var mapKey uint32 = 0

// ebpf标签的说明
// BpfProg对应的是c程序中的bSEC(tracepoinst/...)的方法名
// TrackerMap对应的c程序中的SEC(map)
type bpfPrograms struct {
	BpfProg    *ebpf.Program `ebpf:"bpf_prog"`
	TrackerMap *ebpf.Map     `ebpf:"tracker_map"`
}

func (p *bpfPrograms) Close() error {
	err := p.BpfProg.Close()
	err = p.TrackerMap.Close()
	return err
}

// 字段类型，对应c程序中的event_data_t类型，注意Comm是uint8
type EventData struct {
	Pid  uint32
	Comm [20]uint8
}

func (e EventData) CommHex() string {
	ba := []byte{}
	for _, b := range e.Comm {
		ba = append(ba, b)
	}
	return string(ba)
}

//程序
func LoadTestEbpf() {

	//
	if err := rlimit.RemoveMemlock(); err != nil {
		log.Fatal(err)
	}

	//加载c编译出来的.o文件的相对路径,这个地址一定不能出错
	spec, err := ebpf.LoadCollectionSpec("ebpf/bpf_program.o")
	if err != nil {
		panic(err)
	}

	//赋值obj
	obj := bpfPrograms{}
	if err := spec.LoadAndAssign(&obj, nil); err != nil {
		panic(err)
	}
	defer obj.Close()

	tp, err := link.Tracepoint("syscalls", "sys_enter_execve", obj.BpfProg)
	if err != nil {
		panic(err)
	}
	defer tp.Close()

	// Read loop reporting the total amount of times the kernel
	// function was entered, once per second.
	ticker := time.NewTicker(1 * time.Second)
	log.Println("Waiting for events..")
	for range ticker.C {

		var value []byte
		//c的结构体序列化成bytes（value）
		if err := obj.TrackerMap.Lookup(&mapKey, &value); err != nil {
			log.Printf("reading map: %v", err)
		} else {
			var event EventData
			//c的结构体序列化成golang的喜爱那个并且打印出来
			if err := binary.Read(bytes.NewBuffer(value), binary.LittleEndian, &event); err != nil {
				log.Printf("parsing perf event: %s", err)
				continue
			}
			log.Printf("pid:%v,comm:%v", event.Pid, event.CommHex())
		}
	}
}

func main() {
	ebpf.LoadTestEbpf()
}

2022/03/11 17:01:26 reading map: lookup: key does not exist
2022/03/11 17:01:30 pid:60184,comm:sshd

type Map struct {
	mu Mutex //锁 用来保护read、dirty的并发控制

	// read包含部分map的内容，他是atomic.Value类型的用来解决并发访问的安全的问题，在读的场景不需要加锁，而在写的场景需要mu的控制
	read atomic.Value // readOnly 

	// dirty访问要在mu的保护下进行，他包含所有的readOnly里non-expunged的数据
	// 在read中标记为Expunged的entries不会被存储在dirt中，如果一个在read中存在的key被标记为expunged,他需要先unexpunged在保存在dirty中
	// 如果dirty是nil，当下一次修改map的时候需要初始化dirty，初始化的方式是将read的不为exunped的value都copy到dirty中
	dirty map[interface{}]*entry

	// 计数器，当从read读取数据时候miss回增加该值，打到一定的阈值，即miss>=len(dirty)的时候回触发dirty和read的互换
	misses int
}


// read中的值
type readOnly struct {
	m       map[interface{}]*entry
	amended bool // 一个标记为，默认是false，true说明readOnly的m和dirty已经同步过了，即dirty不为nil了，在Store操作中，dirtyLocked函数调用后会置为true
}

  
type entry struct {
	// 封装了指向value值的指针
	//
	// If p == nil, the entry has been deleted and m.dirty == nil.
	//
	// If p == expunged, the entry has been deleted, m.dirty != nil, and the entry
	// is missing from m.dirty.
	//
	// Otherwise, the entry is valid and recorded in m.read.m[key] and, if m.dirty
	// != nil, in m.dirty[key].
	//
	// An entry can be deleted by atomic replacement with nil: when m.dirty is
	// next created, it will atomically replace nil with expunged and leave
	// m.dirty[key] unset.
	//
	// An entry's associated value can be updated by atomic replacement, provided
	// p != expunged. If p == expunged, an entry's associated value can be updated
	// only after first setting m.dirty[key] = e so that lookups using the dirty
	// map find the entry.
	p unsafe.Pointer // *interface{}
}

//标记位当entry.p=expunged说明，该对象在read中被删除，标记了expunged的key不会出现在dirty中。
var expunged = unsafe.Pointer(new(interface{}))

func (m *Map) Store(key, value interface{}) {
	//从read中获取readOnly，如果key存在，通过cas修改不为expunged的值，成功后快速返回
	read, _ := m.read.Load().(readOnly)
		if e, ok := read.m[key]; ok && e.tryStore(&value) {
		return
	}

	//修改失败通过锁进行鬓发保护
	m.mu.Lock()
	read, _ = m.read.Load().(readOnly)//双重检查
	if e, ok := read.m[key]; ok {
		//key存在于read但是状态是expunged，cas修改成nil，同步dirty和readOnly的值，
		if e.unexpungeLocked() {
				//走到这里说明dirty已经被初始化了，见m.dirtyLocked()里e.tryExpungeLocked()这一步
				m.dirty[key] = e
		}
		//cas保存value
		e.storeLocked(&value)
	} else if e, ok := m.dirty[key]; ok {
		//key存在于dirty
		e.storeLocked(&value)
	} else {
		//!read.amended说明dirty为空初始化dirty，将read中不为expunged值写入dirty，见下面
		if !read.amended {
			m.dirtyLocked()
			m.read.Store(readOnly{m: read.m, amended: true})
		}
		//修改dirty的值
		m.dirty[key] = newEntry(value)
	}
	m.mu.Unlock()
}

func (m *Map) dirtyLocked() {
	if m.dirty != nil {
		return
	}

	read, _ := m.read.Load().(readOnly)
	m.dirty = make(map[interface{}]*entry, len(read.m))
	for k, e := range read.m {
		if !e.tryExpungeLocked() {
			m.dirty[k] = e
		}
	}
}

func (e *entry) tryExpungeLocked() (isExpunged bool) {
	p := atomic.LoadPointer(&e.p)
	for p == nil {
		if atomic.CompareAndSwapPointer(&e.p, nil, expunged) {
			return true
		}
		p = atomic.LoadPointer(&e.p)
	}
	return p == expunged
}

func (m *Map) Load(key interface{}) (value interface{}, ok bool) {
	read, _ := m.read.Load().(readOnly)
	//优先读取read
	e, ok := read.m[key]
	if !ok && read.amended {
		//key不存在但是dirty已经初始化，这里需要锁来保护并发冲突
		m.mu.Lock()
		read, _ = m.read.Load().(readOnly)//双重检查
		e, ok = read.m[key]
		if !ok && read.amended {
			//从dirty里取
			e, ok = m.dirty[key]
			//超过阈值交换dirty和read,并且dirty置为nil，见下面
			m.missLocked()
		}
		m.mu.Unlock()
	}
	if !ok {
		return nil, false
	}
	//加载value
	return e.load()
}

func (e *entry) load() (value interface{}, ok bool) {
	p := atomic.LoadPointer(&e.p)
	if p == nil || p == expunged {
		return nil, false
	}
	return *(*interface{})(p), true
}

func (m *Map) missLocked() {
	m.misses++
	if m.misses < len(m.dirty) {
		return
	}
	m.read.Store(readOnly{m: m.dirty})
	m.dirty = nil
	m.misses = 0
}

func (m *Map) Delete(key interface{}) {
	read, _ := m.read.Load().(readOnly)
	e, ok := read.m[key]
	if !ok && read.amended {
		m.mu.Lock()
		read, _ = m.read.Load().(readOnly)
		e, ok = read.m[key]
		if !ok && read.amended {
			delete(m.dirty, key)
		}
		m.mu.Unlock()
	}
	if ok {
		e.delete()
	}
}

func (e *entry) delete() (hadValue bool) {
	for {
		p := atomic.LoadPointer(&e.p)
		if p == nil || p == expunged {
			return false
		}
		if atomic.CompareAndSwapPointer(&e.p, p, nil) {
			return true
		}
	}
}
`