Reduce BPF memory consumption

bpf/go_common.h

@@ -17,7 +17,6 @@
 #include "map_sizing.h"
 #include "bpf_dbg.h"
 #include "http_trace.h"
-#include "ringbuf.h"
 #include "tracing.h"
 #include "trace_util.h"
 #include "go_traceparent.h"

bpf/go_grpc.c

@@ -18,6 +18,7 @@
 #include "go_common.h"
 #include "go_traceparent.h"
 #include "hpack.h"
+#include "ringbuf.h"
 
 typedef struct grpc_srv_func_invocation {
     u64 start_monotime_ns;

bpf/go_nethttp.c

@@ -1,3 +1,6 @@
+// Copyright The OpenTelemetry Authors
+// Copyright Grafana Labs
+//
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -21,6 +24,7 @@
 #include "http_types.h"
 #include "tracing.h"
 #include "hpack.h"
+#include "ringbuf.h"
 
 typedef struct http_func_invocation {
     u64 start_monotime_ns;
@@ -693,3 +697,87 @@ int uprobe_persistConnRoundTrip(struct pt_regs *ctx) {
 
     return 0;
 }
+
+// SQL support
+// This implementation was inspired by https://github.com/open-telemetry/opentelemetry-go-instrumentation/blob/ca1afccea6ec520d18238c3865024a9f5b9c17fe/internal/pkg/instrumentors/bpf/database/sql/bpf/probe.bpf.c
+// and has been modified since.
+
+typedef struct sql_func_invocation {
+    u64 start_monotime_ns;
+    u64 sql_param;
+    u64 query_len;
+    tp_info_t tp;
+} sql_func_invocation_t;
+
+struct {
+    __uint(type, BPF_MAP_TYPE_HASH);
+    __type(key, void *); // key: pointer to the request goroutine
+    __type(value, sql_func_invocation_t);
+    __uint(max_entries, MAX_CONCURRENT_REQUESTS);
+} ongoing_sql_queries SEC(".maps");
+
+SEC("uprobe/queryDC")
+int uprobe_queryDC(struct pt_regs *ctx) {
+    bpf_dbg_printk("=== uprobe/queryDC === ");
+    void *goroutine_addr = GOROUTINE_PTR(ctx);
+    bpf_dbg_printk("goroutine_addr %lx", goroutine_addr);
+
+    void *sql_param = GO_PARAM8(ctx);
+    void *query_len = GO_PARAM9(ctx);
+
+    sql_func_invocation_t invocation = {
+        .start_monotime_ns = bpf_ktime_get_ns(),
+        .sql_param = (u64)sql_param,
+        .query_len = (u64)query_len,
+        .tp = {0}
+    };
+
+    // We don't look up in the headers, no http/grpc request, therefore 0 as last argument
+    client_trace_parent(goroutine_addr, &invocation.tp, 0);
+
+    // Write event
+    if (bpf_map_update_elem(&ongoing_sql_queries, &goroutine_addr, &invocation, BPF_ANY)) {
+        bpf_dbg_printk("can't update map element");
+    }
+
+    return 0;
+}
+
+SEC("uprobe/queryDC")
+int uprobe_queryDCReturn(struct pt_regs *ctx) {
+
+    bpf_dbg_printk("=== uprobe/queryDC return === ");
+    void *goroutine_addr = GOROUTINE_PTR(ctx);
+    bpf_dbg_printk("goroutine_addr %lx", goroutine_addr);
+
+    sql_func_invocation_t *invocation = bpf_map_lookup_elem(&ongoing_sql_queries, &goroutine_addr);
+    if (invocation == NULL) {
+        bpf_dbg_printk("Request not found for this goroutine");
+        return 0;
+    }
+    bpf_map_delete_elem(&ongoing_sql_queries, &goroutine_addr);
+
+    sql_request_trace *trace = bpf_ringbuf_reserve(&events, sizeof(sql_request_trace), 0);
+    if (trace) {
+        task_pid(&trace->pid);
+        trace->type = EVENT_SQL_CLIENT;
+        trace->start_monotime_ns = invocation->start_monotime_ns;
+        trace->end_monotime_ns = bpf_ktime_get_ns();
+
+        void *resp_ptr = GO_PARAM1(ctx);
+        trace->status = (resp_ptr == NULL);
+        trace->tp = invocation->tp;
+
+        u64 query_len = invocation->query_len;
+        if (query_len > sizeof(trace->sql)) {
+            query_len = sizeof(trace->sql);
+        }
+        bpf_probe_read(trace->sql, query_len, (void*)invocation->sql_param);
+        bpf_dbg_printk("Found sql statement %s", trace->sql);
+        // submit the completed trace via ringbuffer
+        bpf_ringbuf_submit(trace, get_flags());
+    } else {
+        bpf_dbg_printk("can't reserve space in the ringbuffer");
+    }
+    return 0;
+}

bpf/http_sock.c

@@ -5,7 +5,7 @@
 #include "pid.h"
 #include "sockaddr.h"
 #include "tcp_info.h"
-#include "ringbuf.h"
+#include "kringbuf.h"
 #include "http_sock.h"
 #include "http_ssl.h"
 

bpf/http_sock.h

@@ -5,7 +5,7 @@
 #include "bpf_helpers.h"
 #include "bpf_builtins.h"
 #include "http_types.h"
-#include "ringbuf.h"
+#include "kringbuf.h"
 #include "pid.h"
 #include "trace_common.h"
 
@@ -30,7 +30,7 @@ struct {
     __uint(type, BPF_MAP_TYPE_LRU_HASH);
     __type(key, connection_info_t);
     __type(value, http_info_t);
-    __uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
+    __uint(max_entries, 1024);
     __uint(pinning, LIBBPF_PIN_BY_NAME);
 } ongoing_http_fallback SEC(".maps");
 

bpf/kringbuf.h

@@ -0,0 +1,44 @@
+#ifndef KRINGBUF_H
+#define KRINGBUF_H
+
+#include "utils.h"
+
+// These need to line up with some Go identifiers:
+// EventTypeHTTP, EventTypeGRPC, EventTypeHTTPClient, EventTypeGRPCClient, EventTypeSQLClient
+#define EVENT_HTTP_REQUEST 1
+#define EVENT_GRPC_REQUEST 2
+#define EVENT_HTTP_CLIENT  3
+#define EVENT_GRPC_CLIENT  4
+#define EVENT_SQL_CLIENT   5
+
+// setting here the following map definitions without pinning them to a global namespace
+// would lead that services running both HTTP and GRPC server would duplicate 
+// the events ringbuffer and goroutines map.
+// This is an edge inefficiency that allows us avoiding the gotchas of
+// pinning maps to the global namespace (e.g. like not cleaning them up when
+// the autoinstrumenter ends abruptly)
+// https://ants-gitlab.inf.um.es/jorgegm/xdp-tutorial/-/blob/master/basic04-pinning-maps/README.org
+// we can share them later if we find is worth not including code per duplicate
+struct {
+    __uint(type, BPF_MAP_TYPE_RINGBUF);
+    __uint(max_entries, 1 << 24);
+} events SEC(".maps");
+
+// To be Injected from the user space during the eBPF program load & initialization
+volatile const u32 wakeup_data_bytes;
+
+// get_flags prevents waking the userspace process up on each ringbuf message.
+// If wakeup_data_bytes > 0, it will wait until wakeup_data_bytes are accumulated
+// into the buffer before waking the userspace.
+static __always_inline long get_flags()
+{
+	long sz;
+
+	if (!wakeup_data_bytes)
+		return 0;
+
+	sz = bpf_ringbuf_query(&events, BPF_RB_AVAIL_DATA);
+	return sz >= wakeup_data_bytes ? BPF_RB_FORCE_WAKEUP : BPF_RB_NO_WAKEUP;
+}
+
+#endif

bpf/ringbuf.h

@@ -21,7 +21,7 @@
 // we can share them later if we find is worth not including code per duplicate
 struct {
     __uint(type, BPF_MAP_TYPE_RINGBUF);
-    __uint(max_entries, 1 << 24);
+    __uint(max_entries, 1 << 16);
 } events SEC(".maps");
 
 // To be Injected from the user space during the eBPF program load & initialization

bpf/watch_helper.c

@@ -18,7 +18,7 @@ const watch_info_t *unused_2 __attribute__((unused));
 
 struct {
     __uint(type, BPF_MAP_TYPE_RINGBUF);
-    __uint(max_entries, 1 << 24);
+    __uint(max_entries, 1 << 8);
 } watch_events SEC(".maps");
 
 SEC("kprobe/sys_bind")

pkg/internal/discover/finder.go

@@ -10,7 +10,6 @@ import (
 	"github.com/grafana/beyla/pkg/beyla"
 	"github.com/grafana/beyla/pkg/internal/ebpf"
 	"github.com/grafana/beyla/pkg/internal/ebpf/goruntime"
-	"github.com/grafana/beyla/pkg/internal/ebpf/gosql"
 	"github.com/grafana/beyla/pkg/internal/ebpf/grpc"
 	"github.com/grafana/beyla/pkg/internal/ebpf/httpfltr"
 	"github.com/grafana/beyla/pkg/internal/ebpf/httpssl"
@@ -81,7 +80,6 @@ func newGoTracersGroup(cfg *beyla.Config, metrics imetrics.Reporter) []ebpf.Trac
 		&nethttp.GinTracer{Tracer: *nethttp.New(&cfg.EBPF, metrics)},
 		grpc.New(&cfg.EBPF, metrics),
 		goruntime.New(&cfg.EBPF, metrics),
-		gosql.New(&cfg.EBPF, metrics),
 	}
 }