How to automatically ATTACH all programs in a CollectionSpec?

[f18m]

Hi,
I'm new to cilium/ebpf so this might be a dumb question.
I have written my own eBPF kernel program in C. I have also a small C++ userspace counterpart written using libbpf.
In that C++ program what I have a short snippet that handles LOADING and ATTACHING of the ebpf programs:

	skel = <myebpfname>_bpf__open_and_load();
	if (!skel)
	{
		printf("Failed to open/load eBPF kernel program\n");
		return 1;
	}

	err = <myebpfname>_bpf__attach(skel);
	if (err)
	{
		fprintf(stderr, "Failed to attach BPF skeleton: %d\n", err);
		<myebpfname>_bpf__destroy(skel);
		return 1;
	}

Now I'm trying to do the same in Go using cilium/ebpf. Reading the docs I think tha the equivalent portion for LOADING ebpf kernel program is the auto-generated (by "go generate") function:

func load<myebpfname>Objects(obj interface{}, opts *ebpf.CollectionOptions) error {
	spec, err := load<myebpfname>()  // loads the embedded .o bytecode into a CollectionSpec
	if err != nil {
		return err
	}

        // use a CollectionSpec to automatically load the programs & maps and assign them to the "obj" struct
	return spec.LoadAndAssign(obj, opts)
}

My understanding is that next step, ATTACHING requires manual writing a snippet like:

	// Attach the eBPF program to a kernel syscall
	err = ebpf.AttachKprobe("syscall.SyscallName", obj_struct_with_all_programs_and_maps.myProgramName)
	if err != nil {
		fmt.Println("Failed to attach eBPF program to syscall:", err)
		return
	}

is that correct?
Does cilium/ebpf provides some way to automatically ATTACH all programs embedded into a bytecode .o file to the matching kernel kprobes?
I think cilium/ebpf does have all the information required, and manually repeating the syscall name using ebpf.AttachKprobe() is error-prone... after all the syscall name is already encoded in the kernel program using the

SEC("ksyscall/accept")
int BPF_KPROBE_SYSCALL(my_syscall_accept_probe, int sockfd, struct sockaddr *addr, socklen_t *addrlen)
{
    ... my code...
}

what am I missing?
thanks!!

[lmb]

You're correct, there currently isn't an API to automatically attach programs. The reason is that not all program types carry all the necessary information in the ELF. For example, we can't know which interface to attach an XDP program to.

In your case, would something like the following work?

err = link.AttachKprobe(progSpec.AttachTo, struct.myProgramname)

[f18m]

hi @lmb ,
thanks for your pointer. I actually managed to get it to work with a snippet of code like (in case this turns out to be useful to others):

	// FIXME: I'm pretty sure there would be a smarter way to do this, using the Golang reflect package
	//        instead of hardcoding the list of eBPF programs and their CollectionSpec name:
	allPrograms := map[string]*ebpf.Program{
		"<ebpf_probe1>":    objs.Program1,          // "objs" is the auto-generated (using bpf2go) structure with the list of eBPF kernel progs
		"<ebpf_probe1_exit>":    objs.Program1Exit,
                // ...the hardcoded list goes on...
	}

	// Attach all programs to their kprobe/kretprobe... C++ libbpf has a smarter way to do this...
	// see my post at https://github.com/cilium/ebpf/discussions/1372
	var linksToReturn []link.Link
	for _, v := range spec.Programs {
		isRetProbe := strings.HasSuffix(v.Name, "_exit")
		realAttachPoint := "__x64_sys_" + v.AttachTo
		if isRetProbe {
			log.Printf("Loaded eBPF RETURN KPROBE [%s] that needs to be attached to [%s]", v.Name, realAttachPoint)

			// Attach the program to the kernel
			prog, err := link.Kretprobe(realAttachPoint, allPrograms[v.Name], nil)
			if err != nil {
				log.Fatalf("attaching kprobe: %s", err)
			}
			linksToReturn = append(linksToReturn, prog)
		} else {

			log.Printf("Loaded eBPF KPROBE [%s] that needs to be attached to [%s]", v.Name, realAttachPoint)

			// Attach the program to the kernel
			prog, err := link.Kprobe(realAttachPoint, allPrograms[v.Name], nil)
			if err != nil {
				log.Fatalf("attaching kprobe: %s", err)
			}
			linksToReturn = append(linksToReturn, prog)
		}
	}

Note that I put all "links" into a slice because I want to defer their closure in the right "scope" (this snippet comes from an auxiliary function doing just initilization)

THanks!

[lmb]

Instead of populating allPrograms you can call NewCollection with the CollectionSpec returned by your equivalent of

ebpf/cmd/bpf2go/test/test_bpfel.go

Line 30 in 42cbe8f

func loadTest() (*ebpf.CollectionSpec, error) {

You also shouldn't have to deal with the __x64_sys_ prefix for the Kprobe, the library does that for you.

Interesting that there is no better way to figure out whether a program is a kretprobe!

[f18m]

Instead of populating allPrograms you can call NewCollection with the CollectionSpec returned by your equivalent of

ebpf/cmd/bpf2go/test/test_bpfel.go

Line 30 in 42cbe8f

func loadTest() (*ebpf.CollectionSpec, error) {

thanks, good to know that!

You also shouldn't have to deal with the __x64_sys_ prefix for the Kprobe, the library does that for you.

right - I need to try to get rid of that prefix.

Interesting that there is no better way to figure out whether a program is a kretprobe!

Right... it's not the most elegant way at all... but it's simple and works fine for me

Thanks!