Commit ed21adfc authored by Sasha Goldshtein's avatar Sasha Goldshtein

Added optional label, fixed inline examples

parent 85384852
...@@ -31,7 +31,10 @@ int PROBENAME(struct pt_regs *ctx SIGNATURE) ...@@ -31,7 +31,10 @@ int PROBENAME(struct pt_regs *ctx SIGNATURE)
def __init__(self, type, specifier, pid): def __init__(self, type, specifier, pid):
self.raw_spec = specifier self.raw_spec = specifier
parts = specifier.strip().split(':') spec_and_label = specifier.split(';')
self.label = spec_and_label[1] \
if len(spec_and_label) == 2 else None
parts = spec_and_label[0].strip().split(':')
if len(parts) < 3 or len(parts) > 6: if len(parts) < 3 or len(parts) > 6:
raise ValueError("invalid specifier format") raise ValueError("invalid specifier format")
self.type = type # hist or freq self.type = type # hist or freq
...@@ -139,7 +142,7 @@ bpf_probe_read(&__key.key, sizeof(__key.key), %s); ...@@ -139,7 +142,7 @@ bpf_probe_read(&__key.key, sizeof(__key.key), %s);
fn_name=self.probe_func_name) fn_name=self.probe_func_name)
def display(self): def display(self):
print(self.raw_spec) print(self.label or self.raw_spec)
data = self.bpf.get_table(self.probe_hash_name) data = self.bpf.get_table(self.probe_hash_name)
if self.type == "freq": if self.type == "freq":
print("\t%-10s %s" % ("COUNT", "EVENT")) print("\t%-10s %s" % ("COUNT", "EVENT"))
...@@ -165,7 +168,7 @@ bpf_probe_read(&__key.key, sizeof(__key.key), %s); ...@@ -165,7 +168,7 @@ bpf_probe_read(&__key.key, sizeof(__key.key), %s);
examples = """ examples = """
Probe specifier syntax: Probe specifier syntax:
{p,r}:[library]:function(signature)[:type:expr[:filter]] {p,r}:[library]:function(signature)[:type:expr[:filter]][;label]
Where: Where:
p,r -- probe at function entry or at function exit p,r -- probe at function entry or at function exit
in exit probes, only $retval is accessible in exit probes, only $retval is accessible
...@@ -175,43 +178,44 @@ Where: ...@@ -175,43 +178,44 @@ Where:
signature -- the function's parameters, as in the C header signature -- the function's parameters, as in the C header
type -- the type of the expression to collect type -- the type of the expression to collect
expr -- the expression to collect expr -- the expression to collect
filter -- a filter that is applied to collected values filter -- the filter that is applied to collected values
label -- the label for this probe in the resulting output
EXAMPLES: EXAMPLES:
argdist.py -H "p::__kmalloc(u64 size):u64:size" argdist.py -H 'p::__kmalloc(u64 size):u64:size'
Print a histogram of allocation sizes passed to kmalloc Print a histogram of allocation sizes passed to kmalloc
argdist.py -p 1005 -C "p:c:malloc(size_t size):size_t:size:size==16" argdist.py -p 1005 -C 'p:c:malloc(size_t size):size_t:size:size==16'
Print a frequency count of how many times process 1005 called malloc Print a frequency count of how many times process 1005 called malloc
with an allocation size of 16 bytes with an allocation size of 16 bytes
argdist.py -C "r:c:gets():char*:@retval" argdist.py -C 'r:c:gets():char*:$retval;snooped strings'
Snoop on all strings returned by gets() Snoop on all strings returned by gets()
argdist.py -p 1005 -C "p:c:write(int fd):int:fd" argdist.py -p 1005 -C 'p:c:write(int fd):int:fd'
Print frequency counts of how many times writes were issued to a Print frequency counts of how many times writes were issued to a
particular file descriptor number, in process 1005 particular file descriptor number, in process 1005
argdist.py -p 1005 -H "r:c:read()" argdist.py -p 1005 -H 'r:c:read()'
Print a histogram of error codes returned by read() in process 1005 Print a histogram of error codes returned by read() in process 1005
argdist.py -H \\ argdist.py -H \\
"p:c:write(int fd, const void *buf, size_t count):size_t:count:fd==1" 'p:c:write(int fd, const void *buf, size_t count):size_t:count:fd==1'
Print a histogram of buffer sizes passed to write() across all Print a histogram of buffer sizes passed to write() across all
processes, where the file descriptor was 1 (STDOUT) processes, where the file descriptor was 1 (STDOUT)
argdist.py -C "p:c:fork()" argdist.py -C 'p:c:fork();fork calls'
Count fork() calls in libc across all processes Count fork() calls in libc across all processes
Can also use funccount.py, which is easier and more flexible Can also use funccount.py, which is easier and more flexible
argdist.py \\ argdist.py \\
-H "p:c:sleep(u32 seconds):u32:seconds" \\ -H 'p:c:sleep(u32 seconds):u32:seconds' \\
-H "p:c:nanosleep(struct timespec { time_t tv_sec; long tv_nsec; } *req):long:req->tv_nsec" -H 'p:c:nanosleep(struct timespec { time_t tv_sec; long tv_nsec; } *req):long:req->tv_nsec'
Print histograms of sleep() and nanosleep() parameter values Print histograms of sleep() and nanosleep() parameter values
argdist.py -p 2780 -z 120 \\ argdist.py -p 2780 -z 120 \\
-C "p:c:write(int fd, char* buf, size_t len):char*:buf:fd==1" -C 'p:c:write(int fd, char* buf, size_t len):char*:buf:fd==1'
Spy on writes to STDOUT performed by process 2780, up to a string size Spy on writes to STDOUT performed by process 2780, up to a string size
of 120 characters of 120 characters
""" """
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment