, $@)   $< > $@
+
+# NETWORKDIR
+objs/%.ll: $(NETWORKDIR)%.c
+	$(CLANG) $(CLANG_FLAGS) -c $< -o $@
+
+$(DEPSDIR)%.d: $(NETWORKDIR)%.c
+	$(CLANG) $(CLANG_FLAGS) -MM -MP -MT $(patsubst $(DEPSDIR)%.d, $(OBJSDIR)%.ll, $@)   $< > $@
+
+# BPFTESTDIR
+objs/%.ll: $(BPFTESTDIR)%.c
+	$(CLANG) $(CLANG_FLAGS) -c $< -o $@
+
+$(DEPSDIR)%.d: $(BPFTESTDIR)%.c
+	$(CLANG) $(CLANG_FLAGS) -MM -MP -MT $(patsubst $(DEPSDIR)%.d, $(OBJSDIR)%.ll, $@)   $< > $@
+
+# Remaining objects are built without mcpu=v2
+objs/%.o: objs/%.ll
+	$(LLC) $(LLC_FLAGS) -filetype=obj $< -o $@
+
+# include dependencies, see https://lists.gnu.org/archive/html/make-w32/2004-03/msg00062.html
+ifeq (,$(filter $(MAKECMDGOALS),clean run-test))
+-include $(DEPS)
+endif
+
+endif
+
+# the 'test' target is already taken
+run-test:
+	$(MAKE) -C tests test
+
+# SUBDIRS=tests
+
+clean:
+	@$(ECHO_CLEAN)
+	$(QUIET) $(foreach TARGET,$(SUBDIRS), \
+		$(MAKE) -C $(TARGET) clean)
+	$(QUIET)rm -f $(OBJSDIR)*.{o,ll,i,s}
+	$(QUIET)rm -f $(DEPSDIR)*.d 

pkg/collector/bpf/Makefile.common

@@ -0,0 +1,72 @@
+SHELL=/bin/bash # needed for the *.{o,ll,i,s} pattern in the clean target
+
+CLANG  ?= clang
+LLC    ?= llc
+
+# Build the BPF programs for the detected architecture, default to x86, and
+# allow easy overriding by using ?= for cross-compilation
+# UNAME_M := $(shell uname -m)
+# ifeq ($(UNAME_M),x86_64)
+# 	BPF_TARGET_ARCH ?= x86
+# endif
+# ifeq ($(UNAME_M),aarch64)
+# 	BPF_TARGET_ARCH ?= arm64
+# endif
+
+# Get cross-compiling flags from GOARCH env variable
+# Endians are picked up https://github.com/cilium/ebpf/blob/625b0a910e1ba666e483e75b149880ce3b54dc85/cmd/bpf2go/gen/target.go#L14-L28
+BPF_TARGET_ARCH ?= x86
+BPF_TARGET_MARCH ?= bpf
+BPF_TARGET_COMPILE ?= 1
+ifeq ($(GOARCH),386)
+	BPF_TARGET_ARCH = x86
+	BPF_TARGET_MARCH = bpfel
+else ifeq ($(GOARCH),amd64)
+	BPF_TARGET_ARCH = x86
+	BPF_TARGET_MARCH = bpfel
+else ifeq ($(GOARCH),arm64)
+	BPF_TARGET_ARCH = arm64
+	BPF_TARGET_MARCH = bpfel
+else ifeq ($(GOARCH),mpis)
+	BPF_TARGET_ARCH = mips
+	BPF_TARGET_MARCH = bpfeb
+else ifeq ($(GOARCH),ppc64)
+	BPF_TARGET_ARCH = powerpc
+	BPF_TARGET_MARCH = bpfeb
+else ifeq ($(GOARCH),ppc64le)
+	BPF_TARGET_ARCH = powerpc
+	BPF_TARGET_MARCH = bpfel
+else ifeq ($(GOARCH),riscv64)
+	BPF_TARGET_ARCH = riscv
+	BPF_TARGET_MARCH = bpfel
+else ifeq ($(GOARCH),s390x)
+	BPF_TARGET_ARCH = s390
+	BPF_TARGET_MARCH = bpfeb
+endif
+
+# Do not compile BPF assets for mipsle, mips64 and mips64le architectures
+ifeq ($(GOARCH),mipsle)   
+   BPF_TARGET_COMPILE = 0
+endif
+ifeq ($(GOARCH),mips64)  
+   BPF_TARGET_COMPILE = 0
+endif
+ifeq ($(GOARCH),mips64le)
+   BPF_TARGET_COMPILE = 0
+endif
+
+ROOT_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
+
+IDIR = $(ROOT_DIR)include/
+LIBBPF = $(ROOT_DIR)libbpf/
+LDIR = $(ROOT_DIR)lib
+DEPS = $(patsubst %,$(IDIR)/%,$(_DEPS))
+
+FLAGS := -I$(ROOT_DIR) \
+	 -Wall -Werror \
+	 -Wno-address-of-packed-member -Wno-compare-distinct-pointer-types -Wno-unknown-warning-option \
+	 -O2
+
+CLANG_FLAGS += $(FLAGS) -I $(LIBBPF) -I $(IDIR) -I $(LDIR) -target bpf -emit-llvm -g -D__TARGET_ARCH_$(BPF_TARGET_ARCH) -fdebug-default-version=4
+LLC_FLAGS   := -march=$(BPF_TARGET_MARCH) -mcpu=v2 -mattr=dwarfris
+LLC_FLAGS_ALU32 := -march=$(BPF_TARGET_MARCH) -mcpu=v3 -mattr=dwarfris 

pkg/collector/bpf/README.md

@@ -0,0 +1 @@
+ 

pkg/collector/bpf/include/compiler.h

@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: (GPL-3.0-only) */
+
+#ifndef MAX_MAP_ENTRIES
+#define MAX_MAP_ENTRIES 256
+#endif
+
+#define FUNC_INLINE static inline __attribute__((always_inline))
+
+/*
+ * Following define is to assist VSCode Intellisense so that it treats
+ * __builtin_preserve_access_index() as a const void * instead of a
+ * simple void (because it doesn't have a definition for it). This stops
+ * Intellisense marking all _(P) macros (used in probe_read()) as errors.
+ * To use this, just define VSCODE in 'C/C++: Edit Configurations (JSON)'
+ * in the Command Palette in VSCODE (F1 or View->Command Palette...):
+ *    "defines": ["VSCODE"]
+ * under configurations.
+ */
+#ifdef VSCODE
+const void *__builtin_preserve_access_index(void *);
+#endif
+#define _(P) (__builtin_preserve_access_index(P))
+
+#ifndef likely
+# define likely(X)		__builtin_expect(!!(X), 1)
+#endif
+
+#ifndef unlikely
+# define unlikely(X)    __builtin_expect(!!(X), 0)
+#endif
+
+#ifndef __inline__
+# define __inline__		__attribute__((always_inline))
+#endif
+
+#define DEBUG
+#ifdef DEBUG
+/* Only use this for debug output. Notice output from bpf_trace_printk()
+ * ends up in /sys/kernel/debug/tracing/trace_pipe
+ */
+#define bpf_debug(fmt, ...)                                                    \
+	({                                                                     \
+		char ____fmt[] = fmt;                                          \
+		bpf_trace_printk(____fmt, sizeof(____fmt), ##__VA_ARGS__);     \
+	})
+#else
+#define bpf_debug(fmt, ...){;}
+#endif
+
+// Just to ensure that we can use vfs_write/vfs_read calls
+// Picked from https://github.com/torvalds/linux/blob/master/tools/include/linux/types.h#L56
+#ifndef __user
+#define __user
+#endif

pkg/collector/bpf/include/net_shared.h

@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: (GPL-3.0-only) */
+
+#ifndef _NET_SHARED_H
+#define _NET_SHARED_H
+
+#define AF_INET		2
+#define AF_INET6	10
+
+#define ETH_ALEN 6
+#define ETH_P_802_3_MIN 0x0600
+#define ETH_P_8021Q 0x8100
+#define ETH_P_8021AD 0x88A8
+#define ETH_P_IP 0x0800
+#define ETH_P_IPV6 0x86DD
+#define ETH_P_ARP 0x0806
+#define IPPROTO_ICMPV6 58
+
+#define TC_ACT_OK		0
+#define TC_ACT_SHOT		2
+
+#define IFNAMSIZ 16
+
+#if defined(__BYTE_ORDER__) && defined(__ORDER_LITTLE_ENDIAN__) && \
+	__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+#define bpf_ntohs(x)		__builtin_bswap16(x)
+#define bpf_htons(x)		__builtin_bswap16(x)
+#elif defined(__BYTE_ORDER__) && defined(__ORDER_BIG_ENDIAN__) && \
+	__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+#define bpf_ntohs(x)		(x)
+#define bpf_htons(x)		(x)
+#else
+# error "Endianness detection needs to be set up for your compiler?!"
+#endif
+
+#endif