bpfbacktracer

func NewBPFBacktracer ¶

func NewBPFBacktracer() (*BpfBacktracer, error)

TODO: use bpf2go to generate a program
BCC version of a program:

prog.c ``` #include <uapi/linux/ptrace.h> #include <linux/sched.h>

struct data_t {
    u64 stacks[4];
};

BPF_HASH(gcored_samples, u32, struct data_t, 128);

void trace_stack(struct pt_regs *ctx) {
    u32 pid = bpf_get_current_pid_tgid();
    struct data_t data = {};
    u64 ret = bpf_get_stack(ctx, data.stacks, sizeof(data.stacks), BPF_F_USER_STACK);
    if (ret > 0) {
        gcored_samples.update(&pid, &data);
    }
}

```

NewBPFBacktracer creates a BPF Backtracer struct that allocates map, prog and attaches kprobe.