ebpf

type CommonTracer interface {
	// Load the bpf object that is generated by the bpf2go compiler
	Load() (*ebpf.CollectionSpec, error)
	// AddCloser adds io.Closer instances that need to be invoked when the
	// Run function ends.
	AddCloser(c ...io.Closer)
	// BpfObjects that are created by the bpf2go compiler
	BpfObjects() any
	// Sets up any tail call tables if the BPF program has it
	SetupTailCalls()
}

type EventHandler func(ctx context.Context, events []RingbufEvent) error

type Instrumentable struct {
	Type                 svc.InstrumentableType
	InstrumentationError error

	// in some runtimes, like python gunicorn, we need to allow
	// tracing both the parent pid and all of its children pid
	ChildPids []uint32

	FileInfo *exec.FileInfo
	Offsets  *goexec.Offsets
	Tracer   *ProcessTracer

	LogEnricherEnabled bool
}

type KprobesTracer interface {
	CommonTracer
	// KProbes returns a map with the name of the kernel probes that need to be
	// tapped into. Start matches kprobe, End matches kretprobe
	KProbes() map[string]ebpfcommon.ProbeDesc
	Tracepoints() map[string]ebpfcommon.ProbeDesc
}

type Manager struct {
	// contains filtered or unexported fields
}

type ManagerConfig struct {
	// BTFPath is an optional path to a BTF file
	BTFPath string `mapstructure:"btf_path"`

	// PinPath is the path for pinning BPF objects
	PinPath string `mapstructure:"pin_path"`

	// LogLevel for eBPF verifier (0-2)
	LogLevel int `mapstructure:"log_level"`

	// LogSize for verifier log buffer
	LogSize int `mapstructure:"log_size"`

	// RemoveRlimit removes memory rlimit for BPF
	RemoveRlimit bool `mapstructure:"remove_rlimit"`
}

type ManagerStats struct {
	SpecsLoaded       int
	CollectionsLoaded int
	ProgramsLoaded    int
	LinksActive       int
}

type MapInfo struct {
	Name       string
	Type       MapType
	KeySize    uint32
	ValueSize  uint32
	MaxEntries uint32
	Flags      uint32
	Pinned     bool
	PinPath    string
}

type MapManager struct {
	// contains filtered or unexported fields
}

type MapManagerStats struct {
	MapsLoaded int
}

type MapSpec struct {
	Name       string
	Type       ebpf.MapType
	KeySize    uint32
	ValueSize  uint32
	MaxEntries uint32
	Flags      uint32
	Pinning    bool
}

type MapType string

type PIDsAccounter interface {
	// AllowPID notifies the tracer to accept traces from the process with the
	// provided PID. The Tracer should discard
	// traces from processes whose PID has not been allowed before
	// We must use a pointer for svc.Attrs so that all child processes share the same
	// object. This is important when we tag a service as exporting traces or metrics.
	AllowPID(uint32, uint32, *svc.Attrs)
	// BlockPID notifies the tracer to stop accepting traces from the process
	// with the provided PID. After receiving them via ringbuffer, it should
	// discard them.
	BlockPID(uint32, uint32)
}

type PerfEventHandler func(ctx context.Context, events []PerfbufEvent) error

type PerfEventHeader struct {
	// Type identifies the event type
	Type uint32
	// Flags contains event flags
	Flags uint32
	// Size is the total size of the event including header
	Size uint32
}

type PerfbufConfig struct {
	// PerCPUBufferSize is the size of each per-CPU buffer
	PerCPUBufferSize int `mapstructure:"per_cpu_buffer_size"`

	// Watermark is the number of bytes after which the buffer is flushed
	Watermark int `mapstructure:"watermark"`

	// Workers is the number of worker goroutines processing events
	Workers int `mapstructure:"workers"`

	// BatchSize is the number of events to batch before processing
	BatchSize int `mapstructure:"batch_size"`

	// FlushInterval is the max time to wait before processing a partial batch
	FlushInterval time.Duration `mapstructure:"flush_interval"`
}

type PerfbufEvent struct {
	// Raw is the raw event data
	Raw []byte

	// CPU is the CPU that generated the event
	CPU int

	// Timestamp is when the event was read
	Timestamp time.Time

	// Lost is the number of events lost before this one
	Lost uint64
}

type PerfbufReader struct {
	// contains filtered or unexported fields
}

type PerfbufStats struct {
	EventsReceived int64
	EventsDropped  int64
	EventsLost     int64
	BytesReceived  int64
}

type ProcessTracer struct {
	Programs []Tracer

	Type            ProcessTracerType
	Instrumentables map[uint64]*instrumenter
	// contains filtered or unexported fields
}

type ProcessTracerType int

type ProgramInfo struct {
	Name        string
	Type        ProgramType
	Tag         string
	ID          uint32
	LoadedAt    time.Time
	AttachPoint string
}

type ProgramType string

type RingbufConfig struct {
	// BufferSize is the size hint for the ring buffer reader
	BufferSize int `mapstructure:"buffer_size"`

	// Workers is the number of worker goroutines processing events
	Workers int `mapstructure:"workers"`

	// BatchSize is the number of events to batch before processing
	BatchSize int `mapstructure:"batch_size"`

	// FlushInterval is the max time to wait before processing a partial batch
	FlushInterval time.Duration `mapstructure:"flush_interval"`
}

type RingbufEvent struct {
	// Raw is the raw event data
	Raw []byte

	// Timestamp is when the event was read
	Timestamp time.Time
}

type RingbufReader struct {
	// contains filtered or unexported fields
}

type RingbufStats struct {
	EventsReceived int64
	EventsDropped  int64
	EventsLost     int64
	BytesReceived  int64
}

type Tracer interface {
	PIDsAccounter
	KprobesTracer
	// Constants returns a map of constants to be overridden into the eBPF program.
	// The key is the constant name and the value is the value to overwrite.
	Constants() map[string]any
	// GoProbes returns a slice with the name of Go functions that need to be inspected
	// in the executable, as well as the eBPF programs that optionally need to be
	// inserted as the Go function start and end probes
	GoProbes() map[string][]*ebpfcommon.ProbeDesc
	// UProbes returns a map with the module name mapping to the uprobes that need to be
	// tapped into. Start matches uprobe, End matches uretprobe
	UProbes() map[string]map[string][]*ebpfcommon.ProbeDesc
	// SocketFilters  returns a list of programs that need to be loaded as a
	// generic eBPF socket filter
	SocketFilters() []*ebpf.Program
	// SockMsgs returns a list of programs that need to be loaded as a
	// BPF_PROG_TYPE_SK_MSG eBPF programs
	SockMsgs() []ebpfcommon.SockMsg
	// SockOps returns a list of programs that need to be loaded as a
	// BPF_PROG_TYPE_SOCK_OPS eBPF programs
	SockOps() []ebpfcommon.SockOps
	// Iters returns a list of programs that need to be loaded as a
	// BPF_PROG_TYPE_TRACING with BPF_TRACE_ITER attach type
	Iters() []*ebpfcommon.Iter
	// Probes can potentially instrument a shared library among multiple executables
	// These two functions alow programs to remember this and avoid duplicated instrumentations
	// The argument is the OS file id
	// Closers are the associated closable resources to this lib, that may be
	// closed when UnlinkInstrumentedLib() is called
	RecordInstrumentedLib(uint64, []io.Closer)
	AddInstrumentedLibRef(uint64)
	AlreadyInstrumentedLib(uint64) bool
	UnlinkInstrumentedLib(uint64)
	RegisterOffsets(*exec.FileInfo, *goexec.Offsets)
	ProcessBinary(*exec.FileInfo)
	Required() bool
	// Run will do the action of listening for eBPF traces and forward them
	// periodically to the output channel.
	Run(context.Context, *ebpfcommon.EBPFEventContext, *msg.Queue[[]request.Span])
}

type UtilityTracer interface {
	KprobesTracer
	Run(context.Context)
}