diff --git a/plugin/driver/eBPF/kernel/Makefile b/plugin/driver/eBPF/kernel/Makefile index 6b596d57..b6117601 100644 --- a/plugin/driver/eBPF/kernel/Makefile +++ b/plugin/driver/eBPF/kernel/Makefile @@ -56,11 +56,13 @@ all: $(MAKE) hades_ebpf_driver.o -s --no-print-directory $(shell cp hades_ebpf_driver.o ../userspace/hades_ebpf_driver.o) +# KBUILD_NAME: https://github.com/iovisor/bpftrace/pull/1352 hades_ebpf_driver.o: src/hades.c $(CMD_CLANG) src/hades.c -S \ -D__BPF_TRACING__ \ -D__KERNEL__ \ -D__TARGET_ARCH_$(linux_arch) \ + -DKBUILD_MODNAME=\"hades\" \ -include $(KERN_SRC_PATH)/include/linux/kconfig.h \ -I $(KERN_SRC_PATH)/arch/$(linux_arch)/include \ -I $(KERN_SRC_PATH)/arch/$(linux_arch)/include/uapi \ diff --git a/plugin/driver/eBPF/kernel/include/hades_uprobe.h b/plugin/driver/eBPF/kernel/include/hades_uprobe.h index 2fabf3bd..4715c8e7 100644 --- a/plugin/driver/eBPF/kernel/include/hades_uprobe.h +++ b/plugin/driver/eBPF/kernel/include/hades_uprobe.h @@ -51,4 +51,13 @@ int uretprobe_bash_readline(struct pt_regs *ctx) // And uprobe (maybe, I have not checked yet) can be used in kernel version // lower 4.18, above 3.18 (maybe). The way we used in k(ret)probe/uprobe, // the pt_regs, seems to be used in kernel > 4.17. We need to change the -// format. \ No newline at end of file +// format. +// SEC("uprobe/JVM_GC") +// int uprobe_JVM_GC(struct pt_regs *ctx) +// { +// event_data_t data = {}; +// if (!init_event_data(&data, ctx)) +// return 0; +// data.context.type = 2001; +// return events_perf_submit(&data); +// } \ No newline at end of file diff --git a/plugin/driver/eBPF/kernel/include/utils.h b/plugin/driver/eBPF/kernel/include/utils.h index f56187bd..cdd1c64a 100644 --- a/plugin/driver/eBPF/kernel/include/utils.h +++ b/plugin/driver/eBPF/kernel/include/utils.h @@ -7,7 +7,6 @@ #include #include #include -#define KBUILD_MODNAME "hades" #include #include diff --git a/plugin/driver/eBPF/userspace/decoder/event.go b/plugin/driver/eBPF/userspace/decoder/event.go index e24f9296..9f212a0a 100644 --- a/plugin/driver/eBPF/userspace/decoder/event.go +++ b/plugin/driver/eBPF/userspace/decoder/event.go @@ -16,6 +16,10 @@ type Event interface { var eventMap map[uint32]Event = make(map[uint32]Event) func Regist(event Event) { + // if event.ID() != 2001 { + // return + // } + // fmt.Println(event.String(), " loaded!") eventMap[event.ID()] = event }