mirror of
https://github.com/varun-r-mallya/Python-BPF.git
synced 2025-12-31 21:06:25 +00:00
Compare commits
10 Commits
7a99d21b24
...
5c1e7103a6
| Author | SHA1 | Date | |
|---|---|---|---|
| 5c1e7103a6 | |||
| 576fa2f106 | |||
| 76a873cb0d | |||
| e86c6082c9 | |||
| cb1ad15f43 | |||
| b24b3ed250 | |||
| beaad996db | |||
| 99b92e44e3 | |||
| ce7adaadb6 | |||
| 5ac316a1ac |
83
BCC-Examples/hello_fields.ipynb
Normal file
83
BCC-Examples/hello_fields.ipynb
Normal file
@ -0,0 +1,83 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "28cf2e27-41e2-461c-a39c-147417141a4e",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, section, bpfglobal, BPF, trace_fields\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "133190e5-5a99-4585-b6e1-91224ed973c2",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_clone\")\n",
|
||||
"def hello_world(ctx: c_void_p) -> c_int64:\n",
|
||||
" print(\"Hello, World!\")\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Compile and load\n",
|
||||
"b = BPF()\n",
|
||||
"b.load()\n",
|
||||
"b.attach_all()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "d3934efb-4043-4545-ae4c-c50ec40a24fd",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"# header\n",
|
||||
"print(f\"{'TIME(s)':<18} {'COMM':<16} {'PID':<6} {'MESSAGE'}\")\n",
|
||||
"\n",
|
||||
"# format output\n",
|
||||
"while True:\n",
|
||||
" try:\n",
|
||||
" (task, pid, cpu, flags, ts, msg) = trace_fields()\n",
|
||||
" except ValueError:\n",
|
||||
" continue\n",
|
||||
" except KeyboardInterrupt:\n",
|
||||
" exit()\n",
|
||||
" print(f\"{ts:<18} {task:<16} {pid:<6} {msg}\")"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
110
BCC-Examples/hello_perf_output.ipynb
Normal file
110
BCC-Examples/hello_perf_output.ipynb
Normal file
@ -0,0 +1,110 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "79b74928-f4b4-4320-96e3-d973997de2f4",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, map, struct, section, bpfglobal, BPF\n",
|
||||
"from pythonbpf.helper import ktime, pid, comm\n",
|
||||
"from pythonbpf.maps import PerfEventArray\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "5bdb0329-ae2d-45e8-808e-5ed5b1374204",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@struct\n",
|
||||
"class data_t:\n",
|
||||
" pid: c_int64\n",
|
||||
" ts: c_int64\n",
|
||||
" comm: str(16)\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@map\n",
|
||||
"def events() -> PerfEventArray:\n",
|
||||
" return PerfEventArray(key_size=c_int64, value_size=c_int64)\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_clone\")\n",
|
||||
"def hello(ctx: c_void_p) -> c_int64:\n",
|
||||
" dataobj = data_t()\n",
|
||||
" dataobj.pid, dataobj.ts = pid(), ktime()\n",
|
||||
" comm(dataobj.comm)\n",
|
||||
" events.output(dataobj)\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Compile and load\n",
|
||||
"b = BPF()\n",
|
||||
"b.load()\n",
|
||||
"b.attach_all()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "4bcc7d57-6cc4-48a3-bbd2-42ad6263afdf",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"start = 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"def callback(cpu, event):\n",
|
||||
" global start\n",
|
||||
" if start == 0:\n",
|
||||
" start = event.ts\n",
|
||||
" ts = (event.ts - start) / 1e9\n",
|
||||
" print(f\"[CPU {cpu}] PID: {event.pid}, TS: {ts}, COMM: {event.comm.decode()}\")\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"perf = b[\"events\"].open_perf_buffer(callback, struct_name=\"data_t\")\n",
|
||||
"print(\"Starting to poll... (Ctrl+C to stop)\")\n",
|
||||
"print(\"Try running: fork() or clone() system calls to trigger events\")\n",
|
||||
"\n",
|
||||
"try:\n",
|
||||
" while True:\n",
|
||||
" b[\"events\"].poll(1000)\n",
|
||||
"except KeyboardInterrupt:\n",
|
||||
" print(\"Stopping...\")"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
116
BCC-Examples/hello_world.ipynb
Normal file
116
BCC-Examples/hello_world.ipynb
Normal file
@ -0,0 +1,116 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 9,
|
||||
"id": "7d5d3cfb-39ba-4516-9856-b3bed47a0cef",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, section, bpfglobal, BPF, trace_pipe\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 10,
|
||||
"id": "cf1c87aa-e173-4156-8f2d-762225bc6d19",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_clone\")\n",
|
||||
"def hello_world(ctx: c_void_p) -> c_int64:\n",
|
||||
" print(\"Hello, World!\")\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"b = BPF()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "bd81383d-f75a-4269-8451-3d985d85b124",
|
||||
"metadata": {
|
||||
"scrolled": true
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"name": "stdout",
|
||||
"output_type": "stream",
|
||||
"text": [
|
||||
" Cache2 I/O-4716 [003] ...21 8218.000492: bpf_trace_printk: count: 11 with 4716\n",
|
||||
"\n",
|
||||
" Cache2 I/O-4716 [003] ...21 8218.000499: bpf_trace_printk: Hello, World!\n",
|
||||
"\n",
|
||||
" WebExtensions-5168 [002] ...21 8219.320392: bpf_trace_printk: count: 13 with 5168\n",
|
||||
"\n",
|
||||
" WebExtensions-5168 [002] ...21 8219.320399: bpf_trace_printk: Hello, World!\n",
|
||||
"\n",
|
||||
" python-21155 [001] ...21 8220.933716: bpf_trace_printk: count: 5 with 21155\n",
|
||||
"\n",
|
||||
" python-21155 [001] ...21 8220.933721: bpf_trace_printk: Hello, World!\n",
|
||||
"\n",
|
||||
" python-21155 [002] ...21 8221.341290: bpf_trace_printk: count: 6 with 21155\n",
|
||||
"\n",
|
||||
" python-21155 [002] ...21 8221.341295: bpf_trace_printk: Hello, World!\n",
|
||||
"\n",
|
||||
" Isolated Web Co-5462 [000] ...21 8223.095033: bpf_trace_printk: count: 7 with 5462\n",
|
||||
"\n",
|
||||
" Isolated Web Co-5462 [000] ...21 8223.095043: bpf_trace_printk: Hello, World!\n",
|
||||
"\n",
|
||||
" firefox-4542 [000] ...21 8227.760067: bpf_trace_printk: count: 8 with 4542\n",
|
||||
"\n",
|
||||
" firefox-4542 [000] ...21 8227.760080: bpf_trace_printk: Hello, World!\n",
|
||||
"\n",
|
||||
" Isolated Web Co-12404 [003] ...21 8227.917086: bpf_trace_printk: count: 7 with 12404\n",
|
||||
"\n",
|
||||
" Isolated Web Co-12404 [003] ...21 8227.917095: bpf_trace_printk: Hello, World!\n",
|
||||
"\n"
|
||||
]
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"b.load()\n",
|
||||
"b.attach_all()\n",
|
||||
"trace_pipe()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "01e1f25b-decc-425b-a1aa-a5e701082574",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": []
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
107
BCC-Examples/sync_count.ipynb
Normal file
107
BCC-Examples/sync_count.ipynb
Normal file
@ -0,0 +1,107 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "dcab010c-f5e9-446f-9f9f-056cc794ad14",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, map, section, bpfglobal, BPF, trace_fields\n",
|
||||
"from pythonbpf.helper import ktime\n",
|
||||
"from pythonbpf.maps import HashMap\n",
|
||||
"\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "720797e8-9c81-4af6-a385-80f1ec4c0f15",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@map\n",
|
||||
"def last() -> HashMap:\n",
|
||||
" return HashMap(key=c_int64, value=c_int64, max_entries=2)\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_sync\")\n",
|
||||
"def do_trace(ctx: c_void_p) -> c_int64:\n",
|
||||
" ts_key, cnt_key = 0, 1\n",
|
||||
" tsp, cntp = last.lookup(ts_key), last.lookup(cnt_key)\n",
|
||||
" if not cntp:\n",
|
||||
" last.update(cnt_key, 0)\n",
|
||||
" cntp = last.lookup(cnt_key)\n",
|
||||
" if tsp:\n",
|
||||
" delta = ktime() - tsp\n",
|
||||
" if delta < 1000000000:\n",
|
||||
" time_ms = delta // 1000000\n",
|
||||
" print(f\"{time_ms} {cntp}\")\n",
|
||||
" last.delete(ts_key)\n",
|
||||
" else:\n",
|
||||
" last.update(ts_key, ktime())\n",
|
||||
" last.update(cnt_key, cntp + 1)\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Compile and load\n",
|
||||
"b = BPF()\n",
|
||||
"b.load()\n",
|
||||
"b.attach_all()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "78a8b82c-7c5f-43c1-9de1-cd982a0f345b",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"print(\"Tracing for quick sync's... Ctrl-C to end\")\n",
|
||||
"\n",
|
||||
"# format output\n",
|
||||
"start = 0\n",
|
||||
"while True:\n",
|
||||
" try:\n",
|
||||
" task, pid, cpu, flags, ts, msg = trace_fields()\n",
|
||||
" if start == 0:\n",
|
||||
" start = ts\n",
|
||||
" ts -= start\n",
|
||||
" ms, cnt = msg.split()\n",
|
||||
" print(f\"At time {ts} s: Multiple syncs detected, last {ms} ms ago. Count {cnt}\")\n",
|
||||
" except KeyboardInterrupt:\n",
|
||||
" exit()"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
134
BCC-Examples/sync_perf_output.ipynb
Normal file
134
BCC-Examples/sync_perf_output.ipynb
Normal file
@ -0,0 +1,134 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "b0d1ab05-0c1f-4578-9c1b-568202b95a5c",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, map, struct, section, bpfglobal, BPF\n",
|
||||
"from pythonbpf.helper import ktime\n",
|
||||
"from pythonbpf.maps import HashMap, PerfEventArray\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "85e50d0a-f9d8-468f-8e03-f5f7128f05d8",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@struct\n",
|
||||
"class data_t:\n",
|
||||
" ts: c_int64\n",
|
||||
" ms: c_int64\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@map\n",
|
||||
"def events() -> PerfEventArray:\n",
|
||||
" return PerfEventArray(key_size=c_int64, value_size=c_int64)\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@map\n",
|
||||
"def last() -> HashMap:\n",
|
||||
" return HashMap(key=c_int64, value=c_int64, max_entries=1)\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_sync\")\n",
|
||||
"def do_trace(ctx: c_void_p) -> c_int64:\n",
|
||||
" dat, dat.ts, key = data_t(), ktime(), 0\n",
|
||||
" tsp = last.lookup(key)\n",
|
||||
" if tsp:\n",
|
||||
" delta = ktime() - tsp\n",
|
||||
" if delta < 1000000000:\n",
|
||||
" dat.ms = delta // 1000000\n",
|
||||
" events.output(dat)\n",
|
||||
" last.delete(key)\n",
|
||||
" else:\n",
|
||||
" last.update(key, ktime())\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Compile and load\n",
|
||||
"b = BPF()\n",
|
||||
"b.load()\n",
|
||||
"b.attach_all()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "40bb1107-369f-4be7-9f10-37201900c16b",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"print(\"Tracing for quick sync's... Ctrl-C to end\")\n",
|
||||
"\n",
|
||||
"# format output\n",
|
||||
"start = 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"def callback(cpu, event):\n",
|
||||
" global start\n",
|
||||
" if start == 0:\n",
|
||||
" start = event.ts\n",
|
||||
" event.ts -= start\n",
|
||||
" print(\n",
|
||||
" f\"At time {event.ts / 1e9} s: Multiple sync detected, Last sync: {event.ms} ms ago\"\n",
|
||||
" )\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"perf = b[\"events\"].open_perf_buffer(callback, struct_name=\"data_t\")\n",
|
||||
"print(\"Starting to poll... (Ctrl+C to stop)\")\n",
|
||||
"print(\"Try running: fork() or clone() system calls to trigger events\")\n",
|
||||
"\n",
|
||||
"try:\n",
|
||||
" while True:\n",
|
||||
" b[\"events\"].poll(1000)\n",
|
||||
"except KeyboardInterrupt:\n",
|
||||
" print(\"Stopping...\")"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "94a588d9-3a40-437c-a35b-fc40410f3eb7",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": []
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
@ -1,7 +1,6 @@
|
||||
from pythonbpf import bpf, map, struct, section, bpfglobal, BPF
|
||||
from pythonbpf.helper import ktime
|
||||
from pythonbpf.maps import HashMap
|
||||
from pythonbpf.maps import PerfEventArray
|
||||
from pythonbpf.maps import HashMap, PerfEventArray
|
||||
from ctypes import c_void_p, c_int64
|
||||
|
||||
|
||||
|
||||
102
BCC-Examples/sync_timing.ipynb
Normal file
102
BCC-Examples/sync_timing.ipynb
Normal file
@ -0,0 +1,102 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "bfe01ceb-2f27-41b3-b3ba-50ec65cfddda",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, map, section, bpfglobal, BPF, trace_fields\n",
|
||||
"from pythonbpf.helper import ktime\n",
|
||||
"from pythonbpf.maps import HashMap\n",
|
||||
"\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "ddb115f4-20a7-43bc-bb5b-ccbfd6031fc2",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@map\n",
|
||||
"def last() -> HashMap:\n",
|
||||
" return HashMap(key=c_int64, value=c_int64, max_entries=1)\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_sync\")\n",
|
||||
"def do_trace(ctx: c_void_p) -> c_int64:\n",
|
||||
" key = 0\n",
|
||||
" tsp = last.lookup(key)\n",
|
||||
" if tsp:\n",
|
||||
" delta = ktime() - tsp\n",
|
||||
" if delta < 1000000000:\n",
|
||||
" time_ms = delta // 1000000\n",
|
||||
" print(f\"{time_ms}\")\n",
|
||||
" last.delete(key)\n",
|
||||
" else:\n",
|
||||
" last.update(key, ktime())\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Compile and load\n",
|
||||
"b = BPF()\n",
|
||||
"b.load()\n",
|
||||
"b.attach_all()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "e4f46574-9fd8-46e7-9c7b-27a36d07f200",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"print(\"Tracing for quick sync's... Ctrl-C to end\")\n",
|
||||
"\n",
|
||||
"# format output\n",
|
||||
"start = 0\n",
|
||||
"while True:\n",
|
||||
" try:\n",
|
||||
" task, pid, cpu, flags, ts, ms = trace_fields()\n",
|
||||
" if start == 0:\n",
|
||||
" start = ts\n",
|
||||
" ts -= start\n",
|
||||
" print(f\"At time {ts} s: Multiple syncs detected, last {ms} ms ago\")\n",
|
||||
" except KeyboardInterrupt:\n",
|
||||
" exit()"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
73
BCC-Examples/sys_sync.ipynb
Normal file
73
BCC-Examples/sys_sync.ipynb
Normal file
@ -0,0 +1,73 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "bb49598f-b9cc-4ea8-8391-923cad513711",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, section, bpfglobal, BPF, trace_pipe\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "5da237b0-1c7d-4ec5-8c24-696b1c1d97fa",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_sync\")\n",
|
||||
"def hello_world(ctx: c_void_p) -> c_int64:\n",
|
||||
" print(\"sys_sync() called\")\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Compile and load\n",
|
||||
"b = BPF()\n",
|
||||
"b.load()\n",
|
||||
"b.attach_all()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "e4c218ac-fe47-4fd1-a27b-c07e02f3cd05",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"print(\"Tracing sys_sync()... Ctrl-C to end.\")\n",
|
||||
"trace_pipe()"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
252
BCC-Examples/vfsreadlat.ipynb
Normal file
252
BCC-Examples/vfsreadlat.ipynb
Normal file
File diff suppressed because one or more lines are too long
@ -21,17 +21,17 @@ def last() -> HashMap:
|
||||
@section("tracepoint/syscalls/sys_enter_execve")
|
||||
def do_trace(ctx: c_void_p) -> c_int64:
|
||||
key = 0
|
||||
tsp = last().lookup(key)
|
||||
tsp = last.lookup(key)
|
||||
if tsp:
|
||||
kt = ktime()
|
||||
delta = kt - tsp
|
||||
if delta < 1000000000:
|
||||
time_ms = delta // 1000000
|
||||
print(f"Execve syscall entered within last second, last {time_ms} ms ago")
|
||||
last().delete(key)
|
||||
last.delete(key)
|
||||
else:
|
||||
kt = ktime()
|
||||
last().update(key, kt)
|
||||
last.update(key, kt)
|
||||
return c_int64(0)
|
||||
|
||||
|
||||
|
||||
File diff suppressed because one or more lines are too long
@ -3,7 +3,6 @@ import time
|
||||
from pythonbpf import bpf, map, section, bpfglobal, BPF
|
||||
from pythonbpf.helper import pid
|
||||
from pythonbpf.maps import HashMap
|
||||
from pylibbpf import BpfMap
|
||||
from ctypes import c_void_p, c_int64, c_uint64, c_int32
|
||||
import matplotlib.pyplot as plt
|
||||
|
||||
@ -26,14 +25,14 @@ def hist() -> HashMap:
|
||||
def hello(ctx: c_void_p) -> c_int64:
|
||||
process_id = pid()
|
||||
one = 1
|
||||
prev = hist().lookup(process_id)
|
||||
prev = hist.lookup(process_id)
|
||||
if prev:
|
||||
previous_value = prev + 1
|
||||
print(f"count: {previous_value} with {process_id}")
|
||||
hist().update(process_id, previous_value)
|
||||
hist.update(process_id, previous_value)
|
||||
return c_int64(0)
|
||||
else:
|
||||
hist().update(process_id, one)
|
||||
hist.update(process_id, one)
|
||||
return c_int64(0)
|
||||
|
||||
|
||||
@ -44,12 +43,12 @@ def LICENSE() -> str:
|
||||
|
||||
|
||||
b = BPF()
|
||||
b.load_and_attach()
|
||||
hist = BpfMap(b, hist)
|
||||
b.load()
|
||||
b.attach_all()
|
||||
print("Recording")
|
||||
time.sleep(10)
|
||||
|
||||
counts = list(hist.values())
|
||||
counts = list(b["hist"].values())
|
||||
|
||||
plt.hist(counts, bins=20)
|
||||
plt.xlabel("Clone calls per PID")
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
from pythonbpf import bpf, section, bpfglobal, BPF
|
||||
from pythonbpf import bpf, section, bpfglobal, BPF, trace_pipe
|
||||
from ctypes import c_void_p, c_int64
|
||||
|
||||
# Instructions to how to run this program
|
||||
@ -21,10 +21,6 @@ def LICENSE() -> str:
|
||||
|
||||
|
||||
b = BPF()
|
||||
b.load_and_attach()
|
||||
if b.is_loaded() and b.is_attached():
|
||||
print("Successfully loaded and attached")
|
||||
else:
|
||||
print("Could not load successfully")
|
||||
|
||||
# Now cat /sys/kernel/debug/tracing/trace_pipe to see results of the execve syscall.
|
||||
b.load()
|
||||
b.attach_all()
|
||||
trace_pipe()
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
from pythonbpf import bpf, section, bpfglobal, BPF
|
||||
from pythonbpf import bpf, section, bpfglobal, BPF, trace_pipe
|
||||
from ctypes import c_void_p, c_int64
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ def LICENSE() -> str:
|
||||
|
||||
|
||||
b = BPF()
|
||||
b.load_and_attach()
|
||||
while True:
|
||||
print("running")
|
||||
# Now cat /sys/kernel/debug/tracing/trace_pipe to see results of unlink kprobe.
|
||||
b.load()
|
||||
b.attach_all()
|
||||
print("running")
|
||||
trace_pipe()
|
||||
|
||||
@ -23,14 +23,14 @@ def count() -> HashMap:
|
||||
def hello_world(ctx: c_void_p) -> c_int64:
|
||||
key = 0
|
||||
one = 1
|
||||
prev = count().lookup(key)
|
||||
prev = count.lookup(key)
|
||||
if prev:
|
||||
prevval = prev + 1
|
||||
print(f"count: {prevval}")
|
||||
count().update(key, prevval)
|
||||
count.update(key, prevval)
|
||||
return XDP_PASS
|
||||
else:
|
||||
count().update(key, one)
|
||||
count.update(key, one)
|
||||
|
||||
return XDP_PASS
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
from enum import Enum, auto
|
||||
from typing import Any, Dict, List, Optional, TypedDict
|
||||
from typing import Any, Dict, List, Optional
|
||||
from dataclasses import dataclass
|
||||
import llvmlite.ir as ir
|
||||
|
||||
@ -16,7 +16,7 @@ class AssignmentType(Enum):
|
||||
|
||||
|
||||
@dataclass
|
||||
class FunctionSignature(TypedDict):
|
||||
class FunctionSignature:
|
||||
return_type: str
|
||||
param_types: List[str]
|
||||
varargs: bool
|
||||
@ -24,7 +24,7 @@ class FunctionSignature(TypedDict):
|
||||
|
||||
# Thew name of the assignment will be in the dict that uses this class
|
||||
@dataclass
|
||||
class AssignmentInfo(TypedDict):
|
||||
class AssignmentInfo:
|
||||
value_type: AssignmentType
|
||||
python_type: type
|
||||
value: Optional[Any]
|
||||
|
||||
@ -144,7 +144,8 @@ mkdir -p examples
|
||||
cd examples || exit 1
|
||||
|
||||
echo "Fetching example files list..."
|
||||
FILES=$(curl -s "https://api.github.com/repos/pythonbpf/Python-BPF/contents/examples" | grep -o '"path": "examples/[^"]*"' | awk -F'"' '{print $4}')
|
||||
FILES=$(curl -s "https://api.github.com/repos/pythonbpf/Python-BPF/contents/examples" | grep -E -o '"path": "examples/[^"]*(\.md|\.ipynb|\.py)"' | awk -F'"' '{print $4}')
|
||||
BCC_EXAMPLES=$(curl -s "https://api.github.com/repos/pythonbpf/Python-BPF/contents/BCC-Examples" | grep -E -o '"path": "BCC-Examples/[^"]*(\.md|\.ipynb|\.py)"' | awk -F'"' '{print $4}')
|
||||
|
||||
if [ -z "$FILES" ]; then
|
||||
echo "Failed to fetch file list from repository. Using fallback method..."
|
||||
@ -166,11 +167,20 @@ if [ -z "$FILES" ]; then
|
||||
curl -s -O "https://raw.githubusercontent.com/pythonbpf/Python-BPF/master/examples/$example"
|
||||
done
|
||||
else
|
||||
mkdir examples && cd examples
|
||||
for file in $FILES; do
|
||||
filename=$(basename "$file")
|
||||
echo "Downloading: $filename"
|
||||
curl -s -o "$filename" "https://raw.githubusercontent.com/pythonbpf/Python-BPF/master/$file"
|
||||
done
|
||||
cd ..
|
||||
mkdir BCC-Examples && cd BCC-Examples
|
||||
for file in $BCC_EXAMPLES; do
|
||||
filename=$(basename "$file")
|
||||
echo "Downloading: $filename"
|
||||
curl -s -o "$filename" "https://raw.githubusercontent.com/pythonbpf/Python-BPF/master/$file"
|
||||
done
|
||||
cd ..
|
||||
fi
|
||||
|
||||
cd "$WORK_DIR" || exit 1
|
||||
|
||||
Reference in New Issue
Block a user