Skip to content

Commit 6bea191

Browse files
qjeromeqjerome
committed
refactor: turn error event into log event
- more accurate terminology as a log can be either info/warn/error - refactored eBPF error and warn macro to handle all the cases - removed error_msg and warn_msg macros - renamed structures and enums to turn "error" terminology to "log"
1 parent 4d13bcc commit 6bea191

File tree

13 files changed

+65
-69
lines changed

13 files changed

+65
-69
lines changed

‎kunai-common/src/bpf_events.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -134,8 +134,8 @@ pub enum Type {
134134
Correlation,
135135
#[str("cache_hash")]
136136
CacheHash,
137-
#[str("error")]
138-
Error,
137+
#[str("log")]
138+
Log,
139139
#[str("syscore_resume")]
140140
SyscoreResume,
141141

‎kunai-common/src/bpf_events/events.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ mod mount;
3030
pub use mount::*;
3131
mod prctl;
3232
pub use prctl::*;
33-
pub mod error;
34-
pub use error::{ErrorData, ErrorEvent};
33+
pub mod log;
34+
pub use log::{LogData, LogEvent};
3535
mod syscore_resume;
3636
pub use syscore_resume::*;
3737
mod kill;
@@ -85,7 +85,7 @@ const fn max_bpf_event_size() -> usize {
8585
| Type::FileCreate => FileEvent::size_of(),
8686
Type::FileRename => FileRenameEvent::size_of(),
8787
Type::FileUnlink => UnlinkEvent::size_of(),
88-
Type::Error => ErrorEvent::size_of(),
88+
Type::Log => LogEvent::size_of(),
8989
Type::SyscoreResume => SysCoreResumeEvent::size_of(),
9090
// these are event types only used in user land
9191
Type::Unknown

‎kunai-common/src/bpf_events/events/error.rs renamed to ‎kunai-common/src/bpf_events/events/log.rs

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,18 @@ use crate::{
55
string::String,
66
};
77

8-
pub type ErrorEvent = Event<ErrorData>;
8+
pub type LogEvent = Event<LogData>;
99

10+
#[repr(C)]
1011
#[derive(Clone, Copy)]
1112
pub enum Level {
13+
Info,
1214
Warn,
1315
Error,
1416
}
1517

1618
#[repr(C)]
17-
pub struct ErrorData {
19+
pub struct LogData {
1820
pub location: String<32>,
1921
pub line: u32,
2022
pub level: Level,
@@ -28,7 +30,7 @@ bpf_target_code! {
2830

2931
const DEFAULT_COMM: String<16> = string::from_static("?");
3032

31-
impl ErrorEvent {
33+
impl LogEvent {
3234
#[inline(always)]
3335
pub fn init_with_level(&mut self, level: Level){
3436
let pid_tgid = bpf_get_current_pid_tgid();
@@ -41,7 +43,7 @@ bpf_target_code! {
4143
}
4244

4345
not_bpf_target_code! {
44-
impl core::fmt::Display for ErrorEvent {
46+
impl core::fmt::Display for LogEvent {
4547
fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
4648
write!(
4749
f,

‎kunai-common/src/bpf_events/events/perfs.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ pub const KUNAI_EVENTS_MAP: &str = "KUNAI_EVENTS";
44
pub const KUNAI_STATS_MAP: &str = "KUNAI_STATS";
55

66
bpf_target_code! {
7-
use crate::bpf_events::{Event,Type, ErrorEvent};
7+
use crate::bpf_events::{Event,Type, LogEvent};
88
use aya_ebpf::{macros::map, maps::{HashMap,PerfEventByteArray}, EbpfContext};
99

1010
#[map(name = "KUNAI_EVENTS")]
@@ -15,7 +15,7 @@ bpf_target_code! {
1515

1616

1717
#[inline(always)]
18-
pub unsafe fn pipe_error<C: EbpfContext>(ctx: &C, e: &ErrorEvent) {
18+
pub unsafe fn pipe_log<C: EbpfContext>(ctx: &C, e: &LogEvent) {
1919
EVENTS.output(ctx, e.encode(), 0);
2020
}
2121

‎kunai-common/src/errors/bpf.rs

Lines changed: 28 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,18 @@
11
use aya_ebpf::{macros::map, maps::LruPerCpuHashMap, EbpfContext};
22

33
use crate::{
4-
bpf_events::{error, ErrorEvent},
4+
bpf_events::{log, LogEvent},
55
string::String,
66
};
77

88
#[allow(unused_imports)]
99
use super::*;
1010

1111
#[map]
12-
pub static mut ERRORS: LruPerCpuHashMap<u32, ErrorEvent> =
13-
LruPerCpuHashMap::with_max_entries(16, 0);
12+
pub static mut LOGS: LruPerCpuHashMap<u32, LogEvent> = LruPerCpuHashMap::with_max_entries(16, 0);
1413

15-
const SIZE: usize = ErrorEvent::size_of();
16-
pub static EMPTY_ERROR: [u8; SIZE] = [0; SIZE];
14+
const SIZE: usize = LogEvent::size_of();
15+
pub static EMPTY_LOG: [u8; SIZE] = [0; SIZE];
1716

1817
#[macro_export]
1918
macro_rules! probe_name {
@@ -90,27 +89,27 @@ pub struct Args {
9089
pub location: String<32>,
9190
pub message: Option<String<64>>,
9291
pub err: Option<ProbeError>,
93-
pub level: error::Level,
92+
pub level: log::Level,
9493
}
9594

9695
#[inline(always)]
97-
pub unsafe fn error_with_args<C: EbpfContext>(ctx: &C, args: &Args) {
98-
let _ = ERRORS.insert(&0, &(*(EMPTY_ERROR.as_ptr() as *const ErrorEvent)), 0);
99-
if let Some(e) = ERRORS.get_ptr_mut(&0) {
96+
pub unsafe fn log_with_args<C: EbpfContext>(ctx: &C, args: &Args) {
97+
let _ = LOGS.insert(&0, &(*(EMPTY_LOG.as_ptr() as *const LogEvent)), 0);
98+
if let Some(e) = LOGS.get_ptr_mut(&0) {
10099
let e = &mut *e;
101100
e.init_with_level(args.level);
102-
e.info.etype = bpf_events::Type::Error;
101+
e.info.etype = bpf_events::Type::Log;
103102
e.data.location.copy_from(&args.location);
104103
e.data.line = args.line;
105104
e.data.error = args.err;
106105
e.data.message = args.message;
107106

108-
bpf_events::pipe_error(ctx, e);
107+
bpf_events::pipe_log(ctx, e);
109108
}
110109
}
111110

112111
#[macro_export]
113-
macro_rules! _error {
112+
macro_rules! log {
114113
($ctx:expr, $msg:literal, $err:expr, $level:expr) => {{
115114
unsafe {
116115
const _PROBE_NAME: $crate::string::String<32> = $crate::probe_name!();
@@ -130,53 +129,44 @@ macro_rules! _error {
130129
level: $level,
131130
};
132131

133-
$crate::errors::error_with_args($ctx, &args);
132+
$crate::errors::log_with_args($ctx, &args);
134133
};
135134
}};
136135
}
137136

138137
#[macro_export]
139138
macro_rules! error {
140-
($ctx:expr, $err:expr) => {{
141-
$crate::error!($ctx, "", $err)
142-
}};
143-
144-
($ctx:expr, $msg:literal, $err:expr) => {{
145-
$crate::_error!(
146-
$ctx,
147-
$msg,
148-
Some($err),
149-
$crate::bpf_events::error::Level::Error
150-
);
151-
}};
152-
}
153-
154-
#[macro_export]
155-
macro_rules! error_msg {
139+
// literal must be evaluated first
156140
($ctx:expr, $msg:literal) => {
157-
$crate::_error!($ctx, $msg, None, $crate::bpf_events::error::Level::Error)
141+
$crate::log!($ctx, $msg, None, $crate::bpf_events::log::Level::Error)
158142
};
159-
}
160143

161-
#[macro_export]
162-
macro_rules! warn {
163144
($ctx:expr, $err:expr) => {
164-
$crate::warn!($ctx, "", $err);
145+
$crate::log!($ctx, "", Some($err), $crate::bpf_events::log::Level::Error)
165146
};
166147

167148
($ctx:expr, $msg:literal, $err:expr) => {
168-
$crate::_error!(
149+
$crate::log!(
169150
$ctx,
170151
$msg,
171152
Some($err),
172-
$crate::bpf_events::error::Level::Warn
153+
$crate::bpf_events::log::Level::Error
173154
);
174155
};
175156
}
176157

177158
#[macro_export]
178-
macro_rules! warn_msg {
159+
macro_rules! warn {
160+
// literal must be evaluated first
179161
($ctx:expr, $msg:literal) => {
180-
$crate::_error!($ctx, $msg, None, $crate::bpf_events::error::Level::Warn)
162+
$crate::log!($ctx, $msg, None, $crate::bpf_events::log::Level::Warn)
163+
};
164+
165+
($ctx:expr, $err:expr) => {
166+
$crate::log!($ctx, "", Some($err), $crate::bpf_events::log::Level::Warn);
167+
};
168+
169+
($ctx:expr, $msg:literal, $err:expr) => {
170+
$crate::log!($ctx, $msg, Some($err), $crate::bpf_events::log::Level::Warn);
181171
};
182172
}

‎kunai-ebpf/src/probes.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@ use kunai_common::{
55
bpf_events::*,
66
co_re,
77
consts::*,
8-
error, error_msg,
8+
error,
99
errors::{self, *},
1010
inspect_err,
1111
path::{self, *},
1212
utils::*,
13-
warn, warn_msg,
13+
warn,
1414
};
1515

1616
#[cfg(feature = "debug")]

‎kunai-ebpf/src/probes/bpf.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ unsafe fn try_bpf_prog_load(ctx: &RetProbeContext) -> ProbeResult<()> {
7272
if let Some(p_name) = bpf_prog_aux.name() {
7373
ignore_result!(inspect_err!(
7474
event.data.name.read_kernel_str_bytes(p_name),
75-
|_| warn_msg!(ctx, "failed to read program name")
75+
|_| warn!(ctx, "failed to read program name")
7676
));
7777
}
7878

@@ -90,7 +90,7 @@ unsafe fn try_bpf_prog_load(ctx: &RetProbeContext) -> ProbeResult<()> {
9090
if let Some(afn) = bpf_prog_aux.attach_func_name() {
9191
ignore_result!(inspect_err!(
9292
event.data.attached_func_name.read_kernel_str_bytes(afn),
93-
|_| warn_msg!(ctx, "failed to read attach_func_name")
93+
|_| warn!(ctx, "failed to read attach_func_name")
9494
));
9595
}
9696

@@ -102,7 +102,7 @@ unsafe fn try_bpf_prog_load(ctx: &RetProbeContext) -> ProbeResult<()> {
102102

103103
pipe_event(ctx, event);
104104
} else {
105-
error_msg!(ctx, "failed to retrieve BPF program load event")
105+
error!(ctx, "failed to retrieve BPF program load event")
106106
}
107107

108108
// we use a LruHashmap so we can safely ignore result

‎kunai-ebpf/src/probes/bpf_socket.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ unsafe fn handle_socket_attach_prog(
122122
}
123123

124124
//handle loading of regular bpf program
125-
warn_msg!(exit_ctx, "bpf program attached to socket not yet supported");
125+
warn!(exit_ctx, "bpf program attached to socket not yet supported");
126126

127127
Ok(())
128128
}

‎kunai-ebpf/src/probes/execve.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ unsafe fn execve_event<C: EbpfContext>(ctx: &C, rc: i32) -> ProbeResult<()> {
131131
.read_user_at(arg_start as *const u8, arg_len as u32)
132132
.is_err()
133133
{
134-
warn_msg!(ctx, "failed to read argv")
134+
warn!(ctx, "failed to read argv")
135135
}
136136

137137
// cgroup parsing

‎kunai-ebpf/src/probes/fs.rs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -138,15 +138,15 @@ unsafe fn limit_eps_with_context<C: EbpfContext>(ctx: &C) -> ProbeResult<bool> {
138138
// we allow a process to take alone half of this otherwise we report it
139139
if let (true, limit) = is_task_io_limit_reach(task_limit) {
140140
if limit {
141-
error_msg!(ctx, "current task i/o limit reached");
141+
error!(ctx, "current task i/o limit reached");
142142
}
143143
return Ok(true);
144144
}
145145

146146
// if there are too many I/O globally a random task can see its I/O ignored
147147
if let (true, limit) = is_global_io_limit_reach(glob_limit) {
148148
if limit {
149-
error_msg!(ctx, "global i/o limit reached");
149+
error!(ctx, "global i/o limit reached");
150150
}
151151
return Ok(true);
152152
}
@@ -221,7 +221,7 @@ unsafe fn try_vfs_read(ctx: &ProbeContext) -> ProbeResult<()> {
221221
}
222222

223223
// we mark file as being tracked
224-
ignore_result!(inspect_err!(file_set_flag(&file, READ), |_| warn_msg!(
224+
ignore_result!(inspect_err!(file_set_flag(&file, READ), |_| warn!(
225225
ctx,
226226
"failed to track file read"
227227
)));
@@ -297,7 +297,7 @@ unsafe fn try_vfs_write(ctx: &ProbeContext) -> ProbeResult<()> {
297297
}
298298

299299
// we mark file as being tracked
300-
ignore_result!(inspect_err!(file_set_flag(&file, WRITE), |_| warn_msg!(
300+
ignore_result!(inspect_err!(file_set_flag(&file, WRITE), |_| warn!(
301301
ctx,
302302
"failed to track file write"
303303
)));

0 commit comments

Comments
 (0)