elf

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 5, 2021 License: Apache-2.0 Imports: 21 Imported by: 35

Documentation

Index

Constants

View Source 
const (

	// Object pin settings should correspond to those of other projects, e.g.:
	// https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git/tree/include/bpf_elf.h#n25
	// Also it should be self-consistent with `elf/include/bpf.h` in the same repository.
	PIN_NONE      = 0
	PIN_OBJECT_NS = 1
	PIN_GLOBAL_NS = 2
	PIN_CUSTOM_NS = 3
)
View Source 
const (
	BPFDirGlobals = "globals" // as in iproute2's BPF_DIR_GLOBALS
	BPFFSPath     = "/sys/fs/bpf/"
)

Variables

This section is empty.

Functions

func AttachCgroupProgram 

func AttachCgroupProgram(cgroupProg *CgroupProgram, cgroupPath string, attachType AttachType) error

func AttachCgroupProgramFromFd 

func AttachCgroupProgramFromFd(progFd int, cgroupPath string, attachType AttachType) error

func AttachSocketFilter 

func AttachSocketFilter(socketFilter *SocketFilter, sockFd int) error

func AttachUprobe 

func AttachUprobe(uprobe *Uprobe, path string, offset uint64) error

AttachUprobe attaches the uprobe's BPF script to the program or library at the given path and offset.

func CurrentKernelVersion 

func CurrentKernelVersion() (uint32, error)

CurrentKernelVersion returns the current kernel version in LINUX_VERSION_CODE format (see KernelVersionFromReleaseString())

func DetachCgroupProgram 

func DetachCgroupProgram(cgroupProg *CgroupProgram, cgroupPath string, attachType AttachType) error

func DetachSocketFilter 

func DetachSocketFilter(socketFilter *SocketFilter, sockFd int) error

func GetProgFd 

func GetProgFd(pinPath string) int

GetProgFd returns the fd for a pinned bpf program at the given path

func GetSyscallFnName 

func GetSyscallFnName(name string) (string, error)

Returns the qualified syscall named by going through '/proc/kallsyms' on the system on which its executed. It allows BPF programs that may have been compiled for older syscall functions to run on newer kernels

func KernelVersionFromReleaseString 

func KernelVersionFromReleaseString(releaseString string) (uint32, error)

KernelVersionFromReleaseString converts a release string with format 4.4.2[-1] to a kernel version number in LINUX_VERSION_CODE format. That is, for kernel "a.b.c", the version number will be (a<<16 + b<<8 + c)

func NowNanoseconds 

func NowNanoseconds() uint64

NowNanoseconds returns a time that can be compared to bpf_ktime_get_ns()

func PinObject 

func PinObject(fd int, pinPath string) error

PinObject pins an object to a path

func PinObjectGlobal 

func PinObjectGlobal(fd int, namespace, name string) error

PinObjectGlobal pins and object to a name in a namespaces e.g. `/sys/fs/bpf/my-namespace/globals/my-name`

Types

type AttachType 

type AttachType int
const (
	IngressType AttachType = iota
	EgressType
	SockCreateType
)

type CgroupProgram 

type CgroupProgram struct {
	Name string
	// contains filtered or unexported fields
}

CgroupProgram represents a cgroup skb/sock program

func (*CgroupProgram) Fd 

func (p *CgroupProgram) Fd() int

type CloseOptions 

type CloseOptions struct {
	// Set Unpin to true to close pinned maps as well
	Unpin   bool
	PinPath string
}

CloseOptions can be used for custom `Close` parameters

type Kprobe 

type Kprobe struct {
	Name string
	// contains filtered or unexported fields
}

Kprobe represents a kprobe or kretprobe and has to be declared in the C file,

func (*Kprobe) Fd 

func (kp *Kprobe) Fd() int

type Map 

type Map struct {
	Name string
	// contains filtered or unexported fields
}

Map represents a eBPF map. An eBPF map has to be declared in the C file.

func (*Map) Fd 

func (m *Map) Fd() int

type Module 

type Module struct {
	// contains filtered or unexported fields
}

func NewModule 

func NewModule(fileName string) *Module

func NewModuleFromReader 

func NewModuleFromReader(fileReader io.ReaderAt) *Module

func NewModuleFromReaderWithLog 

func NewModuleFromReaderWithLog(fileReader io.ReaderAt, logSize uint32) *Module

func NewModuleWithLog 

func NewModuleWithLog(fileName string, logSize uint32) *Module

func (*Module) AttachXDP 

func (b *Module) AttachXDP(devName string, secName string) error

func (*Module) AttachXDPWithFlags 

func (b *Module) AttachXDPWithFlags(devName string, secName string, flags uint32) error

AttachXDPWithFlags attaches an xdp section to a device with flags.

func (*Module) CgroupProgram 

func (b *Module) CgroupProgram(name string) *CgroupProgram

func (*Module) Close 

func (b *Module) Close() error

Close takes care of terminating all underlying BPF programs and structures. That is:

* Closing map file descriptors and unpinning them where applicable * Detaching BPF programs from kprobes and closing their file descriptors * Closing cgroup-bpf file descriptors * Closing socket filter file descriptors * Closing XDP file descriptors

It doesn't detach BPF programs from cgroups or sockets because they're considered resources the user controls. It also doesn't unpin pinned maps. Use CloseExt and set Unpin to do this.

func (*Module) CloseExt 

func (b *Module) CloseExt(options map[string]CloseOptions) error

CloseExt takes a map "elf section -> CloseOptions"

func (*Module) DeleteElement 

func (b *Module) DeleteElement(mp *Map, key unsafe.Pointer) error

DeleteElement deletes the given key in the the map stored in mp. The key is stored in the key unsafe.Pointer.

func (*Module) EnableKprobe 

func (b *Module) EnableKprobe(secName string, maxactive int) error

EnableKprobe enables a kprobe/kretprobe identified by secName. For kretprobes, you can configure the maximum number of instances of the function that can be probed simultaneously with maxactive. If maxactive is 0 it will be set to the default value: if CONFIG_PREEMPT is enabled, this is max(10, 2*NR_CPUS); otherwise, it is NR_CPUS. For kprobes, maxactive is ignored.

func (*Module) EnableKprobes 

func (b *Module) EnableKprobes(maxactive int) error

EnableKprobes enables all kprobes/kretprobes included in the module. The value in maxactive will be applied to all the kretprobes.

func (*Module) EnableOptionCompatProbe 

func (b *Module) EnableOptionCompatProbe()

EnableOptionCompatProbe will attempt to automatically convert function names in kprobe and kretprobe to maintain compatibility between kernel versions. See: https://github.com/iovisor/gobpf/issues/146

func (*Module) EnableTracepoint 

func (b *Module) EnableTracepoint(secName string) error

func (*Module) IterCgroupProgram 

func (b *Module) IterCgroupProgram() <-chan *CgroupProgram

func (*Module) IterKprobes 

func (b *Module) IterKprobes() <-chan *Kprobe

IterKprobes returns a channel that emits the kprobes that included in the module.

func (*Module) IterMaps 

func (b *Module) IterMaps() <-chan *Map

func (*Module) IterSchedProgram 

func (b *Module) IterSchedProgram() <-chan *SchedProgram

IterSchedProgram returns a channel that emits the sched programs included in the module.

func (*Module) IterSocketFilter 

func (b *Module) IterSocketFilter() <-chan *SocketFilter

func (*Module) IterTracepointProgram 

func (b *Module) IterTracepointProgram() <-chan *TracepointProgram

func (*Module) IterUprobes 

func (b *Module) IterUprobes() <-chan *Uprobe

IterUprobes returns a channel that emits the uprobes included in the module.

func (*Module) IterXDPProgram 

func (b *Module) IterXDPProgram() <-chan *XDPProgram

func (*Module) Kprobe 

func (b *Module) Kprobe(name string) *Kprobe

func (*Module) Load 

func (b *Module) Load(parameters map[string]SectionParams) error

Load loads the BPF programs and BPF maps in the module. Each ELF section can optionally have parameters that changes how it is configured.

func (*Module) Log 

func (b *Module) Log() []byte

Log gives users access to the log buffer with verifier messages

func (*Module) LookupAndDeleteElement 

func (b *Module) LookupAndDeleteElement(mp *Map, value unsafe.Pointer) error

LookupAndDeleteElement picks up and delete the element in the the map stored in mp. The value is stored in the value unsafe.Pointer.

func (*Module) LookupElement 

func (b *Module) LookupElement(mp *Map, key, value unsafe.Pointer) error

LookupElement looks up the given key in the the map stored in mp. The value is stored in the value unsafe.Pointer.

func (*Module) LookupNextElement 

func (b *Module) LookupNextElement(mp *Map, key, nextKey, value unsafe.Pointer) (bool, error)

LookupNextElement looks up the next element in mp using the given key. The next key and the value are stored in the nextKey and value parameter. Returns false at the end of the mp.

func (*Module) Map 

func (b *Module) Map(name string) *Map

func (*Module) PerfMapStop 

func (b *Module) PerfMapStop(mapName string) error

PerfMapStop stops the BPF program from writing into the perf ring buffers. However, the userspace program can still read the ring buffers.

func (*Module) RemoveXDP 

func (b *Module) RemoveXDP(devName string) error

func (*Module) SchedProgram 

func (b *Module) SchedProgram(name string) *SchedProgram

func (*Module) SocketFilter 

func (b *Module) SocketFilter(name string) *SocketFilter

func (*Module) UpdateElement 

func (b *Module) UpdateElement(mp *Map, key, value unsafe.Pointer, flags uint64) error

UpdateElement stores value in key in the map stored in mp. The flags can have the following values (if you include "uapi/linux/bpf.h"): C.BPF_ANY to create new element or update existing; C.BPF_NOEXIST to create new element if it didn't exist; C.BPF_EXIST to update existing element.

func (*Module) Uprobe 

func (b *Module) Uprobe(name string) *Uprobe

func (*Module) XDPProgram 

func (b *Module) XDPProgram(name string) *XDPProgram

type OrderedBytesArray 

type OrderedBytesArray struct {
	// contains filtered or unexported fields
}

Assume the timestamp is at the beginning of the user struct

func (OrderedBytesArray) Len 

func (a OrderedBytesArray) Len() int

func (OrderedBytesArray) Less 

func (a OrderedBytesArray) Less(i, j int) bool

func (OrderedBytesArray) Swap 

func (a OrderedBytesArray) Swap(i, j int)

type PerfEventHeader 

type PerfEventHeader struct {
	Type      uint32
	Misc      uint16
	TotalSize uint16
}

Matching 'struct perf_event_header in <linux/perf_event.h>

type PerfEventLost 

type PerfEventLost struct {
	PerfEventHeader
	Id   uint64
	Lost uint64
}

Matching 'struct perf_event_lost in kernel sources

type PerfEventSample 

type PerfEventSample struct {
	PerfEventHeader
	Size uint32
	// contains filtered or unexported fields
}

Matching 'struct perf_event_sample in kernel sources

type PerfMap 

type PerfMap struct {
	// contains filtered or unexported fields
}

func InitPerfMap 

func InitPerfMap(b *Module, mapName string, receiverChan chan []byte, lostChan chan uint64) (*PerfMap, error)

func (*PerfMap) DumpBackward 

func (pm *PerfMap) DumpBackward() (out [][]byte)

func (*PerfMap) PollStart 

func (pm *PerfMap) PollStart()

func (*PerfMap) PollStop 

func (pm *PerfMap) PollStop()

PollStop stops the goroutine that polls the perf event map. Callers must not close receiverChan or lostChan: they will be automatically closed on the sender side.

func (*PerfMap) SetTimestampFunc 

func (pm *PerfMap) SetTimestampFunc(timestamp func(*[]byte) uint64)

SetTimestampFunc registers a timestamp callback that will be used to reorder the perf events chronologically.

If not set, the order of events sent through receiverChan is not guaranteed.

Typically, the ebpf program will use bpf_ktime_get_ns() to get a timestamp and store it in the perf event. The perf event struct is opaque to this package, hence the need for a callback.

func (*PerfMap) SwapAndDumpBackward 

func (pm *PerfMap) SwapAndDumpBackward() (out [][]byte)

type SchedProgram 

type SchedProgram struct {
	Name string
	// contains filtered or unexported fields
}

SchedProgram represents a traffic classifier program

func (*SchedProgram) Fd 

func (sp *SchedProgram) Fd() int

type SectionParams 

type SectionParams struct {
	PerfRingBufferPageCount    int
	SkipPerfMapInitialization  bool
	PinPath                    string // path to be pinned, relative to "/sys/fs/bpf"
	MapMaxEntries              int    // Used to override bpf map entries size
	PerfRingBufferBackward     bool
	PerfRingBufferOverwritable bool
}

type SocketFilter 

type SocketFilter struct {
	Name string
	// contains filtered or unexported fields
}

SocketFilter represents a socket filter

func (*SocketFilter) Fd 

func (sf *SocketFilter) Fd() int

type TracepointProgram 

type TracepointProgram struct {
	Name string
	// contains filtered or unexported fields
}

TracepointProgram represents a tracepoint program

func (*TracepointProgram) Fd 

func (tp *TracepointProgram) Fd() int

type Uprobe 

type Uprobe struct {
	Name string
	// contains filtered or unexported fields
}

func (*Uprobe) Fd 

func (up *Uprobe) Fd() int

type XDPProgram 

type XDPProgram struct {
	Name string
	// contains filtered or unexported fields
}

XDPProgram represents a XDP hook program

func (*XDPProgram) Fd 

func (xdpp *XDPProgram) Fd() int

Source Files

View all Source files

Directories

Path Synopsis
uapi/linux

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.