varun-r-mallya/python-bpf
1
0
Fork 0
mirror of https://github.com/varun-r-mallya/Python-BPF.git synced 2025-12-31 21:06:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

add disksnoop ipynb

Browse Source
This commit is contained in:
varun-r-mallya
2025-11-25 22:51:24 +05:30
parent 102e4ca78c
commit 7b7b00dbe7
3 changed files with 3729 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3690
BCC-Examples/disksnoop.ipynb Normal file
View File

File diff suppressed because it is too large Load Diff

6
BCC-Examples/disksnoop.py
View File

@ -3,16 +3,18 @@ from pythonbpf import bpf, section, bpfglobal, compile_to_ir, compile, map
from pythonbpf.helper import ktime from pythonbpf.helper import ktime
from pythonbpf.maps import HashMap from pythonbpf.maps import HashMap
import logging import logging
from ctypes import c_int64, c_uint64, c_uint32, c_int32 from ctypes import c_int64, c_uint64, c_int32
# Constants # Constants
REQ_WRITE = 1 # from include/linux/blk_types.h REQ_WRITE = 1 # from include/linux/blk_types.h
@bpf @bpf
@map @map
def start() -> HashMap: def start() -> HashMap:
return HashMap(key=c_uint64, value=c_uint64, max_entries=10240) return HashMap(key=c_uint64, value=c_uint64, max_entries=10240)
@bpf @bpf
@section("kprobe/blk_mq_end_request") @section("kprobe/blk_mq_end_request")
def trace_completion(ctx: struct_pt_regs) -> c_int64: def trace_completion(ctx: struct_pt_regs) -> c_int64:
@ -38,6 +40,7 @@ def trace_completion(ctx: struct_pt_regs) -> c_int64:
return c_int64(0) return c_int64(0)
@bpf @bpf
@section("kprobe/blk_mq_start_request") @section("kprobe/blk_mq_start_request")
def trace_start(ctx1: struct_pt_regs) -> c_int32: def trace_start(ctx1: struct_pt_regs) -> c_int32:
@ -46,6 +49,7 @@ def trace_start(ctx1: struct_pt_regs) -> c_int32:
start.update(req, ts) start.update(req, ts)
return c_int32(0) return c_int32(0)
@bpf @bpf
@bpfglobal @bpfglobal
def LICENSE() -> str: def LICENSE() -> str:

68
tests/c-form/disksnoop.bpf.c
View File

@ -8,59 +8,59 @@
char LICENSE[] SEC("license") = "GPL"; char LICENSE[] SEC("license") = "GPL";
struct { struct {
__uint(type, BPF_MAP_TYPE_HASH); __uint(type, BPF_MAP_TYPE_HASH);
__type(key, __u64); __type(key, __u64);
__type(value, __u64); __type(value, __u64);
__uint(max_entries, 10240); __uint(max_entries, 10240);
} start_map SEC(".maps"); } start_map SEC(".maps");
/* kprobe: record start timestamp keyed by request pointer */ /* kprobe: record start timestamp keyed by request pointer */
SEC("kprobe/blk_mq_start_request") SEC("kprobe/blk_mq_start_request")
int trace_start(struct pt_regs *ctx) int trace_start(struct pt_regs *ctx)
{ {
/* request * is first arg */ /* request * is first arg */
__u64 reqp = (__u64)(ctx->di); __u64 reqp = (__u64)(ctx->di);
__u64 ts = bpf_ktime_get_ns(); __u64 ts = bpf_ktime_get_ns();
bpf_map_update_elem(&start_map, &reqp, &ts, BPF_ANY); bpf_map_update_elem(&start_map, &reqp, &ts, BPF_ANY);
// /* optional debug: // /* optional debug:
bpf_printk("start: req=%llu ts=%llu\n", reqp, ts); bpf_printk("start: req=%llu ts=%llu\n", reqp, ts);
// */ // */
return 0; return 0;
} }
/* completion: compute latency and print data_len, cmd_flags, latency_us */ /* completion: compute latency and print data_len, cmd_flags, latency_us */
SEC("kprobe/blk_mq_end_request") SEC("kprobe/blk_mq_end_request")
int trace_completion(struct pt_regs *ctx) int trace_completion(struct pt_regs *ctx)
{ {
__u64 reqp = (__u64)(ctx->di); __u64 reqp = (__u64)(ctx->di);
__u64 *tsp; __u64 *tsp;
__u64 now_ns; __u64 now_ns;
__u64 delta_ns; __u64 delta_ns;
__u64 delta_us = 0; __u64 delta_us = 0;
bpf_printk("%lld", reqp); bpf_printk("%lld", reqp);
tsp = bpf_map_lookup_elem(&start_map, &reqp); tsp = bpf_map_lookup_elem(&start_map, &reqp);
if (!tsp) if (!tsp)
return 0; return 0;
now_ns = bpf_ktime_get_ns(); now_ns = bpf_ktime_get_ns();
delta_ns = now_ns - *tsp; delta_ns = now_ns - *tsp;
delta_us = delta_ns / 1000; delta_us = delta_ns / 1000;
/* read request fields using CO-RE; needs vmlinux.h/BTF */ /* read request fields using CO-RE; needs vmlinux.h/BTF */
__u32 data_len = 0; __u32 data_len = 0;
__u32 cmd_flags = 0; __u32 cmd_flags = 0;
/* __data_len is usually a 32/64-bit; use CORE read to be safe */ /* __data_len is usually a 32/64-bit; use CORE read to be safe */
data_len = ( __u32 ) BPF_CORE_READ((struct request *)reqp, __data_len); data_len = ( __u32 ) BPF_CORE_READ((struct request *)reqp, __data_len);
cmd_flags = ( __u32 ) BPF_CORE_READ((struct request *)reqp, cmd_flags); cmd_flags = ( __u32 ) BPF_CORE_READ((struct request *)reqp, cmd_flags);
/* print: "<bytes> <flags_hex> <latency_us>" */ /* print: "<bytes> <flags_hex> <latency_us>" */
bpf_printk("%u %x %llu\n", data_len, cmd_flags, delta_us); bpf_printk("%u %x %llu\n", data_len, cmd_flags, delta_us);
/* remove from map */ /* remove from map */
bpf_map_delete_elem(&start_map, &reqp); bpf_map_delete_elem(&start_map, &reqp);
return 0; return 0;
} }