Derek [Tue, 7 Feb 2017 03:34:11 +0000 (19:34 -0800)]
switch bcc to use single instance per bcc process,
instance dir is bcc_pid, fixed issue #940
4ast [Mon, 6 Feb 2017 18:26:31 +0000 (10:26 -0800)]
Merge pull request #943 from edwardshao/topic/fix-docs-commit-link
docs: fix "BPF attached to sockets" commit link
Edward Shao [Mon, 6 Feb 2017 17:27:27 +0000 (01:27 +0800)]
docs: fix "BPF attached to sockets" commit link
4ast [Sun, 5 Feb 2017 16:24:37 +0000 (08:24 -0800)]
Merge pull request #937 from netoptimizer/for_upstream01
docs: keep track of when prealloc of map elements were introduced
Jesper Dangaard Brouer [Fri, 3 Feb 2017 07:46:48 +0000 (08:46 +0100)]
docs: keep track of when prealloc of map elements were introduced
Kernel v4.6-rc1~91^2~108^2~6
commit
6c9059817432 ("bpf: pre-allocate hash map elements")
Introduced default preallocation of mem elements to solve a deadlock
(when kprobe'ing the memory allocator itself).
This change is also a performance enhancement.
The commit also introduced a map_flags on BPF_MAP_CREATE, which can disable
this preallocation again BPF_F_NO_PREALLOC.
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Brenden Blanco [Fri, 3 Feb 2017 00:55:51 +0000 (16:55 -0800)]
Merge pull request #935 from wcohen/wcohen/lua_opt
Allow RPMS to be built on ppc64 and aarch64 by making luajit optional
William Cohen [Thu, 2 Feb 2017 22:24:32 +0000 (17:24 -0500)]
Allow RPMS to be built on ppc64 and aarch64 by making luajit optional
Not all architectures have luajit supported. The bcc configure and
build were already was set up to make the luajit dependent parts
optional. The bcc.spec now makes the luajit dependent parts optional
too allowing Fedora 25 builds on ppc64, ppc64le, and aarch64. This
change has been tested and allows the resulting srpm to build on the
Fedora koji build system for the newly added architectures.
Signed-off-by: William Cohen <wcohen@redhat.com>
4ast [Wed, 1 Feb 2017 18:21:16 +0000 (10:21 -0800)]
Merge pull request #928 from goldshtn/tp-data-loc
Support for __data_loc tracepoint fields
Sasha Goldshtein [Wed, 1 Feb 2017 09:57:01 +0000 (09:57 +0000)]
tplist: Don't ignore __data_loc fields
Sasha Goldshtein [Wed, 1 Feb 2017 09:39:12 +0000 (09:39 +0000)]
tests: Add test for TP_DATA_LOC_READ_CONST
Sasha Goldshtein [Wed, 1 Feb 2017 06:58:59 +0000 (06:58 +0000)]
cc: Support for __data_loc tracepoint fields
`__data_loc` fields are dynamically sized by the kernel at
runtime. The field data follows the tracepoint structure entry,
and needs to be extracted in a special way. The `__data_loc` field
itself is a 32-bit value that consists of two 16-bit parts: the
high 16 bits are the length of the data, and the low 16 bits are
the offset of the data from the beginning of the tracepoint
structure. From a cursory look, there are >200 tracepoints in
recent kernels that have this kind of field.
This patch fixes `tp_frontend_action.cc` to recognize and emit
`__data_loc` fields correctly, as 32-bit opaque fields. Then, it
introduces two helper macros:
`TP_DATA_LOC_READ(dst, field)` reads from `args->field` by finding
the right offset and length and emitting the `bpf_probe_read`
required to fetch the data. This will only work with new kernels.
`TP_DATA_LOC_READ_CONST(dst, field, length)` takes a user-specified
length rather than finding it from `args->field`. This will work
on older kernels, where the BPF verifier doesn't allow non-constant
sizes to be passed to `bpf_probe_read`.
4ast [Wed, 1 Feb 2017 04:39:09 +0000 (20:39 -0800)]
Merge pull request #918 from derek0883/mybcc
Handling multiple concurrent probe users.
Derek [Wed, 1 Feb 2017 03:28:10 +0000 (19:28 -0800)]
enum bpf_probe_attach_type to CAPITAL
Derek [Wed, 1 Feb 2017 02:22:24 +0000 (18:22 -0800)]
undo rebase
4ast [Tue, 31 Jan 2017 17:59:34 +0000 (09:59 -0800)]
Merge pull request #927 from rnav/powerpc-fixes
powerpc: update the build triplet
Naveen N. Rao [Tue, 31 Jan 2017 11:49:17 +0000 (17:19 +0530)]
powerpc: update the build triplet
The more commonly used triplet on ppc64le happens to be
powerpc64le-unknown-linux-gnu. The existing one causes problems in
certain build environments. Change this.
While at it, also include support for building on big endian.
Reported-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Derek [Tue, 31 Jan 2017 05:16:55 +0000 (21:16 -0800)]
Merge branch 'mybcc' of https://github.com/derek0883/bcc into mybcc
Derek [Tue, 31 Jan 2017 05:03:02 +0000 (21:03 -0800)]
keep 'enum bpf_attach_type' inside libbpf.h, renamed it to bpf_probe_attach_type
using static buf size in libbpf.c. for uprobe, set buf size to PATH_MAX
Derek [Sun, 29 Jan 2017 01:43:15 +0000 (17:43 -0800)]
Fixed test case test_trace4.py error
Derek [Sun, 29 Jan 2017 00:11:28 +0000 (16:11 -0800)]
Handling multiple concurrent probe users.
remove event_desc from front-end, handle it inside libbpf
Event naming pattern changed to $(eventname)_bcc_$(pid)
Derek [Thu, 26 Jan 2017 02:01:16 +0000 (18:01 -0800)]
rename event_name for lua
Derek [Tue, 24 Jan 2017 04:46:35 +0000 (20:46 -0800)]
rename event name in detach_uprobe/detach_uretprobe
Derek [Tue, 24 Jan 2017 04:32:59 +0000 (20:32 -0800)]
rename event name in detach_kprobe/detach_kretprobe
Derek [Mon, 23 Jan 2017 04:58:23 +0000 (20:58 -0800)]
Handling multiple concurrent probe users.
Event naming pattern changed to $(eventname)_bcc_$(pid)
Detect /sys/kernel/debug/tracing/instances in bpf_attach_probe,
if it exist, then will per-instance event, if failed the make global
event instance as same as before.
4ast [Mon, 30 Jan 2017 16:07:05 +0000 (08:07 -0800)]
Merge pull request #926 from goldshtn/argdist-pid-fix
argdist: Fix -p behavior to filter tgid and not pid
4ast [Mon, 30 Jan 2017 16:05:13 +0000 (08:05 -0800)]
Merge pull request #925 from goldshtn/cpudist-import-fix
cpudist: remove unused Tracepoint import
Sasha Goldshtein [Mon, 30 Jan 2017 11:08:12 +0000 (11:08 +0000)]
argdist: Fix -p behavior to filter tgid and not pid
argdist remained one of the last holdouts to use the `-p` switch
inconsistently with other tools, filtering for kernel pid (thread
id from user space perspective) and not kernel tgid (process id
from user space perspective). This is now fixed.
Additionally, minor nits around generating pid filters were fixed,
and a potential collision with user-provided argument names was
fixed too (in general, script-generated arguments/locals should
probably stick to reserved identifiers, such as `__whatever` rather
than `whatever`).
Sasha Goldshtein [Mon, 30 Jan 2017 07:40:42 +0000 (07:40 +0000)]
cpudist: remove unused Tracepoint import
Derek [Sun, 29 Jan 2017 01:43:15 +0000 (17:43 -0800)]
Fixed test case test_trace4.py error
Derek [Sun, 29 Jan 2017 00:11:28 +0000 (16:11 -0800)]
Handling multiple concurrent probe users.
remove event_desc from front-end, handle it inside libbpf
Event naming pattern changed to $(eventname)_bcc_$(pid)
Derek [Thu, 26 Jan 2017 02:01:16 +0000 (18:01 -0800)]
rename event_name for lua
Derek [Tue, 24 Jan 2017 04:46:35 +0000 (20:46 -0800)]
rename event name in detach_uprobe/detach_uretprobe
Derek [Tue, 24 Jan 2017 04:32:59 +0000 (20:32 -0800)]
rename event name in detach_kprobe/detach_kretprobe
Derek [Mon, 23 Jan 2017 04:58:23 +0000 (20:58 -0800)]
Handling multiple concurrent probe users.
Event naming pattern changed to $(eventname)_bcc_$(pid)
Detect /sys/kernel/debug/tracing/instances in bpf_attach_probe,
if it exist, then will per-instance event, if failed the make global
event instance as same as before.
4ast [Sun, 22 Jan 2017 17:34:21 +0000 (09:34 -0800)]
Merge pull request #913 from iovisor/python23_percpu
Fix python2/3 incompatible percpu helpers
Brenden Blanco [Fri, 20 Jan 2017 23:35:36 +0000 (15:35 -0800)]
Skip percpu testing on unsupported kernels
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
Brenden Blanco [Fri, 20 Jan 2017 23:34:36 +0000 (15:34 -0800)]
Support for hotplug cpu cases in percpu array sizing
The kernel uses number of possible cpus to size the leaf, not the num of
online cpus. Fixup the python side appropriately.
Update: use num_possible_cpus() helper instead
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
Brenden Blanco [Wed, 18 Jan 2017 17:02:59 +0000 (09:02 -0800)]
Fix python2/3 incompatible percpu helpers
The python3 version of the percpu helpers (average, sum, etc.) were
using a python2 function that has since moved to functools (reduce).
Worse, the test case for percpu functionality was not enabled in the
cmake file. Better turn that on and make it work.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
4ast [Fri, 20 Jan 2017 17:33:46 +0000 (09:33 -0800)]
Merge pull request #914 from mkacik/master
[tools][memleak.py] add parameter for specifying object to load malloc/free from
Maria Kacik [Thu, 19 Jan 2017 05:43:41 +0000 (21:43 -0800)]
[memleak] add parameter for specifying object to load malloc/free from
4ast [Tue, 17 Jan 2017 19:06:38 +0000 (11:06 -0800)]
Merge pull request #911 from goldshtn/trace-params-signature
trace: Allow function signatures in uprobes and kprobes
4ast [Tue, 17 Jan 2017 19:04:41 +0000 (11:04 -0800)]
Merge pull request #909 from goldshtn/tp-str-fixes
trace, tplist, argdist: UDST probe miscellaneous fixes
Sasha Goldshtein [Tue, 17 Jan 2017 08:49:36 +0000 (08:49 +0000)]
trace: Allow function signatures in uprobes and kprobes
§`trace` now allows uprobes and kprobes to have function signatures,
which means function parameters can be named and typed, rather than
relying on the positional arg1, arg2, etc. arguments. This also
enables structure field access, which is impossible with the unnamed
arguments due to rewriter limitations.
The example requested by @brendangregg, which now works, is the
following:
§Â```
PID TID COMM FUNC -
777 785 automount SyS_nanosleep sleep for
500000000 ns
777 785 automount SyS_nanosleep sleep for
500000000 ns
777 785 automount SyS_nanosleep sleep for
500000000 ns
777 785 automount SyS_nanosleep sleep for
500000000 ns
^C
```
Sasha Goldshtein [Tue, 17 Jan 2017 07:40:57 +0000 (07:40 +0000)]
trace, argdist: Fix code formatting nits
Sasha Goldshtein [Mon, 16 Jan 2017 18:43:11 +0000 (18:43 +0000)]
trace: Use correct argument index and tgid for filters
`trace` would use the incorrect argument index for USDT probes when
filtering specifically, e.g. `trace u:lib:tp (arg1 != 0) ...` would
actually use the type of the 2nd argument, and not the 1st argument
for the type of the filter variable in the generated program. This
could cause compilation errors or subtle bugs where the data would
be either extended or contracted to fit the wrong argument's type.
Additionally, `trace` would use the pid (thread id, `-L`) filter
with the `attach_uprobe` API, which expects a tgid (process id).
As a result, incorrect filtering would happen.
Sasha Goldshtein [Mon, 16 Jan 2017 18:41:22 +0000 (18:41 +0000)]
trace: Generated streq-helper to ignore null terminator
Sasha Goldshtein [Mon, 16 Jan 2017 18:38:30 +0000 (18:38 +0000)]
argdist: Generated streq-helper to ignore null terminator
Oftentimes we want to use the STRCMP helper to compare strings that
are not null-terminated, e.g. in USDT probes this often happens.
Ignore the null terminator (i.e. loop until the last character
excluding the null terminator).
Sasha Goldshtein [Mon, 16 Jan 2017 18:36:52 +0000 (18:36 +0000)]
tplist: Print one-based location and argument indices
The `trace` and `argdist` tools expect location and argument indices
to start at 1 -- the first argument is arg1, and so on. The `tplist`
tool now prints UDST argument indices (and location indices, for
consistency) as 1-based as well.
4ast [Tue, 17 Jan 2017 01:24:17 +0000 (17:24 -0800)]
Merge pull request #875 from pchaigno/target-process-library
Use targeted process to resolve library names
4ast [Mon, 16 Jan 2017 21:35:04 +0000 (13:35 -0800)]
Merge pull request #908 from Catalysts/cpu-iteration
fix iteration over CPUs
Andreas Gerstmayr [Mon, 16 Jan 2017 15:35:58 +0000 (16:35 +0100)]
fix iteration over CPUs
Since kernel version 4.9.0 BPF stopped working in a KVM guest.
The problem are calls to perf_event_open with CPU identifiers which do
not exist (ENODEV). The root cause for this is that the current code
assumes ascending numbered CPUs. However, this is not always the case
(e.g. CPU hotplugging).
This patch introduces the get_online_cpus() and get_possible_cpus()
helper functions and uses the appropriate function for iterations over
CPUs. The BPF_MAP_TYPE_PERF_EVENT_ARRAY map contains now an entry for
each possible CPU instead of for each online CPU.
Fixes: #893
Signed-off-by: Andreas Gerstmayr <andreas.gerstmayr@catalysts.cc>
Brendan Gregg [Mon, 16 Jan 2017 11:13:39 +0000 (03:13 -0800)]
Merge pull request #906 from goldshtn/valid-idents
argdist, trace: Support non-C identifier names
Paul Chaignon [Sun, 15 Jan 2017 09:11:42 +0000 (10:11 +0100)]
cc: Dynamically allocate memory for library path
Paul Chaignon [Fri, 13 Jan 2017 22:37:28 +0000 (23:37 +0100)]
cc: Use PID to detach uprobes
We need the PID when detaching uprobes to resolve library names
to the same path as when attaching
Paul Chaignon [Sun, 25 Dec 2016 18:43:41 +0000 (19:43 +0100)]
cc: Resolve library names using loaded libraries
To resolve library names, bcc_procutils_which_so leverages mapped
libraries of the targeted process, if one is given. Uses the kernel's
/proc/$pid/maps
Sasha Goldshtein [Sat, 14 Jan 2017 11:17:40 +0000 (11:17 +0000)]
argdist, trace: Support non-C identifier names
When argdist or trace face a function that has characters
in its name that are not valid in C identifier, they now
replace these characters with an underscore (`_`) when
generating function names and structure names to include
in the BPF program. As a result, it is now possible to
trace functions that have these identifiers in their names,
such as Golang functions like `fmt.Println`.
4ast [Fri, 13 Jan 2017 23:36:53 +0000 (15:36 -0800)]
Merge pull request #904 from brendangregg/master
add some error hints
Brendan Gregg [Fri, 13 Jan 2017 22:02:02 +0000 (14:02 -0800)]
add some error hints
4ast [Wed, 11 Jan 2017 18:47:47 +0000 (10:47 -0800)]
Merge pull request #899 from brendangregg/tool2
profile: increase unique stack default to 10k
4ast [Wed, 11 Jan 2017 18:40:47 +0000 (10:40 -0800)]
Merge pull request #896 from brendangregg/tool1
trace: allow tracing of functions containing a dot (golang)
4ast [Wed, 11 Jan 2017 18:40:19 +0000 (10:40 -0800)]
Merge pull request #897 from brendangregg/master
statsnoop: refactor
Brendan Gregg [Wed, 11 Jan 2017 17:40:49 +0000 (09:40 -0800)]
profile: increase unique stack default to 10k
Brendan Gregg [Wed, 11 Jan 2017 06:31:30 +0000 (22:31 -0800)]
statsnoop: refactor
4ast [Wed, 11 Jan 2017 05:28:55 +0000 (21:28 -0800)]
Merge pull request #895 from brendangregg/master
gethostlatency: remove unused code
Brendan Gregg [Wed, 11 Jan 2017 04:39:07 +0000 (20:39 -0800)]
trace: allow tracing of functions containing a dot (golang)
Brendan Gregg [Wed, 11 Jan 2017 04:31:06 +0000 (20:31 -0800)]
gethostlatency: remove unused code
4ast [Wed, 11 Jan 2017 02:04:41 +0000 (18:04 -0800)]
Merge pull request #894 from brendangregg/master
add a few funccount examples
Brendan Gregg [Wed, 11 Jan 2017 01:36:07 +0000 (17:36 -0800)]
add a few funccount examples
4ast [Mon, 9 Jan 2017 20:40:46 +0000 (12:40 -0800)]
Merge pull request #883 from ColinIanKing/master
snapcraft: add cpuunclaimed to snapcraft wrapper rules
4ast [Mon, 9 Jan 2017 20:23:40 +0000 (12:23 -0800)]
Merge pull request #890 from mvbpolito/add_helpers
Add missing helper prototypes
4ast [Mon, 9 Jan 2017 20:23:22 +0000 (12:23 -0800)]
Merge pull request #889 from totally/preprocess_4.10
Fixes bio{snoop,top} on 4.10
Mauricio Vasquez B [Mon, 9 Jan 2017 02:26:32 +0000 (21:26 -0500)]
Add missing helpers prototypes in helpers.h
Signed-off-by: Mauricio Vasquez B <mauricio.vasquez@polito.it>
Ryan Leary [Sat, 7 Jan 2017 20:34:31 +0000 (15:34 -0500)]
Fixes bio{snoop,top} on 4.10.
This commit fixes #888. The 2 scripts run the same check, and now run
basically the same code to do it.
Tested on 4.10-rc2.
Brenden Blanco [Sat, 7 Jan 2017 19:16:59 +0000 (11:16 -0800)]
Merge pull request #887 from rneugeba/cflags
Add -fno-stack-protector to CFLAGS
Rolf Neugebauer [Sat, 7 Jan 2017 14:05:15 +0000 (14:05 +0000)]
Add -fno-stack-protector to CFLAGS
When compiling ebpf programs on Alpine Linux the compiler throws the following
error:
LLVM ERROR: Cannot select: 0x56049b79dcb0: ch,glue = BPFISD::CALL 0x56049a93ad60, TargetExternalSymbol:i64'__stack_chk_fail'
0x56049b391500: i64 = TargetExternalSymbol'__stack_chk_fail'
In function: waker
Disabling the stack protector explicitly with '-fno-stack-protector'
fixes this error.
clang version 3.8.1 (tags/RELEASE_381/final)
Target: x86_64-alpine-linux-musl
Thread model: posix
InstalledDir: /usr/bin
Signed-off-by: Rolf Neugebauer <rolf.neugebauer@docker.com>
Brenden Blanco [Thu, 5 Jan 2017 22:50:07 +0000 (14:50 -0800)]
Merge pull request #882 from mvbpolito/master
add missing inclusion guards in bcc/proto.h
Brenden Blanco [Thu, 5 Jan 2017 19:35:37 +0000 (11:35 -0800)]
Merge branch 'master' into master
4ast [Thu, 5 Jan 2017 19:35:13 +0000 (11:35 -0800)]
Merge pull request #886 from iovisor/llvm_40_fixes
Fixes for LLVM 4.0 and python3
Brenden Blanco [Thu, 5 Jan 2017 19:13:12 +0000 (11:13 -0800)]
Fixes for LLVM 4.0 and python3
Avoid conflicting [no]inline attributes in function annotation. This was
probably always there but now 4.0 is treating this as an error.
Also, explicitly inline several functions in helpers.h.
Turn off unwind tables in the flags passed to clang. This was generating
calls to the elf relocator, which doesn't work for the BPF target. It is
unclear which change in LLVM 4.0 altered this behavior.
On python3, handle byte strings in the usual way for supporting
backwards compatibility.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
Colin Ian King [Thu, 5 Jan 2017 15:54:29 +0000 (15:54 +0000)]
snapcraft.yaml: fix typo in ttysnoop wrapper
fix stupid typo in wrapper: ttysnop -> ttysnoop
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Colin Ian King [Thu, 5 Jan 2017 16:06:52 +0000 (16:06 +0000)]
snapcraft: add cpuunclaimed to snapcraft wrapper rules
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Brenden Blanco [Tue, 3 Jan 2017 15:34:45 +0000 (07:34 -0800)]
Merge pull request #878 from iovisor/compat-4.10-update
Update [virtual_]bpf.h to 4.10
Mauricio Vasquez B [Mon, 2 Jan 2017 20:49:27 +0000 (15:49 -0500)]
add missing inclusion guards in bcc/proto.h
Signed-off-by: Mauricio Vasquez B <mauricio.vasquez@polito.it>
Brenden Blanco [Thu, 29 Dec 2016 23:55:07 +0000 (15:55 -0800)]
Use compat bpf_common.h for local clang build
Only the virtual_bpf.h should point to the installed kernel headers.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
Brenden Blanco [Thu, 29 Dec 2016 23:40:59 +0000 (15:40 -0800)]
Update [virtual_]bpf.h to 4.10
As is occassionally necessary, we need to update the compat header
files for new kernels. This picks up the bpf.h from 4.10rc1.
Fixes: #877
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
4ast [Wed, 28 Dec 2016 04:34:24 +0000 (20:34 -0800)]
Merge pull request #874 from pchaigno/fix-var
Fix variable names in exceptions
Paul Chaignon [Mon, 26 Dec 2016 15:01:19 +0000 (16:01 +0100)]
Fix variable name
4ast [Thu, 22 Dec 2016 01:01:29 +0000 (17:01 -0800)]
Merge pull request #870 from brendangregg/master
add cpuunclaimed
Brendan Gregg [Wed, 21 Dec 2016 23:35:36 +0000 (15:35 -0800)]
fix comment in runqlen
Brendan Gregg [Wed, 21 Dec 2016 23:34:09 +0000 (15:34 -0800)]
add cpuunclaimed
4ast [Wed, 21 Dec 2016 18:32:40 +0000 (10:32 -0800)]
Merge pull request #835 from ColinIanKing/master
Add snapcraft script to package up bcc as a snap
4ast [Wed, 21 Dec 2016 16:30:36 +0000 (08:30 -0800)]
Merge pull request #867 from shodoco/extern
Don't close extern table when a module destructs
Huapeng Zhou [Wed, 21 Dec 2016 06:47:51 +0000 (22:47 -0800)]
fix company copyright
4ast [Wed, 21 Dec 2016 06:41:13 +0000 (22:41 -0800)]
Merge pull request #868 from shodoco/pin
add bpf_obj_pin/bpf_obj_get to pin/get bpf objects
Huapeng Zhou [Tue, 20 Dec 2016 21:42:01 +0000 (13:42 -0800)]
add bpf_obj_pin/bpf_obj_get to pin/get bpf objects
Huapeng Zhou [Tue, 20 Dec 2016 21:10:12 +0000 (13:10 -0800)]
do not close extern table when a module destructs
Huapeng Zhou [Tue, 20 Dec 2016 21:06:29 +0000 (13:06 -0800)]
add table type to shared tables
Brenden Blanco [Tue, 20 Dec 2016 08:12:46 +0000 (00:12 -0800)]
Merge pull request #863 from shodoco/master
support macro in call arguments
shodoco [Mon, 19 Dec 2016 19:04:56 +0000 (11:04 -0800)]
Merge branch 'master' into master
4ast [Mon, 19 Dec 2016 18:58:59 +0000 (10:58 -0800)]
Merge pull request #865 from goldshtn/trace-timestamp
trace: -L, -t, -T switches