0

Id like to create an EBPF program for Golang that records when a function is entered and returns.

Some issues I have:

  • A. Functions are inlined.
  • B. Closures are anonymous.
  • C. Reading Golang structs.

Questions:

A.

In my case its not possible to prevent function inlining with go build -gcflags '-l.

If I could identify the instruction of the inlined function in the binary could I place a probe on it (instead of "place probe on function X" can I tell EBPF to "place probe at instruction X"?).

B.

Can I do the same with anonymous closures?

C.

How do I read Golang structs in an EBPF C program?

I want to extract scalar values that belong to a struct hierarchy. The examples I can find all probe functions that take scalars not structs as their args.

Related

Thanks.

Qeole
  • 8,284
  • 1
  • 24
  • 52
zino
  • 1,222
  • 2
  • 17
  • 47
  • 1
    https://meta.stackexchange.com/questions/39223/one-post-with-multiple-questions-or-multiple-posts – Dmitry Harnitski Jan 04 '20 at 23:38
  • These questions are tightly coupled, it would not make sense to separate them as if you are asking one of them its likely you will need the others. – zino Jan 05 '20 at 13:40

0 Answers0