Merge pull request #158 from kinvolk/alban/filter_cgroup

Add filter by cgroup-v2 id

README.md

@@ -130,6 +130,9 @@ bpftrace -e 'hardware:cache-misses:1000000 { @[comm, pid] = count(); }'
 
 # Profile user-level stacks at 99 Hertz, for PID 189:
 bpftrace -e 'profile:hz:99 /pid == 189/ { @[ustack] = count(); }'
+
+# Files opened, for processes in the root cgroup-v2
+bpftrace -e 'tracepoint:syscalls:sys_enter_open /cgroup == 0x100000001/ { printf("%s\n", str(args->filename)); }'
 ```
 
 ## Tools
@@ -234,6 +237,7 @@ The following variables and functions are available for use in bpftrace scripts:
 Variables:
 - `pid` - Process ID (kernel tgid)
 - `tid` - Thread ID (kernel pid)
+- `cgroup` - Cgroup ID of the current process
 - `uid` - User ID
 - `gid` - Group ID
 - `nsecs` - Nanosecond timestamp

src/ast/codegen_llvm.cpp

@@ -54,6 +54,10 @@ void CodegenLLVM::visit(Builtin &builtin)
       expr_ = b_.CreateAnd(pidtgid, 0xffffffff);
     }
   }
+  else if (builtin.ident == "cgroup")
+  {
+    expr_ = b_.CreateGetCurrentCgroupId();
+  }
   else if (builtin.ident == "uid" || builtin.ident == "gid" || builtin.ident == "username")
   {
     Value *uidgid = b_.CreateGetUidGid();

src/ast/irbuilderbpf.cpp

@@ -411,6 +411,19 @@ CallInst *IRBuilderBPF::CreateGetPidTgid()
   return CreateCall(getpidtgid_func, {}, "get_pid_tgid");
 }
 
+CallInst *IRBuilderBPF::CreateGetCurrentCgroupId()
+{
+  // u64 bpf_get_current_cgroup_id(void)
+  // Return: 64-bit cgroup-v2 id
+  FunctionType *getcgroupid_func_type = FunctionType::get(getInt64Ty(), false);
+  PointerType *getcgroupid_func_ptr_type = PointerType::get(getcgroupid_func_type, 0);
+  Constant *getcgroupid_func = ConstantExpr::getCast(
+      Instruction::IntToPtr,
+      getInt64(BPF_FUNC_get_current_cgroup_id),
+      getcgroupid_func_ptr_type);
+  return CreateCall(getcgroupid_func, {}, "get_cgroup_id");
+}
+
 CallInst *IRBuilderBPF::CreateGetUidGid()
 {
   // u64 bpf_get_current_uid_gid(void)

src/ast/irbuilderbpf.h

@@ -38,6 +38,7 @@ public:
   Value      *CreateStrcmp(Value* val, std::string str, bool inverse=false);
   CallInst   *CreateGetNs();
   CallInst   *CreateGetPidTgid();
+  CallInst   *CreateGetCurrentCgroupId();
   CallInst   *CreateGetUidGid();
   CallInst   *CreateGetCpuId();
   CallInst   *CreateGetCurrentTask();

src/ast/semantic_analyser.cpp

@@ -31,6 +31,7 @@ void SemanticAnalyser::visit(Builtin &builtin)
   if (builtin.ident == "nsecs" ||
       builtin.ident == "pid" ||
       builtin.ident == "tid" ||
+      builtin.ident == "cgroup" ||
       builtin.ident == "uid" ||
       builtin.ident == "gid" ||
       builtin.ident == "cpu" ||

src/lexer.l

@@ -48,7 +48,7 @@ path   :(\\.|[_\-\./a-zA-Z0-9])*:
 <COMMENT>"*/"           BEGIN(INITIAL);
 <COMMENT>"EOF"          driver.error(loc, std::string("end of file during comment"));
 
-pid|tid|uid|gid|nsecs|cpu|comm|stack|ustack|arg[0-9]|retval|func|name|curtask|rand|ctx|username|args {
+pid|tid|cgroup|uid|gid|nsecs|cpu|comm|stack|ustack|arg[0-9]|retval|func|name|curtask|rand|ctx|username|args {
                           return Parser::make_BUILTIN(yytext, loc); }
 {path}                  { return Parser::make_PATH(yytext, loc); }
 {map}                   { return Parser::make_MAP(yytext, loc); }

tests/parser.cpp

@@ -25,6 +25,7 @@ TEST(Parser, builtin_variables)
 {
   test("kprobe:f { pid }", "Program\n kprobe:f\n  builtin: pid\n");
   test("kprobe:f { tid }", "Program\n kprobe:f\n  builtin: tid\n");
+  test("kprobe:f { cgroup }", "Program\n kprobe:f\n  builtin: cgroup\n");
   test("kprobe:f { uid }", "Program\n kprobe:f\n  builtin: uid\n");
   test("kprobe:f { username }", "Program\n kprobe:f\n  builtin: username\n");
   test("kprobe:f { gid }", "Program\n kprobe:f\n  builtin: gid\n");

tests/semantic_analyser.cpp

@@ -48,6 +48,7 @@ TEST(semantic_analyser, builtin_variables)
 {
   test("kprobe:f { pid }", 0);
   test("kprobe:f { tid }", 0);
+  test("kprobe:f { cgroup }", 0);
   test("kprobe:f { uid }", 0);
   test("kprobe:f { username }", 0);
   test("kprobe:f { gid }", 0);