A nice and convenient way to work with eBPF programs / perf events from Go.
- Go 1.9+
- Linux Kernel 4.15+
- eBPF programs
SocketFilterXDPKprobe/Kretprobe
- Perf Events
Support for other program types / features can be added in future. Meanwhile your contributions are warmly welcomed.. :)
# Main library
go get github.com/dropbox/goebpf
# Mock version (if needed)
go get github.com/dropbox/goebpf/goebpf_mockConsider very simple example of Read / Load / Attach
// In order to be simple this examples does not handle errorsbpf:=goebpf.NewDefaultEbpfSystem()
// Read clang compiled binarybpf.LoadElf("test.elf")
// Load XDP program into kernel (name matches function name in C)xdp:=bpf.GetProgramByName("xdp_test")
xdp.Load()
// Attach to interfacexdp.Attach("eth0")
deferxdp.Detach()
// Work with mapstest:=bpf.GetMapByName("test")
value, _:=test.LookupInt(0)
fmt.Printf("Value at index 0 of map 'test': %d\n", )Like it? Check our examples
Library currently has support for one, most popular use case of perf_events - where eBPF map key maps to cpu_id.
So eBPF and go parts actually bind cpu_id to map index. It maybe as simple as:
// Define special, perf_events map where key maps to CPU_IDBPF_MAP_DEF(perfmap) = {
.map_type=BPF_MAP_TYPE_PERF_EVENT_ARRAY,
.max_entries=128, // Max supported CPUs
};
BPF_MAP_ADD(perfmap);
// ...// Emit perf event with "data" to map "perfmap" where index is current CPU_IDbpf_perf_event_output(ctx, &perfmap, BPF_F_CURRENT_CPU, &data, sizeof(data));And the go part:
perf, err:=goebpf.NewPerfEvents("perfmap")
// 4096 is ring buffer sizeperfEvents, err:=perf.StartForAllProcessesAndCPUs(4096)
deferperf.Stop()
for {
select {
casedata:=<-perfEvents:
fmt.Println(data)
}
}Simple? Check full XDP dump example
Library currently has support for kprobes and kretprobes.
It can be as simple as:
// kprobe handler functionSEC("kprobe/guess_execve")
intexecve_entry(structpt_regs*ctx) {
// ...buf_perf_output(ctx);
return0;
}And the go part:
// Cleanup old probeserr:=goebpf.CleanupProbes()
// Attach all probe programsfor_, prog:=rangebpf.GetPrograms() {
err:=prog.Attach(nil)
}
// Create perf eventseventsMap:=p.bpf.GetMapByName("events")
p.pe, err=goebpf.NewPerfEvents(eventsMap)
events, err:=p.pe.StartForAllProcessesAndCPUs(4096)
deferevents.Stop()
for {
select {
casedata:=<-events:
fmt.Println(data) // kProbe event
}
}Simple? Check exec dump example