Brenden Blanco [Fri, 6 Nov 2015 07:31:22 +0000 (23:31 -0800)]
Add perf_output support for high rate events
This adds support for the bpf_perf_event_output command. This is
intended for per-process events from bpf to userspace at high rate. The
events from the bpf program can be completely customized.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Thu, 5 Nov 2015 22:04:56 +0000 (14:04 -0800)]
Update compat bpf.h with 4.4 features
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Thu, 5 Nov 2015 21:28:32 +0000 (13:28 -0800)]
Change indentation in bpf/helpers.h
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
yonghong-song [Wed, 4 Nov 2015 22:00:50 +0000 (14:00 -0800)]
Merge pull request #280 from iovisor/bblanco_dev
Reorganize examples into subdirectories
Brenden Blanco [Thu, 29 Oct 2015 23:58:23 +0000 (08:58 +0900)]
Reorganize examples into subdirectories
Examples directory has been growing, so add a bit of organization.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
4ast [Sat, 24 Oct 2015 16:05:10 +0000 (09:05 -0700)]
Merge pull request #279 from iovisor/bblanco_dev
Bump ulimit for locked memory in test wrapper
Brenden Blanco [Sat, 24 Oct 2015 15:59:53 +0000 (08:59 -0700)]
Bump ulimit for locked memory in test wrapper
This follows from a change in upstream kernel for counting bpf maps
against the locked memory limit.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Fri, 23 Oct 2015 15:37:55 +0000 (08:37 -0700)]
Merge pull request #278 from SomaLDEN/drzix
Python: fix detach_kprobe()
Dr.Z [Fri, 23 Oct 2015 09:59:10 +0000 (18:59 +0900)]
Python: fix detach_kprobe()
As open_kprobes contains not fd but pointer to struct perf_reader,
it should call lib.perf_reader_free() instead of os.close()
Brenden Blanco [Wed, 21 Oct 2015 14:30:24 +0000 (07:30 -0700)]
Merge pull request #277 from SomaLDEN/drzix
perf_reader: allow more than one reader to poll
Dr.Z [Wed, 21 Oct 2015 12:52:10 +0000 (21:52 +0900)]
perf_reader: allow more than one reader to poll
When more than one events are used with attach_kprobe, the
perf_reader_poll() will segfault by buffer overflow like below.
*** buffer overflow detected ***: python terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x7338f)[0x7fcc971fb38f]
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x7fcc97292c9c]
/lib/x86_64-linux-gnu/libc.so.6(+0x109b60)[0x7fcc97291b60]
/lib/x86_64-linux-gnu/libc.so.6(+0x10ac04)[0x7fcc97292c04]
/usr/lib/x86_64-linux-gnu/libbcc.so(perf_reader_poll+0x42)[0x7fcc93969cc2]
/usr/lib/x86_64-linux-gnu/libffi.so.6(ffi_call_unix64+0x4c)[0x7fcc95c2badc]
/usr/lib/x86_64-linux-gnu/libffi.so.6(ffi_call+0x1fc)[0x7fcc95c2b40c]
/usr/lib/python2.7/lib-dynload/_ctypes.x86_64-linux-gnu.so(_ctypes_callproc+0x48e)[0x7fcc95e425fe]
/usr/lib/python2.7/lib-dynload/_ctypes.x86_64-linux-gnu.so(+0x15f9e)[0x7fcc95e43f9e]
python(PyEval_EvalFrameEx+0x965)[0x499be5]
python(PyEval_EvalCodeEx+0x2ac)[0x4a090c]
python(PyEval_EvalFrameEx+0x7d2)[0x499a52]
python[0x4a1634]
python(PyRun_FileExFlags+0x92)[0x44e4a5]
python(PyRun_SimpleFileExFlags+0x2ee)[0x44ec9f]
python(Py_Main+0xb5e)[0x44f904]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7fcc971a9ec5]
python[0x578c4e]
Brenden Blanco [Wed, 21 Oct 2015 00:34:03 +0000 (17:34 -0700)]
Merge pull request #276 from brendangregg/master
softirq and hardirq
Brendan Gregg [Tue, 20 Oct 2015 22:52:23 +0000 (15:52 -0700)]
softirq and hardirq
Brenden Blanco [Fri, 16 Oct 2015 04:06:01 +0000 (21:06 -0700)]
Merge pull request #274 from brendangregg/master
tcpconnect for IPv4 and IPv6, and make tcpv4connect a trimmed example
Brendan Gregg [Fri, 16 Oct 2015 00:22:32 +0000 (17:22 -0700)]
refer to tcpconnect
Brendan Gregg [Fri, 16 Oct 2015 00:21:32 +0000 (17:21 -0700)]
tcpconnect for IPv4 and IPv6, and make tcpv4connect a trimmed example
Brenden Blanco [Wed, 14 Oct 2015 14:48:12 +0000 (07:48 -0700)]
Merge pull request #272 from SomaLDEN/poll_timeout
perf_reader : add timeout argument to perf_reader_poll
SunKyu [Wed, 14 Oct 2015 11:47:05 +0000 (04:47 -0700)]
perf_reader : add timeout argument to perf_reader_poll
Brenden Blanco [Tue, 13 Oct 2015 23:44:22 +0000 (16:44 -0700)]
Merge pull request #271 from brendangregg/master
tcpaccept
Brendan Gregg [Tue, 13 Oct 2015 23:35:25 +0000 (16:35 -0700)]
filter to match TCP only
Brendan Gregg [Tue, 13 Oct 2015 22:41:46 +0000 (15:41 -0700)]
USAGE message typos
Brendan Gregg [Tue, 13 Oct 2015 22:35:58 +0000 (15:35 -0700)]
tcpaccept
4ast [Mon, 12 Oct 2015 18:51:53 +0000 (11:51 -0700)]
Merge pull request #268 from iovisor/bblanco_dev
Fixes for deb/rpm packaging
Brenden Blanco [Mon, 12 Oct 2015 18:13:48 +0000 (11:13 -0700)]
Fixes for deb/rpm packaging
These fixes are manually included in the released 0.1.7 packages, but
will help with future builds.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
4ast [Mon, 12 Oct 2015 16:59:13 +0000 (09:59 -0700)]
Merge pull request #267 from iovisor/bblanco_dev
Update tag to v0.1.7
Brenden Blanco [Mon, 12 Oct 2015 16:31:03 +0000 (09:31 -0700)]
Update tag to v0.1.7
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Mon, 12 Oct 2015 16:45:03 +0000 (09:45 -0700)]
Merge pull request #265 from iovisor/yhs_dev
handle return value in kretprobe handler for tcpv4connect
Brenden Blanco [Thu, 8 Oct 2015 17:10:29 +0000 (10:10 -0700)]
Merge pull request #264 from iovisor/yhs_dev
Fix an uninitialized variable access in test_clang
Yonghong Song [Wed, 7 Oct 2015 15:59:42 +0000 (08:59 -0700)]
handle return value in kretprobe handler for tcpv4connect
Signed-off-by: Yonghong Song <yhs@plumgrid.com>
Yonghong Song [Wed, 7 Oct 2015 12:16:15 +0000 (05:16 -0700)]
Fix an uninitialized variable access in test_clang
Signed-off-by: Yonghong Song <yhs@plumgrid.com>
4ast [Tue, 6 Oct 2015 21:16:08 +0000 (14:16 -0700)]
Merge pull request #262 from iovisor/bblanco_dev
Make KeyboardInterrupt catch more aggressive
Brenden Blanco [Tue, 6 Oct 2015 21:08:03 +0000 (14:08 -0700)]
Make KeyboardInterrupt catch more aggressive
Fixes: #186
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
4ast [Tue, 6 Oct 2015 20:01:49 +0000 (13:01 -0700)]
Merge pull request #261 from iovisor/bblanco_dev
Fixes for table indexing and clear()
Brenden Blanco [Tue, 6 Oct 2015 19:12:42 +0000 (12:12 -0700)]
Avoid infinite loops in BPF.Table destructor
In the case that python process tries to clear() a table object while
the bpf program is still running and doing lookup_or_init, the python
clean() routine will race with the bpf program (and bpf will win in the
case of frequent kprobe hits) causing a hang. Instead, first get the
full list of keys and then delete them rather than rely on the default
popitem implementation.
Fixes: #233
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Tue, 6 Oct 2015 19:05:25 +0000 (12:05 -0700)]
Support iterating from a 0-filled table key
In the case that 0-filled keys are valid in the table, the previous
algorithm did not properly iterate.
The API of the bpf_get_next_key routine is such that the iteration
over a map should start with an invalid key. When a 0 key is valid, this
causes iteration to start anywhere inside the hash table, skipping some
entries. So, add logic to the Iter object to test if the init key is
invalid. If otherwise, try a few alternatives until an invalid key is
found. If none found, raise an exception.
Also adds a test for indexing arrays from 0, which nows works with this
too.
Fixes: #260
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
4ast [Thu, 1 Oct 2015 19:01:10 +0000 (12:01 -0700)]
Merge pull request #259 from iovisor/bblanco_dev
Don't treat fundamentally typed args as needing probe_read
Brenden Blanco [Thu, 1 Oct 2015 18:18:07 +0000 (11:18 -0700)]
Don't treat fundamentally typed args as needing probe_read
The rewriter was aggressively parsing PoD types as requiring probe_read
and poisoning other decls when those arguments were used.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
yonghong-song [Tue, 29 Sep 2015 21:19:23 +0000 (14:19 -0700)]
Merge pull request #257 from iovisor/bblanco_dev
Mask function calls from influencing probe_read
Brenden Blanco [Tue, 29 Sep 2015 20:44:19 +0000 (13:44 -0700)]
Mask function calls from influencing probe_read
Calls to functions were propagating the needs_probe state, causing map
values to require a probe_read improperly. Although there may be a use
case for this, generally it will not be needed and should be solved
differently.
Fixes: #256
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
4ast [Mon, 28 Sep 2015 18:46:06 +0000 (11:46 -0700)]
Merge pull request #255 from iovisor/bblanco_dev
Add ability to consume perf events in python
Brenden Blanco [Mon, 28 Sep 2015 18:35:26 +0000 (11:35 -0700)]
Add check for fd < 0 in perf_reader_free
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Fri, 25 Sep 2015 20:58:30 +0000 (13:58 -0700)]
Add ability to consume perf events in python
This adds the ability to consume perf events in libbpf/python using the
ring buffer. For now, this is the only way to get access to the function
call graph. Only kernel functions are supported.
It does this by introducing a new set of libbpf helper functions that
can open the perf fd, mmap it, and poll over the events as they are
submitted by the kernel. This allow for faster event processing than
trace_printks, but has not been tested.
The functionality is disabled by default, the user can enable it by
passing a non-empty cb parameter into the BPF constructor. That cb
function will be invoked for each event that is read from the buffer.
Buffers are per-fd, so each event is distinct as well as separated from
other processes that may be running simultaneously.
The initial test case uses this functionality to build a histogram of
events keyed by the callchain.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Sun, 27 Sep 2015 03:19:54 +0000 (23:19 -0400)]
Merge pull request #254 from brendangregg/master
tcpv4connect
Brendan Gregg [Sat, 26 Sep 2015 00:01:17 +0000 (17:01 -0700)]
tcpv4connect
Brenden Blanco [Fri, 25 Sep 2015 21:05:59 +0000 (17:05 -0400)]
Merge pull request #252 from iovisor/bblanco_dev
Add custom formatter function to print_log2_hist
Brenden Blanco [Fri, 25 Sep 2015 20:57:18 +0000 (13:57 -0700)]
Add custom formatter function to print_log2_hist
Fixes: #251
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Fri, 25 Sep 2015 20:34:49 +0000 (16:34 -0400)]
Merge pull request #250 from brendangregg/master
begin using new histogram breakdowns feature
Brendan Gregg [Fri, 25 Sep 2015 20:20:16 +0000 (13:20 -0700)]
biolatency -D
Brendan Gregg [Fri, 25 Sep 2015 19:47:53 +0000 (12:47 -0700)]
funclatency -F
Brenden Blanco [Fri, 25 Sep 2015 18:22:57 +0000 (14:22 -0400)]
Merge pull request #249 from brendangregg/master
use BPF_HISTOGRAM and num_open_kprobes
Brendan Gregg [Fri, 25 Sep 2015 18:17:00 +0000 (11:17 -0700)]
tidy up: delete value after use
Brendan Gregg [Fri, 25 Sep 2015 18:16:33 +0000 (11:16 -0700)]
use new num_open_kprobes() function
Brendan Gregg [Fri, 25 Sep 2015 18:07:35 +0000 (11:07 -0700)]
improve comments for prime example
Brendan Gregg [Fri, 25 Sep 2015 18:07:23 +0000 (11:07 -0700)]
use BPF_HISTOGRAM
Brenden Blanco [Fri, 25 Sep 2015 15:54:15 +0000 (11:54 -0400)]
Merge pull request #248 from tuxology/open_probes
Helper to get open k[ret]probes. Fixes #236
Suchakra Sharma [Fri, 25 Sep 2015 15:45:06 +0000 (11:45 -0400)]
A more suitable function mame
Suchakra Sharma [Fri, 25 Sep 2015 15:37:03 +0000 (11:37 -0400)]
Merge branch 'master' into open_probes
Suchakra Sharma [Fri, 25 Sep 2015 15:24:12 +0000 (11:24 -0400)]
Helper to get open k[ret]probes. Fixes #236
Brenden Blanco [Thu, 24 Sep 2015 21:45:49 +0000 (17:45 -0400)]
Merge pull request #247 from iovisor/bblanco_dev
Add BPF_HISTOGRAM type and print support
Brenden Blanco [Thu, 24 Sep 2015 21:11:19 +0000 (14:11 -0700)]
Add support for char[N] as a histogram key
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Thu, 24 Sep 2015 04:36:05 +0000 (21:36 -0700)]
Add BPF_HISTOGRAM type and print support
This adds support for a specialized histogram type, which underneath
maps to an array or a hash table, depending on key type. With no
arguments, it takes on the type `u64 table[64];`. The other current
supported key type is `struct { int32|int64 bucket; int32|int64 slot }`.
To print these automatically, print_log2_hist is underneath split into
two types of printouts, one which prints the single histogram, and
another which prints a histogram for each unique `bucket` value.
See test_histogram.py for examples.
Fixes: #144
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Thu, 24 Sep 2015 13:52:08 +0000 (06:52 -0700)]
Add pointer dereference support to probe_read
Allows things like:
```c
int kprobe__foo(struct pt_regs *ctx, u64 *ptr) {
bpf_trace_printk("%lx\n", *ptr);
```
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Thu, 24 Sep 2015 21:41:33 +0000 (17:41 -0400)]
Merge pull request #230 from mbudiu-bfn/master
Initial implementation of P4->ebpf compiler.
Mihai Budiu [Thu, 24 Sep 2015 21:35:12 +0000 (14:35 -0700)]
initial prototype P4->EBPF compiler
Brenden Blanco [Thu, 24 Sep 2015 18:31:39 +0000 (14:31 -0400)]
Merge pull request #246 from tuxology/master
Add contribution section
Suchakra Sharma [Thu, 24 Sep 2015 18:27:46 +0000 (14:27 -0400)]
Formatting suggestions
Suchakra Sharma [Thu, 24 Sep 2015 17:16:26 +0000 (13:16 -0400)]
Add contribution section
4ast [Wed, 23 Sep 2015 15:00:59 +0000 (08:00 -0700)]
Merge pull request #244 from iovisor/bblanco_dev
Use GNUInstallDirs for LIBDIR variable
Brenden Blanco [Wed, 23 Sep 2015 14:23:35 +0000 (07:23 -0700)]
Use GNUInstallDirs for LIBDIR variable
This should be supported in older versions of cmake, but haven't
explicitly tested those.
Fixes: #243
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Mon, 21 Sep 2015 22:59:07 +0000 (15:59 -0700)]
Merge pull request #241 from brendangregg/master
biolatency, funclatency, and bpf_log2l usage
Brendan Gregg [Mon, 21 Sep 2015 22:52:01 +0000 (15:52 -0700)]
Merge remote-tracking branch 'upstream/master'
Brendan Gregg [Mon, 21 Sep 2015 22:51:11 +0000 (15:51 -0700)]
biolatency
Brendan Gregg [Mon, 21 Sep 2015 22:49:21 +0000 (15:49 -0700)]
funclatency
Brendan Gregg [Mon, 21 Sep 2015 22:46:36 +0000 (15:46 -0700)]
use bpf_log2l helper
Brenden Blanco [Mon, 21 Sep 2015 22:44:14 +0000 (15:44 -0700)]
Merge pull request #240 from brendangregg/master
add bpf_log2 functions
Brendan Gregg [Mon, 21 Sep 2015 22:39:46 +0000 (15:39 -0700)]
add bpf_log2 functions
Brenden Blanco [Mon, 21 Sep 2015 19:28:16 +0000 (12:28 -0700)]
Merge pull request #238 from brendangregg/master
killsnoop and some minor fixes
Brendan Gregg [Mon, 21 Sep 2015 18:59:42 +0000 (11:59 -0700)]
killsnoop
Brendan Gregg [Mon, 21 Sep 2015 18:58:16 +0000 (11:58 -0700)]
some simplifications
Brendan Gregg [Mon, 21 Sep 2015 18:55:52 +0000 (11:55 -0700)]
variable name typo
Brendan Gregg [Mon, 21 Sep 2015 18:52:52 +0000 (11:52 -0700)]
man page missing syntax
Brendan Gregg [Mon, 21 Sep 2015 18:52:21 +0000 (11:52 -0700)]
remove vfs copy-n-paste extras
Brendan Gregg [Mon, 21 Sep 2015 18:51:03 +0000 (11:51 -0700)]
add dynamic tracing warning
Brendan Gregg [Mon, 21 Sep 2015 18:50:29 +0000 (11:50 -0700)]
update kernel version
Brenden Blanco [Fri, 18 Sep 2015 12:18:40 +0000 (05:18 -0700)]
Merge pull request #229 from brendangregg/master
opensnoop
Brendan Gregg [Fri, 18 Sep 2015 04:52:52 +0000 (21:52 -0700)]
opensnoop
4ast [Thu, 17 Sep 2015 21:35:34 +0000 (14:35 -0700)]
Merge pull request #228 from iovisor/bblanco_dev
Add a better test case for nested probe reads
Brenden Blanco [Thu, 17 Sep 2015 21:23:34 +0000 (14:23 -0700)]
Add a better test case for nested probe reads
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
4ast [Thu, 17 Sep 2015 20:50:42 +0000 (13:50 -0700)]
Merge pull request #227 from iovisor/bblanco_dev
Add support for static helper functions
Brenden Blanco [Wed, 16 Sep 2015 21:59:35 +0000 (14:59 -0700)]
Add support for static helper functions
This adds support for static helper functions that can be reused. It is
not necessary to include pt_regs in the helper functions, even though
external pointers may be dereferenced. Arguments in the helpers can also
be reordered.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
Brenden Blanco [Wed, 16 Sep 2015 22:33:17 +0000 (15:33 -0700)]
Merge pull request #223 from brendangregg/master
add biosnoop to README
Brendan Gregg [Wed, 16 Sep 2015 22:30:07 +0000 (15:30 -0700)]
add biosnoop to README
Brenden Blanco [Wed, 16 Sep 2015 22:24:04 +0000 (15:24 -0700)]
Merge pull request #222 from brendangregg/master
biosnoop and disk updates
Brendan Gregg [Wed, 16 Sep 2015 22:19:03 +0000 (15:19 -0700)]
fix comment
Brendan Gregg [Wed, 16 Sep 2015 22:12:55 +0000 (15:12 -0700)]
accomodate mq block device I/O
Brendan Gregg [Wed, 16 Sep 2015 22:09:04 +0000 (15:09 -0700)]
biosnoop for block device I/O
4ast [Wed, 16 Sep 2015 21:11:35 +0000 (14:11 -0700)]
Merge pull request #221 from iovisor/bblanco_dev
Fix probe reads on char[] types
Brenden Blanco [Wed, 16 Sep 2015 21:06:06 +0000 (14:06 -0700)]
Fix probe reads on char[] types
It is easy enough to wrap the type in a typeof(), otherwise the rewriter
would need to do a deeper parsing of the type information to place it
properly next to the variable name.
Fixes: #219
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>
4ast [Tue, 15 Sep 2015 23:04:09 +0000 (16:04 -0700)]
Merge pull request #218 from iovisor/bblanco_dev
Translate multiple pointer dereference into bpr_probe_read
Brenden Blanco [Tue, 15 Sep 2015 22:46:26 +0000 (15:46 -0700)]
Translate multiple pointer dereference into bpr_probe_read
This commit adds support for multiple consecutive and nested pointer
dereference of function arguments that should be converted to
bpf_probe_read. The logic works by marking variables as needing a
probe_read if they come from the register argument, and then applying
this property transitively.
Supported syntax:
```
int trace_entry(struct pt_regs *ctx, struct file *file) {
struct vfsmount *mnt = file->f_path.mnt;
struct super_block *k = mnt->mnt_sb;
const char *name = file->f_path.dentry->d_name.name;
```
Not supported: probe reads from map leaves, probe reads after explicit casts.
Fixes: #188
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>