cloudflare / cloudflare/ebpf_exporter

RFE: Pre-populate BPF maps with string keys and scalar values

Open
#638 0 comments 4 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2.6k
Forks
282
Avg merge
5d 7h
Merged PRs (30d)
8

Description

Add an ebpf-exporter feature to pre-populate BPF maps with string keys (and small scalar values) declared in the program's YAML config, so that match tables - UNIX socket paths, task comms, netdev names, exe path prefixes - can be maintained as data instead of BPF C code.

Several of our eBPF probes match a kernel-side string (`sun_path`, `task->comm`, `dev->name`, `exe` path) against a fixed list and emit a label per match. Today this is implemented as a chain of `__builtin_memcmp` calls against `#define`d constants, with a parallel `static_map` decoder in YAML mapping the `enum` back to a human-readable string. Two sources of truth, both compiled in.

Adding or removing an entry requires:
- Editing the `.bpf.c` (new `#define`, new `enum` value, new `memcmp` branch).
- Editing the `.yaml` (new `static_map` entry, kept in numeric sync with the `enum`).
- Rebuilding and redeploying the package.

ebpf-exporter already supports patching `const volatile u64 kaddr_*` globals from kallsyms at load time. We want the analogous mechanism for map contents.

# Proposal

Extend the YAML schema with a `maps:` section declaring initial entries to insert into named BPF maps after load, before attach. Strawman:

```yaml
maps:
monitored_paths: # name matches SEC(".maps") symbol
/run/dbus/system_bus_socket: 0
/run/systemd/journal/stdout: 1
/var/run/mysqld/mysqld.sock: 2
```

* Key encoding: string, zero-padded to the map's declared key size.
* Value: integer, matches map value size.
* Map types supported initially: `HASH`.
* Exporter fails loudly on size/type mismatch.

With this, [`match_unix_path()`](https://github.com/cloudflare/ebpf_exporter/blob/master/examples/unix-accept-latency.bpf.c#L38) collapses to one `bpf_map_lookup_elem()` and the static_map decoder in YAML can be derived from the same maps block (or kept separate - either is fine):

```c
struct path_key k = {};

bpf_probe_read_kernel_str(k.path, sizeof(k.path), addr->name[0].sun_path);
u32 *idx = bpf_map_lookup_elem(&monitored_paths, &k);
return idx ? *idx : -1;
```

Contributor guide

Open the contributing guide

Research direction

Start with the exporter’s YAML configuration and BPF map-loading path, then use examples/unix-accept-latency.bpf.c and match_unix_path() as the behavior reference. Done means HASH maps accept declared string keys and scalar values after load and before attach, reject size or type mismatches, and support the proposed example configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, go, linux, yaml
Domain
devtools, observability
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.