mirror of
https://github.com/varun-r-mallya/Python-BPF.git
synced 2025-12-31 21:06:25 +00:00
deletions of demo
This commit is contained in:
46
demo/bcc.py
46
demo/bcc.py
@ -1,46 +0,0 @@
|
||||
from __future__ import print_function
|
||||
from bcc import BPF
|
||||
from bcc.utils import printb
|
||||
|
||||
# load BPF program
|
||||
b = BPF(text="""
|
||||
#include <uapi/linux/ptrace.h>
|
||||
|
||||
BPF_HASH(last);
|
||||
|
||||
int do_trace(struct pt_regs *ctx) {
|
||||
u64 ts, *tsp, delta, key = 0;
|
||||
|
||||
// attempt to read stored timestamp
|
||||
tsp = last.lookup(&key);
|
||||
if (tsp != NULL) {
|
||||
delta = bpf_ktime_get_ns() - *tsp;
|
||||
if (delta < 1000000000) {
|
||||
// output if time is less than 1 second
|
||||
bpf_trace_printk("%d\\n", delta / 1000000);
|
||||
}
|
||||
last.delete(&key);
|
||||
}
|
||||
|
||||
// update stored timestamp
|
||||
ts = bpf_ktime_get_ns();
|
||||
last.update(&key, &ts);
|
||||
return 0;
|
||||
}
|
||||
""")
|
||||
|
||||
b.attach_kprobe(event=b.get_syscall_fnname("sync"), fn_name="do_trace")
|
||||
print("Tracing for quick sync's... Ctrl-C to end")
|
||||
|
||||
# TODO
|
||||
# format output
|
||||
start = 0
|
||||
while 1:
|
||||
try:
|
||||
(task, pid, cpu, flags, ts, ms) = b.trace_fields()
|
||||
if start == 0:
|
||||
start = ts
|
||||
ts = ts - start
|
||||
printb(b"At time %.2f s: multiple syncs detected, last %s ms ago" % (ts, ms))
|
||||
except KeyboardInterrupt:
|
||||
exit()
|
||||
File diff suppressed because one or more lines are too long
@ -1,23 +0,0 @@
|
||||
from pythonbpf import bpf, section, bpfglobal, compile
|
||||
|
||||
from ctypes import c_void_p, c_int64
|
||||
|
||||
# Instructions to how to run this program
|
||||
# 1. Install PythonBPF: pip install pythonbpf
|
||||
# 2. Run the program: python demo/pybpf0.py
|
||||
# 3. Run the program with sudo: sudo examples/check.sh run demo/pybpf0.o
|
||||
# 4. Start up any program and watch the output
|
||||
|
||||
|
||||
@bpf
|
||||
@section("tracepoint/syscalls/sys_enter_execve")
|
||||
def hello_world(ctx: c_void_p) -> c_int64:
|
||||
print("Hello, World!")
|
||||
return c_int64(0)
|
||||
|
||||
@bpf
|
||||
@bpfglobal
|
||||
def LICENSE() -> str:
|
||||
return "GPL"
|
||||
|
||||
compile()
|
||||
@ -1,41 +0,0 @@
|
||||
from pythonbpf import bpf, map, section, bpfglobal, compile
|
||||
from pythonbpf.helpers import XDP_PASS
|
||||
from pythonbpf.maps import HashMap
|
||||
|
||||
from ctypes import c_void_p, c_int64
|
||||
|
||||
# Instructions to how to run this program
|
||||
# 1. Install PythonBPF: pip install pythonbpf
|
||||
# 2. Run the program: python demo/pybpf1.py
|
||||
# 3. Run the program with sudo: sudo examples/check.sh run demo/pybpf1.o
|
||||
# 4. Attach object file to any network device with something like ./check.sh xdp ../demo/pybpf1.o tailscale0
|
||||
# 5. send traffic through the device and observe effects
|
||||
|
||||
@bpf
|
||||
@map
|
||||
def count() -> HashMap:
|
||||
return HashMap(key=c_int64, value=c_int64, max_entries=1)
|
||||
|
||||
|
||||
@bpf
|
||||
@section("xdp")
|
||||
def hello_world(ctx: c_void_p) -> c_int64:
|
||||
key = 0
|
||||
one = 1
|
||||
prev = count().lookup(key)
|
||||
if prev:
|
||||
prevval = prev + 1
|
||||
print(f"count: {prevval}")
|
||||
count().update(key, prevval)
|
||||
return XDP_PASS
|
||||
else:
|
||||
count().update(key, one)
|
||||
|
||||
return XDP_PASS
|
||||
|
||||
@bpf
|
||||
@bpfglobal
|
||||
def LICENSE() -> str:
|
||||
return "GPL"
|
||||
|
||||
compile()
|
||||
@ -1,43 +0,0 @@
|
||||
from pythonbpf import bpf, map, section, bpfglobal, compile
|
||||
from pythonbpf.helpers import ktime
|
||||
from pythonbpf.maps import HashMap
|
||||
|
||||
from ctypes import c_void_p, c_int64, c_uint64
|
||||
|
||||
# Instructions to how to run this program
|
||||
# 1. Install PythonBPF: pip install pythonbpf
|
||||
# 2. Run the program: python demo/pybpf2.py
|
||||
# 3. Run the program with sudo: sudo examples/check.sh run demo/pybpf2.o
|
||||
# 4. Start a Python repl and `import os` and then keep entering `os.sync()` to see reponses.
|
||||
|
||||
@bpf
|
||||
@map
|
||||
def last() -> HashMap:
|
||||
return HashMap(key=c_uint64, value=c_uint64, max_entries=3)
|
||||
|
||||
|
||||
@bpf
|
||||
@section("tracepoint/syscalls/sys_enter_sync")
|
||||
def do_trace(ctx: c_void_p) -> c_int64:
|
||||
key = 0
|
||||
tsp = last().lookup(key)
|
||||
if tsp:
|
||||
kt = ktime()
|
||||
delta = (kt - tsp)
|
||||
if delta < 1000000000:
|
||||
time_ms = (delta // 1000000)
|
||||
print(f"sync called within last second, last {time_ms} ms ago")
|
||||
last().delete(key)
|
||||
else:
|
||||
kt = ktime()
|
||||
last().update(key, kt)
|
||||
return c_int64(0)
|
||||
|
||||
|
||||
@bpf
|
||||
@bpfglobal
|
||||
def LICENSE() -> str:
|
||||
return "GPL"
|
||||
|
||||
|
||||
compile()
|
||||
@ -1,52 +0,0 @@
|
||||
from pythonbpf import bpf, map, section, bpfglobal, compile
|
||||
from pythonbpf.helpers import ktime
|
||||
from pythonbpf.maps import HashMap
|
||||
|
||||
from ctypes import c_void_p, c_int64, c_uint64
|
||||
|
||||
# Instructions to how to run this program
|
||||
# 1. Install PythonBPF: pip install pythonbpf
|
||||
# 2. Run the program: python demo/pybpf3.py
|
||||
# 3. Run the program with sudo: sudo examples/check.sh run demo/pybpf3.o
|
||||
# 4. Start up any program and watch the output
|
||||
|
||||
@bpf
|
||||
@map
|
||||
def last() -> HashMap:
|
||||
return HashMap(key=c_uint64, value=c_uint64, max_entries=3)
|
||||
|
||||
|
||||
@bpf
|
||||
@section("tracepoint/syscalls/sys_enter_execve")
|
||||
def do_trace(ctx: c_void_p) -> c_int64:
|
||||
key = 0
|
||||
tsp = last().lookup(key)
|
||||
if tsp:
|
||||
kt = ktime()
|
||||
delta = (kt - tsp)
|
||||
if delta < 1000000000:
|
||||
time_ms = (delta // 1000000)
|
||||
print(f"Execve syscall entered within last second, last {time_ms} ms ago")
|
||||
last().delete(key)
|
||||
else:
|
||||
kt = ktime()
|
||||
last().update(key, kt)
|
||||
return c_int64(0)
|
||||
|
||||
@bpf
|
||||
@section("tracepoint/syscalls/sys_exit_execve")
|
||||
def do_exit(ctx: c_void_p) -> c_int64:
|
||||
va = 8
|
||||
nm = 5 ^ va
|
||||
al = 6 & 3
|
||||
ru = (nm + al)
|
||||
print(f"this is a variable {ru}")
|
||||
return c_int64(0)
|
||||
|
||||
@bpf
|
||||
@bpfglobal
|
||||
def LICENSE() -> str:
|
||||
return "GPL"
|
||||
|
||||
|
||||
compile()
|
||||
@ -1,56 +0,0 @@
|
||||
import time
|
||||
|
||||
from pythonbpf import bpf, map, section, bpfglobal, BPF
|
||||
from pythonbpf.helpers import pid
|
||||
from pythonbpf.maps import HashMap
|
||||
from pylibbpf import *
|
||||
from ctypes import c_void_p, c_int64, c_uint64, c_int32
|
||||
import matplotlib.pyplot as plt
|
||||
|
||||
# This program attaches an eBPF tracepoint to sys_enter_clone,
|
||||
# counts per-PID clone syscalls, stores them in a hash map,
|
||||
# and then plots the distribution as a histogram using matplotlib.
|
||||
# It provides a quick view of process creation activity over 10 seconds.
|
||||
# Everything is done with Python only code and with the new pylibbpf library.
|
||||
# Run `sudo /path/to/python/binary/ pybpf4.py`
|
||||
|
||||
@bpf
|
||||
@map
|
||||
def hist() -> HashMap:
|
||||
return HashMap(key=c_int32, value=c_uint64, max_entries=4096)
|
||||
|
||||
@bpf
|
||||
@section("tracepoint/syscalls/sys_enter_clone")
|
||||
def hello(ctx: c_void_p) -> c_int64:
|
||||
process_id = pid()
|
||||
one = 1
|
||||
prev = hist().lookup(process_id)
|
||||
if prev:
|
||||
previous_value = prev + 1
|
||||
print(f"count: {previous_value} with {process_id}")
|
||||
hist().update(process_id, previous_value)
|
||||
return c_int64(0)
|
||||
else:
|
||||
hist().update(process_id, one)
|
||||
return c_int64(0)
|
||||
|
||||
|
||||
@bpf
|
||||
@bpfglobal
|
||||
def LICENSE() -> str:
|
||||
return "GPL"
|
||||
|
||||
|
||||
b = BPF()
|
||||
b.load_and_attach()
|
||||
hist = BpfMap(b, hist)
|
||||
print("Recording")
|
||||
time.sleep(10)
|
||||
|
||||
counts = list(hist.values())
|
||||
|
||||
plt.hist(counts, bins=20)
|
||||
plt.xlabel("Clone calls per PID")
|
||||
plt.ylabel("Frequency")
|
||||
plt.title("Syscall clone counts")
|
||||
plt.show()
|
||||
Reference in New Issue
Block a user