bpftrace go programs

README.md

bpftrace go programs

go build -o server main.go
./server

objdump -t ./server | grep "main."
objdump --disassemble="main.add" ./server

./server &
sudo bpftrace -e 'uprobe:./server:main.add { print(reg("ax") + reg("bx")); }' &
# or sudo bpftrace debug.bt &
curl 'localhost:8080?x=10&y=21'

debug.bt

// $ objdump --disassemble="main.getint" ./server
// 
// ./server:     file format elf64-x86-64
// 
// 
// Disassembly of section .text:
// 
// 0000000000606fa0 <main.getint>:
//   606fa0:    49 3b 66 10             cmp    0x10(%r14),%rsp
//   606fa4:    76 5f                   jbe    607005 <main.getint+0x65>
//   606fa6:    48 83 ec 28             sub    $0x28,%rsp
//   606faa:    48 89 6c 24 20          mov    %rbp,0x20(%rsp)
//   606faf:    48 8d 6c 24 20          lea    0x20(%rsp),%rbp
//   606fb4:    48 89 44 24 30          mov    %rax,0x30(%rsp)
//   606fb9:    48 85 c9                test   %rcx,%rcx
//   606fbc:    75 06                   jne    606fc4 <main.getint+0x24>
//   606fbe:    31 c9                   xor    %ecx,%ecx
//   606fc0:    31 d2                   xor    %edx,%edx
//   606fc2:    eb 2c                   jmp    606ff0 <main.getint+0x50>
//   606fc4:    48 89 df                mov    %rbx,%rdi
//   606fc7:    48 89 cb                mov    %rcx,%rbx
//   606fca:    48 89 c1                mov    %rax,%rcx
//   606fcd:    48 8d 05 8c 3d 04 00    lea    0x43d8c(%rip),%rax        # 64ad60 <type.*+0x42d60>
//   606fd4:    e8 c7 c7 e0 ff          call   4137a0 <runtime.mapaccess1_faststr>
//   606fd9:    48 8b 10                mov    (%rax),%rdx
//   606fdc:    48 83 78 08 00          cmpq   $0x0,0x8(%rax)
//   606fe1:    75 06                   jne    606fe9 <main.getint+0x49>
//   606fe3:    31 c9                   xor    %ecx,%ecx
//   606fe5:    31 d2                   xor    %edx,%edx
//   606fe7:    eb 07                   jmp    606ff0 <main.getint+0x50>
//   606fe9:    48 8b 4a 08             mov    0x8(%rdx),%rcx
//   606fed:    48 8b 12                mov    (%rdx),%rdx
//   606ff0:    48 89 d0                mov    %rdx,%rax
//   606ff3:    48 89 cb                mov    %rcx,%rbx
//   606ff6:    e8 e5 2f e6 ff          call   469fe0 <strconv.Atoi>
//   606ffb:    48 8b 6c 24 20          mov    0x20(%rsp),%rbp
//   607000:    48 83 c4 28             add    $0x28,%rsp
//   607004:    c3                      ret
//   607005:    48 89 44 24 08          mov    %rax,0x8(%rsp)
//   60700a:    48 89 5c 24 10          mov    %rbx,0x10(%rsp)
//   60700f:    48 89 4c 24 18          mov    %rcx,0x18(%rsp)
//   607014:    e8 47 a2 e5 ff          call   461260 <runtime.morestack_noctxt.abi0>
//   607019:    48 8b 44 24 08          mov    0x8(%rsp),%rax
//   60701e:    48 8b 5c 24 10          mov    0x10(%rsp),%rbx
//   607023:    48 8b 4c 24 18          mov    0x18(%rsp),%rcx
//   607028:    e9 73 ff ff ff          jmp    606fa0 <main.getint>
// 
// Disassembly of section .plt:

uprobe:./server:main.getint {
    $name = str(reg("ax"), reg("bx"));
    $len  = *reg("cx");
    printf("main.convert:args %s - %d\n", $name, $len);
}


// $ objdump --disassemble="main.add" ./server
// 
// ./server:     file format elf64-x86-64
// 
// 
// Disassembly of section .text:
// 
// 0000000000607040 <main.add>:
//   607040:       48 01 d8                add    %rbx,%rax
//   607043:       c3                      ret
// 
// Disassembly of section .plt:

uprobe:./server:main.add {
    $x = reg("ax");
    $y = reg("bx");
    printf("main.add:args %d %d\n", $x, $y);
}


// $ objdump --disassemble="main.fmtint" ./server
// 
// ./server:     file format elf64-x86-64
// 
// 
// Disassembly of section .text:
// 
// 0000000000607060 <main.fmtint>:
//   607060:    49 3b 66 10             cmp    0x10(%r14),%rsp
//   607064:    76 3b                   jbe    6070a1 <main.fmtint+0x41>
//   607066:    48 83 ec 30             sub    $0x30,%rsp
//   60706a:    48 89 6c 24 28          mov    %rbp,0x28(%rsp)
//   60706f:    48 8d 6c 24 28          lea    0x28(%rsp),%rbp
//   607074:    bb 0a 00 00 00          mov    $0xa,%ebx
//   607079:    e8 62 73 e6 ff          call   46e3e0 <strconv.FormatInt>
//   60707e:    48 89 d9                mov    %rbx,%rcx
//   607081:    48 8d 3d 82 a5 05 00    lea    0x5a582(%rip),%rdi        # 66160a <go.string.*+0x1a>
//   607088:    be 01 00 00 00          mov    $0x1,%esi
//   60708d:    48 89 c3                mov    %rax,%rbx
//   607090:    31 c0                   xor    %eax,%eax
//   607092:    e8 29 7c e4 ff          call   44ecc0 <runtime.concatstring2>
//   607097:    48 8b 6c 24 28          mov    0x28(%rsp),%rbp
//   60709c:    48 83 c4 30             add    $0x30,%rsp
//   6070a0:    c3                      ret
//   6070a1:    48 89 44 24 08          mov    %rax,0x8(%rsp)
//   6070a6:    e8 b5 a1 e5 ff          call   461260 <runtime.morestack_noctxt.abi0>
//   6070ab:    48 8b 44 24 08          mov    0x8(%rsp),%rax
//   6070b0:    eb ae                   jmp    607060 <main.fmtint>
// 
// Disassembly of section .plt:

uprobe:./server:main.fmtint {
    $sum = reg("ax");
    printf("main.sum:args %d\n", $sum);
}

main.go

package main

import (
    "log"
    "net/http"
    "net/url"
    "strconv"
)

func main() {
    http.HandleFunc("/", handler)

    log.Printf("info: listening on :8080")
    if err := http.ListenAndServe(":8080", nil); err != nil {
        log.Fatalf("fatal: %s", err)
    }
}

//go:noinline
func handler(resp http.ResponseWriter, req *http.Request) {
    vals := req.URL.Query()
    x, y := getint("x", vals), getint("y", vals)

    sum := add(x, y)
    out := fmtint(sum)

    resp.WriteHeader(http.StatusOK)
    resp.Write([]byte(out))
}

//go:noinline
func getint(name string, vals url.Values) int {
    val := vals.Get(name)
    num, _ := strconv.Atoi(val)
    return num
}

//go:noinline
func add(x, y int) int {
    return x + y
}

//go:noinline
func fmtint(sum int) string {
    fmt := strconv.FormatInt(int64(sum), 10)
    return fmt + "\n"
}