ebpf

Documentation

Index

• Constants
• type Event
  • func NewEvent(class Type, name string, fnName string) *Event
  • func NewKprobeEvent(name string, fnName string, maxActive int) *Event
  • func NewKretprobeEvent(name string, fnName string, maxActive int) *Event
  • func NewUprobeEvent(name, fnName, fileName string, pid int) *Event
  • func NewUretprobeEvent(name, fnName, fileName string, pid int) *Event
• type KprobeEvent
  • func (e *KprobeEvent) Attach(m *bpf.Module, fd int) error
  • func (e *KprobeEvent) Load(m *bpf.Module) (int, error)
• type KretprobeEvent
  • func (e *KretprobeEvent) Attach(m *bpf.Module, fd int) error
• type Module
  • func NewModule(name string, source string, cFlags []string) *Module
  • func (m *Module) AddEvent(event *Event) *Module
  • func (m *Module) DoAction() *bpf.Module
  • func (m *Module) PreProcessing(ctx PreParam)
• type PreParam
• type Type
  • func (t Type) String() (name string)
• type UprobeEvent
  • func (e *UprobeEvent) Attach(m *bpf.Module, fd int) error
  • func (e *UprobeEvent) Load(m *bpf.Module) (int, error)
• type UretprobeEvent
  • func (e *UretprobeEvent) Attach(m *bpf.Module, fd int) error

Constants

const (
	KprobeType    = Type(iota) // kprobe
	KretprobeType              // kretprobe
	UprobeType                 // uprobe
	UretprobeType              // uretprobe
)

Types

type Event

type Event struct {
	Class  Type   // 事件类型
	Name   string // 事件名称
	FnName string // 函数名称
	// contains filtered or unexported fields
}

func NewEvent

func NewEvent(class Type, name string, fnName string) *Event

func NewKprobeEvent

func NewKprobeEvent(name string, fnName string, maxActive int) *Event

func NewKretprobeEvent

func NewKretprobeEvent(name string, fnName string, maxActive int) *Event

func NewUprobeEvent

func NewUprobeEvent(name, fnName, fileName string, pid int) *Event

NewUprobeEvent 创建 UprobeEvent, name: ebpf 对应的函数名, fnName: 用户程序目标函数, fileName: 用户程序路径, pid: 进程 pid

func NewUretprobeEvent

func NewUretprobeEvent(name, fnName, fileName string, pid int) *Event

type KprobeEvent

type KprobeEvent struct {
	// contains filtered or unexported fields
}

func (*KprobeEvent) Attach

func (e *KprobeEvent) Attach(m *bpf.Module, fd int) error

func (*KprobeEvent) Load

func (e *KprobeEvent) Load(m *bpf.Module) (int, error)

type KretprobeEvent

type KretprobeEvent struct {
	KprobeEvent
}

func (*KretprobeEvent) Attach

func (e *KretprobeEvent) Attach(m *bpf.Module, fd int) error

type Module

type Module struct {
	Name   string
	Source string
	CFlags []string
	// contains filtered or unexported fields
}

func NewModule

func NewModule(name string, source string, cFlags []string) *Module

func (*Module) AddEvent

func (m *Module) AddEvent(event *Event) *Module

AddEvent 设置事件

func (*Module) DoAction

func (m *Module) DoAction() *bpf.Module

DoAction 执行 attach operation 操作

func (*Module) PreProcessing

func (m *Module) PreProcessing(ctx PreParam)

PreProcessing 预处理

type PreParam

type PreParam struct {
	Pid  int
	Path string

	// ELF 文件相关
	Header elf.FileHeader
	IsDyn  bool
	Interp string
}

type Type

type Type uint8

func (Type) String

func (t Type) String() (name string)

type UprobeEvent

type UprobeEvent struct {
	// contains filtered or unexported fields
}

func (*UprobeEvent) Attach

func (e *UprobeEvent) Attach(m *bpf.Module, fd int) error

func (*UprobeEvent) Load

func (e *UprobeEvent) Load(m *bpf.Module) (int, error)

type UretprobeEvent

type UretprobeEvent struct {
	UprobeEvent
}

func (*UretprobeEvent) Attach

func (e *UretprobeEvent) Attach(m *bpf.Module, fd int) error