Functionality used by Tetragon on Linux

[Lorenz Bauer (lmb)]

As discussed, here is a list of eBPF features used by Tetragon.

Maps:

All map types referenced in source code.

• BPF_MAP_TYPE_ARRAY
• BPF_MAP_TYPE_ARRAY_OF_MAPS
• BPF_MAP_TYPE_HASH
• BPF_MAP_TYPE_HASH_OF_MAPS
• BPF_MAP_TYPE_LPM_TRIE
• BPF_MAP_TYPE_LRU_HASH
• BPF_MAP_TYPE_PERCPU_ARRAY
• BPF_MAP_TYPE_PERCPU_HASH
• BPF_MAP_TYPE_PERF_EVENT_ARRAY
• BPF_MAP_TYPE_PROG_ARRAY
• BPF_MAP_TYPE_STACK_TRACE

Generator

rg -I -o -e '.+\(type, (BPF_MAP_TYPE_[A-Z_]+)\);' -r '$1' -g '*.h' -g '*.c' -g '!**/vmlinux.h' | sort -u

Helper calls:

All helper calls made from compiled programs.

• BPF_FUNC_map_lookup_elem = 1,
• BPF_FUNC_map_update_elem = 2,
• BPF_FUNC_map_delete_elem = 3,
• BPF_FUNC_probe_read = 4,
• BPF_FUNC_ktime_get_ns = 5,
• BPF_FUNC_get_smp_processor_id = 8,
• BPF_FUNC_tail_call = 12,
• BPF_FUNC_get_current_pid_tgid = 14,
• BPF_FUNC_perf_event_output = 25,
• BPF_FUNC_get_stackid = 27,
• BPF_FUNC_get_current_task = 35,
• BPF_FUNC_probe_read_str = 45,
• BPF_FUNC_override_return = 58,
• BPF_FUNC_get_current_cgroup_id = 80,
• BPF_FUNC_send_signal = 109,
• BPF_FUNC_get_attach_cookie = 174,
• BPF_FUNC_loop = 181,

Generator

In a checkout of tetragon, with BPF built.

#!/bin/bash

set -euo pipefail

for call in $(find . -name "*.o" -exec llvm-objdump -d --no-leading-addr {} \; | rg '85 00 [0-9a-z ]+\tcall (\d+)' -r '$1' -o | sort -uV); do
	rg -o "BPF_FUNC_.+? = $call," bpf/include/vmlinux.h
done

Program types:

All program sections used in source code.

• fmod_ret
• kprobe
• raw_tracepoint
• tracepoint
• uprobe

Generator

rg -I -o -e '.+\(type, (BPF_MAP_TYPE_[A-Z_]+)\);' -r '$1' -g '*.h' -g '*.c' -g '!**/vmlinux.h' | sort -u