Hi,
I am looking what' s the best way to run kprobes/kretprobes eBPF in
Golang and get events via perf maps. I was directed on IRC to
iomodules as example:
https://github.com/iovisor/iomodules/tree/master/hover/bpf
I wrote a proof-of-concept to learn how this works at:
https://github.com/alban/golang-ebpf/blob/v0.1/main.go
It reuses the iomodules bpf package to build bpf.BpfModule. Then,
getting the events from the perf map cannot be done completely via the
iomodules bpf package because bpf.BpfTable seems to only support maps
with string keys. So I needed to use cgo and call
C.bpf_open_perf_buffer() directly, and iterate over the perf map to
install a reader for each cpu.
Is it the best approach? Should there be a perf map initializer in the
iomodules bpf package, or create another Golang lib for that? Or maybe
something directly in C in bcc.so?
Another piece missing in the iomodules bpf package is
AttachKretprobe(). At the moment, there is only a function for
AttachKprobe(). Iago has a PR for this:
https://github.com/iovisor/iomodules/pull/22
Cheers,
Alban
_______________________________________________
iovisor-dev mailing list
[email protected]
https://lists.iovisor.org/mailman/listinfo/iovisor-dev
