Derek [Sun, 29 Jan 2017 00:11:28 +0000 (16:11 -0800)]
Handling multiple concurrent probe users.
remove event_desc from front-end, handle it inside libbpf
Event naming pattern changed to $(eventname)_bcc_$(pid)
Derek [Thu, 26 Jan 2017 02:01:16 +0000 (18:01 -0800)]
rename event_name for lua
Derek [Tue, 24 Jan 2017 04:46:35 +0000 (20:46 -0800)]
rename event name in detach_uprobe/detach_uretprobe
Derek [Tue, 24 Jan 2017 04:32:59 +0000 (20:32 -0800)]
rename event name in detach_kprobe/detach_kretprobe
Derek [Mon, 23 Jan 2017 04:58:23 +0000 (20:58 -0800)]
Handling multiple concurrent probe users.
Event naming pattern changed to $(eventname)_bcc_$(pid)
Detect /sys/kernel/debug/tracing/instances in bpf_attach_probe,
if it exist, then will per-instance event, if failed the make global
event instance as same as before.
4ast [Sun, 22 Jan 2017 17:34:21 +0000 (09:34 -0800)]
Merge pull request #913 from iovisor/python23_percpu
Fix python2/3 incompatible percpu helpers
Brenden Blanco [Fri, 20 Jan 2017 23:35:36 +0000 (15:35 -0800)]
Skip percpu testing on unsupported kernels
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
Brenden Blanco [Fri, 20 Jan 2017 23:34:36 +0000 (15:34 -0800)]
Support for hotplug cpu cases in percpu array sizing
The kernel uses number of possible cpus to size the leaf, not the num of
online cpus. Fixup the python side appropriately.
Update: use num_possible_cpus() helper instead
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
Brenden Blanco [Wed, 18 Jan 2017 17:02:59 +0000 (09:02 -0800)]
Fix python2/3 incompatible percpu helpers
The python3 version of the percpu helpers (average, sum, etc.) were
using a python2 function that has since moved to functools (reduce).
Worse, the test case for percpu functionality was not enabled in the
cmake file. Better turn that on and make it work.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
4ast [Fri, 20 Jan 2017 17:33:46 +0000 (09:33 -0800)]
Merge pull request #914 from mkacik/master
[tools][memleak.py] add parameter for specifying object to load malloc/free from
Maria Kacik [Thu, 19 Jan 2017 05:43:41 +0000 (21:43 -0800)]
[memleak] add parameter for specifying object to load malloc/free from
4ast [Tue, 17 Jan 2017 19:06:38 +0000 (11:06 -0800)]
Merge pull request #911 from goldshtn/trace-params-signature
trace: Allow function signatures in uprobes and kprobes
4ast [Tue, 17 Jan 2017 19:04:41 +0000 (11:04 -0800)]
Merge pull request #909 from goldshtn/tp-str-fixes
trace, tplist, argdist: UDST probe miscellaneous fixes
Sasha Goldshtein [Tue, 17 Jan 2017 08:49:36 +0000 (08:49 +0000)]
trace: Allow function signatures in uprobes and kprobes
§`trace` now allows uprobes and kprobes to have function signatures,
which means function parameters can be named and typed, rather than
relying on the positional arg1, arg2, etc. arguments. This also
enables structure field access, which is impossible with the unnamed
arguments due to rewriter limitations.
The example requested by @brendangregg, which now works, is the
following:
§Â```
PID TID COMM FUNC -
777 785 automount SyS_nanosleep sleep for
500000000 ns
777 785 automount SyS_nanosleep sleep for
500000000 ns
777 785 automount SyS_nanosleep sleep for
500000000 ns
777 785 automount SyS_nanosleep sleep for
500000000 ns
^C
```
Sasha Goldshtein [Tue, 17 Jan 2017 07:40:57 +0000 (07:40 +0000)]
trace, argdist: Fix code formatting nits
Sasha Goldshtein [Mon, 16 Jan 2017 18:43:11 +0000 (18:43 +0000)]
trace: Use correct argument index and tgid for filters
`trace` would use the incorrect argument index for USDT probes when
filtering specifically, e.g. `trace u:lib:tp (arg1 != 0) ...` would
actually use the type of the 2nd argument, and not the 1st argument
for the type of the filter variable in the generated program. This
could cause compilation errors or subtle bugs where the data would
be either extended or contracted to fit the wrong argument's type.
Additionally, `trace` would use the pid (thread id, `-L`) filter
with the `attach_uprobe` API, which expects a tgid (process id).
As a result, incorrect filtering would happen.
Sasha Goldshtein [Mon, 16 Jan 2017 18:41:22 +0000 (18:41 +0000)]
trace: Generated streq-helper to ignore null terminator
Sasha Goldshtein [Mon, 16 Jan 2017 18:38:30 +0000 (18:38 +0000)]
argdist: Generated streq-helper to ignore null terminator
Oftentimes we want to use the STRCMP helper to compare strings that
are not null-terminated, e.g. in USDT probes this often happens.
Ignore the null terminator (i.e. loop until the last character
excluding the null terminator).
Sasha Goldshtein [Mon, 16 Jan 2017 18:36:52 +0000 (18:36 +0000)]
tplist: Print one-based location and argument indices
The `trace` and `argdist` tools expect location and argument indices
to start at 1 -- the first argument is arg1, and so on. The `tplist`
tool now prints UDST argument indices (and location indices, for
consistency) as 1-based as well.
4ast [Tue, 17 Jan 2017 01:24:17 +0000 (17:24 -0800)]
Merge pull request #875 from pchaigno/target-process-library
Use targeted process to resolve library names
4ast [Mon, 16 Jan 2017 21:35:04 +0000 (13:35 -0800)]
Merge pull request #908 from Catalysts/cpu-iteration
fix iteration over CPUs
Andreas Gerstmayr [Mon, 16 Jan 2017 15:35:58 +0000 (16:35 +0100)]
fix iteration over CPUs
Since kernel version 4.9.0 BPF stopped working in a KVM guest.
The problem are calls to perf_event_open with CPU identifiers which do
not exist (ENODEV). The root cause for this is that the current code
assumes ascending numbered CPUs. However, this is not always the case
(e.g. CPU hotplugging).
This patch introduces the get_online_cpus() and get_possible_cpus()
helper functions and uses the appropriate function for iterations over
CPUs. The BPF_MAP_TYPE_PERF_EVENT_ARRAY map contains now an entry for
each possible CPU instead of for each online CPU.
Fixes: #893
Signed-off-by: Andreas Gerstmayr <andreas.gerstmayr@catalysts.cc>
Brendan Gregg [Mon, 16 Jan 2017 11:13:39 +0000 (03:13 -0800)]
Merge pull request #906 from goldshtn/valid-idents
argdist, trace: Support non-C identifier names
Paul Chaignon [Sun, 15 Jan 2017 09:11:42 +0000 (10:11 +0100)]
cc: Dynamically allocate memory for library path
Paul Chaignon [Fri, 13 Jan 2017 22:37:28 +0000 (23:37 +0100)]
cc: Use PID to detach uprobes
We need the PID when detaching uprobes to resolve library names
to the same path as when attaching
Paul Chaignon [Sun, 25 Dec 2016 18:43:41 +0000 (19:43 +0100)]
cc: Resolve library names using loaded libraries
To resolve library names, bcc_procutils_which_so leverages mapped
libraries of the targeted process, if one is given. Uses the kernel's
/proc/$pid/maps
Sasha Goldshtein [Sat, 14 Jan 2017 11:17:40 +0000 (11:17 +0000)]
argdist, trace: Support non-C identifier names
When argdist or trace face a function that has characters
in its name that are not valid in C identifier, they now
replace these characters with an underscore (`_`) when
generating function names and structure names to include
in the BPF program. As a result, it is now possible to
trace functions that have these identifiers in their names,
such as Golang functions like `fmt.Println`.
4ast [Fri, 13 Jan 2017 23:36:53 +0000 (15:36 -0800)]
Merge pull request #904 from brendangregg/master
add some error hints
Brendan Gregg [Fri, 13 Jan 2017 22:02:02 +0000 (14:02 -0800)]
add some error hints
4ast [Wed, 11 Jan 2017 18:47:47 +0000 (10:47 -0800)]
Merge pull request #899 from brendangregg/tool2
profile: increase unique stack default to 10k
4ast [Wed, 11 Jan 2017 18:40:47 +0000 (10:40 -0800)]
Merge pull request #896 from brendangregg/tool1
trace: allow tracing of functions containing a dot (golang)
4ast [Wed, 11 Jan 2017 18:40:19 +0000 (10:40 -0800)]
Merge pull request #897 from brendangregg/master
statsnoop: refactor
Brendan Gregg [Wed, 11 Jan 2017 17:40:49 +0000 (09:40 -0800)]
profile: increase unique stack default to 10k
Brendan Gregg [Wed, 11 Jan 2017 06:31:30 +0000 (22:31 -0800)]
statsnoop: refactor
4ast [Wed, 11 Jan 2017 05:28:55 +0000 (21:28 -0800)]
Merge pull request #895 from brendangregg/master
gethostlatency: remove unused code
Brendan Gregg [Wed, 11 Jan 2017 04:39:07 +0000 (20:39 -0800)]
trace: allow tracing of functions containing a dot (golang)
Brendan Gregg [Wed, 11 Jan 2017 04:31:06 +0000 (20:31 -0800)]
gethostlatency: remove unused code
4ast [Wed, 11 Jan 2017 02:04:41 +0000 (18:04 -0800)]
Merge pull request #894 from brendangregg/master
add a few funccount examples
Brendan Gregg [Wed, 11 Jan 2017 01:36:07 +0000 (17:36 -0800)]
add a few funccount examples
4ast [Mon, 9 Jan 2017 20:40:46 +0000 (12:40 -0800)]
Merge pull request #883 from ColinIanKing/master
snapcraft: add cpuunclaimed to snapcraft wrapper rules
4ast [Mon, 9 Jan 2017 20:23:40 +0000 (12:23 -0800)]
Merge pull request #890 from mvbpolito/add_helpers
Add missing helper prototypes
4ast [Mon, 9 Jan 2017 20:23:22 +0000 (12:23 -0800)]
Merge pull request #889 from totally/preprocess_4.10
Fixes bio{snoop,top} on 4.10
Mauricio Vasquez B [Mon, 9 Jan 2017 02:26:32 +0000 (21:26 -0500)]
Add missing helpers prototypes in helpers.h
Signed-off-by: Mauricio Vasquez B <mauricio.vasquez@polito.it>
Ryan Leary [Sat, 7 Jan 2017 20:34:31 +0000 (15:34 -0500)]
Fixes bio{snoop,top} on 4.10.
This commit fixes #888. The 2 scripts run the same check, and now run
basically the same code to do it.
Tested on 4.10-rc2.
Brenden Blanco [Sat, 7 Jan 2017 19:16:59 +0000 (11:16 -0800)]
Merge pull request #887 from rneugeba/cflags
Add -fno-stack-protector to CFLAGS
Rolf Neugebauer [Sat, 7 Jan 2017 14:05:15 +0000 (14:05 +0000)]
Add -fno-stack-protector to CFLAGS
When compiling ebpf programs on Alpine Linux the compiler throws the following
error:
LLVM ERROR: Cannot select: 0x56049b79dcb0: ch,glue = BPFISD::CALL 0x56049a93ad60, TargetExternalSymbol:i64'__stack_chk_fail'
0x56049b391500: i64 = TargetExternalSymbol'__stack_chk_fail'
In function: waker
Disabling the stack protector explicitly with '-fno-stack-protector'
fixes this error.
clang version 3.8.1 (tags/RELEASE_381/final)
Target: x86_64-alpine-linux-musl
Thread model: posix
InstalledDir: /usr/bin
Signed-off-by: Rolf Neugebauer <rolf.neugebauer@docker.com>
Brenden Blanco [Thu, 5 Jan 2017 22:50:07 +0000 (14:50 -0800)]
Merge pull request #882 from mvbpolito/master
add missing inclusion guards in bcc/proto.h
Brenden Blanco [Thu, 5 Jan 2017 19:35:37 +0000 (11:35 -0800)]
Merge branch 'master' into master
4ast [Thu, 5 Jan 2017 19:35:13 +0000 (11:35 -0800)]
Merge pull request #886 from iovisor/llvm_40_fixes
Fixes for LLVM 4.0 and python3
Brenden Blanco [Thu, 5 Jan 2017 19:13:12 +0000 (11:13 -0800)]
Fixes for LLVM 4.0 and python3
Avoid conflicting [no]inline attributes in function annotation. This was
probably always there but now 4.0 is treating this as an error.
Also, explicitly inline several functions in helpers.h.
Turn off unwind tables in the flags passed to clang. This was generating
calls to the elf relocator, which doesn't work for the BPF target. It is
unclear which change in LLVM 4.0 altered this behavior.
On python3, handle byte strings in the usual way for supporting
backwards compatibility.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
Colin Ian King [Thu, 5 Jan 2017 15:54:29 +0000 (15:54 +0000)]
snapcraft.yaml: fix typo in ttysnoop wrapper
fix stupid typo in wrapper: ttysnop -> ttysnoop
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Colin Ian King [Thu, 5 Jan 2017 16:06:52 +0000 (16:06 +0000)]
snapcraft: add cpuunclaimed to snapcraft wrapper rules
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Brenden Blanco [Tue, 3 Jan 2017 15:34:45 +0000 (07:34 -0800)]
Merge pull request #878 from iovisor/compat-4.10-update
Update [virtual_]bpf.h to 4.10
Mauricio Vasquez B [Mon, 2 Jan 2017 20:49:27 +0000 (15:49 -0500)]
add missing inclusion guards in bcc/proto.h
Signed-off-by: Mauricio Vasquez B <mauricio.vasquez@polito.it>
Brenden Blanco [Thu, 29 Dec 2016 23:55:07 +0000 (15:55 -0800)]
Use compat bpf_common.h for local clang build
Only the virtual_bpf.h should point to the installed kernel headers.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
Brenden Blanco [Thu, 29 Dec 2016 23:40:59 +0000 (15:40 -0800)]
Update [virtual_]bpf.h to 4.10
As is occassionally necessary, we need to update the compat header
files for new kernels. This picks up the bpf.h from 4.10rc1.
Fixes: #877
Signed-off-by: Brenden Blanco <bblanco@gmail.com>
4ast [Wed, 28 Dec 2016 04:34:24 +0000 (20:34 -0800)]
Merge pull request #874 from pchaigno/fix-var
Fix variable names in exceptions
Paul Chaignon [Mon, 26 Dec 2016 15:01:19 +0000 (16:01 +0100)]
Fix variable name
4ast [Thu, 22 Dec 2016 01:01:29 +0000 (17:01 -0800)]
Merge pull request #870 from brendangregg/master
add cpuunclaimed
Brendan Gregg [Wed, 21 Dec 2016 23:35:36 +0000 (15:35 -0800)]
fix comment in runqlen
Brendan Gregg [Wed, 21 Dec 2016 23:34:09 +0000 (15:34 -0800)]
add cpuunclaimed
4ast [Wed, 21 Dec 2016 18:32:40 +0000 (10:32 -0800)]
Merge pull request #835 from ColinIanKing/master
Add snapcraft script to package up bcc as a snap
4ast [Wed, 21 Dec 2016 16:30:36 +0000 (08:30 -0800)]
Merge pull request #867 from shodoco/extern
Don't close extern table when a module destructs
Huapeng Zhou [Wed, 21 Dec 2016 06:47:51 +0000 (22:47 -0800)]
fix company copyright
4ast [Wed, 21 Dec 2016 06:41:13 +0000 (22:41 -0800)]
Merge pull request #868 from shodoco/pin
add bpf_obj_pin/bpf_obj_get to pin/get bpf objects
Huapeng Zhou [Tue, 20 Dec 2016 21:42:01 +0000 (13:42 -0800)]
add bpf_obj_pin/bpf_obj_get to pin/get bpf objects
Huapeng Zhou [Tue, 20 Dec 2016 21:10:12 +0000 (13:10 -0800)]
do not close extern table when a module destructs
Huapeng Zhou [Tue, 20 Dec 2016 21:06:29 +0000 (13:06 -0800)]
add table type to shared tables
Brenden Blanco [Tue, 20 Dec 2016 08:12:46 +0000 (00:12 -0800)]
Merge pull request #863 from shodoco/master
support macro in call arguments
shodoco [Mon, 19 Dec 2016 19:04:56 +0000 (11:04 -0800)]
Merge branch 'master' into master
4ast [Mon, 19 Dec 2016 18:58:59 +0000 (10:58 -0800)]
Merge pull request #865 from goldshtn/trace-timestamp
trace: -L, -t, -T switches
4ast [Mon, 19 Dec 2016 16:13:46 +0000 (08:13 -0800)]
Merge pull request #774 from goldshtn/usdt-tools
USDT tools for higher level languages
Sasha Goldshtein [Mon, 19 Dec 2016 10:17:38 +0000 (10:17 +0000)]
trace: -L, -t, -T switches
The `-t` switch for specifying a thread id has been renamed
to `-L`. The `-T` switch specifies that a time column should
be provided, whereas the `-t` switch requests a relative
timestamp (from the beginning of the trace). This is more
consistent with other tools, and lets the user choose the
desired format for the time column, if any.
Sasha Goldshtein [Mon, 19 Dec 2016 09:54:31 +0000 (09:54 +0000)]
uobjnew: Remove -l switch from examples
Sasha Goldshtein [Mon, 19 Dec 2016 09:52:34 +0000 (09:52 +0000)]
uobjnew: Attach uprobe only to the requested process
When C allocations are traced, attach the `malloc`
uprobe only to the requested process -- otherwise, we
get allocation information from the entire system.
Sasha Goldshtein [Sat, 29 Oct 2016 21:03:44 +0000 (14:03 -0700)]
README: Add u* tools based on USDT probes
Sasha Goldshtein [Sat, 29 Oct 2016 21:00:25 +0000 (14:00 -0700)]
uflow: Add man page and companion examples file
Sasha Goldshtein [Sat, 29 Oct 2016 20:44:55 +0000 (13:44 -0700)]
uthreads: Add man page and companion examples file
Sasha Goldshtein [Sat, 29 Oct 2016 20:33:24 +0000 (13:33 -0700)]
uobjnew: Add man page and companion examples file
Sasha Goldshtein [Sat, 29 Oct 2016 20:20:52 +0000 (13:20 -0700)]
ugc: Add man page and companion examples file
Sasha Goldshtein [Sat, 29 Oct 2016 20:08:39 +0000 (13:08 -0700)]
ucalls: Add man page and companion examples file
Sasha Goldshtein [Sat, 29 Oct 2016 19:35:29 +0000 (12:35 -0700)]
ustat: Add man page and companion example file
Sasha Goldshtein [Thu, 27 Oct 2016 22:58:14 +0000 (15:58 -0700)]
ustat: Graceful error handling
If the process in question doesn't have the USDT probes we
expect, handle the failure gracefully. After all, it could
be a binary compiled without USDT support, the pid could be
recycled to some other application, or -- the process name
could match, but by accident, and really belong to some
other runtime.
Sasha Goldshtein [Thu, 27 Oct 2016 22:17:58 +0000 (15:17 -0700)]
ustat: Replace \0 with spaces in cmdline
The /proc/PID/cmdline file has \0 for spaces in the command
line, and there may be trailing \0 characters as well.
Replace them all with spaces.
Sasha Goldshtein [Wed, 26 Oct 2016 19:52:06 +0000 (12:52 -0700)]
uflow: Trace method execution flow
This tool traces method executions and prints out messages
with a nesting depth indicator that allows relatively easy
visualization of program flow. To reduce overhead, `-C` and
`-M` switches take class and method prefixes to filter the
output by. The filtering takes place in the BPF program, so
the unnecessary data never ends up in user space.
Usage examples:
```
uflow java 185
uflow -M index python 180
uflow -C 'IRB::Irb' ruby 10041
```
Sasha Goldshtein [Wed, 26 Oct 2016 13:50:31 +0000 (06:50 -0700)]
ustat: Change 'count' argument type to int
Sasha Goldshtein [Wed, 26 Oct 2016 13:40:35 +0000 (06:40 -0700)]
ustat: Sort by pid if no other sort column provided
Sasha Goldshtein [Wed, 26 Oct 2016 13:34:06 +0000 (06:34 -0700)]
tools: Add block comments to u* scripts
Sasha Goldshtein [Tue, 25 Oct 2016 18:52:39 +0000 (11:52 -0700)]
ustat: Activity stats from high-level languages
This tool gathers statistics (by pid) on method calls,
class loads, garbage collections, thread creations, object
allocations, and exceptions raised and prints them in a
top-like style. Supported languages currently include
Java, Python, Ruby, and Node. Not all languages provide
the necessary probes for all event types.
Usage examples:
```
ustat -C
ustat -l java 1
ustat -l ruby -S objnew
```
Sasha Goldshtein [Tue, 25 Oct 2016 18:51:46 +0000 (11:51 -0700)]
python: Expose active probes from USDT object
Allow callers to obtain the list of active (enabled) USDT
probes from the USDT object, if they need to enable the
uprobes by hand without using the bcc attach support. This
is required when the same uprobe needs to be enabled in
more than one process.
Sasha Goldshtein [Tue, 25 Oct 2016 18:51:32 +0000 (11:51 -0700)]
python: Do not call USDT.get_text() twice
Sasha Goldshtein [Tue, 25 Oct 2016 12:28:29 +0000 (05:28 -0700)]
uobjnew: Summarize object allocations
Use various USDT probes in Java and Ruby, and `malloc()`
uprobe in C, to summarize object allocations by type or
by size. Print statistics at the end or at intervals, with
optional trimming of top types by number of instances
allocated or number of bytes.
Sasha Goldshtein [Tue, 25 Oct 2016 11:30:54 +0000 (04:30 -0700)]
ucalls: TODO reminder to probe C methods
Sasha Goldshtein [Tue, 25 Oct 2016 11:28:53 +0000 (04:28 -0700)]
ugc: Fix order of arguments in usage comment
Sasha Goldshtein [Tue, 25 Oct 2016 11:28:06 +0000 (04:28 -0700)]
uthreads: Add pthread support
Trace `pthread_start` calls and get the symbol for the
newly-started thread for printing. Also allow no-Java runs
with no language specified for pthread-only tracing.
Sasha Goldshtein [Tue, 25 Oct 2016 11:08:10 +0000 (04:08 -0700)]
uthreads: Trace thread creation/destruction events
`uthreads` attaches to thread start and stop USDT probes
and traces out thread creation and destruction events.
Currently, only Java is supported.
Sasha Goldshtein [Tue, 25 Oct 2016 09:18:35 +0000 (02:18 -0700)]
ucalls: Trace syscalls
Add `-S` switch for tracing syscalls with or without high-
level language method calls. When `-S` is provided, attach
to all `sys_` and `SyS_` entry points in the kernel and
trace the number of calls and execution latency (if `-L`
was also specified).
This is now also a useful general-purpose tool for syscall
count/latency summarizing when a language is not specified.
Sasha Goldshtein [Tue, 25 Oct 2016 07:08:33 +0000 (00:08 -0700)]
ugc: Node support
Add Node support for gc__start and gc__done probes, which
includes GC type flag parsing.
Sasha Goldshtein [Thu, 20 Oct 2016 23:08:37 +0000 (16:08 -0700)]
tools: Script skeletons
Skeletons for method flow, object allocations, general
event statistics, and thread statistics.
Sasha Goldshtein [Thu, 20 Oct 2016 23:07:23 +0000 (16:07 -0700)]
ugc: Add description messages for GC events
For runtimes that make it available, we now extract GC
event information such as heap sizes and print this
information in addition to the GC duration and timestamp.