beyla icon indicating copy to clipboard operation
beyla copied to clipboard

Writing to a Go hmap/map

Open ananthvanchip opened this issue 7 months ago • 1 comments

Hi, I am trying to extend Beyla to add instrumentation to SQS. I am writing a uprobe on the sqs.SendMessage method which contains the message metadata.

The SendMessageInput contains an MessageAttributes which is a map.

I want to add a key and value to the map so that its available at the consumer side.

While I see a lot of code examples to read a go map, I dont find any examples to write into a go map. Can you tell me if there are any around the same that I can re-use?

ananthvanchip avatar Apr 24 '25 07:04 ananthvanchip

I think what you are trying to do is very hard, for couple of reasons:

  1. You can't add to a Go map in eBPF without being able allocate extra memory, in case the spine array is completely full. Since Go manages its own memory, it's inherently unsafe to change memory segments owned by the Go GC. You can attach external memory segments and all, but it's always problematic to make the references stick when the heap is scanned for live references.
  2. There are two types of maps. Go 1.24 introduced Swiss maps, which add one more level of complexity and you still need to support the older Go maps.
  3. Finally to write memory that's not at the network level, you need to use bpf_probe_write_user which requires SYS_ADMIN and it will not be available on systems with secure boot.

If 3. is not an issue for your work, I'd look if it's possible to write the memory in the final buffer, after the map is serialised to an array which is likely going to be at some point in the SQS protocol. We have couple of examples in the code where we've done this, to avoid dealing with adding memory to maps or even arrays.

https://github.com/grafana/beyla/blob/main/bpf/gotracer/go_nethttp.c#L941

or

https://github.com/grafana/beyla/blob/main/bpf/gotracer/go_grpc.c#L710

grcevski avatar Apr 24 '25 15:04 grcevski

Thanks @ananthvanchip for your question/ideas! Closing as this is more a question than feature/bug. Feel free to reopen if you think the opossite. If you have more questions i'd say our slack is more appropiate fro this: https://grafana.slack.com/archives/C05T4PW9E85

marctc avatar May 02 '25 13:05 marctc