• Sasha Goldshtein's avatar
    stackcount: Support uprobes, tracepoints, and USDT (#730) · 07175d05
    Sasha Goldshtein authored
    * stackcount: Support user-space functions
    
    Add support for user-space functions in `stackcount` by taking an additional
    `-l` command-line parameter specifying the name of the user-space library.
    When a user-space library is specified, `stackcount` attaches to a specific
    process and traces a user-space function with user-space stacks only.
    Regex support for uprobes (similar to what is available for kprobes) is
    not currently provided.
    
    Also add a couple of functions to the `BPF` object for consistency.
    
    * bcc: Support regex in attach_uprobe
    
    attach_kprobe allows a regular expression for the function name,
    while attach_uprobe does not. Add support in libccc for enumerating
    all the function symbols in a binary, and use that in the BPF module
    to attach uprobes according to a regular expression. For example:
    
    ```python
    bpf = BPF(text="...")
    bpf.attach_uprobe(name="c", sym_re=".*write$", fn_name="probe")
    ```
    
    * python: Support regex in attach_tracepoint
    
    Modify attach_tracepoint to take a regex argument, in which case
    it enumerates all tracepoints matching that regex and attaches to
    all of them. The logic for enumerating tracepoints should eventually
    belong in libccc and be shared across all the tools (tplist, trace
    and so on).
    
    * cc: Fix termination condition bug in symbol enumeration
    
    bcc_elf would not terminate the enumeration correctly when the
    user-provided callback returned -1 but there were still more
    sections remaining in the ELF to be enumerated.
    
    * stackcount: Support uprobes and tracepoints
    
    Refactored stackcount and added support for uprobes and tracepoints,
    which also required changes to the BPF module. USDT support still
    pending.
    
    * bcc: Refactor symbol listing to use foreach-style
    
    Refactor symbol listing from paging style to foreach-style with a
    callback function per-symbol. Even though we're now performing a
    callback from C to Python for each symbol, this is preferable to the
    paging approach because we need all the symbols in the current use
    case.
    
    Also refactored `stackcount` slightly; only missing support for USDT
    probes now.
    
    * stackcount: Support per-process displays
    
    For user-space functions, or when requested for kernel-space
    functions or tracepoints, group the output by process. Toggled
    with the -P switch, off by default (except for user-space).
    
    * Fix rebase issues, print pid only when there is one
    
    * stackcount: Add USDT support
    
    Now, stackcount supports USDT tracepoints in addition to
    kernel functions, user functions, and kernel tracepoints.
    The format is the same as with the other general-purpose
    tools (argdist, trace):
    
    ```
    stackcount -p $(pidof node) u:node:gc*
    stackcount -p 185 u:pthread:pthread_create
    ```
    
    * stackcount: Update examples and man page
    
    Add examples and man page documentation for kernel
    tracepoints, USDT tracepoints, and other features.
    
    * stackcount: Change printing format slightly
    
    When -p is specified, don't print the comm and pid. Also,
    when -P is specified for kernel probes (kprobes and
    tracepoints), use -1 for symbol resolution so that we
    don't try to resolve kernel functions as user symbols.
    Finally, print the comm and pid at the end of the stack
    output and not at the beginning.
    07175d05
stackcount_example.txt 11.3 KB