Awesome

NAME

ebpf - Pure-Perl interface for eBPF (extended Berkeley Packet Filter)

SYNOPSIS

use strict;
use warnings;
use utf8;
use Sys::Ebpf::Loader;
use Sys::Ebpf::Link::Perf::Kprobe;

my $file   = "kprobe.o";
my $loader = Sys::Ebpf::Loader->new($file);
my $data   = $loader->load_elf();
my $kprobe_fn = "kprobe/sys_execve";

my ( $map_data, $prog_fd ) = $loader->load_bpf($kprobe_fn);
my $map_kprobe_map = $map_data->{kprobe_map};
$map_kprobe_map->{key_schema}   = [ [ 'kprobe_map_key',   'uint32' ], ];
$map_kprobe_map->{value_schema} = [ [ 'kprobe_map_value', 'uint64' ], ];

my $kprobe_info = Sys::Ebpf::Link::Perf::Kprobe::attach_kprobe( $prog_fd, $kprobe_fn );

while (1) {
    my $key   = { kprobe_map_key => 0 };
    my $value = $map_kprobe_map->lookup($key);
    if ( defined $value ) {
        print Dumper($value);
        printf "%s called %d times\n", $kprobe_fn, $value->{kprobe_map_value};
    }
    else {
        warn "Failed to read map value\n";
    }
    sleep(1);
}

DESCRIPTION

The ebpf module provides a Perl interface for working with eBPF (extended Berkeley Packet Filter) on Linux systems. It allows you to load eBPF programs, create and manipulate BPF maps, and interact with the eBPF subsystem directly from Perl.

This module includes several submodules:

Sys::Ebpf::Loader - For loading eBPF programs and maps
Sys::Ebpf::Asm - eBPF assembly helpers
Sys::Ebpf::Reader - For reading ELF files
Sys::Ebpf::Elf::Parser - For parsing ELF files
Sys::Ebpf::Link::Netlink - For calling BPF-related netlink commands(e.g. XDP)
Sys::Ebpf::Link::Perf - For calling BPF-related perf events(e.g. kprobes)

FUNCTIONS

This module primarily serves as a namespace and version container for its submodules. Refer to the documentation of individual submodules for specific functions and usage.

AUTHOR

TAKERU HAYASAKA hayatake396@gmail.com

LICENSE AND COPYRIGHT

This program is free software; you can redistribute it and/or modify it under the terms of either: the GNU General Public License as published by the Free Software Foundation; or the Artistic License.

See http://dev.perl.org/licenses/ for more information.