kallsyms

Documentation

Overview

Package kallsyms provides functions to resolve kernel symbols.

Index

• func SpecUpdateAddresses(spec *ebpf.CollectionSpec, symbols []string) error
• type KAllSyms
  • func NewKAllSyms() (*KAllSyms, error)
  • func NewKAllSymsFromReader(reader io.Reader) (*KAllSyms, error)
  • func (k *KAllSyms) LookupByInstructionPointer(ip uint64) string
  • func (k *KAllSyms) SymbolExists(symbol string) bool

Functions

func SpecUpdateAddresses

func SpecUpdateAddresses(spec *ebpf.CollectionSpec, symbols []string) error

SpecUpdateAddresses updates the addresses of the given symbols in the given collection spec.

The ebpf program is expected to be have global variables with the suffix "_addr" for each symbol:

const volatile __u64 socket_file_ops_addr = 0;

Then, SpecUpdateAddresses() can be called in this way:

kallsyms.SpecUpdateAddresses(spec, []string{"socket_file_ops"})

Types

type KAllSyms

type KAllSyms struct {
	// contains filtered or unexported fields
}

func NewKAllSyms

func NewKAllSyms() (*KAllSyms, error)

NewKAllSyms reads /proc/kallsyms and returns a KAllSyms.

func NewKAllSymsFromReader

func NewKAllSymsFromReader(reader io.Reader) (*KAllSyms, error)

NewKAllSymsFromReader reads a kallsyms file from the given reader and returns a KAllSyms.

func (*KAllSyms) LookupByInstructionPointer

func (k *KAllSyms) LookupByInstructionPointer(ip uint64) string

LookupByInstructionPointer tries to find the kernel symbol corresponding to the given instruction pointer. For example, if instruction pointer is 0x1004 and there is a symbol which address is 0x1000, this function will return the name of this symbol. If no symbol is found, it returns "[unknown]".

func (*KAllSyms) SymbolExists

func (k *KAllSyms) SymbolExists(symbol string) bool

SymbolExists returns true if the given symbol exists in the kernel.