bpf

Documentation

Index

• Constants
• func LoadUfuncgraph() (*ebpf.CollectionSpec, error)
• func LoadUfuncgraphObjects(obj interface{}, opts *ebpf.CollectionOptions) error
• type BPF
  • func New() *BPF
  • func (b *BPF) Attach(bin string, uprobes []uprobe.Uprobe) (err error)
  • func (b *BPF) Detach()
  • func (b *BPF) Load(uprobes []uprobe.Uprobe) (err error)
  • func (b *BPF) PollEvents(ctx context.Context) chan UfuncgraphEvent
• type UfuncgraphEvent
• type UfuncgraphMapSpecs
• type UfuncgraphMaps
  • func (m *UfuncgraphMaps) Close() error
• type UfuncgraphObjects
  • func (o *UfuncgraphObjects) Close() error
• type UfuncgraphProgramSpecs
• type UfuncgraphPrograms
  • func (p *UfuncgraphPrograms) Close() error
• type UfuncgraphSpecs

Constants

const (
	BpfInsertIndex        = 81
	EventDataOffset int64 = 436
	VacantR10Offset       = -96
)

Functions

func LoadUfuncgraph

func LoadUfuncgraph() (*ebpf.CollectionSpec, error)

LoadUfuncgraph returns the embedded CollectionSpec for Ufuncgraph.

func LoadUfuncgraphObjects

func LoadUfuncgraphObjects(obj interface{}, opts *ebpf.CollectionOptions) error

LoadUfuncgraphObjects loads Ufuncgraph and converts it into a struct.

The following types are suitable as obj argument:

*UfuncgraphObjects
*UfuncgraphPrograms
*UfuncgraphMaps

See ebpf.CollectionSpec.LoadAndAssign documentation for details.

Types

type BPF

type BPF struct {
	// contains filtered or unexported fields
}

func New

func New() *BPF

func (*BPF) Attach

func (b *BPF) Attach(bin string, uprobes []uprobe.Uprobe) (err error)

func (*BPF) Detach

func (b *BPF) Detach()

func (*BPF) Load

func (b *BPF) Load(uprobes []uprobe.Uprobe) (err error)

func (*BPF) PollEvents

func (b *BPF) PollEvents(ctx context.Context) chan UfuncgraphEvent

type UfuncgraphEvent

type UfuncgraphEvent struct {
	StackId    uint64
	CallerIp   uint64
	Ip         uint64
	TimeNs     uint64
	StackDepth uint16
	Location   uint8
	Errno      uint8
	Bt         [400]uint8
	Data       [100]uint8
}

type UfuncgraphMapSpecs

type UfuncgraphMapSpecs struct {
	BpfStack   *ebpf.MapSpec `ebpf:"bpf_stack"`
	EventQueue *ebpf.MapSpec `ebpf:"event_queue"`
	Goids      *ebpf.MapSpec `ebpf:"goids"`
}

UfuncgraphMapSpecs contains maps before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type UfuncgraphMaps

type UfuncgraphMaps struct {
	BpfStack   *ebpf.Map `ebpf:"bpf_stack"`
	EventQueue *ebpf.Map `ebpf:"event_queue"`
	Goids      *ebpf.Map `ebpf:"goids"`
}

UfuncgraphMaps contains all maps after they have been loaded into the kernel.

It can be passed to LoadUfuncgraphObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*UfuncgraphMaps) Close

func (m *UfuncgraphMaps) Close() error

type UfuncgraphObjects

type UfuncgraphObjects struct {
	UfuncgraphPrograms
	UfuncgraphMaps
}

UfuncgraphObjects contains all objects after they have been loaded into the kernel.

It can be passed to LoadUfuncgraphObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*UfuncgraphObjects) Close

func (o *UfuncgraphObjects) Close() error

type UfuncgraphProgramSpecs

type UfuncgraphProgramSpecs struct {
	Entpoint       *ebpf.ProgramSpec `ebpf:"entpoint"`
	EntpointWithBt *ebpf.ProgramSpec `ebpf:"entpoint_with_bt"`
	Retpoint       *ebpf.ProgramSpec `ebpf:"retpoint"`
}

UfuncgraphSpecs contains programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type UfuncgraphPrograms

type UfuncgraphPrograms struct {
	Entpoint       *ebpf.Program `ebpf:"entpoint"`
	EntpointWithBt *ebpf.Program `ebpf:"entpoint_with_bt"`
	Retpoint       *ebpf.Program `ebpf:"retpoint"`
}

UfuncgraphPrograms contains all programs after they have been loaded into the kernel.

It can be passed to LoadUfuncgraphObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*UfuncgraphPrograms) Close

func (p *UfuncgraphPrograms) Close() error

type UfuncgraphSpecs

type UfuncgraphSpecs struct {
	UfuncgraphProgramSpecs
	UfuncgraphMapSpecs
}

UfuncgraphSpecs contains maps and programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.