Structs§
- Bpffs
Prune Entry - Bpffs
Prune Options - Bpffs
Prune Report - PidAlias
Value - Value for the pinned
pid_aliasesmap. - Proc
Module Key - Key for the pinned
proc_module_offsetsmap. - Proc
Module Offsets Value - Value for the pinned
proc_module_offsetsmap. - Proc
Module Range Key - Key for the pinned
proc_module_rangesmap. - Proc
Module Range Meta - Value for the pinned
proc_module_range_metamap. - Proc
Module Range Value - Value for the pinned
proc_module_rangesmap.
Enums§
Constants§
- ALLOWED_
PIDS_ MAP_ NAME - BT_
MODULE_ ROW_ RANGES_ MAP_ NAME - BT_
UNWIND_ ROWS_ MAP_ NAME - PID_
ALIASES_ MAP_ NAME - PROC_
MODULE_ RANGES_ MAP_ NAME - PROC_
MODULE_ RANGE_ META_ MAP_ NAME - PROC_
OFFSETS_ MAP_ NAME - Map name as embedded in BPF object
- SYSMON_
MAP_ CHANGE_ UNFILTERED_ MAP_ NAME - TARGET_
EXEC_ COMM_ MAP_ NAME
Functions§
- allowed_
pid_ exists - Return whether a PID is already present in the allowed_pids pinned map.
- allowed_
pids_ pin_ path - Compute the bpffs pin path for the allowed_pids map for current process
- bpffs_
mount_ hint_ for_ pin_ path - bt_
module_ row_ ranges_ pin_ path - bt_
unwind_ rows_ pin_ path - cleanup_
current_ pinned_ maps - Remove the current process’s pinned maps and its per-process directory (best effort). Safe to call multiple times; missing paths are ignored.
- cleanup_
stale_ pinned_ maps_ root - Remove stale per-process pinned map directories whose PID no longer exists.
- ensure_
pinned_ allowed_ pids_ exists - Ensure the pinned allowed_pids map exists under the per-process directory.
- ensure_
pinned_ backtrace_ cfi_ maps_ exist - Ensure the session-shared backtrace CFI maps exist under the per-process pin directory. These maps are shared by all trace loaders in one GhostScope process when backtrace rows are module-normalized.
- ensure_
pinned_ pid_ aliases_ exists - Ensure the pinned pid_aliases map exists under the per-process directory.
- ensure_
pinned_ proc_ module_ ranges_ exist - Ensure the pinned module range maps exist under the per-process directory.
- ensure_
pinned_ proc_ offsets_ exists - Ensure the pinned global proc_module_offsets map exists at the standard path. If not present, create and pin it with the specified capacity.
- insert_
allowed_ pid - Insert a PID into the allowed_pids pinned map.
- insert_
offsets_ for_ pid - Open the pinned global proc_module_offsets map and insert entries.
- insert_
pid_ alias - Insert a runtime-pid -> proc-pid alias into the pinned pid_aliases map.
- pid_
aliases_ pin_ path - Compute the bpffs pin path for the pid_aliases map for current process.
- proc_
module_ range_ meta_ pin_ path - Compute the bpffs pin path for the proc_module_range_meta map.
- proc_
module_ ranges_ max_ entries - proc_
module_ ranges_ pin_ path - Compute the bpffs pin path for the proc_module_ranges map.
- proc_
offsets_ pin_ dir - Pin directory containing the per-process offsets map
- proc_
offsets_ pin_ path - Compute the bpffs pin path for the proc_module_offsets map for current process Using per-process directory avoids conflicts across multiple GhostScope instances
- prune_
pinned_ maps_ root - purge_
offsets_ for_ pid - Purge all entries for a given pid in the pinned proc_module_offsets map.
- purge_
ranges_ for_ pid - Purge all module range index entries for a given pid.
- remove_
allowed_ pid - Remove a PID from the allowed_pids pinned map.
- remove_
pid_ alias - Remove a runtime-pid alias from the pinned pid_aliases map.
- replace_
ranges_ for_ pid - Replace the raw-address range index for a PID using a full
/proc/<pid>/mapssnapshot. The inactive slot is rewritten first, then the PID meta entry is flipped so eBPF readers either see the old complete snapshot or the new one.