aquasecurity
Global application configuration
This article section describes how globals can be used to configure a BPF program before loading. I'm curious if we could have some helpers for setting some simple configurations from Go. For my use case, I want to configure a single uint32, for which an entire map and the lookup overhead seem a little drastic. Any ideas on how we could maybe achieve this?
@yanivagman @eyakubovich @grantseltzer
libbpf uses some trickery to expose globals as a BPF map of array type. An array map is special in that it's mmap-able so the skeleton code will mmap it into the userspace and cast the pointer to point to a struct that matches the layout of data in the ELF section. All of that is doable from Go except that without the use of bpftool to generate the struct, it would need to be hand coded an maintained, making it fragile (if it's just one variable, it's fine). It might be easier to use the skeleton generator and then access the skeleton from Go.
However you can also just use a BPF array map of one uint32, load it and set the value before attaching the BPF program to the kprobes, tracepoints, etc. Only downside is that accessing it in BPF will be a bit slower as it'll go through the map API.
However you can also just use a BPF array map of one uint32, load it and set the value before attaching the BPF program to the kprobes, tracepoints, etc. Only downside is that accessing it in BPF will be a bit slower as it'll go through the map API.
Yeah, this is what I am currently doing.
All of that is doable from Go except that without the use of bpftool to generate the struct, it would need to be hand coded an maintained, making it fragile (if it's just one variable, it's fine). It might be easier to use the skeleton generator and then access the skeleton from Go.
I'd be fine with maintaining this just for my case in my repo, do you happen to have an example of this?
I'd be fine with maintaining this just for my case in my repo, do you happen to have an example of this?
I don't although I dug around in libbpf to locate where they do it. I would like to have mmap support for arrays as well as I currently have to go through the map API on the userspace in critical path. However it's not urgent enough so I decided to put off implementing this PR till later.
I brought something similar up on the mailing list a little while back: https://lore.kernel.org/bpf/CAEf4BzZ2Piu5kkpp6PmHUFryGOo7P=jjNk7DkUVg6kJUBaHs8g@mail.gmail.com/
I believe it would just be a matter of having a map iterator and finding the rodata map. Once libbpf is 1.0 we'll quick switch over to supporting it, and hopefully by then we can just find the map with the name ".rodata".
Regardless this would be great to have!
