internal

Documentation

Index

• Constants
• Variables
• func BPF(cmd BPFCmd, attr unsafe.Pointer, size uintptr) (uintptr, error)
• func BPFObjGetInfoByFD(fd *FD, info unsafe.Pointer, size uintptr) error
• func BPFObjPin(fileName string, fd *FD) error
• func BPFProgAttach(attr *BPFProgAttachAttr) error
• func BPFProgDetach(attr *BPFProgDetachAttr) error
• func CString(in []byte) string
• func ErrorWithLog(err error, log []byte, logErr error) error
• func FeatureTest(name, version string, fn FeatureTestFn) func() error
• func Pin(currentPath, newPath string, fd *FD) error
• func PossibleCPUs() (int, error)
• func Unpin(pinnedPath string) error
• type BPFCmd
  • func (i BPFCmd) String() string
• type BPFEnableStatsAttr
• type BPFProgAttachAttr
• type BPFProgDetachAttr
• type DiscardZeroes
  • func (DiscardZeroes) Write(p []byte) (int, error)
• type FD
  • func BPFEnableStats(attr *BPFEnableStatsAttr) (*FD, error)
  • func BPFObjGet(fileName string, flags uint32) (*FD, error)
  • func NewFD(value uint32) *FD
  • func (fd *FD) Close() error
  • func (fd *FD) Dup() (*FD, error)
  • func (fd *FD) File(name string) *os.File
  • func (fd *FD) Forget()
  • func (fd *FD) String() string
  • func (fd *FD) Value() (uint32, error)
• type FeatureTestFn
• type Pointer
  • func NewPointer(ptr unsafe.Pointer) Pointer
  • func NewSlicePointer(buf []byte) Pointer
  • func NewStringPointer(str string) Pointer
• type SafeELFFile
  • func NewSafeELFFile(r io.ReaderAt) (safe *SafeELFFile, err error)
  • func (se *SafeELFFile) Symbols() (syms []elf.Symbol, err error)
• type UnsupportedFeatureError
  • func (ufe *UnsupportedFeatureError) Error() string
  • func (ufe *UnsupportedFeatureError) Is(target error) bool
• type VerifierError
  • func (le *VerifierError) Error() string
• type Version
  • func KernelVersion() (Version, error)
  • func NewVersion(ver string) (Version, error)
  • func (v Version) Kernel() uint32
  • func (v Version) Less(other Version) bool
  • func (v Version) String() string
  • func (v Version) Unspecified() bool

Constants

const (
	// Version constant used in ELF binaries indicating that the loader needs to
	// substitute the eBPF program's version with the value of the kernel's
	// KERNEL_VERSION compile-time macro. Used for compatibility with BCC, gobpf
	// and RedSift.
	MagicKernelVersion = 0xFFFFFFFE
)

Variables

var ErrClosedFd = errors.New("use of closed file descriptor")

var ErrNotSupported = errors.New("not supported")

ErrNotSupported indicates that a feature is not supported by the current kernel.

var NativeEndian binary.ByteOrder

NativeEndian is set to either binary.BigEndian or binary.LittleEndian, depending on the host's endianness.

Functions

func BPF

func BPF(cmd BPFCmd, attr unsafe.Pointer, size uintptr) (uintptr, error)

BPF wraps SYS_BPF.

Any pointers contained in attr must use the Pointer type from this package.

func BPFObjGetInfoByFD

func BPFObjGetInfoByFD(fd *FD, info unsafe.Pointer, size uintptr) error

BPFObjGetInfoByFD wraps BPF_OBJ_GET_INFO_BY_FD.

Available from 4.13.

func BPFObjPin

func BPFObjPin(fileName string, fd *FD) error

BPFObjPin wraps BPF_OBJ_PIN.

func BPFProgAttach

func BPFProgAttach(attr *BPFProgAttachAttr) error

func BPFProgDetach

func BPFProgDetach(attr *BPFProgDetachAttr) error

func CString

func CString(in []byte) string

CString turns a NUL / zero terminated byte buffer into a string.

func ErrorWithLog

func ErrorWithLog(err error, log []byte, logErr error) error

ErrorWithLog returns an error that includes logs from the kernel verifier.

logErr should be the error returned by the syscall that generated the log. It is used to check for truncation of the output.

func FeatureTest

func FeatureTest(name, version string, fn FeatureTestFn) func() error

FeatureTest wraps a function so that it is run at most once.

name should identify the tested feature, while version must be in the form Major.Minor[.Patch].

Returns an error wrapping ErrNotSupported if the feature is not supported.

func Pin

func Pin(currentPath, newPath string, fd *FD) error

func PossibleCPUs

func PossibleCPUs() (int, error)

PossibleCPUs returns the max number of CPUs a system may possibly have Logical CPU numbers must be of the form 0-n

func Unpin

func Unpin(pinnedPath string) error

Types

type BPFCmd

type BPFCmd int

BPFCmd identifies a subcommand of the bpf syscall.

const (
	BPF_MAP_CREATE BPFCmd = iota
	BPF_MAP_LOOKUP_ELEM
	BPF_MAP_UPDATE_ELEM
	BPF_MAP_DELETE_ELEM
	BPF_MAP_GET_NEXT_KEY
	BPF_PROG_LOAD
	BPF_OBJ_PIN
	BPF_OBJ_GET
	BPF_PROG_ATTACH
	BPF_PROG_DETACH
	BPF_PROG_TEST_RUN
	BPF_PROG_GET_NEXT_ID
	BPF_MAP_GET_NEXT_ID
	BPF_PROG_GET_FD_BY_ID
	BPF_MAP_GET_FD_BY_ID
	BPF_OBJ_GET_INFO_BY_FD
	BPF_PROG_QUERY
	BPF_RAW_TRACEPOINT_OPEN
	BPF_BTF_LOAD
	BPF_BTF_GET_FD_BY_ID
	BPF_TASK_FD_QUERY
	BPF_MAP_LOOKUP_AND_DELETE_ELEM
	BPF_MAP_FREEZE
	BPF_BTF_GET_NEXT_ID
	BPF_MAP_LOOKUP_BATCH
	BPF_MAP_LOOKUP_AND_DELETE_BATCH
	BPF_MAP_UPDATE_BATCH
	BPF_MAP_DELETE_BATCH
	BPF_LINK_CREATE
	BPF_LINK_UPDATE
	BPF_LINK_GET_FD_BY_ID
	BPF_LINK_GET_NEXT_ID
	BPF_ENABLE_STATS
	BPF_ITER_CREATE
)

Well known BPF commands.

func (BPFCmd) String

func (i BPFCmd) String() string

type BPFEnableStatsAttr

type BPFEnableStatsAttr struct {
	StatsType uint32
}

type BPFProgAttachAttr

type BPFProgAttachAttr struct {
	TargetFd     uint32
	AttachBpfFd  uint32
	AttachType   uint32
	AttachFlags  uint32
	ReplaceBpfFd uint32
}

type BPFProgDetachAttr

type BPFProgDetachAttr struct {
	TargetFd    uint32
	AttachBpfFd uint32
	AttachType  uint32
}

type DiscardZeroes

type DiscardZeroes struct{}

DiscardZeroes makes sure that all written bytes are zero before discarding them.

func (DiscardZeroes) Write

func (DiscardZeroes) Write(p []byte) (int, error)

type FD

type FD struct {
	// contains filtered or unexported fields
}

func BPFEnableStats

func BPFEnableStats(attr *BPFEnableStatsAttr) (*FD, error)

func BPFObjGet

func BPFObjGet(fileName string, flags uint32) (*FD, error)

BPFObjGet wraps BPF_OBJ_GET.

func NewFD

func NewFD(value uint32) *FD

func (*FD) Close

func (fd *FD) Close() error

func (*FD) Dup

func (fd *FD) Dup() (*FD, error)

func (*FD) File

func (fd *FD) File(name string) *os.File

func (*FD) Forget

func (fd *FD) Forget()

func (*FD) String

func (fd *FD) String() string

func (*FD) Value

func (fd *FD) Value() (uint32, error)

type FeatureTestFn

type FeatureTestFn func() error

FeatureTestFn is used to determine whether the kernel supports a certain feature.

The return values have the following semantics:

err == ErrNotSupported: the feature is not available
err == nil: the feature is available
err != nil: the test couldn't be executed

type Pointer

type Pointer struct {
	// contains filtered or unexported fields
}

Pointer wraps an unsafe.Pointer to be 64bit to conform to the syscall specification.

func NewPointer

func NewPointer(ptr unsafe.Pointer) Pointer

NewPointer creates a 64-bit pointer from an unsafe Pointer.

func NewSlicePointer

func NewSlicePointer(buf []byte) Pointer

NewSlicePointer creates a 64-bit pointer from a byte slice.

func NewStringPointer

func NewStringPointer(str string) Pointer

NewStringPointer creates a 64-bit pointer from a string.

type SafeELFFile

type SafeELFFile struct {
	*elf.File
}

func NewSafeELFFile

func NewSafeELFFile(r io.ReaderAt) (safe *SafeELFFile, err error)

NewSafeELFFile reads an ELF safely.

Any panic during parsing is turned into an error. This is necessary since there are a bunch of unfixed bugs in debug/elf.

https://github.com/golang/go/issues?q=is%3Aissue+is%3Aopen+debug%2Felf+in%3Atitle

func (*SafeELFFile) Symbols

func (se *SafeELFFile) Symbols() (syms []elf.Symbol, err error)

Symbols is the safe version of elf.File.Symbols.

type UnsupportedFeatureError

type UnsupportedFeatureError struct {
	// The minimum Linux mainline version required for this feature.
	// Used for the error string, and for sanity checking during testing.
	MinimumVersion Version

	// The name of the feature that isn't supported.
	Name string
}

UnsupportedFeatureError is returned by FeatureTest() functions.

func (*UnsupportedFeatureError) Error

func (ufe *UnsupportedFeatureError) Error() string

func (*UnsupportedFeatureError) Is

func (ufe *UnsupportedFeatureError) Is(target error) bool

Is indicates that UnsupportedFeatureError is ErrNotSupported.

type VerifierError

type VerifierError struct {
	// contains filtered or unexported fields
}

VerifierError includes information from the eBPF verifier.

func (*VerifierError) Error

func (le *VerifierError) Error() string

type Version

type Version [3]uint16

A Version in the form Major.Minor.Patch.

func KernelVersion

func KernelVersion() (Version, error)

KernelVersion returns the version of the currently running kernel.

func NewVersion

func NewVersion(ver string) (Version, error)

NewVersion creates a version from a string like "Major.Minor.Patch".

Patch is optional.

func (Version) Kernel

func (v Version) Kernel() uint32

Kernel implements the kernel's KERNEL_VERSION macro from linux/version.h. It represents the kernel version and patch level as a single value.

func (Version) Less

func (v Version) Less(other Version) bool

Less returns true if the version is less than another version.

func (Version) String

func (v Version) String() string

func (Version) Unspecified

func (v Version) Unspecified() bool

Unspecified returns true if the version is all zero.