github.com/kubeshark/ebpf@v0.9.2/link/tracepoint_test.go (about)

     1  package link
     2  
     3  import (
     4  	"errors"
     5  	"os"
     6  	"testing"
     7  
     8  	"github.com/kubeshark/ebpf"
     9  	"github.com/kubeshark/ebpf/internal/testutils"
    10  	"github.com/kubeshark/ebpf/internal/unix"
    11  
    12  	qt "github.com/frankban/quicktest"
    13  )
    14  
    15  func TestTracepoint(t *testing.T) {
    16  	// Requires at least 4.7 (98b5c2c65c29 "perf, bpf: allow bpf programs attach to tracepoints")
    17  	testutils.SkipOnOldKernel(t, "4.7", "tracepoint support")
    18  
    19  	prog := mustLoadProgram(t, ebpf.TracePoint, 0, "")
    20  
    21  	// printk is guaranteed to be present.
    22  	// Kernels before 4.14 don't support attaching to syscall tracepoints.
    23  	tp, err := Tracepoint("printk", "console", prog, nil)
    24  	if err != nil {
    25  		t.Fatal(err)
    26  	}
    27  
    28  	if err := tp.Close(); err != nil {
    29  		t.Error("closing tracepoint:", err)
    30  	}
    31  }
    32  
    33  func TestTracepointMissing(t *testing.T) {
    34  	// Requires at least 4.7 (98b5c2c65c29 "perf, bpf: allow bpf programs attach to tracepoints")
    35  	testutils.SkipOnOldKernel(t, "4.7", "tracepoint support")
    36  
    37  	prog := mustLoadProgram(t, ebpf.TracePoint, 0, "")
    38  
    39  	_, err := Tracepoint("missing", "foobazbar", prog, nil)
    40  	if !errors.Is(err, os.ErrNotExist) {
    41  		t.Error("Expected os.ErrNotExist, got", err)
    42  	}
    43  }
    44  
    45  func TestTracepointErrors(t *testing.T) {
    46  	c := qt.New(t)
    47  
    48  	// Invalid Tracepoint incantations.
    49  	_, err := Tracepoint("", "", nil, nil) // empty names
    50  	c.Assert(errors.Is(err, errInvalidInput), qt.IsTrue)
    51  
    52  	_, err = Tracepoint("_", "_", nil, nil) // empty prog
    53  	c.Assert(errors.Is(err, errInvalidInput), qt.IsTrue)
    54  
    55  	_, err = Tracepoint(".", "+", &ebpf.Program{}, nil) // illegal chars in group/name
    56  	c.Assert(errors.Is(err, errInvalidInput), qt.IsTrue)
    57  
    58  	_, err = Tracepoint("foo", "bar", &ebpf.Program{}, nil) // wrong prog type
    59  	c.Assert(errors.Is(err, errInvalidInput), qt.IsTrue)
    60  }
    61  
    62  func TestTraceGetEventID(t *testing.T) {
    63  	_, err := getTraceEventID("syscalls", "sys_enter_openat")
    64  	if err != nil {
    65  		t.Fatal("Can't read trace event ID:", err)
    66  	}
    67  
    68  	_, err = getTraceEventID("totally", "bogus")
    69  	if !errors.Is(err, os.ErrNotExist) {
    70  		t.Fatal("Expected os.ErrNotExist, got", err)
    71  	}
    72  }
    73  
    74  func TestTracepointProgramCall(t *testing.T) {
    75  	// Kernels before 4.14 don't support attaching to syscall tracepoints.
    76  	testutils.SkipOnOldKernel(t, "4.14", "syscalls tracepoint support")
    77  
    78  	m, p := newUpdaterMapProg(t, ebpf.TracePoint)
    79  
    80  	// Open Tracepoint at /sys/kernel/debug/tracing/events/syscalls/sys_enter_getpid
    81  	// and attach it to the ebpf program created above.
    82  	tp, err := Tracepoint("syscalls", "sys_enter_getpid", p, nil)
    83  	if err != nil {
    84  		t.Fatal(err)
    85  	}
    86  
    87  	// Trigger ebpf program call.
    88  	unix.Getpid()
    89  
    90  	// Assert that the value at index 0 has been updated to 1.
    91  	assertMapValue(t, m, 0, 1)
    92  
    93  	// Detach the Tracepoint.
    94  	if err := tp.Close(); err != nil {
    95  		t.Fatal(err)
    96  	}
    97  
    98  	// Reset map value to 0 at index 0.
    99  	if err := m.Update(uint32(0), uint32(0), ebpf.UpdateExist); err != nil {
   100  		t.Fatal(err)
   101  	}
   102  
   103  	// Retrigger the ebpf program call.
   104  	unix.Getpid()
   105  
   106  	// Assert that this time the value has not been updated.
   107  	assertMapValue(t, m, 0, 0)
   108  }