Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
B
bcc
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Kirill Smelkov
bcc
Commits
120ac968
Commit
120ac968
authored
Dec 15, 2017
by
4ast
Committed by
GitHub
Dec 15, 2017
Browse files
Options
Browse Files
Download
Plain Diff
Merge pull request #1490 from palmtenor/clean_api
Clean-up unused parameter in tracing APIs
parents
2aa3c0be
d3b9d6a1
Changes
14
Hide whitespace changes
Inline
Side-by-side
Showing
14 changed files
with
126 additions
and
159 deletions
+126
-159
src/cc/api/BPF.cc
src/cc/api/BPF.cc
+24
-37
src/cc/api/BPF.h
src/cc/api/BPF.h
+25
-30
src/cc/libbpf.c
src/cc/libbpf.c
+23
-16
src/cc/libbpf.h
src/cc/libbpf.h
+8
-9
src/lua/bcc/bpf.lua
src/lua/bcc/bpf.lua
+2
-6
src/lua/bcc/libbcc.lua
src/lua/bcc/libbcc.lua
+5
-7
src/python/bcc/__init__.py
src/python/bcc/__init__.py
+23
-32
src/python/bcc/libbcc.py
src/python/bcc/libbcc.py
+5
-5
tests/python/test_trace1.py
tests/python/test_trace1.py
+3
-3
tests/python/test_trace2.py
tests/python/test_trace2.py
+1
-1
tests/python/test_trace3.py
tests/python/test_trace3.py
+2
-2
tools/deadlock_detector.py
tools/deadlock_detector.py
+1
-3
tools/funccount.py
tools/funccount.py
+2
-4
tools/stackcount.py
tools/stackcount.py
+2
-4
No files found.
src/cc/api/BPF.cc
View file @
120ac968
...
@@ -161,7 +161,6 @@ StatusTuple BPF::detach_all() {
...
@@ -161,7 +161,6 @@ StatusTuple BPF::detach_all() {
StatusTuple
BPF
::
attach_kprobe
(
const
std
::
string
&
kernel_func
,
StatusTuple
BPF
::
attach_kprobe
(
const
std
::
string
&
kernel_func
,
const
std
::
string
&
probe_func
,
const
std
::
string
&
probe_func
,
bpf_probe_attach_type
attach_type
,
bpf_probe_attach_type
attach_type
,
pid_t
pid
,
int
cpu
,
int
group_fd
,
perf_reader_cb
cb
,
void
*
cb_cookie
)
{
perf_reader_cb
cb
,
void
*
cb_cookie
)
{
std
::
string
probe_event
=
get_kprobe_event
(
kernel_func
,
attach_type
);
std
::
string
probe_event
=
get_kprobe_event
(
kernel_func
,
attach_type
);
if
(
kprobes_
.
find
(
probe_event
)
!=
kprobes_
.
end
())
if
(
kprobes_
.
find
(
probe_event
)
!=
kprobes_
.
end
())
...
@@ -170,9 +169,8 @@ StatusTuple BPF::attach_kprobe(const std::string& kernel_func,
...
@@ -170,9 +169,8 @@ StatusTuple BPF::attach_kprobe(const std::string& kernel_func,
int
probe_fd
;
int
probe_fd
;
TRY2
(
load_func
(
probe_func
,
BPF_PROG_TYPE_KPROBE
,
probe_fd
));
TRY2
(
load_func
(
probe_func
,
BPF_PROG_TYPE_KPROBE
,
probe_fd
));
void
*
res
=
void
*
res
=
bpf_attach_kprobe
(
probe_fd
,
attach_type
,
probe_event
.
c_str
(),
bpf_attach_kprobe
(
probe_fd
,
attach_type
,
probe_event
.
c_str
(),
kernel_func
.
c_str
(),
kernel_func
.
c_str
(),
cb
,
cb_cookie
);
pid
,
cpu
,
group_fd
,
cb
,
cb_cookie
);
if
(
!
res
)
{
if
(
!
res
)
{
TRY2
(
unload_func
(
probe_func
));
TRY2
(
unload_func
(
probe_func
));
...
@@ -192,8 +190,7 @@ StatusTuple BPF::attach_uprobe(const std::string& binary_path,
...
@@ -192,8 +190,7 @@ StatusTuple BPF::attach_uprobe(const std::string& binary_path,
const
std
::
string
&
symbol
,
const
std
::
string
&
symbol
,
const
std
::
string
&
probe_func
,
const
std
::
string
&
probe_func
,
uint64_t
symbol_addr
,
uint64_t
symbol_addr
,
bpf_probe_attach_type
attach_type
,
bpf_probe_attach_type
attach_type
,
pid_t
pid
,
pid_t
pid
,
int
cpu
,
int
group_fd
,
perf_reader_cb
cb
,
void
*
cb_cookie
)
{
perf_reader_cb
cb
,
void
*
cb_cookie
)
{
std
::
string
module
;
std
::
string
module
;
uint64_t
offset
;
uint64_t
offset
;
...
@@ -207,8 +204,8 @@ StatusTuple BPF::attach_uprobe(const std::string& binary_path,
...
@@ -207,8 +204,8 @@ StatusTuple BPF::attach_uprobe(const std::string& binary_path,
TRY2
(
load_func
(
probe_func
,
BPF_PROG_TYPE_KPROBE
,
probe_fd
));
TRY2
(
load_func
(
probe_func
,
BPF_PROG_TYPE_KPROBE
,
probe_fd
));
void
*
res
=
void
*
res
=
bpf_attach_uprobe
(
probe_fd
,
attach_type
,
probe_event
.
c_str
(),
binary_path
.
c_str
(),
bpf_attach_uprobe
(
probe_fd
,
attach_type
,
probe_event
.
c_str
(),
offset
,
pid
,
cpu
,
group_f
d
,
cb
,
cb_cookie
);
binary_path
.
c_str
(),
offset
,
pi
d
,
cb
,
cb_cookie
);
if
(
!
res
)
{
if
(
!
res
)
{
TRY2
(
unload_func
(
probe_func
));
TRY2
(
unload_func
(
probe_func
));
...
@@ -226,8 +223,7 @@ StatusTuple BPF::attach_uprobe(const std::string& binary_path,
...
@@ -226,8 +223,7 @@ StatusTuple BPF::attach_uprobe(const std::string& binary_path,
return
StatusTuple
(
0
);
return
StatusTuple
(
0
);
}
}
StatusTuple
BPF
::
attach_usdt
(
const
USDT
&
usdt
,
pid_t
pid
,
int
cpu
,
StatusTuple
BPF
::
attach_usdt
(
const
USDT
&
usdt
,
pid_t
pid
)
{
int
group_fd
)
{
for
(
const
auto
&
u
:
usdt_
)
for
(
const
auto
&
u
:
usdt_
)
if
(
u
==
usdt
)
{
if
(
u
==
usdt
)
{
bool
failed
=
false
;
bool
failed
=
false
;
...
@@ -259,7 +255,6 @@ StatusTuple BPF::attach_usdt(const USDT& usdt, pid_t pid, int cpu,
...
@@ -259,7 +255,6 @@ StatusTuple BPF::attach_usdt(const USDT& usdt, pid_t pid, int cpu,
StatusTuple
BPF
::
attach_tracepoint
(
const
std
::
string
&
tracepoint
,
StatusTuple
BPF
::
attach_tracepoint
(
const
std
::
string
&
tracepoint
,
const
std
::
string
&
probe_func
,
const
std
::
string
&
probe_func
,
pid_t
pid
,
int
cpu
,
int
group_fd
,
perf_reader_cb
cb
,
void
*
cb_cookie
)
{
perf_reader_cb
cb
,
void
*
cb_cookie
)
{
if
(
tracepoints_
.
find
(
tracepoint
)
!=
tracepoints_
.
end
())
if
(
tracepoints_
.
find
(
tracepoint
)
!=
tracepoints_
.
end
())
return
StatusTuple
(
-
1
,
"Tracepoint %s already attached"
,
return
StatusTuple
(
-
1
,
"Tracepoint %s already attached"
,
...
@@ -274,9 +269,8 @@ StatusTuple BPF::attach_tracepoint(const std::string& tracepoint,
...
@@ -274,9 +269,8 @@ StatusTuple BPF::attach_tracepoint(const std::string& tracepoint,
int
probe_fd
;
int
probe_fd
;
TRY2
(
load_func
(
probe_func
,
BPF_PROG_TYPE_TRACEPOINT
,
probe_fd
));
TRY2
(
load_func
(
probe_func
,
BPF_PROG_TYPE_TRACEPOINT
,
probe_fd
));
void
*
res
=
void
*
res
=
bpf_attach_tracepoint
(
probe_fd
,
tp_category
.
c_str
(),
bpf_attach_tracepoint
(
probe_fd
,
tp_category
.
c_str
(),
tp_name
.
c_str
(),
pid
,
tp_name
.
c_str
(),
cb
,
cb_cookie
);
cpu
,
group_fd
,
cb
,
cb_cookie
);
if
(
!
res
)
{
if
(
!
res
)
{
TRY2
(
unload_func
(
probe_func
));
TRY2
(
unload_func
(
probe_func
));
...
@@ -309,7 +303,7 @@ StatusTuple BPF::attach_perf_event(uint32_t ev_type, uint32_t ev_config,
...
@@ -309,7 +303,7 @@ StatusTuple BPF::attach_perf_event(uint32_t ev_type, uint32_t ev_config,
cpus
.
push_back
(
cpu
);
cpus
.
push_back
(
cpu
);
else
else
cpus
=
get_online_cpus
();
cpus
=
get_online_cpus
();
for
(
int
i
:
cpus
)
{
for
(
int
i
:
cpus
)
{
int
fd
=
bpf_attach_perf_event
(
probe_fd
,
ev_type
,
ev_config
,
sample_period
,
int
fd
=
bpf_attach_perf_event
(
probe_fd
,
ev_type
,
ev_config
,
sample_period
,
sample_freq
,
pid
,
i
,
group_fd
);
sample_freq
,
pid
,
i
,
group_fd
);
if
(
fd
<
0
)
{
if
(
fd
<
0
)
{
...
@@ -347,8 +341,7 @@ StatusTuple BPF::detach_kprobe(const std::string& kernel_func,
...
@@ -347,8 +341,7 @@ StatusTuple BPF::detach_kprobe(const std::string& kernel_func,
StatusTuple
BPF
::
detach_uprobe
(
const
std
::
string
&
binary_path
,
StatusTuple
BPF
::
detach_uprobe
(
const
std
::
string
&
binary_path
,
const
std
::
string
&
symbol
,
uint64_t
symbol_addr
,
const
std
::
string
&
symbol
,
uint64_t
symbol_addr
,
bpf_probe_attach_type
attach_type
,
bpf_probe_attach_type
attach_type
,
pid_t
pid
)
{
pid_t
pid
)
{
std
::
string
module
;
std
::
string
module
;
uint64_t
offset
;
uint64_t
offset
;
TRY2
(
check_binary_symbol
(
binary_path
,
symbol
,
symbol_addr
,
module
,
offset
));
TRY2
(
check_binary_symbol
(
binary_path
,
symbol
,
symbol_addr
,
module
,
offset
));
...
@@ -399,21 +392,19 @@ StatusTuple BPF::detach_tracepoint(const std::string& tracepoint) {
...
@@ -399,21 +392,19 @@ StatusTuple BPF::detach_tracepoint(const std::string& tracepoint) {
StatusTuple
BPF
::
detach_perf_event
(
uint32_t
ev_type
,
uint32_t
ev_config
)
{
StatusTuple
BPF
::
detach_perf_event
(
uint32_t
ev_type
,
uint32_t
ev_config
)
{
auto
it
=
perf_events_
.
find
(
std
::
make_pair
(
ev_type
,
ev_config
));
auto
it
=
perf_events_
.
find
(
std
::
make_pair
(
ev_type
,
ev_config
));
if
(
it
==
perf_events_
.
end
())
if
(
it
==
perf_events_
.
end
())
return
StatusTuple
(
-
1
,
"Perf Event type %d config %d not attached"
,
return
StatusTuple
(
-
1
,
"Perf Event type %d config %d not attached"
,
ev_type
,
ev_
type
,
ev_
config
);
ev_config
);
TRY2
(
detach_perf_event_all_cpu
(
it
->
second
));
TRY2
(
detach_perf_event_all_cpu
(
it
->
second
));
perf_events_
.
erase
(
it
);
perf_events_
.
erase
(
it
);
return
StatusTuple
(
0
);
return
StatusTuple
(
0
);
}
}
StatusTuple
BPF
::
open_perf_event
(
const
std
::
string
&
name
,
StatusTuple
BPF
::
open_perf_event
(
const
std
::
string
&
name
,
uint32_t
type
,
uint32_t
type
,
uint64_t
config
)
{
uint64_t
config
)
{
if
(
perf_event_arrays_
.
find
(
name
)
==
perf_event_arrays_
.
end
())
{
if
(
perf_event_arrays_
.
find
(
name
)
==
perf_event_arrays_
.
end
())
{
TableStorage
::
iterator
it
;
TableStorage
::
iterator
it
;
if
(
!
bpf_module_
->
table_storage
().
Find
(
Path
({
bpf_module_
->
id
(),
name
}),
it
))
if
(
!
bpf_module_
->
table_storage
().
Find
(
Path
({
bpf_module_
->
id
(),
name
}),
it
))
return
StatusTuple
(
-
1
,
return
StatusTuple
(
-
1
,
"open_perf_event: unable to find table_storage %s"
,
"open_perf_event: unable to find table_storage %s"
,
name
.
c_str
());
name
.
c_str
());
perf_event_arrays_
[
name
]
=
new
BPFPerfEventArray
(
it
->
second
);
perf_event_arrays_
[
name
]
=
new
BPFPerfEventArray
(
it
->
second
);
}
}
...
@@ -434,8 +425,7 @@ StatusTuple BPF::close_perf_event(const std::string& name) {
...
@@ -434,8 +425,7 @@ StatusTuple BPF::close_perf_event(const std::string& name) {
StatusTuple
BPF
::
open_perf_buffer
(
const
std
::
string
&
name
,
StatusTuple
BPF
::
open_perf_buffer
(
const
std
::
string
&
name
,
perf_reader_raw_cb
cb
,
perf_reader_raw_cb
cb
,
perf_reader_lost_cb
lost_cb
,
perf_reader_lost_cb
lost_cb
,
void
*
cb_cookie
,
void
*
cb_cookie
,
int
page_cnt
)
{
int
page_cnt
)
{
if
(
perf_buffers_
.
find
(
name
)
==
perf_buffers_
.
end
())
{
if
(
perf_buffers_
.
find
(
name
)
==
perf_buffers_
.
end
())
{
TableStorage
::
iterator
it
;
TableStorage
::
iterator
it
;
...
@@ -467,8 +457,8 @@ void BPF::poll_perf_buffer(const std::string& name, int timeout) {
...
@@ -467,8 +457,8 @@ void BPF::poll_perf_buffer(const std::string& name, int timeout) {
it
->
second
->
poll
(
timeout
);
it
->
second
->
poll
(
timeout
);
}
}
StatusTuple
BPF
::
load_func
(
const
std
::
string
&
func_name
,
StatusTuple
BPF
::
load_func
(
const
std
::
string
&
func_name
,
bpf_prog_type
type
,
bpf_prog_type
type
,
int
&
fd
)
{
int
&
fd
)
{
if
(
funcs_
.
find
(
func_name
)
!=
funcs_
.
end
())
{
if
(
funcs_
.
find
(
func_name
)
!=
funcs_
.
end
())
{
fd
=
funcs_
[
func_name
];
fd
=
funcs_
[
func_name
];
return
StatusTuple
(
0
);
return
StatusTuple
(
0
);
...
@@ -487,17 +477,15 @@ StatusTuple BPF::load_func(const std::string& func_name,
...
@@ -487,17 +477,15 @@ StatusTuple BPF::load_func(const std::string& func_name,
log_level
=
1
;
log_level
=
1
;
fd
=
bpf_prog_load
(
type
,
func_name
.
c_str
(),
fd
=
bpf_prog_load
(
type
,
func_name
.
c_str
(),
reinterpret_cast
<
struct
bpf_insn
*>
(
func_start
),
reinterpret_cast
<
struct
bpf_insn
*>
(
func_start
),
func_size
,
func_size
,
bpf_module_
->
license
(),
bpf_module_
->
license
(),
bpf_module_
->
kern_version
(),
bpf_module_
->
kern_version
(),
log_level
,
nullptr
,
0
);
log_level
,
nullptr
,
0
);
if
(
fd
<
0
)
if
(
fd
<
0
)
return
StatusTuple
(
-
1
,
"Failed to load %s: %d"
,
func_name
.
c_str
(),
fd
);
return
StatusTuple
(
-
1
,
"Failed to load %s: %d"
,
func_name
.
c_str
(),
fd
);
bpf_module_
->
annotate_prog_tag
(
func_name
,
fd
,
bpf_module_
->
annotate_prog_tag
(
reinterpret_cast
<
struct
bpf_insn
*>
(
func_start
),
func_name
,
fd
,
reinterpret_cast
<
struct
bpf_insn
*>
(
func_start
),
func_size
);
func_size
);
funcs_
[
func_name
]
=
fd
;
funcs_
[
func_name
]
=
fd
;
return
StatusTuple
(
0
);
return
StatusTuple
(
0
);
}
}
...
@@ -518,8 +506,8 @@ StatusTuple BPF::unload_func(const std::string& func_name) {
...
@@ -518,8 +506,8 @@ StatusTuple BPF::unload_func(const std::string& func_name) {
StatusTuple
BPF
::
check_binary_symbol
(
const
std
::
string
&
binary_path
,
StatusTuple
BPF
::
check_binary_symbol
(
const
std
::
string
&
binary_path
,
const
std
::
string
&
symbol
,
const
std
::
string
&
symbol
,
uint64_t
symbol_addr
,
uint64_t
symbol_addr
,
std
::
string
&
module_res
,
std
::
string
&
module_res
,
uint64_t
&
offset_res
)
{
uint64_t
&
offset_res
)
{
bcc_symbol
output
;
bcc_symbol
output
;
int
res
=
bcc_resolve_symname
(
binary_path
.
c_str
(),
symbol
.
c_str
(),
int
res
=
bcc_resolve_symname
(
binary_path
.
c_str
(),
symbol
.
c_str
(),
symbol_addr
,
-
1
,
nullptr
,
&
output
);
symbol_addr
,
-
1
,
nullptr
,
&
output
);
...
@@ -552,8 +540,7 @@ BPFProgTable BPF::get_prog_table(const std::string& name) {
...
@@ -552,8 +540,7 @@ BPFProgTable BPF::get_prog_table(const std::string& name) {
return
BPFProgTable
({});
return
BPFProgTable
({});
}
}
BPFStackTable
BPF
::
get_stack_table
(
const
std
::
string
&
name
,
BPFStackTable
BPF
::
get_stack_table
(
const
std
::
string
&
name
,
bool
use_debug_file
,
bool
use_debug_file
,
bool
check_debug_file_crc
)
{
bool
check_debug_file_crc
)
{
TableStorage
::
iterator
it
;
TableStorage
::
iterator
it
;
if
(
bpf_module_
->
table_storage
().
Find
(
Path
({
bpf_module_
->
id
(),
name
}),
it
))
if
(
bpf_module_
->
table_storage
().
Find
(
Path
({
bpf_module_
->
id
(),
name
}),
it
))
...
...
src/cc/api/BPF.h
View file @
120ac968
...
@@ -42,7 +42,7 @@ struct open_probe_t {
...
@@ -42,7 +42,7 @@ struct open_probe_t {
class
USDT
;
class
USDT
;
class
BPF
{
class
BPF
{
public:
public:
static
const
int
BPF_MAX_STACK_DEPTH
=
127
;
static
const
int
BPF_MAX_STACK_DEPTH
=
127
;
explicit
BPF
(
unsigned
int
flag
=
0
,
TableStorage
*
ts
=
nullptr
)
explicit
BPF
(
unsigned
int
flag
=
0
,
TableStorage
*
ts
=
nullptr
)
...
@@ -54,33 +54,31 @@ public:
...
@@ -54,33 +54,31 @@ public:
~
BPF
();
~
BPF
();
StatusTuple
detach_all
();
StatusTuple
detach_all
();
StatusTuple
attach_kprobe
(
StatusTuple
attach_kprobe
(
const
std
::
string
&
kernel_func
,
const
std
::
string
&
kernel_func
,
const
std
::
string
&
probe_func
,
const
std
::
string
&
probe_func
,
bpf_probe_attach_type
=
BPF_PROBE_ENTRY
,
bpf_probe_attach_type
=
BPF_PROBE_ENTRY
,
pid_t
pid
=
-
1
,
int
cpu
=
0
,
int
group_fd
=
-
1
,
perf_reader_cb
cb
=
nullptr
,
perf_reader_cb
cb
=
nullptr
,
void
*
cb_cookie
=
nullptr
);
void
*
cb_cookie
=
nullptr
);
StatusTuple
detach_kprobe
(
StatusTuple
detach_kprobe
(
const
std
::
string
&
kernel_func
,
const
std
::
string
&
kernel_func
,
bpf_probe_attach_type
attach_type
=
BPF_PROBE_ENTRY
);
bpf_probe_attach_type
attach_type
=
BPF_PROBE_ENTRY
);
StatusTuple
attach_uprobe
(
StatusTuple
attach_uprobe
(
const
std
::
string
&
binary_path
,
const
std
::
string
&
binary_path
,
const
std
::
string
&
symbol
,
const
std
::
string
&
symbol
,
const
std
::
string
&
probe_func
,
uint64_t
symbol_addr
=
0
,
const
std
::
string
&
probe_func
,
bpf_probe_attach_type
attach_type
=
BPF_PROBE_ENTRY
,
uint64_t
symbol_addr
=
0
,
pid_t
pid
=
-
1
,
int
cpu
=
0
,
int
group_fd
=
-
1
,
bpf_probe_attach_type
attach_type
=
BPF_PROBE_ENTRY
,
perf_reader_cb
cb
=
nullptr
,
void
*
cb_cookie
=
nullptr
);
pid_t
pid
=
-
1
,
perf_reader_cb
cb
=
nullptr
,
StatusTuple
detach_uprobe
(
void
*
cb_cookie
=
nullptr
);
const
std
::
string
&
binary_path
,
const
std
::
string
&
symbol
,
StatusTuple
detach_uprobe
(
const
std
::
string
&
binary_path
,
uint64_t
symbol_addr
=
0
,
const
std
::
string
&
symbol
,
uint64_t
symbol_addr
=
0
,
bpf_probe_attach_type
attach_type
=
BPF_PROBE_ENTRY
,
bpf_probe_attach_type
attach_type
=
BPF_PROBE_ENTRY
,
pid_t
pid
=
-
1
);
pid_t
pid
=
-
1
);
StatusTuple
attach_usdt
(
const
USDT
&
usdt
,
pid_t
pid
=
-
1
,
int
cpu
=
0
,
StatusTuple
attach_usdt
(
const
USDT
&
usdt
,
pid_t
pid
=
-
1
);
int
group_fd
=
-
1
);
StatusTuple
detach_usdt
(
const
USDT
&
usdt
);
StatusTuple
detach_usdt
(
const
USDT
&
usdt
);
StatusTuple
attach_tracepoint
(
const
std
::
string
&
tracepoint
,
StatusTuple
attach_tracepoint
(
const
std
::
string
&
tracepoint
,
const
std
::
string
&
probe_func
,
const
std
::
string
&
probe_func
,
pid_t
pid
=
-
1
,
int
cpu
=
0
,
int
group_fd
=
-
1
,
perf_reader_cb
cb
=
nullptr
,
perf_reader_cb
cb
=
nullptr
,
void
*
cb_cookie
=
nullptr
);
void
*
cb_cookie
=
nullptr
);
StatusTuple
detach_tracepoint
(
const
std
::
string
&
tracepoint
);
StatusTuple
detach_tracepoint
(
const
std
::
string
&
tracepoint
);
...
@@ -121,14 +119,12 @@ public:
...
@@ -121,14 +119,12 @@ public:
bool
use_debug_file
=
true
,
bool
use_debug_file
=
true
,
bool
check_debug_file_crc
=
true
);
bool
check_debug_file_crc
=
true
);
StatusTuple
open_perf_event
(
const
std
::
string
&
name
,
StatusTuple
open_perf_event
(
const
std
::
string
&
name
,
uint32_t
type
,
uint32_t
type
,
uint64_t
config
);
uint64_t
config
);
StatusTuple
close_perf_event
(
const
std
::
string
&
name
);
StatusTuple
close_perf_event
(
const
std
::
string
&
name
);
StatusTuple
open_perf_buffer
(
const
std
::
string
&
name
,
StatusTuple
open_perf_buffer
(
const
std
::
string
&
name
,
perf_reader_raw_cb
cb
,
perf_reader_raw_cb
cb
,
perf_reader_lost_cb
lost_cb
=
nullptr
,
perf_reader_lost_cb
lost_cb
=
nullptr
,
void
*
cb_cookie
=
nullptr
,
void
*
cb_cookie
=
nullptr
,
int
page_cnt
=
DEFAULT_PERF_BUFFER_PAGE_CNT
);
int
page_cnt
=
DEFAULT_PERF_BUFFER_PAGE_CNT
);
...
@@ -139,7 +135,7 @@ public:
...
@@ -139,7 +135,7 @@ public:
int
&
fd
);
int
&
fd
);
StatusTuple
unload_func
(
const
std
::
string
&
func_name
);
StatusTuple
unload_func
(
const
std
::
string
&
func_name
);
private:
private:
std
::
string
get_kprobe_event
(
const
std
::
string
&
kernel_func
,
std
::
string
get_kprobe_event
(
const
std
::
string
&
kernel_func
,
bpf_probe_attach_type
type
);
bpf_probe_attach_type
type
);
std
::
string
get_uprobe_event
(
const
std
::
string
&
binary_path
,
uint64_t
offset
,
std
::
string
get_uprobe_event
(
const
std
::
string
&
binary_path
,
uint64_t
offset
,
...
@@ -181,9 +177,8 @@ private:
...
@@ -181,9 +177,8 @@ private:
StatusTuple
check_binary_symbol
(
const
std
::
string
&
binary_path
,
StatusTuple
check_binary_symbol
(
const
std
::
string
&
binary_path
,
const
std
::
string
&
symbol
,
const
std
::
string
&
symbol
,
uint64_t
symbol_addr
,
uint64_t
symbol_addr
,
std
::
string
&
module_res
,
std
::
string
&
module_res
,
uint64_t
&
offset_res
);
uint64_t
&
offset_res
);
int
flag_
;
int
flag_
;
...
@@ -202,7 +197,7 @@ private:
...
@@ -202,7 +197,7 @@ private:
};
};
class
USDT
{
class
USDT
{
public:
public:
USDT
(
const
std
::
string
&
binary_path
,
const
std
::
string
&
provider
,
USDT
(
const
std
::
string
&
binary_path
,
const
std
::
string
&
provider
,
const
std
::
string
&
name
,
const
std
::
string
&
probe_func
)
const
std
::
string
&
name
,
const
std
::
string
&
probe_func
)
:
initialized_
(
false
),
:
initialized_
(
false
),
...
@@ -221,7 +216,7 @@ public:
...
@@ -221,7 +216,7 @@ public:
return
provider_
+
":"
+
name_
+
" from "
+
binary_path_
;
return
provider_
+
":"
+
name_
+
" from "
+
binary_path_
;
}
}
private:
private:
StatusTuple
init
();
StatusTuple
init
();
bool
initialized_
;
bool
initialized_
;
...
...
src/cc/libbpf.c
View file @
120ac968
...
@@ -529,8 +529,8 @@ int bpf_attach_socket(int sock, int prog) {
...
@@ -529,8 +529,8 @@ int bpf_attach_socket(int sock, int prog) {
}
}
static
int
bpf_attach_tracing_event
(
int
progfd
,
const
char
*
event_path
,
static
int
bpf_attach_tracing_event
(
int
progfd
,
const
char
*
event_path
,
struct
perf_reader
*
reader
,
int
pid
,
int
cpu
,
int
group_f
d
)
{
struct
perf_reader
*
reader
,
int
pi
d
)
{
int
efd
,
pfd
;
int
efd
,
pfd
,
cpu
=
0
;
ssize_t
bytes
;
ssize_t
bytes
;
char
buf
[
256
];
char
buf
[
256
];
struct
perf_event_attr
attr
=
{};
struct
perf_event_attr
attr
=
{};
...
@@ -555,7 +555,15 @@ static int bpf_attach_tracing_event(int progfd, const char *event_path,
...
@@ -555,7 +555,15 @@ static int bpf_attach_tracing_event(int progfd, const char *event_path,
attr
.
sample_type
=
PERF_SAMPLE_RAW
|
PERF_SAMPLE_CALLCHAIN
;
attr
.
sample_type
=
PERF_SAMPLE_RAW
|
PERF_SAMPLE_CALLCHAIN
;
attr
.
sample_period
=
1
;
attr
.
sample_period
=
1
;
attr
.
wakeup_events
=
1
;
attr
.
wakeup_events
=
1
;
pfd
=
syscall
(
__NR_perf_event_open
,
&
attr
,
pid
,
cpu
,
group_fd
,
PERF_FLAG_FD_CLOEXEC
);
// PID filter is only possible for uprobe events.
if
(
pid
<
0
)
pid
=
-
1
;
// perf_event_open API doesn't allow both pid and cpu to be -1.
// So only set it to -1 when PID is not -1.
// Tracing events do not do CPU filtering in any cases.
if
(
pid
!=
-
1
)
cpu
=
-
1
;
pfd
=
syscall
(
__NR_perf_event_open
,
&
attr
,
pid
,
cpu
,
-
1
/* group_fd */
,
PERF_FLAG_FD_CLOEXEC
);
if
(
pfd
<
0
)
{
if
(
pfd
<
0
)
{
fprintf
(
stderr
,
"perf_event_open(%s/id): %s
\n
"
,
event_path
,
strerror
(
errno
));
fprintf
(
stderr
,
"perf_event_open(%s/id): %s
\n
"
,
event_path
,
strerror
(
errno
));
return
-
1
;
return
-
1
;
...
@@ -577,9 +585,8 @@ static int bpf_attach_tracing_event(int progfd, const char *event_path,
...
@@ -577,9 +585,8 @@ static int bpf_attach_tracing_event(int progfd, const char *event_path,
return
0
;
return
0
;
}
}
void
*
bpf_attach_kprobe
(
int
progfd
,
enum
bpf_probe_attach_type
attach_type
,
const
char
*
ev_name
,
void
*
bpf_attach_kprobe
(
int
progfd
,
enum
bpf_probe_attach_type
attach_type
,
const
char
*
fn_name
,
const
char
*
ev_name
,
const
char
*
fn_name
,
pid_t
pid
,
int
cpu
,
int
group_fd
,
perf_reader_cb
cb
,
void
*
cb_cookie
)
perf_reader_cb
cb
,
void
*
cb_cookie
)
{
{
int
kfd
;
int
kfd
;
...
@@ -611,7 +618,7 @@ void * bpf_attach_kprobe(int progfd, enum bpf_probe_attach_type attach_type, con
...
@@ -611,7 +618,7 @@ void * bpf_attach_kprobe(int progfd, enum bpf_probe_attach_type attach_type, con
close
(
kfd
);
close
(
kfd
);
snprintf
(
buf
,
sizeof
(
buf
),
"/sys/kernel/debug/tracing/events/%ss/%s"
,
event_type
,
event_alias
);
snprintf
(
buf
,
sizeof
(
buf
),
"/sys/kernel/debug/tracing/events/%ss/%s"
,
event_type
,
event_alias
);
if
(
bpf_attach_tracing_event
(
progfd
,
buf
,
reader
,
pid
,
cpu
,
group_fd
)
<
0
)
if
(
bpf_attach_tracing_event
(
progfd
,
buf
,
reader
,
-
1
/* PID */
)
<
0
)
goto
error
;
goto
error
;
return
reader
;
return
reader
;
...
@@ -683,10 +690,10 @@ static void exit_mount_ns(int fd) {
...
@@ -683,10 +690,10 @@ static void exit_mount_ns(int fd) {
perror
(
"setns"
);
perror
(
"setns"
);
}
}
void
*
bpf_attach_uprobe
(
int
progfd
,
enum
bpf_probe_attach_type
attach_type
,
const
char
*
ev_nam
e
,
void
*
bpf_attach_uprobe
(
int
progfd
,
enum
bpf_probe_attach_type
attach_typ
e
,
const
char
*
binary_path
,
uint64_t
offset
,
const
char
*
ev_name
,
const
char
*
binary_path
,
pid_t
pid
,
int
cpu
,
int
group_fd
,
uint64_t
offset
,
pid_t
pid
,
perf_reader_cb
cb
,
perf_reader_cb
cb
,
void
*
cb_cookie
)
void
*
cb_cookie
)
{
{
char
buf
[
PATH_MAX
];
char
buf
[
PATH_MAX
];
char
event_alias
[
PATH_MAX
];
char
event_alias
[
PATH_MAX
];
...
@@ -728,7 +735,7 @@ void * bpf_attach_uprobe(int progfd, enum bpf_probe_attach_type attach_type, con
...
@@ -728,7 +735,7 @@ void * bpf_attach_uprobe(int progfd, enum bpf_probe_attach_type attach_type, con
ns_fd
=
-
1
;
ns_fd
=
-
1
;
snprintf
(
buf
,
sizeof
(
buf
),
"/sys/kernel/debug/tracing/events/%ss/%s"
,
event_type
,
event_alias
);
snprintf
(
buf
,
sizeof
(
buf
),
"/sys/kernel/debug/tracing/events/%ss/%s"
,
event_type
,
event_alias
);
if
(
bpf_attach_tracing_event
(
progfd
,
buf
,
reader
,
pid
,
cpu
,
group_fd
)
<
0
)
if
(
bpf_attach_tracing_event
(
progfd
,
buf
,
reader
,
pid
)
<
0
)
goto
error
;
goto
error
;
return
reader
;
return
reader
;
...
@@ -782,9 +789,9 @@ int bpf_detach_uprobe(const char *ev_name)
...
@@ -782,9 +789,9 @@ int bpf_detach_uprobe(const char *ev_name)
}
}
void
*
bpf_attach_tracepoint
(
int
progfd
,
const
char
*
tp_category
,
void
*
bpf_attach_tracepoint
(
int
progfd
,
const
char
*
tp_category
,
const
char
*
tp_name
,
int
pid
,
int
cpu
,
const
char
*
tp_name
,
perf_reader_cb
cb
,
int
group_fd
,
perf_reader_cb
cb
,
void
*
cb_cookie
)
{
void
*
cb_cookie
)
{
char
buf
[
256
];
char
buf
[
256
];
struct
perf_reader
*
reader
=
NULL
;
struct
perf_reader
*
reader
=
NULL
;
...
@@ -794,7 +801,7 @@ void * bpf_attach_tracepoint(int progfd, const char *tp_category,
...
@@ -794,7 +801,7 @@ void * bpf_attach_tracepoint(int progfd, const char *tp_category,
snprintf
(
buf
,
sizeof
(
buf
),
"/sys/kernel/debug/tracing/events/%s/%s"
,
snprintf
(
buf
,
sizeof
(
buf
),
"/sys/kernel/debug/tracing/events/%s/%s"
,
tp_category
,
tp_name
);
tp_category
,
tp_name
);
if
(
bpf_attach_tracing_event
(
progfd
,
buf
,
reader
,
pid
,
cpu
,
group_fd
)
<
0
)
if
(
bpf_attach_tracing_event
(
progfd
,
buf
,
reader
,
-
1
/* PID */
)
<
0
)
goto
error
;
goto
error
;
return
reader
;
return
reader
;
...
...
src/cc/libbpf.h
View file @
120ac968
...
@@ -70,23 +70,22 @@ typedef void (*perf_reader_cb)(void *cb_cookie, int pid, uint64_t callchain_num,
...
@@ -70,23 +70,22 @@ typedef void (*perf_reader_cb)(void *cb_cookie, int pid, uint64_t callchain_num,
typedef
void
(
*
perf_reader_raw_cb
)(
void
*
cb_cookie
,
void
*
raw
,
int
raw_size
);
typedef
void
(
*
perf_reader_raw_cb
)(
void
*
cb_cookie
,
void
*
raw
,
int
raw_size
);
typedef
void
(
*
perf_reader_lost_cb
)(
uint64_t
lost
);
typedef
void
(
*
perf_reader_lost_cb
)(
uint64_t
lost
);
void
*
bpf_attach_kprobe
(
int
progfd
,
enum
bpf_probe_attach_type
attach_type
,
void
*
bpf_attach_kprobe
(
int
progfd
,
enum
bpf_probe_attach_type
attach_type
,
const
char
*
ev_name
,
const
char
*
fn_name
,
const
char
*
ev_name
,
const
char
*
fn_name
,
pid_t
pid
,
int
cpu
,
int
group_fd
,
perf_reader_cb
cb
,
void
*
cb_cookie
);
perf_reader_cb
cb
,
void
*
cb_cookie
);
int
bpf_detach_kprobe
(
const
char
*
ev_name
);
int
bpf_detach_kprobe
(
const
char
*
ev_name
);
void
*
bpf_attach_uprobe
(
int
progfd
,
enum
bpf_probe_attach_type
attach_type
,
void
*
bpf_attach_uprobe
(
int
progfd
,
enum
bpf_probe_attach_type
attach_type
,
const
char
*
ev_name
,
const
char
*
binary_path
,
uint64_t
offset
,
const
char
*
ev_name
,
const
char
*
binary_path
,
pid_t
pid
,
int
cpu
,
int
group_fd
,
uint64_t
offset
,
pid_t
pid
,
perf_reader_cb
cb
,
perf_reader_cb
cb
,
void
*
cb_cookie
);
void
*
cb_cookie
);
int
bpf_detach_uprobe
(
const
char
*
ev_name
);
int
bpf_detach_uprobe
(
const
char
*
ev_name
);
void
*
bpf_attach_tracepoint
(
int
progfd
,
const
char
*
tp_category
,
void
*
bpf_attach_tracepoint
(
int
progfd
,
const
char
*
tp_category
,
const
char
*
tp_name
,
int
pid
,
int
cpu
,
const
char
*
tp_name
,
perf_reader_cb
cb
,
int
group_fd
,
perf_reader_cb
cb
,
void
*
cb_cookie
);
void
*
cb_cookie
);
int
bpf_detach_tracepoint
(
const
char
*
tp_category
,
const
char
*
tp_name
);
int
bpf_detach_tracepoint
(
const
char
*
tp_category
,
const
char
*
tp_name
);
void
*
bpf_open_perf_buffer
(
perf_reader_raw_cb
raw_cb
,
void
*
bpf_open_perf_buffer
(
perf_reader_raw_cb
raw_cb
,
...
...
src/lua/bcc/bpf.lua
View file @
120ac968
...
@@ -189,9 +189,7 @@ function Bpf:attach_uprobe(args)
...
@@ -189,9 +189,7 @@ function Bpf:attach_uprobe(args)
local
retprobe
=
args
.
retprobe
and
1
or
0
local
retprobe
=
args
.
retprobe
and
1
or
0
local
res
=
libbcc
.
bpf_attach_uprobe
(
fn
.
fd
,
retprobe
,
ev_name
,
path
,
addr
,
local
res
=
libbcc
.
bpf_attach_uprobe
(
fn
.
fd
,
retprobe
,
ev_name
,
path
,
addr
,
args
.
pid
or
-
1
,
args
.
pid
or
-
1
,
nil
,
nil
)
-- TODO; reader callback
args
.
cpu
or
0
,
args
.
group_fd
or
-
1
,
nil
,
nil
)
-- TODO; reader callback
assert
(
res
~=
nil
,
"failed to attach BPF to uprobe"
)
assert
(
res
~=
nil
,
"failed to attach BPF to uprobe"
)
self
:
probe_store
(
"uprobe"
,
ev_name
,
res
)
self
:
probe_store
(
"uprobe"
,
ev_name
,
res
)
...
@@ -209,9 +207,7 @@ function Bpf:attach_kprobe(args)
...
@@ -209,9 +207,7 @@ function Bpf:attach_kprobe(args)
local
retprobe
=
args
.
retprobe
and
1
or
0
local
retprobe
=
args
.
retprobe
and
1
or
0
local
res
=
libbcc
.
bpf_attach_kprobe
(
fn
.
fd
,
retprobe
,
ev_name
,
event
,
local
res
=
libbcc
.
bpf_attach_kprobe
(
fn
.
fd
,
retprobe
,
ev_name
,
event
,
args
.
pid
or
-
1
,
nil
,
nil
)
-- TODO; reader callback
args
.
cpu
or
0
,
args
.
group_fd
or
-
1
,
nil
,
nil
)
-- TODO; reader callback
assert
(
res
~=
nil
,
"failed to attach BPF to kprobe"
)
assert
(
res
~=
nil
,
"failed to attach BPF to kprobe"
)
self
:
probe_store
(
"kprobe"
,
ev_name
,
res
)
self
:
probe_store
(
"kprobe"
,
ev_name
,
res
)
...
...
src/lua/bcc/libbcc.lua
View file @
120ac968
...
@@ -43,16 +43,14 @@ typedef void (*perf_reader_cb)(void *cb_cookie, int pid, uint64_t callchain_num,
...
@@ -43,16 +43,14 @@ typedef void (*perf_reader_cb)(void *cb_cookie, int pid, uint64_t callchain_num,
typedef void (*perf_reader_raw_cb)(void *cb_cookie, void *raw, int raw_size);
typedef void (*perf_reader_raw_cb)(void *cb_cookie, void *raw, int raw_size);
typedef void (*perf_reader_lost_cb)(uint64_t lost);
typedef void (*perf_reader_lost_cb)(uint64_t lost);
void * bpf_attach_kprobe(int progfd, int attach_type, const char *ev_name,
void *bpf_attach_kprobe(int progfd, int attach_type, const char *ev_name,
const char *fn_name,
const char *fn_name, perf_reader_cb cb,
int pid, int cpu, int group_fd,
void *cb_cookie);
perf_reader_cb cb, void *cb_cookie);
int bpf_detach_kprobe(const char *ev_name);
int bpf_detach_kprobe(const char *ev_name);
void * bpf_attach_uprobe(int progfd, int attach_type, const char *ev_name,
void *bpf_attach_uprobe(int progfd, int attach_type, const char *ev_name,
const char *binary_path, uint64_t offset,
const char *binary_path, uint64_t offset, int pid,
int pid, int cpu, int group_fd,
perf_reader_cb cb, void *cb_cookie);
perf_reader_cb cb, void *cb_cookie);
int bpf_detach_uprobe(const char *ev_name);
int bpf_detach_uprobe(const char *ev_name);
...
...
src/python/bcc/__init__.py
View file @
120ac968
...
@@ -499,8 +499,7 @@ class BPF(object):
...
@@ -499,8 +499,7 @@ class BPF(object):
del
self
.
open_kprobes
[
name
]
del
self
.
open_kprobes
[
name
]
_num_open_probes
-=
1
_num_open_probes
-=
1
def
attach_kprobe
(
self
,
event
=
""
,
fn_name
=
""
,
event_re
=
""
,
def
attach_kprobe
(
self
,
event
=
""
,
fn_name
=
""
,
event_re
=
""
):
pid
=-
1
,
cpu
=
0
,
group_fd
=-
1
):
# allow the caller to glob multiple functions together
# allow the caller to glob multiple functions together
if
event_re
:
if
event_re
:
...
@@ -508,8 +507,7 @@ class BPF(object):
...
@@ -508,8 +507,7 @@ class BPF(object):
self
.
_check_probe_quota
(
len
(
matches
))
self
.
_check_probe_quota
(
len
(
matches
))
for
line
in
matches
:
for
line
in
matches
:
try
:
try
:
self
.
attach_kprobe
(
event
=
line
,
fn_name
=
fn_name
,
pid
=
pid
,
self
.
attach_kprobe
(
event
=
line
,
fn_name
=
fn_name
)
cpu
=
cpu
,
group_fd
=
group_fd
)
except
:
except
:
pass
pass
return
return
...
@@ -519,8 +517,8 @@ class BPF(object):
...
@@ -519,8 +517,8 @@ class BPF(object):
fn
=
self
.
load_func
(
fn_name
,
BPF
.
KPROBE
)
fn
=
self
.
load_func
(
fn_name
,
BPF
.
KPROBE
)
ev_name
=
"p_"
+
event
.
replace
(
"+"
,
"_"
).
replace
(
"."
,
"_"
)
ev_name
=
"p_"
+
event
.
replace
(
"+"
,
"_"
).
replace
(
"."
,
"_"
)
res
=
lib
.
bpf_attach_kprobe
(
fn
.
fd
,
0
,
ev_name
.
encode
(
"ascii"
),
res
=
lib
.
bpf_attach_kprobe
(
fn
.
fd
,
0
,
ev_name
.
encode
(
"ascii"
),
event
.
encode
(
"ascii"
),
pid
,
cpu
,
group_fd
,
event
.
encode
(
"ascii"
),
self
.
_reader_cb_impl
,
self
.
_reader_cb_impl
,
ct
.
cast
(
id
(
self
),
ct
.
py_object
))
ct
.
cast
(
id
(
self
),
ct
.
py_object
))
res
=
ct
.
cast
(
res
,
ct
.
c_void_p
)
res
=
ct
.
cast
(
res
,
ct
.
c_void_p
)
if
not
res
:
if
not
res
:
raise
Exception
(
"Failed to attach BPF to kprobe"
)
raise
Exception
(
"Failed to attach BPF to kprobe"
)
...
@@ -538,15 +536,13 @@ class BPF(object):
...
@@ -538,15 +536,13 @@ class BPF(object):
raise
Exception
(
"Failed to detach BPF from kprobe"
)
raise
Exception
(
"Failed to detach BPF from kprobe"
)
self
.
_del_kprobe
(
ev_name
)
self
.
_del_kprobe
(
ev_name
)
def
attach_kretprobe
(
self
,
event
=
""
,
fn_name
=
""
,
event_re
=
""
,
def
attach_kretprobe
(
self
,
event
=
""
,
fn_name
=
""
,
event_re
=
""
):
pid
=-
1
,
cpu
=
0
,
group_fd
=-
1
):
# allow the caller to glob multiple functions together
# allow the caller to glob multiple functions together
if
event_re
:
if
event_re
:
for
line
in
BPF
.
get_kprobe_functions
(
event_re
):
for
line
in
BPF
.
get_kprobe_functions
(
event_re
):
try
:
try
:
self
.
attach_kretprobe
(
event
=
line
,
fn_name
=
fn_name
,
pid
=
pid
,
self
.
attach_kretprobe
(
event
=
line
,
fn_name
=
fn_name
)
cpu
=
cpu
,
group_fd
=
group_fd
)
except
:
except
:
pass
pass
return
return
...
@@ -556,8 +552,8 @@ class BPF(object):
...
@@ -556,8 +552,8 @@ class BPF(object):
fn
=
self
.
load_func
(
fn_name
,
BPF
.
KPROBE
)
fn
=
self
.
load_func
(
fn_name
,
BPF
.
KPROBE
)
ev_name
=
"r_"
+
event
.
replace
(
"+"
,
"_"
).
replace
(
"."
,
"_"
)
ev_name
=
"r_"
+
event
.
replace
(
"+"
,
"_"
).
replace
(
"."
,
"_"
)
res
=
lib
.
bpf_attach_kprobe
(
fn
.
fd
,
1
,
ev_name
.
encode
(
"ascii"
),
res
=
lib
.
bpf_attach_kprobe
(
fn
.
fd
,
1
,
ev_name
.
encode
(
"ascii"
),
event
.
encode
(
"ascii"
),
pid
,
cpu
,
group_fd
,
event
.
encode
(
"ascii"
),
self
.
_reader_cb_impl
,
self
.
_reader_cb_impl
,
ct
.
cast
(
id
(
self
),
ct
.
py_object
))
ct
.
cast
(
id
(
self
),
ct
.
py_object
))
res
=
ct
.
cast
(
res
,
ct
.
c_void_p
)
res
=
ct
.
cast
(
res
,
ct
.
c_void_p
)
if
not
res
:
if
not
res
:
raise
Exception
(
"Failed to attach BPF to kprobe"
)
raise
Exception
(
"Failed to attach BPF to kprobe"
)
...
@@ -648,10 +644,8 @@ class BPF(object):
...
@@ -648,10 +644,8 @@ class BPF(object):
results
.
append
(
tp
)
results
.
append
(
tp
)
return
results
return
results
def
attach_tracepoint
(
self
,
tp
=
""
,
tp_re
=
""
,
fn_name
=
""
,
pid
=-
1
,
def
attach_tracepoint
(
self
,
tp
=
""
,
tp_re
=
""
,
fn_name
=
""
):
cpu
=
0
,
group_fd
=-
1
):
"""attach_tracepoint(tp="", tp_re="", fn_name="")
"""attach_tracepoint(tp="", tp_re="", fn_name="", pid=-1,
cpu=0, group_fd=-1)
Run the bpf function denoted by fn_name every time the kernel tracepoint
Run the bpf function denoted by fn_name every time the kernel tracepoint
specified by 'tp' is hit. The optional parameters pid, cpu, and group_fd
specified by 'tp' is hit. The optional parameters pid, cpu, and group_fd
...
@@ -673,15 +667,14 @@ class BPF(object):
...
@@ -673,15 +667,14 @@ class BPF(object):
if
tp_re
:
if
tp_re
:
for
tp
in
BPF
.
get_tracepoints
(
tp_re
):
for
tp
in
BPF
.
get_tracepoints
(
tp_re
):
self
.
attach_tracepoint
(
tp
=
tp
,
fn_name
=
fn_name
,
pid
=
pid
,
self
.
attach_tracepoint
(
tp
=
tp
,
fn_name
=
fn_name
)
cpu
=
cpu
,
group_fd
=
group_fd
)
return
return
fn
=
self
.
load_func
(
fn_name
,
BPF
.
TRACEPOINT
)
fn
=
self
.
load_func
(
fn_name
,
BPF
.
TRACEPOINT
)
(
tp_category
,
tp_name
)
=
tp
.
split
(
':'
)
(
tp_category
,
tp_name
)
=
tp
.
split
(
':'
)
res
=
lib
.
bpf_attach_tracepoint
(
fn
.
fd
,
tp_category
.
encode
(
"ascii"
),
res
=
lib
.
bpf_attach_tracepoint
(
fn
.
fd
,
tp_category
.
encode
(
"ascii"
),
tp_name
.
encode
(
"ascii"
),
pid
,
cpu
,
group_fd
,
tp_name
.
encode
(
"ascii"
),
self
.
_reader_cb_impl
,
self
.
_reader_cb_impl
,
ct
.
cast
(
id
(
self
),
ct
.
py_object
))
ct
.
cast
(
id
(
self
),
ct
.
py_object
))
res
=
ct
.
cast
(
res
,
ct
.
c_void_p
)
res
=
ct
.
cast
(
res
,
ct
.
c_void_p
)
if
not
res
:
if
not
res
:
raise
Exception
(
"Failed to attach BPF to tracepoint"
)
raise
Exception
(
"Failed to attach BPF to tracepoint"
)
...
@@ -794,9 +787,9 @@ class BPF(object):
...
@@ -794,9 +787,9 @@ class BPF(object):
return
"%s_%s_0x%x_%d"
%
(
prefix
,
self
.
_probe_repl
.
sub
(
"_"
,
path
),
addr
,
pid
)
return
"%s_%s_0x%x_%d"
%
(
prefix
,
self
.
_probe_repl
.
sub
(
"_"
,
path
),
addr
,
pid
)
def
attach_uprobe
(
self
,
name
=
""
,
sym
=
""
,
sym_re
=
""
,
addr
=
None
,
def
attach_uprobe
(
self
,
name
=
""
,
sym
=
""
,
sym_re
=
""
,
addr
=
None
,
fn_name
=
""
,
pid
=-
1
,
cpu
=
0
,
group_fd
=-
1
):
fn_name
=
""
,
pid
=-
1
):
"""attach_uprobe(name="", sym="", sym_re="", addr=None, fn_name=""
"""attach_uprobe(name="", sym="", sym_re="", addr=None, fn_name=""
pid=-1
, cpu=0, group_fd=-1
)
pid=-1)
Run the bpf function denoted by fn_name every time the symbol sym in
Run the bpf function denoted by fn_name every time the symbol sym in
the library or binary 'name' is encountered. The real address addr may
the library or binary 'name' is encountered. The real address addr may
...
@@ -823,8 +816,7 @@ class BPF(object):
...
@@ -823,8 +816,7 @@ class BPF(object):
self
.
_check_probe_quota
(
len
(
addresses
))
self
.
_check_probe_quota
(
len
(
addresses
))
for
sym_addr
in
addresses
:
for
sym_addr
in
addresses
:
self
.
attach_uprobe
(
name
=
name
,
addr
=
sym_addr
,
self
.
attach_uprobe
(
name
=
name
,
addr
=
sym_addr
,
fn_name
=
fn_name
,
pid
=
pid
,
cpu
=
cpu
,
fn_name
=
fn_name
,
pid
=
pid
)
group_fd
=
group_fd
)
return
return
(
path
,
addr
)
=
BPF
.
_check_path_symbol
(
name
,
sym
,
addr
,
pid
)
(
path
,
addr
)
=
BPF
.
_check_path_symbol
(
name
,
sym
,
addr
,
pid
)
...
@@ -833,8 +825,8 @@ class BPF(object):
...
@@ -833,8 +825,8 @@ class BPF(object):
fn
=
self
.
load_func
(
fn_name
,
BPF
.
KPROBE
)
fn
=
self
.
load_func
(
fn_name
,
BPF
.
KPROBE
)
ev_name
=
self
.
_get_uprobe_evname
(
"p"
,
path
,
addr
,
pid
)
ev_name
=
self
.
_get_uprobe_evname
(
"p"
,
path
,
addr
,
pid
)
res
=
lib
.
bpf_attach_uprobe
(
fn
.
fd
,
0
,
ev_name
.
encode
(
"ascii"
),
res
=
lib
.
bpf_attach_uprobe
(
fn
.
fd
,
0
,
ev_name
.
encode
(
"ascii"
),
path
.
encode
(
"ascii"
),
addr
,
pid
,
cpu
,
group_fd
,
path
.
encode
(
"ascii"
),
addr
,
pid
,
self
.
_reader_cb_impl
,
self
.
_reader_cb_impl
,
ct
.
cast
(
id
(
self
),
ct
.
py_object
))
ct
.
cast
(
id
(
self
),
ct
.
py_object
))
res
=
ct
.
cast
(
res
,
ct
.
c_void_p
)
res
=
ct
.
cast
(
res
,
ct
.
c_void_p
)
if
not
res
:
if
not
res
:
raise
Exception
(
"Failed to attach BPF to uprobe"
)
raise
Exception
(
"Failed to attach BPF to uprobe"
)
...
@@ -860,9 +852,9 @@ class BPF(object):
...
@@ -860,9 +852,9 @@ class BPF(object):
self
.
_del_uprobe
(
ev_name
)
self
.
_del_uprobe
(
ev_name
)
def
attach_uretprobe
(
self
,
name
=
""
,
sym
=
""
,
sym_re
=
""
,
addr
=
None
,
def
attach_uretprobe
(
self
,
name
=
""
,
sym
=
""
,
sym_re
=
""
,
addr
=
None
,
fn_name
=
""
,
pid
=-
1
,
cpu
=
0
,
group_fd
=-
1
):
fn_name
=
""
,
pid
=-
1
):
"""attach_uretprobe(name="", sym="", sym_re="", addr=None, fn_name=""
"""attach_uretprobe(name="", sym="", sym_re="", addr=None, fn_name=""
pid=-1
, cpu=0, group_fd=-1
)
pid=-1)
Run the bpf function denoted by fn_name every time the symbol sym in
Run the bpf function denoted by fn_name every time the symbol sym in
the library or binary 'name' finishes execution. See attach_uprobe for
the library or binary 'name' finishes execution. See attach_uprobe for
...
@@ -872,8 +864,7 @@ class BPF(object):
...
@@ -872,8 +864,7 @@ class BPF(object):
if
sym_re
:
if
sym_re
:
for
sym_addr
in
BPF
.
get_user_addresses
(
name
,
sym_re
):
for
sym_addr
in
BPF
.
get_user_addresses
(
name
,
sym_re
):
self
.
attach_uretprobe
(
name
=
name
,
addr
=
sym_addr
,
self
.
attach_uretprobe
(
name
=
name
,
addr
=
sym_addr
,
fn_name
=
fn_name
,
pid
=
pid
,
cpu
=
cpu
,
fn_name
=
fn_name
,
pid
=
pid
)
group_fd
=
group_fd
)
return
return
name
=
str
(
name
)
name
=
str
(
name
)
...
@@ -883,8 +874,8 @@ class BPF(object):
...
@@ -883,8 +874,8 @@ class BPF(object):
fn
=
self
.
load_func
(
fn_name
,
BPF
.
KPROBE
)
fn
=
self
.
load_func
(
fn_name
,
BPF
.
KPROBE
)
ev_name
=
self
.
_get_uprobe_evname
(
"r"
,
path
,
addr
,
pid
)
ev_name
=
self
.
_get_uprobe_evname
(
"r"
,
path
,
addr
,
pid
)
res
=
lib
.
bpf_attach_uprobe
(
fn
.
fd
,
1
,
ev_name
.
encode
(
"ascii"
),
res
=
lib
.
bpf_attach_uprobe
(
fn
.
fd
,
1
,
ev_name
.
encode
(
"ascii"
),
path
.
encode
(
"ascii"
),
addr
,
pid
,
cpu
,
group_fd
,
path
.
encode
(
"ascii"
),
addr
,
pid
,
self
.
_reader_cb_impl
,
self
.
_reader_cb_impl
,
ct
.
cast
(
id
(
self
),
ct
.
py_object
))
ct
.
cast
(
id
(
self
),
ct
.
py_object
))
res
=
ct
.
cast
(
res
,
ct
.
c_void_p
)
res
=
ct
.
cast
(
res
,
ct
.
c_void_p
)
if
not
res
:
if
not
res
:
raise
Exception
(
"Failed to attach BPF to uprobe"
)
raise
Exception
(
"Failed to attach BPF to uprobe"
)
...
...
src/python/bcc/libbcc.py
View file @
120ac968
...
@@ -90,18 +90,18 @@ _CB_TYPE = ct.CFUNCTYPE(None, ct.py_object, ct.c_int,
...
@@ -90,18 +90,18 @@ _CB_TYPE = ct.CFUNCTYPE(None, ct.py_object, ct.c_int,
ct
.
c_ulonglong
,
ct
.
POINTER
(
ct
.
c_ulonglong
))
ct
.
c_ulonglong
,
ct
.
POINTER
(
ct
.
c_ulonglong
))
_RAW_CB_TYPE
=
ct
.
CFUNCTYPE
(
None
,
ct
.
py_object
,
ct
.
c_void_p
,
ct
.
c_int
)
_RAW_CB_TYPE
=
ct
.
CFUNCTYPE
(
None
,
ct
.
py_object
,
ct
.
c_void_p
,
ct
.
c_int
)
_LOST_CB_TYPE
=
ct
.
CFUNCTYPE
(
None
,
ct
.
c_ulonglong
)
_LOST_CB_TYPE
=
ct
.
CFUNCTYPE
(
None
,
ct
.
c_ulonglong
)
lib
.
bpf_attach_kprobe
.
argtypes
=
[
ct
.
c_int
,
ct
.
c_int
,
ct
.
c_char_p
,
ct
.
c_char_p
,
ct
.
c_int
,
lib
.
bpf_attach_kprobe
.
argtypes
=
[
ct
.
c_int
,
ct
.
c_int
,
ct
.
c_char_p
,
ct
.
c_char_p
,
ct
.
c_int
,
ct
.
c_int
,
_CB_TYPE
,
ct
.
py_object
]
_CB_TYPE
,
ct
.
py_object
]
lib
.
bpf_detach_kprobe
.
restype
=
ct
.
c_int
lib
.
bpf_detach_kprobe
.
restype
=
ct
.
c_int
lib
.
bpf_detach_kprobe
.
argtypes
=
[
ct
.
c_char_p
]
lib
.
bpf_detach_kprobe
.
argtypes
=
[
ct
.
c_char_p
]
lib
.
bpf_attach_uprobe
.
restype
=
ct
.
c_void_p
lib
.
bpf_attach_uprobe
.
restype
=
ct
.
c_void_p
lib
.
bpf_attach_uprobe
.
argtypes
=
[
ct
.
c_int
,
ct
.
c_int
,
ct
.
c_char_p
,
ct
.
c_char_p
,
lib
.
bpf_attach_uprobe
.
argtypes
=
[
ct
.
c_int
,
ct
.
c_int
,
ct
.
c_char_p
,
ct
.
c_char_p
,
ct
.
c_ulonglong
,
ct
.
c_int
,
ct
.
c_int
,
ct
.
c_int
,
_CB_TYPE
,
ct
.
py_object
]
ct
.
c_ulonglong
,
ct
.
c_int
,
_CB_TYPE
,
ct
.
py_object
]
lib
.
bpf_detach_uprobe
.
restype
=
ct
.
c_int
lib
.
bpf_detach_uprobe
.
restype
=
ct
.
c_int
lib
.
bpf_detach_uprobe
.
argtypes
=
[
ct
.
c_char_p
]
lib
.
bpf_detach_uprobe
.
argtypes
=
[
ct
.
c_char_p
]
lib
.
bpf_attach_tracepoint
.
restype
=
ct
.
c_void_p
lib
.
bpf_attach_tracepoint
.
restype
=
ct
.
c_void_p
lib
.
bpf_attach_tracepoint
.
argtypes
=
[
ct
.
c_int
,
ct
.
c_char_p
,
ct
.
c_char_p
,
ct
.
c_int
,
lib
.
bpf_attach_tracepoint
.
argtypes
=
[
ct
.
c_int
,
ct
.
c_char_p
,
ct
.
c_char_p
,
ct
.
c_int
,
ct
.
c_int
,
_CB_TYPE
,
ct
.
py_object
]
_CB_TYPE
,
ct
.
py_object
]
lib
.
bpf_detach_tracepoint
.
restype
=
ct
.
c_int
lib
.
bpf_detach_tracepoint
.
restype
=
ct
.
c_int
lib
.
bpf_detach_tracepoint
.
argtypes
=
[
ct
.
c_char_p
,
ct
.
c_char_p
]
lib
.
bpf_detach_tracepoint
.
argtypes
=
[
ct
.
c_char_p
,
ct
.
c_char_p
]
lib
.
bpf_open_perf_buffer
.
restype
=
ct
.
c_void_p
lib
.
bpf_open_perf_buffer
.
restype
=
ct
.
c_void_p
...
...
tests/python/test_trace1.py
View file @
120ac968
...
@@ -27,9 +27,9 @@ class TestKprobe(TestCase):
...
@@ -27,9 +27,9 @@ class TestKprobe(TestCase):
def
setUp
(
self
):
def
setUp
(
self
):
b
=
BPF
(
arg1
,
arg2
,
debug
=
0
)
b
=
BPF
(
arg1
,
arg2
,
debug
=
0
)
self
.
stats
=
b
.
get_table
(
"stats"
,
Key
,
Leaf
)
self
.
stats
=
b
.
get_table
(
"stats"
,
Key
,
Leaf
)
b
.
attach_kprobe
(
event
=
"sys_write"
,
fn_name
=
"sys_wr"
,
pid
=
0
,
cpu
=-
1
)
b
.
attach_kprobe
(
event
=
"sys_write"
,
fn_name
=
"sys_wr"
)
b
.
attach_kprobe
(
event
=
"sys_read"
,
fn_name
=
"sys_rd"
,
pid
=
0
,
cpu
=-
1
)
b
.
attach_kprobe
(
event
=
"sys_read"
,
fn_name
=
"sys_rd"
)
b
.
attach_kprobe
(
event
=
"htab_map_get_next_key"
,
fn_name
=
"sys_rd"
,
pid
=
0
,
cpu
=-
1
)
b
.
attach_kprobe
(
event
=
"htab_map_get_next_key"
,
fn_name
=
"sys_rd"
)
def
test_trace1
(
self
):
def
test_trace1
(
self
):
with
open
(
"/dev/null"
,
"a"
)
as
f
:
with
open
(
"/dev/null"
,
"a"
)
as
f
:
...
...
tests/python/test_trace2.py
View file @
120ac968
...
@@ -28,7 +28,7 @@ class TestTracingEvent(TestCase):
...
@@ -28,7 +28,7 @@ class TestTracingEvent(TestCase):
def
setUp
(
self
):
def
setUp
(
self
):
b
=
BPF
(
text
=
text
,
debug
=
0
)
b
=
BPF
(
text
=
text
,
debug
=
0
)
self
.
stats
=
b
.
get_table
(
"stats"
)
self
.
stats
=
b
.
get_table
(
"stats"
)
b
.
attach_kprobe
(
event
=
"finish_task_switch"
,
fn_name
=
"count_sched"
,
pid
=
0
,
cpu
=-
1
)
b
.
attach_kprobe
(
event
=
"finish_task_switch"
,
fn_name
=
"count_sched"
)
def
test_sched1
(
self
):
def
test_sched1
(
self
):
for
i
in
range
(
0
,
100
):
for
i
in
range
(
0
,
100
):
...
...
tests/python/test_trace3.py
View file @
120ac968
...
@@ -19,9 +19,9 @@ class TestBlkRequest(TestCase):
...
@@ -19,9 +19,9 @@ class TestBlkRequest(TestCase):
b
=
BPF
(
arg1
,
arg2
,
debug
=
0
)
b
=
BPF
(
arg1
,
arg2
,
debug
=
0
)
self
.
latency
=
b
.
get_table
(
"latency"
,
c_uint
,
c_ulong
)
self
.
latency
=
b
.
get_table
(
"latency"
,
c_uint
,
c_ulong
)
b
.
attach_kprobe
(
event
=
"blk_start_request"
,
b
.
attach_kprobe
(
event
=
"blk_start_request"
,
fn_name
=
"probe_blk_start_request"
,
pid
=-
1
,
cpu
=
0
)
fn_name
=
"probe_blk_start_request"
)
b
.
attach_kprobe
(
event
=
"blk_update_request"
,
b
.
attach_kprobe
(
event
=
"blk_update_request"
,
fn_name
=
"probe_blk_update_request"
,
pid
=-
1
,
cpu
=
0
)
fn_name
=
"probe_blk_update_request"
)
def
test_blk1
(
self
):
def
test_blk1
(
self
):
import
subprocess
import
subprocess
...
...
tools/deadlock_detector.py
View file @
120ac968
...
@@ -468,9 +468,7 @@ def main():
...
@@ -468,9 +468,7 @@ def main():
bpf
=
BPF
(
src_file
=
'deadlock_detector.c'
)
bpf
=
BPF
(
src_file
=
'deadlock_detector.c'
)
# Trace where threads are created
# Trace where threads are created
bpf
.
attach_kretprobe
(
bpf
.
attach_kretprobe
(
event
=
'sys_clone'
,
fn_name
=
'trace_clone'
)
event
=
'sys_clone'
,
fn_name
=
'trace_clone'
,
pid
=
args
.
pid
)
# We must trace unlock first, otherwise in the time we attached the probe
# We must trace unlock first, otherwise in the time we attached the probe
# on lock() and have not yet attached the probe on unlock(), a thread can
# on lock() and have not yet attached the probe on unlock(), a thread can
...
...
tools/funccount.py
View file @
120ac968
...
@@ -90,8 +90,7 @@ class Probe(object):
...
@@ -90,8 +90,7 @@ class Probe(object):
for
index
,
function
in
self
.
trace_functions
.
items
():
for
index
,
function
in
self
.
trace_functions
.
items
():
self
.
bpf
.
attach_kprobe
(
self
.
bpf
.
attach_kprobe
(
event
=
function
,
event
=
function
,
fn_name
=
"trace_count_%d"
%
index
,
fn_name
=
"trace_count_%d"
%
index
)
pid
=
self
.
pid
or
-
1
)
elif
self
.
type
==
"p"
and
self
.
library
:
elif
self
.
type
==
"p"
and
self
.
library
:
for
index
,
function
in
self
.
trace_functions
.
items
():
for
index
,
function
in
self
.
trace_functions
.
items
():
self
.
bpf
.
attach_uprobe
(
self
.
bpf
.
attach_uprobe
(
...
@@ -103,8 +102,7 @@ class Probe(object):
...
@@ -103,8 +102,7 @@ class Probe(object):
for
index
,
function
in
self
.
trace_functions
.
items
():
for
index
,
function
in
self
.
trace_functions
.
items
():
self
.
bpf
.
attach_tracepoint
(
self
.
bpf
.
attach_tracepoint
(
tp
=
function
,
tp
=
function
,
fn_name
=
"trace_count_%d"
%
index
,
fn_name
=
"trace_count_%d"
%
index
)
pid
=
self
.
pid
or
-
1
)
elif
self
.
type
==
"u"
:
elif
self
.
type
==
"u"
:
pass
# Nothing to do -- attach already happened in `load`
pass
# Nothing to do -- attach already happened in `load`
...
...
tools/stackcount.py
View file @
120ac968
...
@@ -90,13 +90,11 @@ class Probe(object):
...
@@ -90,13 +90,11 @@ class Probe(object):
self
.
matched
=
self
.
bpf
.
num_open_uprobes
()
self
.
matched
=
self
.
bpf
.
num_open_uprobes
()
else
:
else
:
self
.
bpf
.
attach_kprobe
(
event_re
=
self
.
pattern
,
self
.
bpf
.
attach_kprobe
(
event_re
=
self
.
pattern
,
fn_name
=
"trace_count"
,
fn_name
=
"trace_count"
)
pid
=
self
.
pid
or
-
1
)
self
.
matched
=
self
.
bpf
.
num_open_kprobes
()
self
.
matched
=
self
.
bpf
.
num_open_kprobes
()
elif
self
.
type
==
"t"
:
elif
self
.
type
==
"t"
:
self
.
bpf
.
attach_tracepoint
(
tp_re
=
self
.
pattern
,
self
.
bpf
.
attach_tracepoint
(
tp_re
=
self
.
pattern
,
fn_name
=
"trace_count"
,
fn_name
=
"trace_count"
)
pid
=
self
.
pid
or
-
1
)
self
.
matched
=
self
.
bpf
.
num_open_tracepoints
()
self
.
matched
=
self
.
bpf
.
num_open_tracepoints
()
elif
self
.
type
==
"u"
:
elif
self
.
type
==
"u"
:
pass
# Nothing to do -- attach already happened in `load`
pass
# Nothing to do -- attach already happened in `load`
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment