Documentation ¶
Index ¶
- Variables
- func HasFramePointers(executable string) (bool, error)
- func ReadFDEs(path string) (frame.FrameDescriptionEntries, error)
- type BpfCfaType
- type CompactUnwindTable
- type CompactUnwindTableRow
- func (cutr *CompactUnwindTableRow) CfaOffset() int16
- func (cutr *CompactUnwindTableRow) CfaType() uint8
- func (cutr *CompactUnwindTableRow) IsEndOfFDEMarker() bool
- func (cutr *CompactUnwindTableRow) Pc() uint64
- func (cutr *CompactUnwindTableRow) RbpOffset() int16
- func (cutr *CompactUnwindTableRow) RbpType() uint8
- func (cutr *CompactUnwindTableRow) ReservedDoNotUse() uint16
- type DwarfExpressionID
- type ExecutableMapping
- type ExecutableMappings
- type FramePointerCache
- type UnwindTable
- type UnwindTableBuilder
- type UnwindTableRow
Constants ¶
This section is empty.
Variables ¶
var ( ErrNoFDEsFound = errors.New("no FDEs found") ErrEhFrameSectionNotFound = errors.New("failed to find .eh_frame section") )
var Plt1 = [...]byte{ frame.DW_OP_breg7, frame.DW_OP_const1u, frame.DW_OP_breg16, frame.DW_OP_lit15, frame.DW_OP_and, frame.DW_OP_lit11, frame.DW_OP_ge, frame.DW_OP_lit3, frame.DW_OP_shl, frame.DW_OP_plus, }
Plt1 is equivalent to: sp + 8 + ((((ip & 15) >= 11)) << 3.
var Plt2 = [...]byte{ frame.DW_OP_breg7, frame.DW_OP_const1u, frame.DW_OP_breg16, frame.DW_OP_lit15, frame.DW_OP_and, frame.DW_OP_lit10, frame.DW_OP_ge, frame.DW_OP_lit3, frame.DW_OP_shl, frame.DW_OP_plus, }
Plt2 is quivalent to: sp + 8 + ((((ip & 15) >= 10)) << 3.
Functions ¶
func HasFramePointers ¶ added in v0.12.0
Types ¶
type BpfCfaType ¶ added in v0.12.0
type BpfCfaType uint16
type CompactUnwindTable ¶ added in v0.12.0
type CompactUnwindTable []CompactUnwindTableRow
func BuildCompactUnwindTable ¶ added in v0.12.0
func BuildCompactUnwindTable(fdes frame.FrameDescriptionEntries) (CompactUnwindTable, error)
BuildCompactUnwindTable produces a compact unwind table for the given frame description entries.
func CompactUnwindTableRepresentation ¶ added in v0.12.0
func CompactUnwindTableRepresentation(unwindTable UnwindTable) (CompactUnwindTable, error)
CompactUnwindTableRepresentation converts an unwind table to its compact table representation.
func (CompactUnwindTable) Len ¶ added in v0.12.0
func (t CompactUnwindTable) Len() int
func (CompactUnwindTable) Less ¶ added in v0.12.0
func (t CompactUnwindTable) Less(i, j int) bool
func (CompactUnwindTable) Swap ¶ added in v0.12.0
func (t CompactUnwindTable) Swap(i, j int)
type CompactUnwindTableRow ¶ added in v0.12.0
type CompactUnwindTableRow struct {
// contains filtered or unexported fields
}
CompactUnwindTableRows encodes unwind information using 2x 64 bit words.
func (*CompactUnwindTableRow) CfaOffset ¶ added in v0.12.0
func (cutr *CompactUnwindTableRow) CfaOffset() int16
func (*CompactUnwindTableRow) CfaType ¶ added in v0.12.0
func (cutr *CompactUnwindTableRow) CfaType() uint8
func (*CompactUnwindTableRow) IsEndOfFDEMarker ¶ added in v0.13.0
func (cutr *CompactUnwindTableRow) IsEndOfFDEMarker() bool
func (*CompactUnwindTableRow) Pc ¶ added in v0.12.0
func (cutr *CompactUnwindTableRow) Pc() uint64
func (*CompactUnwindTableRow) RbpOffset ¶ added in v0.12.0
func (cutr *CompactUnwindTableRow) RbpOffset() int16
func (*CompactUnwindTableRow) RbpType ¶ added in v0.12.0
func (cutr *CompactUnwindTableRow) RbpType() uint8
func (*CompactUnwindTableRow) ReservedDoNotUse ¶ added in v0.12.0
func (cutr *CompactUnwindTableRow) ReservedDoNotUse() uint16
type DwarfExpressionID ¶ added in v0.11.0
type DwarfExpressionID int16
const ( ExpressionUnknown DwarfExpressionID = iota ExpressionPlt1 ExpressionPlt2 )
func ExpressionIdentifier ¶ added in v0.11.0
func ExpressionIdentifier(expression []byte) DwarfExpressionID
ExpressionIdentifier returns the identifier for recognized DWARF expressions.
type ExecutableMapping ¶ added in v0.12.0
type ExecutableMapping struct { LoadAddr uint64 StartAddr uint64 EndAddr uint64 Executable string // contains filtered or unexported fields }
ExecutableMapping represents an executable memory mapping.
func (*ExecutableMapping) IsJitDump ¶ added in v0.14.0
func (pm *ExecutableMapping) IsJitDump() bool
IsJitDump returns whether the mapping looks like a jitdump0 file.
func (*ExecutableMapping) IsJitted ¶ added in v0.12.0
func (pm *ExecutableMapping) IsJitted() bool
IsJitted returns whether an executable mapping is JITed or not. The detection is done by checking if the executable mapping is not backed by a file.
We don't check for the writeable flag as `mprotect(2)` may be called to make it r+w only.
func (*ExecutableMapping) IsMainObject ¶ added in v0.12.0
func (pm *ExecutableMapping) IsMainObject() bool
IsMainObject returns whether this executable is the "main executable". which triggered the loading of all the other mappings.
We care about this because if Linux ASLR is enabled, we have to modify the loaded addresses for the main object.
func (*ExecutableMapping) IsNotFileBacked ¶ added in v0.12.0
func (pm *ExecutableMapping) IsNotFileBacked() bool
IsNotFileBacked returns whether the mapping is not backed by a file, such as JIT or vDSO sections.
func (*ExecutableMapping) IsSpecial ¶ added in v0.12.0
func (pm *ExecutableMapping) IsSpecial() bool
IsSpecial returns whether the file mapping is a "special" region, such as the mappings for vDSOs `[vdso]` and others.
func (*ExecutableMapping) String ¶ added in v0.12.0
func (pm *ExecutableMapping) String() string
type ExecutableMappings ¶ added in v0.12.0
type ExecutableMappings []*ExecutableMapping
func ListExecutableMappings ¶ added in v0.12.0
func ListExecutableMappings(rawMappings []*procfs.ProcMap) ExecutableMappings
ExecutableMappings returns the executable memory mappings with the appropriate loaded base address set for non-JIT code.
The reason why we need to find the loaded base address is that ELF executables aren't typically loaded in one large executable section, but split in several mappings. For example, the .rodata section, as well as .eh_frame might go in sections without executable permissions, as they aren't needed.
Note: jitdump files are typically executable but are excluded from the results.
func (ExecutableMappings) HasJitted ¶ added in v0.12.0
func (pm ExecutableMappings) HasJitted() bool
HasJitted returns if there's at least one JIT'ed mapping.
func (ExecutableMappings) Hash ¶ added in v0.15.0
func (pm ExecutableMappings) Hash() (uint64, error)
Hash produces a summary of the executable mappings.
type FramePointerCache ¶ added in v0.13.0
type FramePointerCache struct {
// contains filtered or unexported fields
}
func NewHasFramePointersCache ¶ added in v0.13.0
func NewHasFramePointersCache(logger log.Logger, reg prometheus.Registerer) FramePointerCache
func (*FramePointerCache) HasFramePointers ¶ added in v0.13.0
func (fpc *FramePointerCache) HasFramePointers(executable string) (bool, error)
type UnwindTable ¶
type UnwindTable []UnwindTableRow
func BuildUnwindTable ¶ added in v0.13.0
func BuildUnwindTable(fdes frame.FrameDescriptionEntries) UnwindTable
func (UnwindTable) Len ¶
func (t UnwindTable) Len() int
func (UnwindTable) Less ¶
func (t UnwindTable) Less(i, j int) bool
func (UnwindTable) Swap ¶
func (t UnwindTable) Swap(i, j int)
type UnwindTableBuilder ¶
type UnwindTableBuilder struct {
// contains filtered or unexported fields
}
func NewUnwindTableBuilder ¶
func NewUnwindTableBuilder(logger log.Logger) *UnwindTableBuilder
func (*UnwindTableBuilder) PrintTable ¶
func (ptb *UnwindTableBuilder) PrintTable(writer io.Writer, path string, compact bool, pc *uint64) error
PrintTable is a debugging helper that prints the unwinding table to the given io.Writer.
type UnwindTableRow ¶
type UnwindTableRow struct { // The address of the machine instruction. // Each row covers a range of machine instruction, from its address (Loc) to that of the row below. Loc uint64 // CFA, the value of the stack pointer in the previous frame. CFA frame.DWRule // The value of the RBP register. RBP frame.DWRule // The value of the saved return address. This is not needed in x86_64 as it's part of the ABI but is necessary // in arm64. RA frame.DWRule }
UnwindTableRow represents a single row in the unwind table. x86_64: rip (instruction pointer register), rsp (stack pointer register), rbp (base pointer/frame pointer register) aarch64: lr, sp, fp