ebpf

package module
v0.6.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 14, 2018 License: ISC Imports: 8 Imported by: 0

README

ebpf

import "acln.ro/ebpf"

eBPF package for Go. Currently under active development.

See documentation at https://godoc.org/acln.ro/ebpf.

license

Package ebpf is distributed under the ISC license. A copy of the license can be found in the LICENSE file.

TODO(acln): leave a note about the samples, figure out what the right license is there, since they're based on GPL samples from the Linux source tree.

Documentation

Index

Constants

View Source 
const MaxInstructions = 4096

MaxInstructions is the maximum number of instructions in a BPF or eBPF program.

Variables

This section is empty.

Functions

func IsExist 

func IsExist(err error) bool

IsExist returns a boolean indicating whether err reports that an object (e.g. an entry in a map) already exists.

func IsNotExist 

func IsNotExist(err error) bool

IsNotExist returns a boolean indicating whether err is reports that an object (e.g. an entry in a map) does not exist.

func IsTooBig 

func IsTooBig(err error) bool

IsTooBig returns a boolean indicating whether err is known to report that a map has reached its size limit.

Types

type ALUOp 

type ALUOp uint8

ALUOp specifies an ALU operation. 

const (
	ADD  ALUOp = 0x00
	SUB  ALUOp = 0x10
	MUL  ALUOp = 0x20
	DIV  ALUOp = 0x30
	OR   ALUOp = 0x40
	AND  ALUOp = 0x50
	LSH  ALUOp = 0x60
	RSH  ALUOp = 0x70
	NEG  ALUOp = 0x80
	MOD  ALUOp = 0x90
	XOR  ALUOp = 0xa0
	MOV  ALUOp = 0xb0
	ARSH ALUOp = 0xc0
	END  ALUOp = 0xd0
)

Valid ALU operations.

func (ALUOp) String added in v0.6.0 

func (op ALUOp) String() string

type AttachType 

type AttachType uint32

AttachType describes the attach type of an eBPF program. 

const (
	AttachTypeCGroupInetIngress AttachType = iota
	AttachTypeCGroupInetEgress
	AttachTypeCGroupInetSockCreate
	AttachTypeCGroupSockOps
	AttachTypeSKSKBStreamParser
	AttachTypeSKSKBStreamVerdict
	AttachTypeCGroupDevice
	AttachTypeSKMsgVerdict
	AttachTypeCGroupInet4Bind
	AttachTypeCGroupInet6Bind
	AttachTypeCGroupInet4Connect
	AttachTypeCGroupInet6Connect
	AttachTypeCGroupInet4PostBind
	AttachTypeCGroupInet6PostBind
	AttachTypeCGroupUDP4SendMsg
	AttachTypeCGroupUDP6SendMsg
	AttachTypeLIRCMode2
)

Valid program attach types.

type CGroupAttachFlag added in v0.3.0 

type CGroupAttachFlag uint32

CGroupAttachFlag is a flag for an AttachCGroup operation. 

const (
	// CGroupAttachAllowNone allows no further bpf programs in the target
	// cgroup sub-tree.
	CGroupAttachAllowNone CGroupAttachFlag = 0

	// CGroupAttachAllowOverride arranges for the program in this cgroup
	// to yield to programs installed by sub-cgroups.
	CGroupAttachAllowOverride CGroupAttachFlag = 1 << 0

	// CGroupAttachAllowMulti arranges for the program in this cgroup
	// to run in addition to programs installed by sub-cgroups.
	CGroupAttachAllowMulti CGroupAttachFlag = 1 << 1
)

cgroup attach flags.

type Class added in v0.6.0 

type Class uint8

Class is an eBPF instruction class. 

const (
	LD    Class = 0x00
	LDX   Class = 0x01
	ST    Class = 0x02
	STX   Class = 0x03
	ALU   Class = 0x04
	JMP   Class = 0x05
	ALU64 Class = 0x07
)

Instruction classes.

func (Class) String added in v0.6.0 

func (c Class) String() string

type InstructionStream added in v0.6.0 

type InstructionStream struct {
	// contains filtered or unexported fields
}

InstructionStream is a stream of eBPF instructions.

func NewInstructionStream added in v0.6.0 

func NewInstructionStream() *InstructionStream

NewInstructionStream constructs an empty instruction stream.

func (*InstructionStream) ALU32Imm added in v0.6.0 

func (s *InstructionStream) ALU32Imm(op ALUOp, dst Register, imm int32)

ALU32Imm emits a 32 bit ALU instruction on a register and a 32 bit immediate.

dst = int32(dst) <op> imm

After the operation, dst is zero-extended into 64 bit.

func (*InstructionStream) ALU32Reg added in v0.6.0 

func (s *InstructionStream) ALU32Reg(op ALUOp, dst, src Register)

ALU32Reg emits a 32 bit ALU operation on registers.

dst = dst <op> src

After the operation, dst is zero-extended into 64 bit.

func (*InstructionStream) ALU32Sym added in v0.6.0 

func (s *InstructionStream) ALU32Sym(op ALUOp, dst Register, sym string)

ALU32Sym emits a 32 bit ALU instruction on a register and a 32 bit symbolic immediate.

dst = int32(dst) <op> $sym

After the operation, dst is zero-extended into 64 bit.

func (*InstructionStream) ALU64Imm added in v0.6.0 

func (s *InstructionStream) ALU64Imm(op ALUOp, dst Register, imm int32)

ALU64Imm emits a 64 bit ALU instruction on a register and a 32 bit immediate.

dst = dst <op> imm

func (*InstructionStream) ALU64Reg added in v0.6.0 

func (s *InstructionStream) ALU64Reg(op ALUOp, dst, src Register)

ALU64Reg emits a 64 bit ALU operation on registers.

dst = dst <op> src

func (*InstructionStream) ALU64Sym added in v0.6.0 

func (s *InstructionStream) ALU64Sym(op ALUOp, dst Register, sym string)

ALU64Sym emits a 64 bit ALU instruction on a register and a 32 bit symbolic immediate.

dst = dst <op> $sym

func (*InstructionStream) AtomicAdd32 added in v0.6.0 

func (s *InstructionStream) AtomicAdd32(dst, src Register, off int16)

AtomicAdd32 emits a 32 bit atomic add to a memory location.

*(uint32 *)(dst + off) += src

func (*InstructionStream) AtomicAdd64 added in v0.6.0 

func (s *InstructionStream) AtomicAdd64(dst, src Register, off int16)

AtomicAdd64 emits a 64 bit atomic add to a memory location.

*(uint64 *)(dst + off) += src

func (*InstructionStream) Call added in v0.6.0 

func (s *InstructionStream) Call(fn KernelFunc)

Call emits a kernel function call instruction.

func (*InstructionStream) Exit added in v0.6.0 

func (s *InstructionStream) Exit()

Exit emits a program exit instruction.

func (*InstructionStream) JumpImm added in v0.6.0 

func (s *InstructionStream) JumpImm(cond JumpCond, dst Register, imm int32, off int16)

JumpImm emits a conditional jump against a 32 bit immediate.

if dst <op> imm { goto pc + off }

func (*InstructionStream) JumpReg added in v0.6.0 

func (s *InstructionStream) JumpReg(cond JumpCond, dst, src Register, off int16)

JumpReg emits a conditional jump against registers.

if dst <op> src { goto pc + off }

func (*InstructionStream) JumpSym added in v0.6.0 

func (s *InstructionStream) JumpSym(cond JumpCond, dst Register, sym string, off int16)

JumpSym emits a contitional jump against a symbolic 32 bit immediate.

if dst <op> $sym { goto pc + off }

func (*InstructionStream) LoadAbs added in v0.6.0 

func (s *InstructionStream) LoadAbs(sz Size, imm int32)

LoadAbs emits the special "direct packet access" instruction.

r0 = *(uints *)(skb->data + imm)

func (*InstructionStream) LoadAbsSym added in v0.6.0 

func (s *InstructionStream) LoadAbsSym(sz Size, sym string)

LoadAbsSym emits the special "direct packet access" instruction, with a symbolic immediate.

r0 = *(uints *)(skb->data + $sym)

func (*InstructionStream) LoadImm64 added in v0.6.0 

func (s *InstructionStream) LoadImm64(dst Register, imm int64)

LoadImm64 emits the special 'load 64 bit immediate' instruction.

dst = imm

func (*InstructionStream) LoadImm64Sym added in v0.6.0 

func (s *InstructionStream) LoadImm64Sym(dst Register, sym string)

LoadImm64Sym emits the special 'load 64 bit immediate' instruction, with a symbolic immediate.

dst = $sym

func (*InstructionStream) LoadMapFD added in v0.6.0 

func (s *InstructionStream) LoadMapFD(dst Register, mapName string)

LoadMapFD emits the special 'load map file descriptor' instruction.

dst = ptr_to_map_fd($mapName)

func (*InstructionStream) MemLoad added in v0.6.0 

func (s *InstructionStream) MemLoad(sz Size, dst, src Register, off int16)

MemLoad emids a memory load.

dst = *(uints *)(src + off)

func (*InstructionStream) MemStoreImm added in v0.6.0 

func (s *InstructionStream) MemStoreImm(sz Size, dst Register, off int16, imm int32)

MemStoreImm emits a memory store from a 32 bit immediate.

*(uints *)(dst + offset) = imm

func (*InstructionStream) MemStoreReg added in v0.6.0 

func (s *InstructionStream) MemStoreReg(sz Size, dst, src Register, off int16)

MemStoreReg emits a memory store from a register.

*(uints *)(dst + offset) = src

func (*InstructionStream) MemStoreSym added in v0.6.0 

func (s *InstructionStream) MemStoreSym(sz Size, dst Register, off int16, sym string)

MemStoreSym emits a memory store from a 32 bit symbolic immediate.

*(uints *)(dst + offset) = $sym

func (*InstructionStream) Mov32Imm added in v0.6.0 

func (s *InstructionStream) Mov32Imm(dst Register, imm int32)

Mov32Imm emits a move of a 32 bit immediate into a register.

dst = imm

After the operation, dst is zero extended into 64 bit.

func (*InstructionStream) Mov32Reg added in v0.6.0 

func (s *InstructionStream) Mov32Reg(dst, src Register)

Mov32Reg emits a move on 32 bit subregisters.

dst = int32(src)

After the operation, dst is zero-extended into 64 bit.

func (*InstructionStream) Mov32Sym added in v0.6.0 

func (s *InstructionStream) Mov32Sym(dst Register, sym string)

Mov32Sym emits a move of a symbolic 32 bit immediate into a register.

dst = $sym

After the operation, dst is zero extended into 64 bit.

func (*InstructionStream) Mov64Imm added in v0.6.0 

func (s *InstructionStream) Mov64Imm(dst Register, imm int32)

Mov64Imm emits a 64 bit move of a 32 bit immediate into a register.

dst = imm

func (*InstructionStream) Mov64Reg added in v0.6.0 

func (s *InstructionStream) Mov64Reg(dst, src Register)

Mov64Reg emits a move on 64 bit registers.

dst = src

func (*InstructionStream) Mov64Sym added in v0.6.0 

func (s *InstructionStream) Mov64Sym(dst Register, sym string)

Mov64Sym emits a 64 bit move of a 32 bit symbolic immediate into a register.

dst = $sym

func (*InstructionStream) Raw added in v0.6.0 

func (s *InstructionStream) Raw(code Opcode, dst, src Register, off int16, imm int32)

Raw emits a raw instruction.

func (*InstructionStream) RawSym added in v0.6.0 

func (s *InstructionStream) RawSym(code Opcode, dst, src Register, off int16, sym string)

RawSym emits a raw instruction with a symbolic 32 bit immediate.

func (*InstructionStream) Resolve added in v0.6.0 

func (s *InstructionStream) Resolve(symtab *SymbolTable) error

Resolve matches unresolved symbols in the instruction stream against a symbol table.

TODO(acln): document this more precisely

type JumpCond added in v0.6.0 

type JumpCond uint8

JumpCond specifies a jump condition. 

const (
	JA   JumpCond = 0x00
	JEQ  JumpCond = 0x10
	JGT  JumpCond = 0x20
	JGE  JumpCond = 0x30
	JSET JumpCond = 0x40
	JNE  JumpCond = 0x50
	JSGT JumpCond = 0x60
	JSGE JumpCond = 0x70
	CALL JumpCond = 0x80
	EXIT JumpCond = 0x90
	JLT  JumpCond = 0xa0
	JLE  JumpCond = 0xb0
	JSLT JumpCond = 0xc0
	JSLE JumpCond = 0xd0
)

Valid jump conditions.

func (JumpCond) String added in v0.6.0 

func (jc JumpCond) String() string

type KernelFunc added in v0.6.0 

type KernelFunc int32

KernelFunc is a function callable by eBPF programs from inside the kernel. 

const (
	KernelFunctionUnspec   KernelFunc = iota // bpf_unspec
	MapLookupElem                            // bpf_map_lookup_elem
	MapUpdateElem                            // bpf_map_update_elem
	MapDeleteElem                            // bpf_map_delete_elem
	ProbeRead                                // bpf_probe_read
	KTimeGetNS                               // bpf_ktime_get_ns
	TracePrintk                              // bpf_trace_printk
	GetPrandomU32                            // bpf_get_prandom_u32
	GetSMPProcessorID                        // bpf_get_smp_processor_id
	SKBStoreBytes                            // bpf_skb_store_bytes
	L3CSumReplace                            // bpf_l3_csum_replace
	L4CSumReplace                            // bpf_l4_csum_replace
	TailCall                                 // bpf_tail_call
	CloneRedirect                            // bpf_clone_redirect
	GetCurrentPIDTGID                        // bpf_get_current_pid_tgid
	GetCurrentUIDGID                         // bpf_get_current_uid_gid
	GetCurrentComm                           // bpf_get_current_comm
	GetCGroupClassID                         // bpf_get_cgroup_classid
	SKBVLanPush                              // bpf_skb_vlan_push
	SKBVLanPop                               // bpf_skb_vlan_pop
	SKBGetTunnelKey                          // bpf_skb_get_tunnel_key
	SKBSetTunnelKey                          // bpf_skb_set_tunnel_key
	PerfEventRead                            // bpf_perf_event_read
	Redirect                                 // bpf_redirect
	GetRouteRealm                            // bpf_get_route_realm
	PerfEventOutput                          // bpf_perf_event_output
	SKBLoadBytes                             // bpf_skb_load_bytes
	GetStackID                               // bpf_get_stackid
	CSumDiff                                 // bpf_csum_diff
	SKBGetTunnelOpt                          // bpf_skb_get_tunnel_opt
	SKBSetTunnelOpt                          // bpf_skb_set_tunnel_opt
	SKBChangeProto                           // bpf_skb_change_proto
	SKBChangeType                            // bpf_skb_change_type
	SKBUnderCGroup                           // bpf_skb_under_cgroup
	GetHashRecalc                            // bpf_get_hash_recalc
	GetCurrentTask                           // bpf_get_current_task
	ProbeWriteUser                           // bpf_probe_write_user
	CurrentTaskUnderCGroup                   // bpf_current_task_under_cgroup
	SKBChangeTail                            // bpf_skb_change_tail
	SKBPullData                              // bpf_skb_pull_data
	CSumUpdate                               // bpf_csum_update
	SetHashInvalid                           // bpf_set_hash_invalid
	GetNUMANodeID                            // bpf_get_numa_node_id
	SKBChangeHEad                            // bpf_skb_change_head
	XDPAdjustHead                            // bpf_xdp_adjust_head
	ProbeReadStr                             // bpf_probe_read_str
	GetSocketCookie                          // bpf_get_socket_cookie
	GetSocketUID                             // bpf_get_socket_uid
	SetHash                                  // bpf_set_hash
	SetSockopt                               // bpf_setsockopt
	SKBAdjustRoom                            // bpf_skb_adjust_room
	RedirectMap                              // bpf_redirect_map
	SKRedirectMap                            // bpf_sk_redirect_map
	SockMapUpdate                            // bpf_sock_map_update
	XDPAdjustMeta                            // bpf_xdp_adjust_meta
	PerfEventReadValue                       // bpf_perf_event_read_value
	PerfProgReadValue                        // bpf_perf_prog_read_value
	GetSockopt                               // bpf_getsockopt
	OverrideReturn                           // bpf_override_return
	SockOpsCBFlagsSet                        // bpf_sock_ops_cb_flags_set
	MsgRedirectMap                           // bpf_msg_redirect_map
	MsgApplyBytes                            // bpf_msg_apply_bytes
	MsgCorkBytes                             // bpf_msg_cork_bytes
	MsgPullData                              // bpf_msg_pull_data
	Bind                                     // bpf_bind
	XDPAdjustTail                            // bpf_xdp_adjust_tail
	SKBGetXFRMState                          // bpf_skb_get_xfrm_state
	GetStack                                 // bpf_get_stack
	SKBLoadBytesRelative                     // bpf_skb_load_bytes_relative
	FibLookup                                // bpf_fib_lookup
	SockHashUpdate                           // bpf_sock_hash_update
	MsgRedirectHash                          // bpf_msg_redirect_hash
	SKRedirectHash                           // bpf_sk_redirect_hash
	LWTPushEncap                             // bpf_lwt_push_encap
	LWTSeg6StoreBytes                        // bpf_lwt_seg6_store_bytes
	LWTSeg6AdjustSRH                         // bpf_lwt_seg6_adjust_srh
	LWTSeg6Action                            // bpf_lwt_seg6_action
	RCRepeat                                 // bpf_rc_repeat
	RCKeydown                                // bpf_rc_keydown
	SKBCGroupID                              // bpf_skb_cgroup_id
	GetCurrentCGroupID                       // bpf_get_current_cgroup_id
	GetLocalStorage                          // bpf_get_local_storage
	SKSelectReuseport                        // bpf_sk_select_reuseport
	SKBAncestorCGroupID                      // bpf_skb_ancestor_cgroup_id
	SKLookupTCP                              // bpf_sk_lookup_tcp
	SKLookupUDP                              // bpf_sk_lookup_udp
	SKRelease                                // bpf_sk_release
	MapPushElem                              // bpf_map_push_elem
	MapPopElem                               // bpf_map_pop_elem
	MapPeekElem                              // bpf_map_peek_elem
	MsgPushData                              // bpf_msg_push_data
)

Kernel functions.

type Map added in v0.5.0 

type Map struct {
	Type           MapType
	KeySize        uint32
	ValueSize      uint32
	MaxEntries     uint32
	Flags          uint32 // TODO(acln): investigate these
	InnerMap       *Map   // TODO(acln): is this right?
	NUMANode       uint32
	ObjectName     string
	InterfaceIndex uint32 // TODO(acln): document this
	// contains filtered or unexported fields
}

Map configures an eBPF map.

Before use, a Map must be initialized using the Init method. KeySize, and MaxEntries must be non-zero. For arrays, KeySize must be 4.

TODO(acln): investigate if ValueSize can be zero.

ObjectName names the map. Names must not contain the NULL character. Names longer than 15 bytes are truncated.

A Map must not be copied after initialization. After initialization, it is safe (in the data race sense) to call methods on the Map from multiple goroutines concurrently. However, it may not always be safe to do so from the perspective of the actual eBPF map semantics. For example, writes to hash maps are atomic, while writes to arrays are not. Consult the bpf documentation for more details.

TODO(acln): eitehr expand on where to find said documentation, or document the semantics more precisely.

func (*Map) Close added in v0.5.0 

func (m *Map) Close() error

Close destroys the map and releases the associated file descriptor. After a call to Close, future method calls on the Map will return errors.

func (*Map) Create added in v0.5.0 

func (m *Map) Create(k, v []byte) error

Create creates a new entry for k in the map, and sets the value to v. If an entry for k exists in the map, Create returns an error such that IsExist(err) == true.

func (*Map) Delete added in v0.5.0 

func (m *Map) Delete(k []byte) error

Delete deletes the entry for k. If an entry for k does not exist in the map, Delete returns an error such that IsNotExist(err) == true.

func (*Map) Init added in v0.5.0 

func (m *Map) Init() error

Init initializes the map.

func (*Map) Iterate added in v0.5.0 

func (m *Map) Iterate(fn func(k, v []byte) (stop bool), startHint []byte) error

Iterate iterates over all keys in the map and calls fn for each key-value pair. If fn returns true or the final element of the map is reached, iteration stops. fn must not retain the arguments it is called with.

startHint optionally specifies a key that does *not* exist in the map, such that Iterate can begin iteration from the first key that does. Due to the nature of BPF map iterators, on Linux kernels older than 4.12, Iterate requires a non-nil startHint. On Linux >= 4.12, startHint may be nil, but it is recommended to pass a valid one nevertheless.

func (*Map) Lookup added in v0.5.0 

func (m *Map) Lookup(k, v []byte) error

Lookup looks up the value for k and stores it in v. If k is not found in the map, Lookup returns an error such that IsNotExist(err) == true.

func (*Map) Set added in v0.5.0 

func (m *Map) Set(k, v []byte) error

Set sets the value for k to v. If an entry for k exists in the map, it will be overwritten.

func (*Map) Update added in v0.5.0 

func (m *Map) Update(k, v []byte) error

Update updates the entry for k to v. If an entry for k does not exist in the map, Update returns an error such that IsNotExist(err) == true.

type MapOpError 

type MapOpError struct {
	Op  string
	Err error
}

MapOpError records an error caused by a map operation.

Op is the high level operation performed.

In some cases, Err is of type SyscallError.

func (*MapOpError) Cause 

func (e *MapOpError) Cause() error

Cause returns e.Err's cause, if any, or e.Err itself otherwise.

func (*MapOpError) Error 

func (e *MapOpError) Error() string

type MapType added in v0.5.0 

type MapType uint32

MapType is the type of an eBPF map. 

const (
	MapUnspec MapType = iota

	MapHash
	MapArray
	MapProgArray
	MapPerfEventArray
	MapPerCPUHash
	MapPerCPUArray
	MapStackTrace
	MapCGroupArray
	MapLRUHash
	MapLRUPerCPUHash
	MapLPMTrie
	MapArrayOfMaps
	MapHashOfMaps
	MapDevmap
	MapSockmap
	MapCPUmap
	MapXSKMap
	MapSockhash
	MapCGroupStorage
	MapReuseportSockarray
)

Supported map types.

type Mode added in v0.6.0 

type Mode uint8

Mode is the addres mode of a load or store instruction. 

const (
	IMM  Mode = 0x00
	ABS  Mode = 0x20
	IND  Mode = 0x40
	MEM  Mode = 0x60
	LEN  Mode = 0x80
	MSH  Mode = 0xa0
	XADD Mode = 0xc0
)

Valid address modes.

func (Mode) String added in v0.6.0 

func (m Mode) String() string

type Opcode added in v0.6.0 

type Opcode uint8

Opcode is an eBPF opcode.

func (Opcode) ALUOp added in v0.6.0 

func (o Opcode) ALUOp() ALUOp

ALUOp returns the ALU operation associated with o, applicable if o.Class() is ALU or ALU64.

func (Opcode) Class added in v0.6.0 

func (o Opcode) Class() Class

Class returns the instruction class of o.

func (Opcode) JumpCond added in v0.6.0 

func (o Opcode) JumpCond() JumpCond

JumpCond returns the jump condition associated with o, applicable if o.Class() is JMP.

func (Opcode) Mode added in v0.6.0 

func (o Opcode) Mode() Mode

Mode returns the address mode of the instruction, applicable if o represents a load or a store.

func (Opcode) Size added in v0.6.0 

func (o Opcode) Size() Size

Size returns the size of the instruction, applicable if o represents a load or a store.

type Prog 

type Prog struct {
	Type               ProgType
	License            string
	KernelVersion      uint32
	StrictAlignment    bool
	ObjectName         string
	IfIndex            uint32
	ExpectedAttachType AttachType
	// contains filtered or unexported fields
}

Prog configures an eBPF program.

func (*Prog) AttachCGroup added in v0.3.0 

func (p *Prog) AttachCGroup(fd int, typ AttachType, flag CGroupAttachFlag) error

AttachCGroup attaches the program to a control group.

TODO(acln): implement this

func (*Prog) AttachSocket added in v0.3.0 

func (p *Prog) AttachSocket(sock syscall.RawConn) error

AttachSocket attaches the program to a socket.

func (*Prog) AttachSocketFD added in v0.3.0 

func (p *Prog) AttachSocketFD(sockFD int) error

AttachSocketFD attaches the program to a raw file descriptor, which must refer to a socket.

func (*Prog) Detach added in v0.3.0 

func (p *Prog) Detach() error

Detach detaches the program from the associated file descriptor. Most programs don't need to call Detach explicitly, since it is called by Unload.

func (*Prog) Load 

func (p *Prog) Load(s *InstructionStream) (log string, err error)

Load attaches the specified InstructionStream to the Prog and loads the program into the kernel.

If the specified InstructionStream uses symbols, all symbols must be resolved before calling Load.

If loading the program produces output from the eBPF kernel verifier, the output is returned in the log string.

func (*Prog) RunTest added in v0.3.0 

func (p *Prog) RunTest(t Test) error

RunTest tests the program, as specified by t.

func (*Prog) Unload 

func (p *Prog) Unload() error

Unload unloads the program from the kernel and releases the associated file descriptor.

type ProgType 

type ProgType uint32

ProgType is the type of an eBPF program. 

const (
	ProgTypeUnspec ProgType = iota
	ProgTypeSocketFilter
	ProgTypeKProbe
	ProgTypeSchedCLS
	ProgTypeSchedACT
	ProgTypeTracepoint
	ProgTypeXDP
	ProgTypePerfEvent
	ProgTypeCGroupSKB
	ProgTypeCGroupSock
	ProgTypeLWTIn
	ProgTypeLWTOut
	ProgTypeLWTXMit
	ProgTypeSockOps
	ProgTypeSKSKB
	ProgTypeCGroupDevice
	ProgTypeSKMsg
	ProgTypeRawTracepoint
	ProgTypeCGroupSockAddr
	ProgTypeLWTSeg6Local
	ProgTypeLIRCMode2
	ProgTypeSKReusePort
)

Valid eBPF program types.

type Register 

type Register uint8

Register is an eBPF register. 

const (
	R0 Register = iota
	R1
	R2
	R3
	R4
	R5
	R6
	R7
	R8
	R9
	R10
	FP = R10

	// PseudoMapFD is used to specify a map file descriptor
	// for loading, in a 64-bit immediate load instruction.
	PseudoMapFD Register = 1

	// PseudoCall is used to specify a kernel function to call,
	// in a call instruction.
	PseudoCall Register = 1
)

Valid eBPF registers.

When calling kernel functions, R0 holds the return value, R1 - R5 are destroyed and set to unreadable, and R6 - R9 are preserved (callee-saved). R10 or FP is the read-only frame pointer.

func (Register) String added in v0.6.0 

func (r Register) String() string

type Size added in v0.6.0 

type Size uint8

Size is the size of a load or store instruction. 

const (
	W  Size = 0x00 // 32 bit
	H  Size = 0x08 // 16 bit
	B  Size = 0x10 // 8 bit
	DW Size = 0x18 // 64 bit
)

Instruction widths.

func (Size) String added in v0.6.0 

func (sz Size) String() string

type SourceOperand added in v0.6.0 

type SourceOperand uint8

SourceOperand specifies the souce operand for an instruction. 

const (
	// K specifies the 32 bit immediate as the source operand.
	K SourceOperand = 0x00

	// X specifies the source register as the source operand.
	X SourceOperand = 0x08
)

Source operands.

func (SourceOperand) String added in v0.6.0 

func (op SourceOperand) String() string

type SymbolTable added in v0.6.0 

type SymbolTable struct {
	Maps  map[string]*Map
	Imm32 map[string]int32
	Imm64 map[string]int64
}

SymbolTable is a symbol table for an eBPF program.

type SyscallError 

type SyscallError struct {
	Cmd string
	Err error
}

SyscallError records an error from a bpf(2) system call.

Cmd is a string describing the bpf command executed, e.g. "BPF_CREATE_MAP".

Err is the underlying error, of type syscall.Errno.

func (*SyscallError) Cause 

func (e *SyscallError) Cause() error

Cause returns the cause of the error: e.Err.

func (*SyscallError) Error 

func (e *SyscallError) Error() string

type Test added in v0.3.0 

type Test struct {
	Retval   uint32 // TODO(acln): what is this for?
	Input    []byte
	Output   []byte
	Repeat   uint32
	Duration uint32 // TODO(acln): what is this? ms? us? ns?
}

Test specifies a test run for an eBPF program.

type UnresolvedSymbolError added in v0.6.0 

type UnresolvedSymbolError struct {
	Kind   string
	Name   string
	Opcode Opcode
	Index  int
}

UnresolvedSymbolError captures an unresolved symbol in an instruction stream.

TODO(acln): document this

func (*UnresolvedSymbolError) Error added in v0.6.0 

func (e *UnresolvedSymbolError) Error() string

Notes

Bugs

  • all of this is very poorly documented

  • there is no exported instruction type, and no way to print instructions yet. We will need this when we add support for loading code from ELF files.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.