GhostScope eBPF Loader

This crate provides the GhostScopeLoader which manages the lifecycle of eBPF programs:

• Loading eBPF bytecode into the kernel
• Attaching/detaching uprobes to target binaries
• Reading trace events from RingBuf or PerfEventArray
• Managing BPF maps for process module offsets

Architecture

The loader supports two event output mechanisms:

• RingBuf: Modern kernel (>= 5.8) continuous byte stream
• PerfEventArray: Legacy kernel (< 5.8) per-CPU independent events

Event parsing is handled by ghostscope_protocol::StreamingTraceParser which adapts to the event source type automatically.

ghostscope-loader

ghostscope-loader manages eBPF program lifecycles for GhostScope sessions. It loads bytecode emitted by ghostscope-compiler, attaches uprobes, and coordinates per-session resources.

Build Notes

• Requires libbpf-compatible kernel headers and the aya user-space stack
• Optional tokio features (io-util, mio, net) are enabled to support async device IO

See the root project guide for usage examples: https://github.com/swananan/ghostscope#readme.