mirror of
https://github.com/varun-r-mallya/Python-BPF.git
synced 2025-12-31 21:06:25 +00:00
Compare commits
13 Commits
all_helper
...
c6b5ecb47e
| Author | SHA1 | Date | |
|---|---|---|---|
| c6b5ecb47e | |||
| 30bcfcbbd0 | |||
| f18a4399ea | |||
| 4e01df735f | |||
| 64674cf646 | |||
| 36a1a0903e | |||
| f2bc7f1434 | |||
| b3921c424d | |||
| adf32560a0 | |||
| 21cea97d78 | |||
| d8729342dc | |||
| 4179fbfc88 | |||
| ba397036b4 |
@ -1,83 +0,0 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "28cf2e27-41e2-461c-a39c-147417141a4e",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, section, bpfglobal, BPF, trace_fields\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "133190e5-5a99-4585-b6e1-91224ed973c2",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_clone\")\n",
|
||||
"def hello_world(ctx: c_void_p) -> c_int64:\n",
|
||||
" print(\"Hello, World!\")\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Compile and load\n",
|
||||
"b = BPF()\n",
|
||||
"b.load()\n",
|
||||
"b.attach_all()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "d3934efb-4043-4545-ae4c-c50ec40a24fd",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"# header\n",
|
||||
"print(f\"{'TIME(s)':<18} {'COMM':<16} {'PID':<6} {'MESSAGE'}\")\n",
|
||||
"\n",
|
||||
"# format output\n",
|
||||
"while True:\n",
|
||||
" try:\n",
|
||||
" (task, pid, cpu, flags, ts, msg) = trace_fields()\n",
|
||||
" except ValueError:\n",
|
||||
" continue\n",
|
||||
" except KeyboardInterrupt:\n",
|
||||
" exit()\n",
|
||||
" print(f\"{ts:<18} {task:<16} {pid:<6} {msg}\")"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
@ -1,110 +0,0 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "79b74928-f4b4-4320-96e3-d973997de2f4",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, map, struct, section, bpfglobal, BPF\n",
|
||||
"from pythonbpf.helper import ktime, pid, comm\n",
|
||||
"from pythonbpf.maps import PerfEventArray\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "5bdb0329-ae2d-45e8-808e-5ed5b1374204",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@struct\n",
|
||||
"class data_t:\n",
|
||||
" pid: c_int64\n",
|
||||
" ts: c_int64\n",
|
||||
" comm: str(16)\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@map\n",
|
||||
"def events() -> PerfEventArray:\n",
|
||||
" return PerfEventArray(key_size=c_int64, value_size=c_int64)\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_clone\")\n",
|
||||
"def hello(ctx: c_void_p) -> c_int64:\n",
|
||||
" dataobj = data_t()\n",
|
||||
" dataobj.pid, dataobj.ts = pid(), ktime()\n",
|
||||
" comm(dataobj.comm)\n",
|
||||
" events.output(dataobj)\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Compile and load\n",
|
||||
"b = BPF()\n",
|
||||
"b.load()\n",
|
||||
"b.attach_all()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "4bcc7d57-6cc4-48a3-bbd2-42ad6263afdf",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"start = 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"def callback(cpu, event):\n",
|
||||
" global start\n",
|
||||
" if start == 0:\n",
|
||||
" start = event.ts\n",
|
||||
" ts = (event.ts - start) / 1e9\n",
|
||||
" print(f\"[CPU {cpu}] PID: {event.pid}, TS: {ts}, COMM: {event.comm.decode()}\")\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"perf = b[\"events\"].open_perf_buffer(callback, struct_name=\"data_t\")\n",
|
||||
"print(\"Starting to poll... (Ctrl+C to stop)\")\n",
|
||||
"print(\"Try running: fork() or clone() system calls to trigger events\")\n",
|
||||
"\n",
|
||||
"try:\n",
|
||||
" while True:\n",
|
||||
" b[\"events\"].poll(1000)\n",
|
||||
"except KeyboardInterrupt:\n",
|
||||
" print(\"Stopping...\")"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
@ -1,116 +0,0 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 9,
|
||||
"id": "7d5d3cfb-39ba-4516-9856-b3bed47a0cef",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, section, bpfglobal, BPF, trace_pipe\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": 10,
|
||||
"id": "cf1c87aa-e173-4156-8f2d-762225bc6d19",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_clone\")\n",
|
||||
"def hello_world(ctx: c_void_p) -> c_int64:\n",
|
||||
" print(\"Hello, World!\")\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"b = BPF()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "bd81383d-f75a-4269-8451-3d985d85b124",
|
||||
"metadata": {
|
||||
"scrolled": true
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"name": "stdout",
|
||||
"output_type": "stream",
|
||||
"text": [
|
||||
" Cache2 I/O-4716 [003] ...21 8218.000492: bpf_trace_printk: count: 11 with 4716\n",
|
||||
"\n",
|
||||
" Cache2 I/O-4716 [003] ...21 8218.000499: bpf_trace_printk: Hello, World!\n",
|
||||
"\n",
|
||||
" WebExtensions-5168 [002] ...21 8219.320392: bpf_trace_printk: count: 13 with 5168\n",
|
||||
"\n",
|
||||
" WebExtensions-5168 [002] ...21 8219.320399: bpf_trace_printk: Hello, World!\n",
|
||||
"\n",
|
||||
" python-21155 [001] ...21 8220.933716: bpf_trace_printk: count: 5 with 21155\n",
|
||||
"\n",
|
||||
" python-21155 [001] ...21 8220.933721: bpf_trace_printk: Hello, World!\n",
|
||||
"\n",
|
||||
" python-21155 [002] ...21 8221.341290: bpf_trace_printk: count: 6 with 21155\n",
|
||||
"\n",
|
||||
" python-21155 [002] ...21 8221.341295: bpf_trace_printk: Hello, World!\n",
|
||||
"\n",
|
||||
" Isolated Web Co-5462 [000] ...21 8223.095033: bpf_trace_printk: count: 7 with 5462\n",
|
||||
"\n",
|
||||
" Isolated Web Co-5462 [000] ...21 8223.095043: bpf_trace_printk: Hello, World!\n",
|
||||
"\n",
|
||||
" firefox-4542 [000] ...21 8227.760067: bpf_trace_printk: count: 8 with 4542\n",
|
||||
"\n",
|
||||
" firefox-4542 [000] ...21 8227.760080: bpf_trace_printk: Hello, World!\n",
|
||||
"\n",
|
||||
" Isolated Web Co-12404 [003] ...21 8227.917086: bpf_trace_printk: count: 7 with 12404\n",
|
||||
"\n",
|
||||
" Isolated Web Co-12404 [003] ...21 8227.917095: bpf_trace_printk: Hello, World!\n",
|
||||
"\n"
|
||||
]
|
||||
}
|
||||
],
|
||||
"source": [
|
||||
"b.load()\n",
|
||||
"b.attach_all()\n",
|
||||
"trace_pipe()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "01e1f25b-decc-425b-a1aa-a5e701082574",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": []
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
@ -1,107 +0,0 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "dcab010c-f5e9-446f-9f9f-056cc794ad14",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, map, section, bpfglobal, BPF, trace_fields\n",
|
||||
"from pythonbpf.helper import ktime\n",
|
||||
"from pythonbpf.maps import HashMap\n",
|
||||
"\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "720797e8-9c81-4af6-a385-80f1ec4c0f15",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@map\n",
|
||||
"def last() -> HashMap:\n",
|
||||
" return HashMap(key=c_int64, value=c_int64, max_entries=2)\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_sync\")\n",
|
||||
"def do_trace(ctx: c_void_p) -> c_int64:\n",
|
||||
" ts_key, cnt_key = 0, 1\n",
|
||||
" tsp, cntp = last.lookup(ts_key), last.lookup(cnt_key)\n",
|
||||
" if not cntp:\n",
|
||||
" last.update(cnt_key, 0)\n",
|
||||
" cntp = last.lookup(cnt_key)\n",
|
||||
" if tsp:\n",
|
||||
" delta = ktime() - tsp\n",
|
||||
" if delta < 1000000000:\n",
|
||||
" time_ms = delta // 1000000\n",
|
||||
" print(f\"{time_ms} {cntp}\")\n",
|
||||
" last.delete(ts_key)\n",
|
||||
" else:\n",
|
||||
" last.update(ts_key, ktime())\n",
|
||||
" last.update(cnt_key, cntp + 1)\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Compile and load\n",
|
||||
"b = BPF()\n",
|
||||
"b.load()\n",
|
||||
"b.attach_all()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "78a8b82c-7c5f-43c1-9de1-cd982a0f345b",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"print(\"Tracing for quick sync's... Ctrl-C to end\")\n",
|
||||
"\n",
|
||||
"# format output\n",
|
||||
"start = 0\n",
|
||||
"while True:\n",
|
||||
" try:\n",
|
||||
" task, pid, cpu, flags, ts, msg = trace_fields()\n",
|
||||
" if start == 0:\n",
|
||||
" start = ts\n",
|
||||
" ts -= start\n",
|
||||
" ms, cnt = msg.split()\n",
|
||||
" print(f\"At time {ts} s: Multiple syncs detected, last {ms} ms ago. Count {cnt}\")\n",
|
||||
" except KeyboardInterrupt:\n",
|
||||
" exit()"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
@ -1,134 +0,0 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "b0d1ab05-0c1f-4578-9c1b-568202b95a5c",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, map, struct, section, bpfglobal, BPF\n",
|
||||
"from pythonbpf.helper import ktime\n",
|
||||
"from pythonbpf.maps import HashMap, PerfEventArray\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "85e50d0a-f9d8-468f-8e03-f5f7128f05d8",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@struct\n",
|
||||
"class data_t:\n",
|
||||
" ts: c_int64\n",
|
||||
" ms: c_int64\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@map\n",
|
||||
"def events() -> PerfEventArray:\n",
|
||||
" return PerfEventArray(key_size=c_int64, value_size=c_int64)\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@map\n",
|
||||
"def last() -> HashMap:\n",
|
||||
" return HashMap(key=c_int64, value=c_int64, max_entries=1)\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_sync\")\n",
|
||||
"def do_trace(ctx: c_void_p) -> c_int64:\n",
|
||||
" dat, dat.ts, key = data_t(), ktime(), 0\n",
|
||||
" tsp = last.lookup(key)\n",
|
||||
" if tsp:\n",
|
||||
" delta = ktime() - tsp\n",
|
||||
" if delta < 1000000000:\n",
|
||||
" dat.ms = delta // 1000000\n",
|
||||
" events.output(dat)\n",
|
||||
" last.delete(key)\n",
|
||||
" else:\n",
|
||||
" last.update(key, ktime())\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Compile and load\n",
|
||||
"b = BPF()\n",
|
||||
"b.load()\n",
|
||||
"b.attach_all()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "40bb1107-369f-4be7-9f10-37201900c16b",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"print(\"Tracing for quick sync's... Ctrl-C to end\")\n",
|
||||
"\n",
|
||||
"# format output\n",
|
||||
"start = 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"def callback(cpu, event):\n",
|
||||
" global start\n",
|
||||
" if start == 0:\n",
|
||||
" start = event.ts\n",
|
||||
" event.ts -= start\n",
|
||||
" print(\n",
|
||||
" f\"At time {event.ts / 1e9} s: Multiple sync detected, Last sync: {event.ms} ms ago\"\n",
|
||||
" )\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"perf = b[\"events\"].open_perf_buffer(callback, struct_name=\"data_t\")\n",
|
||||
"print(\"Starting to poll... (Ctrl+C to stop)\")\n",
|
||||
"print(\"Try running: fork() or clone() system calls to trigger events\")\n",
|
||||
"\n",
|
||||
"try:\n",
|
||||
" while True:\n",
|
||||
" b[\"events\"].poll(1000)\n",
|
||||
"except KeyboardInterrupt:\n",
|
||||
" print(\"Stopping...\")"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "94a588d9-3a40-437c-a35b-fc40410f3eb7",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": []
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
@ -1,6 +1,7 @@
|
||||
from pythonbpf import bpf, map, struct, section, bpfglobal, BPF
|
||||
from pythonbpf.helper import ktime
|
||||
from pythonbpf.maps import HashMap, PerfEventArray
|
||||
from pythonbpf.maps import HashMap
|
||||
from pythonbpf.maps import PerfEventArray
|
||||
from ctypes import c_void_p, c_int64
|
||||
|
||||
|
||||
|
||||
@ -1,102 +0,0 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "bfe01ceb-2f27-41b3-b3ba-50ec65cfddda",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, map, section, bpfglobal, BPF, trace_fields\n",
|
||||
"from pythonbpf.helper import ktime\n",
|
||||
"from pythonbpf.maps import HashMap\n",
|
||||
"\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "ddb115f4-20a7-43bc-bb5b-ccbfd6031fc2",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@map\n",
|
||||
"def last() -> HashMap:\n",
|
||||
" return HashMap(key=c_int64, value=c_int64, max_entries=1)\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_sync\")\n",
|
||||
"def do_trace(ctx: c_void_p) -> c_int64:\n",
|
||||
" key = 0\n",
|
||||
" tsp = last.lookup(key)\n",
|
||||
" if tsp:\n",
|
||||
" delta = ktime() - tsp\n",
|
||||
" if delta < 1000000000:\n",
|
||||
" time_ms = delta // 1000000\n",
|
||||
" print(f\"{time_ms}\")\n",
|
||||
" last.delete(key)\n",
|
||||
" else:\n",
|
||||
" last.update(key, ktime())\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Compile and load\n",
|
||||
"b = BPF()\n",
|
||||
"b.load()\n",
|
||||
"b.attach_all()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "e4f46574-9fd8-46e7-9c7b-27a36d07f200",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"print(\"Tracing for quick sync's... Ctrl-C to end\")\n",
|
||||
"\n",
|
||||
"# format output\n",
|
||||
"start = 0\n",
|
||||
"while True:\n",
|
||||
" try:\n",
|
||||
" task, pid, cpu, flags, ts, ms = trace_fields()\n",
|
||||
" if start == 0:\n",
|
||||
" start = ts\n",
|
||||
" ts -= start\n",
|
||||
" print(f\"At time {ts} s: Multiple syncs detected, last {ms} ms ago\")\n",
|
||||
" except KeyboardInterrupt:\n",
|
||||
" exit()"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
@ -1,73 +0,0 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "bb49598f-b9cc-4ea8-8391-923cad513711",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"from pythonbpf import bpf, section, bpfglobal, BPF, trace_pipe\n",
|
||||
"from ctypes import c_void_p, c_int64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "5da237b0-1c7d-4ec5-8c24-696b1c1d97fa",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"@bpf\n",
|
||||
"@section(\"tracepoint/syscalls/sys_enter_sync\")\n",
|
||||
"def hello_world(ctx: c_void_p) -> c_int64:\n",
|
||||
" print(\"sys_sync() called\")\n",
|
||||
" return 0\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"@bpf\n",
|
||||
"@bpfglobal\n",
|
||||
"def LICENSE() -> str:\n",
|
||||
" return \"GPL\"\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"# Compile and load\n",
|
||||
"b = BPF()\n",
|
||||
"b.load()\n",
|
||||
"b.attach_all()"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "e4c218ac-fe47-4fd1-a27b-c07e02f3cd05",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"print(\"Tracing sys_sync()... Ctrl-C to end.\")\n",
|
||||
"trace_pipe()"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.13.3"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
@ -21,17 +21,17 @@ def last() -> HashMap:
|
||||
@section("tracepoint/syscalls/sys_enter_execve")
|
||||
def do_trace(ctx: c_void_p) -> c_int64:
|
||||
key = 0
|
||||
tsp = last.lookup(key)
|
||||
tsp = last().lookup(key)
|
||||
if tsp:
|
||||
kt = ktime()
|
||||
delta = kt - tsp
|
||||
if delta < 1000000000:
|
||||
time_ms = delta // 1000000
|
||||
print(f"Execve syscall entered within last second, last {time_ms} ms ago")
|
||||
last.delete(key)
|
||||
last().delete(key)
|
||||
else:
|
||||
kt = ktime()
|
||||
last.update(key, kt)
|
||||
last().update(key, kt)
|
||||
return c_int64(0)
|
||||
|
||||
|
||||
|
||||
File diff suppressed because one or more lines are too long
@ -3,6 +3,7 @@ import time
|
||||
from pythonbpf import bpf, map, section, bpfglobal, BPF
|
||||
from pythonbpf.helper import pid
|
||||
from pythonbpf.maps import HashMap
|
||||
from pylibbpf import BpfMap
|
||||
from ctypes import c_void_p, c_int64, c_uint64, c_int32
|
||||
import matplotlib.pyplot as plt
|
||||
|
||||
@ -25,14 +26,14 @@ def hist() -> HashMap:
|
||||
def hello(ctx: c_void_p) -> c_int64:
|
||||
process_id = pid()
|
||||
one = 1
|
||||
prev = hist.lookup(process_id)
|
||||
prev = hist().lookup(process_id)
|
||||
if prev:
|
||||
previous_value = prev + 1
|
||||
print(f"count: {previous_value} with {process_id}")
|
||||
hist.update(process_id, previous_value)
|
||||
hist().update(process_id, previous_value)
|
||||
return c_int64(0)
|
||||
else:
|
||||
hist.update(process_id, one)
|
||||
hist().update(process_id, one)
|
||||
return c_int64(0)
|
||||
|
||||
|
||||
@ -43,12 +44,12 @@ def LICENSE() -> str:
|
||||
|
||||
|
||||
b = BPF()
|
||||
b.load()
|
||||
b.attach_all()
|
||||
b.load_and_attach()
|
||||
hist = BpfMap(b, hist)
|
||||
print("Recording")
|
||||
time.sleep(10)
|
||||
|
||||
counts = list(b["hist"].values())
|
||||
counts = list(hist.values())
|
||||
|
||||
plt.hist(counts, bins=20)
|
||||
plt.xlabel("Clone calls per PID")
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
from pythonbpf import bpf, section, bpfglobal, BPF, trace_pipe
|
||||
from pythonbpf import bpf, section, bpfglobal, BPF
|
||||
from ctypes import c_void_p, c_int64
|
||||
|
||||
# Instructions to how to run this program
|
||||
@ -21,6 +21,10 @@ def LICENSE() -> str:
|
||||
|
||||
|
||||
b = BPF()
|
||||
b.load()
|
||||
b.attach_all()
|
||||
trace_pipe()
|
||||
b.load_and_attach()
|
||||
if b.is_loaded() and b.is_attached():
|
||||
print("Successfully loaded and attached")
|
||||
else:
|
||||
print("Could not load successfully")
|
||||
|
||||
# Now cat /sys/kernel/debug/tracing/trace_pipe to see results of the execve syscall.
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
from pythonbpf import bpf, section, bpfglobal, BPF, trace_pipe
|
||||
from pythonbpf import bpf, section, bpfglobal, BPF
|
||||
from ctypes import c_void_p, c_int64
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ def LICENSE() -> str:
|
||||
|
||||
|
||||
b = BPF()
|
||||
b.load()
|
||||
b.attach_all()
|
||||
print("running")
|
||||
trace_pipe()
|
||||
b.load_and_attach()
|
||||
while True:
|
||||
print("running")
|
||||
# Now cat /sys/kernel/debug/tracing/trace_pipe to see results of unlink kprobe.
|
||||
|
||||
@ -23,14 +23,14 @@ def count() -> HashMap:
|
||||
def hello_world(ctx: c_void_p) -> c_int64:
|
||||
key = 0
|
||||
one = 1
|
||||
prev = count.lookup(key)
|
||||
prev = count().lookup(key)
|
||||
if prev:
|
||||
prevval = prev + 1
|
||||
print(f"count: {prevval}")
|
||||
count.update(key, prevval)
|
||||
count().update(key, prevval)
|
||||
return XDP_PASS
|
||||
else:
|
||||
count.update(key, one)
|
||||
count().update(key, one)
|
||||
|
||||
return XDP_PASS
|
||||
|
||||
|
||||
@ -2,27 +2,15 @@ import ast
|
||||
import logging
|
||||
|
||||
from llvmlite import ir
|
||||
from dataclasses import dataclass
|
||||
from typing import Any
|
||||
from .local_symbol import LocalSymbol
|
||||
from pythonbpf.helper import HelperHandlerRegistry
|
||||
from pythonbpf.vmlinux_parser.dependency_node import Field
|
||||
from .expr import VmlinuxHandlerRegistry
|
||||
from pythonbpf.type_deducer import ctypes_to_ir
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
@dataclass
|
||||
class LocalSymbol:
|
||||
var: ir.AllocaInstr
|
||||
ir_type: ir.Type
|
||||
metadata: Any = None
|
||||
|
||||
def __iter__(self):
|
||||
yield self.var
|
||||
yield self.ir_type
|
||||
yield self.metadata
|
||||
|
||||
|
||||
def create_targets_and_rvals(stmt):
|
||||
"""Create lists of targets and right-hand values from an assignment statement."""
|
||||
if isinstance(stmt.targets[0], ast.Tuple):
|
||||
@ -60,21 +48,11 @@ def handle_assign_allocation(builder, stmt, local_sym_tab, structs_sym_tab):
|
||||
continue
|
||||
|
||||
var_name = target.id
|
||||
|
||||
# Skip if already allocated
|
||||
if var_name in local_sym_tab:
|
||||
logger.debug(f"Variable {var_name} already allocated, skipping")
|
||||
continue
|
||||
|
||||
# When allocating a variable, check if it's a vmlinux struct type
|
||||
if isinstance(
|
||||
stmt.value, ast.Name
|
||||
) and VmlinuxHandlerRegistry.is_vmlinux_struct(stmt.value.id):
|
||||
# Handle vmlinux struct allocation
|
||||
# This requires more implementation
|
||||
print(stmt.value)
|
||||
pass
|
||||
|
||||
# Determine type and allocate based on rval
|
||||
if isinstance(rval, ast.Call):
|
||||
_allocate_for_call(builder, var_name, rval, local_sym_tab, structs_sym_tab)
|
||||
@ -199,33 +177,17 @@ def _allocate_for_binop(builder, var_name, local_sym_tab):
|
||||
logger.info(f"Pre-allocated {var_name} for binop result")
|
||||
|
||||
|
||||
def _get_type_name(ir_type):
|
||||
"""Get a string representation of an IR type."""
|
||||
if isinstance(ir_type, ir.IntType):
|
||||
return f"i{ir_type.width}"
|
||||
elif isinstance(ir_type, ir.PointerType):
|
||||
return "ptr"
|
||||
elif isinstance(ir_type, ir.ArrayType):
|
||||
return f"[{ir_type.count}x{_get_type_name(ir_type.element)}]"
|
||||
else:
|
||||
return str(ir_type).replace(" ", "")
|
||||
|
||||
|
||||
def allocate_temp_pool(builder, max_temps, local_sym_tab):
|
||||
"""Allocate the temporary scratch space pool for helper arguments."""
|
||||
if not max_temps:
|
||||
logger.info("No temp pool allocation needed")
|
||||
if max_temps == 0:
|
||||
return
|
||||
|
||||
for tmp_type, cnt in max_temps.items():
|
||||
type_name = _get_type_name(tmp_type)
|
||||
logger.info(f"Allocating temp pool of {cnt} variables of type {type_name}")
|
||||
for i in range(cnt):
|
||||
temp_name = f"__helper_temp_{type_name}_{i}"
|
||||
temp_var = builder.alloca(tmp_type, name=temp_name)
|
||||
temp_var.align = _get_alignment(tmp_type)
|
||||
local_sym_tab[temp_name] = LocalSymbol(temp_var, tmp_type)
|
||||
logger.debug(f"Allocated temp variable: {temp_name}")
|
||||
logger.info(f"Allocating temp pool of {max_temps} variables")
|
||||
for i in range(max_temps):
|
||||
temp_name = f"__helper_temp_{i}"
|
||||
temp_var = builder.alloca(ir.IntType(64), name=temp_name)
|
||||
temp_var.align = 8
|
||||
local_sym_tab[temp_name] = LocalSymbol(temp_var, ir.IntType(64))
|
||||
|
||||
|
||||
def _allocate_for_name(builder, var_name, rval, local_sym_tab):
|
||||
@ -264,9 +226,46 @@ def _allocate_for_attribute(builder, var_name, rval, local_sym_tab, structs_sym_
|
||||
logger.error(f"Struct variable '{struct_var}' not found")
|
||||
return
|
||||
|
||||
struct_type = local_sym_tab[struct_var].metadata
|
||||
struct_type: type = local_sym_tab[struct_var].metadata
|
||||
if not struct_type or struct_type not in structs_sym_tab:
|
||||
logger.error(f"Struct type '{struct_type}' not found")
|
||||
if VmlinuxHandlerRegistry.is_vmlinux_struct(struct_type.__name__):
|
||||
# Handle vmlinux struct field access
|
||||
vmlinux_struct_name = struct_type.__name__
|
||||
if not VmlinuxHandlerRegistry.has_field(vmlinux_struct_name, field_name):
|
||||
logger.error(
|
||||
f"Field '{field_name}' not found in vmlinux struct '{vmlinux_struct_name}'"
|
||||
)
|
||||
return
|
||||
|
||||
field_type: tuple[ir.GlobalVariable, Field] = (
|
||||
VmlinuxHandlerRegistry.get_field_type(vmlinux_struct_name, field_name)
|
||||
)
|
||||
field_ir, field = field_type
|
||||
# TODO: For now, we only support integer type allocations.
|
||||
|
||||
# loaded_value = builder.load(field_ir, align=8)
|
||||
# #TODO: fatal flaw that this always assumes first argument of function to be the context of what this gets.
|
||||
# base_ptr = builder.function.args[0]
|
||||
# gep_result = builder.gep(
|
||||
# base_ptr,
|
||||
# [loaded_value],
|
||||
# inbounds=False, # Not using inbounds GEP
|
||||
# )
|
||||
# print("DEBB", loaded_value, base_ptr, gep_result)
|
||||
# Use i64 for allocation since that's what the global variable contains
|
||||
|
||||
actual_ir_type = ir.IntType(64)
|
||||
|
||||
# Allocate with the actual IR type, not the GlobalVariable
|
||||
var = _allocate_with_type(builder, var_name, actual_ir_type)
|
||||
local_sym_tab[var_name] = LocalSymbol(var, actual_ir_type, field)
|
||||
|
||||
logger.info(
|
||||
f"Pre-allocated {var_name} from vmlinux struct {vmlinux_struct_name}.{field_name}"
|
||||
)
|
||||
return
|
||||
else:
|
||||
logger.error(f"Struct type '{struct_type}' not found")
|
||||
return
|
||||
|
||||
struct_info = structs_sym_tab[struct_type]
|
||||
|
||||
@ -37,6 +37,24 @@ def finalize_module(original_str):
|
||||
return re.sub(pattern, replacement, original_str)
|
||||
|
||||
|
||||
def bpf_passthrough_gen(module):
|
||||
i32_ty = ir.IntType(32)
|
||||
ptr_ty = ir.PointerType(ir.IntType(8))
|
||||
fnty = ir.FunctionType(ptr_ty, [i32_ty, ptr_ty])
|
||||
|
||||
# Declare the intrinsic
|
||||
passthrough = ir.Function(module, fnty, "llvm.bpf.passthrough.p0.p0")
|
||||
|
||||
# Set function attributes
|
||||
# TODO: the ones commented are supposed to be there but cannot be added due to llvmlite limitations at the moment
|
||||
# passthrough.attributes.add("nofree")
|
||||
# passthrough.attributes.add("nosync")
|
||||
passthrough.attributes.add("nounwind")
|
||||
# passthrough.attributes.add("memory(none)")
|
||||
|
||||
return passthrough
|
||||
|
||||
|
||||
def find_bpf_chunks(tree):
|
||||
"""Find all functions decorated with @bpf in the AST."""
|
||||
bpf_functions = []
|
||||
@ -57,6 +75,8 @@ def processor(source_code, filename, module):
|
||||
for func_node in bpf_chunks:
|
||||
logger.info(f"Found BPF function/struct: {func_node.name}")
|
||||
|
||||
bpf_passthrough_gen(module)
|
||||
|
||||
vmlinux_symtab = vmlinux_proc(tree, module)
|
||||
if vmlinux_symtab:
|
||||
handler = VmlinuxHandler.initialize(vmlinux_symtab)
|
||||
|
||||
@ -72,20 +72,28 @@ def _handle_attribute_expr(
|
||||
if var_name in local_sym_tab:
|
||||
var_ptr, var_type, var_metadata = local_sym_tab[var_name]
|
||||
logger.info(f"Loading attribute {attr_name} from variable {var_name}")
|
||||
logger.info(f"Variable type: {var_type}, Variable ptr: {var_ptr}")
|
||||
logger.info(
|
||||
f"Variable type: {var_type}, Variable ptr: {var_ptr}, Variable Metadata: {var_metadata}"
|
||||
)
|
||||
if (
|
||||
hasattr(var_metadata, "__module__")
|
||||
and var_metadata.__module__ == "vmlinux"
|
||||
):
|
||||
# Try vmlinux handler when var_metadata is not a string, but has a module attribute.
|
||||
# This has been done to keep everything separate in vmlinux struct handling.
|
||||
vmlinux_result = VmlinuxHandlerRegistry.handle_attribute(
|
||||
expr, local_sym_tab, None, builder
|
||||
)
|
||||
if vmlinux_result is not None:
|
||||
return vmlinux_result
|
||||
else:
|
||||
raise RuntimeError("Vmlinux struct did not process successfully")
|
||||
metadata = structs_sym_tab[var_metadata]
|
||||
if attr_name in metadata.fields:
|
||||
gep = metadata.gep(builder, var_ptr, attr_name)
|
||||
val = builder.load(gep)
|
||||
field_type = metadata.field_type(attr_name)
|
||||
return val, field_type
|
||||
|
||||
# Try vmlinux handler as fallback
|
||||
vmlinux_result = VmlinuxHandlerRegistry.handle_attribute(
|
||||
expr, local_sym_tab, None, builder
|
||||
)
|
||||
if vmlinux_result is not None:
|
||||
return vmlinux_result
|
||||
return None
|
||||
|
||||
|
||||
|
||||
@ -1,5 +1,7 @@
|
||||
import ast
|
||||
|
||||
from pythonbpf.vmlinux_parser.vmlinux_exports_handler import VmlinuxHandler
|
||||
|
||||
|
||||
class VmlinuxHandlerRegistry:
|
||||
"""Registry for vmlinux handler operations"""
|
||||
@ -7,7 +9,7 @@ class VmlinuxHandlerRegistry:
|
||||
_handler = None
|
||||
|
||||
@classmethod
|
||||
def set_handler(cls, handler):
|
||||
def set_handler(cls, handler: VmlinuxHandler):
|
||||
"""Set the vmlinux handler"""
|
||||
cls._handler = handler
|
||||
|
||||
@ -43,3 +45,25 @@ class VmlinuxHandlerRegistry:
|
||||
if cls._handler is None:
|
||||
return False
|
||||
return cls._handler.is_vmlinux_struct(name)
|
||||
|
||||
@classmethod
|
||||
def get_struct_type(cls, name):
|
||||
"""Try to handle a struct name as vmlinux struct"""
|
||||
if cls._handler is None:
|
||||
return None
|
||||
return cls._handler.get_vmlinux_struct_type(name)
|
||||
|
||||
@classmethod
|
||||
def has_field(cls, vmlinux_struct_name, field_name):
|
||||
"""Check if a vmlinux struct has a specific field"""
|
||||
if cls._handler is None:
|
||||
return False
|
||||
return cls._handler.has_field(vmlinux_struct_name, field_name)
|
||||
|
||||
@classmethod
|
||||
def get_field_type(cls, vmlinux_struct_name, field_name):
|
||||
"""Get the type of a field in a vmlinux struct"""
|
||||
if cls._handler is None:
|
||||
return None
|
||||
assert isinstance(cls._handler, VmlinuxHandler)
|
||||
return cls._handler.get_field_type(vmlinux_struct_name, field_name)
|
||||
|
||||
@ -7,7 +7,12 @@ from pythonbpf.helper import (
|
||||
reset_scratch_pool,
|
||||
)
|
||||
from pythonbpf.type_deducer import ctypes_to_ir
|
||||
from pythonbpf.expr import eval_expr, handle_expr, convert_to_bool
|
||||
from pythonbpf.expr import (
|
||||
eval_expr,
|
||||
handle_expr,
|
||||
convert_to_bool,
|
||||
VmlinuxHandlerRegistry,
|
||||
)
|
||||
from pythonbpf.assign_pass import (
|
||||
handle_variable_assignment,
|
||||
handle_struct_field_assignment,
|
||||
@ -16,6 +21,7 @@ from pythonbpf.allocation_pass import (
|
||||
handle_assign_allocation,
|
||||
allocate_temp_pool,
|
||||
create_targets_and_rvals,
|
||||
LocalSymbol,
|
||||
)
|
||||
|
||||
from .return_utils import handle_none_return, handle_xdp_return, is_xdp_name
|
||||
@ -33,7 +39,7 @@ logger = logging.getLogger(__name__)
|
||||
def count_temps_in_call(call_node, local_sym_tab):
|
||||
"""Count the number of temporary variables needed for a function call."""
|
||||
|
||||
count = {}
|
||||
count = 0
|
||||
is_helper = False
|
||||
|
||||
# NOTE: We exclude print calls for now
|
||||
@ -43,28 +49,21 @@ def count_temps_in_call(call_node, local_sym_tab):
|
||||
and call_node.func.id != "print"
|
||||
):
|
||||
is_helper = True
|
||||
func_name = call_node.func.id
|
||||
elif isinstance(call_node.func, ast.Attribute):
|
||||
if HelperHandlerRegistry.has_handler(call_node.func.attr):
|
||||
is_helper = True
|
||||
func_name = call_node.func.attr
|
||||
|
||||
if not is_helper:
|
||||
return {} # No temps needed
|
||||
return 0
|
||||
|
||||
for arg_idx in range(len(call_node.args)):
|
||||
for arg in call_node.args:
|
||||
# NOTE: Count all non-name arguments
|
||||
# For struct fields, if it is being passed as an argument,
|
||||
# The struct object should already exist in the local_sym_tab
|
||||
arg = call_node.args[arg_idx]
|
||||
if isinstance(arg, ast.Name) or (
|
||||
if not isinstance(arg, ast.Name) and not (
|
||||
isinstance(arg, ast.Attribute) and arg.value.id in local_sym_tab
|
||||
):
|
||||
continue
|
||||
param_type = HelperHandlerRegistry.get_param_type(func_name, arg_idx)
|
||||
if isinstance(param_type, ir.PointerType):
|
||||
pointee_type = param_type.pointee
|
||||
count[pointee_type] = count.get(pointee_type, 0) + 1
|
||||
count += 1
|
||||
|
||||
return count
|
||||
|
||||
@ -100,15 +99,11 @@ def handle_if_allocation(
|
||||
def allocate_mem(
|
||||
module, builder, body, func, ret_type, map_sym_tab, local_sym_tab, structs_sym_tab
|
||||
):
|
||||
max_temps_needed = {}
|
||||
|
||||
def merge_type_counts(count_dict):
|
||||
nonlocal max_temps_needed
|
||||
for typ, cnt in count_dict.items():
|
||||
max_temps_needed[typ] = max(max_temps_needed.get(typ, 0), cnt)
|
||||
max_temps_needed = 0
|
||||
|
||||
def update_max_temps_for_stmt(stmt):
|
||||
nonlocal max_temps_needed
|
||||
temps_needed = 0
|
||||
|
||||
if isinstance(stmt, ast.If):
|
||||
for s in stmt.body:
|
||||
@ -117,13 +112,10 @@ def allocate_mem(
|
||||
update_max_temps_for_stmt(s)
|
||||
return
|
||||
|
||||
stmt_temps = {}
|
||||
for node in ast.walk(stmt):
|
||||
if isinstance(node, ast.Call):
|
||||
call_temps = count_temps_in_call(node, local_sym_tab)
|
||||
for typ, cnt in call_temps.items():
|
||||
stmt_temps[typ] = stmt_temps.get(typ, 0) + cnt
|
||||
merge_type_counts(stmt_temps)
|
||||
temps_needed += count_temps_in_call(node, local_sym_tab)
|
||||
max_temps_needed = max(max_temps_needed, temps_needed)
|
||||
|
||||
for stmt in body:
|
||||
update_max_temps_for_stmt(stmt)
|
||||
@ -338,6 +330,28 @@ def process_func_body(
|
||||
|
||||
local_sym_tab = {}
|
||||
|
||||
# Add the context parameter (first function argument) to the local symbol table
|
||||
if func_node.args.args and len(func_node.args.args) > 0:
|
||||
context_arg = func_node.args.args[0]
|
||||
context_name = context_arg.arg
|
||||
|
||||
if hasattr(context_arg, "annotation") and context_arg.annotation:
|
||||
if isinstance(context_arg.annotation, ast.Name):
|
||||
context_type_name = context_arg.annotation.id
|
||||
elif isinstance(context_arg.annotation, ast.Attribute):
|
||||
context_type_name = context_arg.annotation.attr
|
||||
else:
|
||||
raise TypeError(
|
||||
f"Unsupported annotation type: {ast.dump(context_arg.annotation)}"
|
||||
)
|
||||
if VmlinuxHandlerRegistry.is_vmlinux_struct(context_type_name):
|
||||
resolved_type = VmlinuxHandlerRegistry.get_struct_type(
|
||||
context_type_name
|
||||
)
|
||||
context_type = LocalSymbol(None, None, resolved_type)
|
||||
local_sym_tab[context_name] = context_type
|
||||
logger.info(f"Added argument '{context_name}' to local symbol table")
|
||||
|
||||
# pre-allocate dynamic variables
|
||||
local_sym_tab = allocate_mem(
|
||||
module,
|
||||
|
||||
@ -1,20 +1,7 @@
|
||||
from .helper_registry import HelperHandlerRegistry
|
||||
from .helper_utils import reset_scratch_pool
|
||||
from .bpf_helper_handler import handle_helper_call, emit_probe_read_kernel_str_call
|
||||
from .helpers import (
|
||||
ktime,
|
||||
pid,
|
||||
deref,
|
||||
comm,
|
||||
probe_read_str,
|
||||
random,
|
||||
probe_read,
|
||||
smp_processor_id,
|
||||
uid,
|
||||
skb_store_bytes,
|
||||
XDP_DROP,
|
||||
XDP_PASS,
|
||||
)
|
||||
from .helpers import ktime, pid, deref, comm, probe_read_str, XDP_DROP, XDP_PASS
|
||||
|
||||
|
||||
# Register the helper handler with expr module
|
||||
@ -78,11 +65,6 @@ __all__ = [
|
||||
"deref",
|
||||
"comm",
|
||||
"probe_read_str",
|
||||
"random",
|
||||
"probe_read",
|
||||
"smp_processor_id",
|
||||
"uid",
|
||||
"skb_store_bytes",
|
||||
"XDP_DROP",
|
||||
"XDP_PASS",
|
||||
]
|
||||
|
||||
@ -8,8 +8,8 @@ from .helper_utils import (
|
||||
get_flags_val,
|
||||
get_data_ptr_and_size,
|
||||
get_buffer_ptr_and_size,
|
||||
get_char_array_ptr_and_size,
|
||||
get_ptr_from_arg,
|
||||
get_int_value_from_arg,
|
||||
)
|
||||
from .printk_formatter import simple_string_print, handle_fstring_print
|
||||
|
||||
@ -23,24 +23,15 @@ class BPFHelperID(Enum):
|
||||
BPF_MAP_LOOKUP_ELEM = 1
|
||||
BPF_MAP_UPDATE_ELEM = 2
|
||||
BPF_MAP_DELETE_ELEM = 3
|
||||
BPF_PROBE_READ = 4
|
||||
BPF_KTIME_GET_NS = 5
|
||||
BPF_PRINTK = 6
|
||||
BPF_GET_PRANDOM_U32 = 7
|
||||
BPF_GET_SMP_PROCESSOR_ID = 8
|
||||
BPF_SKB_STORE_BYTES = 9
|
||||
BPF_GET_CURRENT_PID_TGID = 14
|
||||
BPF_GET_CURRENT_UID_GID = 15
|
||||
BPF_GET_CURRENT_COMM = 16
|
||||
BPF_PERF_EVENT_OUTPUT = 25
|
||||
BPF_PROBE_READ_KERNEL_STR = 115
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"ktime",
|
||||
param_types=[],
|
||||
return_type=ir.IntType(64),
|
||||
)
|
||||
@HelperHandlerRegistry.register("ktime")
|
||||
def bpf_ktime_get_ns_emitter(
|
||||
call,
|
||||
map_ptr,
|
||||
@ -63,11 +54,7 @@ def bpf_ktime_get_ns_emitter(
|
||||
return result, ir.IntType(64)
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"lookup",
|
||||
param_types=[ir.PointerType(ir.IntType(64))],
|
||||
return_type=ir.PointerType(ir.IntType(64)),
|
||||
)
|
||||
@HelperHandlerRegistry.register("lookup")
|
||||
def bpf_map_lookup_elem_emitter(
|
||||
call,
|
||||
map_ptr,
|
||||
@ -91,9 +78,9 @@ def bpf_map_lookup_elem_emitter(
|
||||
map_void_ptr = builder.bitcast(map_ptr, ir.PointerType())
|
||||
|
||||
# TODO: I have changed the return type to i64*, as we are
|
||||
# allocating space for that type in allocate_mem. This is
|
||||
# temporary, and we will honour other widths later. But this
|
||||
# allows us to have cool binary ops on the returned value.
|
||||
# allocating space for that type in allocate_mem. This is
|
||||
# temporary, and we will honour other widths later. But this
|
||||
# allows us to have cool binary ops on the returned value.
|
||||
fn_type = ir.FunctionType(
|
||||
ir.PointerType(ir.IntType(64)), # Return type: void*
|
||||
[ir.PointerType(), ir.PointerType()], # Args: (void*, void*)
|
||||
@ -109,7 +96,6 @@ def bpf_map_lookup_elem_emitter(
|
||||
return result, ir.PointerType()
|
||||
|
||||
|
||||
# NOTE: This has special handling so we won't reflect the signature here.
|
||||
@HelperHandlerRegistry.register("print")
|
||||
def bpf_printk_emitter(
|
||||
call,
|
||||
@ -158,15 +144,7 @@ def bpf_printk_emitter(
|
||||
return True
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"update",
|
||||
param_types=[
|
||||
ir.PointerType(ir.IntType(64)),
|
||||
ir.PointerType(ir.IntType(64)),
|
||||
ir.IntType(64),
|
||||
],
|
||||
return_type=ir.PointerType(ir.IntType(64)),
|
||||
)
|
||||
@HelperHandlerRegistry.register("update")
|
||||
def bpf_map_update_elem_emitter(
|
||||
call,
|
||||
map_ptr,
|
||||
@ -221,11 +199,7 @@ def bpf_map_update_elem_emitter(
|
||||
return result, None
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"delete",
|
||||
param_types=[ir.PointerType(ir.IntType(64))],
|
||||
return_type=ir.PointerType(ir.IntType(64)),
|
||||
)
|
||||
@HelperHandlerRegistry.register("delete")
|
||||
def bpf_map_delete_elem_emitter(
|
||||
call,
|
||||
map_ptr,
|
||||
@ -265,11 +239,7 @@ def bpf_map_delete_elem_emitter(
|
||||
return result, None
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"comm",
|
||||
param_types=[ir.PointerType(ir.IntType(8))],
|
||||
return_type=ir.IntType(64),
|
||||
)
|
||||
@HelperHandlerRegistry.register("comm")
|
||||
def bpf_get_current_comm_emitter(
|
||||
call,
|
||||
map_ptr,
|
||||
@ -326,11 +296,7 @@ def bpf_get_current_comm_emitter(
|
||||
return result, None
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"pid",
|
||||
param_types=[],
|
||||
return_type=ir.IntType(64),
|
||||
)
|
||||
@HelperHandlerRegistry.register("pid")
|
||||
def bpf_get_current_pid_tgid_emitter(
|
||||
call,
|
||||
map_ptr,
|
||||
@ -352,17 +318,12 @@ def bpf_get_current_pid_tgid_emitter(
|
||||
result = builder.call(fn_ptr, [], tail=False)
|
||||
|
||||
# Extract the lower 32 bits (PID) using bitwise AND with 0xFFFFFFFF
|
||||
# TODO: return both PID and TGID if we end up needing TGID somewhere
|
||||
mask = ir.Constant(ir.IntType(64), 0xFFFFFFFF)
|
||||
pid = builder.and_(result, mask)
|
||||
return pid, ir.IntType(64)
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"output",
|
||||
param_types=[ir.PointerType(ir.IntType(8))],
|
||||
return_type=ir.IntType(64),
|
||||
)
|
||||
@HelperHandlerRegistry.register("output")
|
||||
def bpf_perf_event_output_handler(
|
||||
call,
|
||||
map_ptr,
|
||||
@ -437,14 +398,7 @@ def emit_probe_read_kernel_str_call(builder, dst_ptr, dst_size, src_ptr):
|
||||
return result
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"probe_read_str",
|
||||
param_types=[
|
||||
ir.PointerType(ir.IntType(8)),
|
||||
ir.PointerType(ir.IntType(8)),
|
||||
],
|
||||
return_type=ir.IntType(64),
|
||||
)
|
||||
@HelperHandlerRegistry.register("probe_read_str")
|
||||
def bpf_probe_read_kernel_str_emitter(
|
||||
call,
|
||||
map_ptr,
|
||||
@ -463,8 +417,8 @@ def bpf_probe_read_kernel_str_emitter(
|
||||
)
|
||||
|
||||
# Get destination buffer (char array -> i8*)
|
||||
dst_ptr, dst_size = get_or_create_ptr_from_arg(
|
||||
func, module, call.args[0], builder, local_sym_tab, map_sym_tab, struct_sym_tab
|
||||
dst_ptr, dst_size = get_char_array_ptr_and_size(
|
||||
call.args[0], builder, local_sym_tab, struct_sym_tab
|
||||
)
|
||||
|
||||
# Get source pointer (evaluate expression)
|
||||
@ -479,263 +433,6 @@ def bpf_probe_read_kernel_str_emitter(
|
||||
return result, ir.IntType(64)
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"random",
|
||||
param_types=[],
|
||||
return_type=ir.IntType(32),
|
||||
)
|
||||
def bpf_get_prandom_u32_emitter(
|
||||
call,
|
||||
map_ptr,
|
||||
module,
|
||||
builder,
|
||||
func,
|
||||
local_sym_tab=None,
|
||||
struct_sym_tab=None,
|
||||
map_sym_tab=None,
|
||||
):
|
||||
"""
|
||||
Emit LLVM IR for bpf_get_prandom_u32 helper function call.
|
||||
"""
|
||||
helper_id = ir.Constant(ir.IntType(64), BPFHelperID.BPF_GET_PRANDOM_U32.value)
|
||||
fn_type = ir.FunctionType(ir.IntType(32), [], var_arg=False)
|
||||
fn_ptr_type = ir.PointerType(fn_type)
|
||||
fn_ptr = builder.inttoptr(helper_id, fn_ptr_type)
|
||||
result = builder.call(fn_ptr, [], tail=False)
|
||||
return result, ir.IntType(32)
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"probe_read",
|
||||
param_types=[
|
||||
ir.PointerType(ir.IntType(8)),
|
||||
ir.IntType(32),
|
||||
ir.PointerType(ir.IntType(8)),
|
||||
],
|
||||
return_type=ir.IntType(64),
|
||||
)
|
||||
def bpf_probe_read_emitter(
|
||||
call,
|
||||
map_ptr,
|
||||
module,
|
||||
builder,
|
||||
func,
|
||||
local_sym_tab=None,
|
||||
struct_sym_tab=None,
|
||||
map_sym_tab=None,
|
||||
):
|
||||
"""
|
||||
Emit LLVM IR for bpf_probe_read helper function
|
||||
"""
|
||||
|
||||
if len(call.args) != 3:
|
||||
logger.warn("Expected 3 args for probe_read helper")
|
||||
return
|
||||
dst_ptr = get_or_create_ptr_from_arg(
|
||||
func,
|
||||
module,
|
||||
call.args[0],
|
||||
builder,
|
||||
local_sym_tab,
|
||||
map_sym_tab,
|
||||
struct_sym_tab,
|
||||
ir.IntType(8),
|
||||
)
|
||||
size_val = get_int_value_from_arg(
|
||||
call.args[1],
|
||||
func,
|
||||
module,
|
||||
builder,
|
||||
local_sym_tab,
|
||||
map_sym_tab,
|
||||
struct_sym_tab,
|
||||
)
|
||||
src_ptr = get_or_create_ptr_from_arg(
|
||||
func,
|
||||
module,
|
||||
call.args[2],
|
||||
builder,
|
||||
local_sym_tab,
|
||||
map_sym_tab,
|
||||
struct_sym_tab,
|
||||
ir.IntType(8),
|
||||
)
|
||||
fn_type = ir.FunctionType(
|
||||
ir.IntType(64),
|
||||
[ir.PointerType(), ir.IntType(32), ir.PointerType()],
|
||||
var_arg=False,
|
||||
)
|
||||
fn_ptr = builder.inttoptr(
|
||||
ir.Constant(ir.IntType(64), BPFHelperID.BPF_PROBE_READ.value),
|
||||
ir.PointerType(fn_type),
|
||||
)
|
||||
result = builder.call(
|
||||
fn_ptr,
|
||||
[
|
||||
builder.bitcast(dst_ptr, ir.PointerType()),
|
||||
builder.trunc(size_val, ir.IntType(32)),
|
||||
builder.bitcast(src_ptr, ir.PointerType()),
|
||||
],
|
||||
tail=False,
|
||||
)
|
||||
logger.info(f"Emitted bpf_probe_read (size={size_val})")
|
||||
return result, ir.IntType(64)
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"smp_processor_id",
|
||||
param_types=[],
|
||||
return_type=ir.IntType(32),
|
||||
)
|
||||
def bpf_get_smp_processor_id_emitter(
|
||||
call,
|
||||
map_ptr,
|
||||
module,
|
||||
builder,
|
||||
func,
|
||||
local_sym_tab=None,
|
||||
struct_sym_tab=None,
|
||||
map_sym_tab=None,
|
||||
):
|
||||
"""
|
||||
Emit LLVM IR for bpf_get_smp_processor_id helper function call.
|
||||
"""
|
||||
helper_id = ir.Constant(ir.IntType(64), BPFHelperID.BPF_GET_SMP_PROCESSOR_ID.value)
|
||||
fn_type = ir.FunctionType(ir.IntType(32), [], var_arg=False)
|
||||
fn_ptr_type = ir.PointerType(fn_type)
|
||||
fn_ptr = builder.inttoptr(helper_id, fn_ptr_type)
|
||||
result = builder.call(fn_ptr, [], tail=False)
|
||||
logger.info("Emitted bpf_get_smp_processor_id call")
|
||||
return result, ir.IntType(32)
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"uid",
|
||||
param_types=[],
|
||||
return_type=ir.IntType(64),
|
||||
)
|
||||
def bpf_get_current_uid_gid_emitter(
|
||||
call,
|
||||
map_ptr,
|
||||
module,
|
||||
builder,
|
||||
func,
|
||||
local_sym_tab=None,
|
||||
struct_sym_tab=None,
|
||||
map_sym_tab=None,
|
||||
):
|
||||
"""
|
||||
Emit LLVM IR for bpf_get_current_uid_gid helper function call.
|
||||
"""
|
||||
helper_id = ir.Constant(ir.IntType(64), BPFHelperID.BPF_GET_CURRENT_UID_GID.value)
|
||||
fn_type = ir.FunctionType(ir.IntType(64), [], var_arg=False)
|
||||
fn_ptr_type = ir.PointerType(fn_type)
|
||||
fn_ptr = builder.inttoptr(helper_id, fn_ptr_type)
|
||||
result = builder.call(fn_ptr, [], tail=False)
|
||||
|
||||
# Extract the lower 32 bits (UID) using bitwise AND with 0xFFFFFFFF
|
||||
# TODO: return both UID and GID if we end up needing GID somewhere
|
||||
mask = ir.Constant(ir.IntType(64), 0xFFFFFFFF)
|
||||
pid = builder.and_(result, mask)
|
||||
return pid, ir.IntType(64)
|
||||
|
||||
|
||||
@HelperHandlerRegistry.register(
|
||||
"skb_store_bytes",
|
||||
param_types=[
|
||||
ir.IntType(32),
|
||||
ir.PointerType(ir.IntType(8)),
|
||||
ir.IntType(32),
|
||||
ir.IntType(64),
|
||||
],
|
||||
return_type=ir.IntType(64),
|
||||
)
|
||||
def bpf_skb_store_bytes_emitter(
|
||||
call,
|
||||
map_ptr,
|
||||
module,
|
||||
builder,
|
||||
func,
|
||||
local_sym_tab=None,
|
||||
struct_sym_tab=None,
|
||||
map_sym_tab=None,
|
||||
):
|
||||
"""
|
||||
Emit LLVM IR for bpf_skb_store_bytes helper function call.
|
||||
Expected call signature: skb_store_bytes(skb, offset, from, len, flags)
|
||||
"""
|
||||
|
||||
args_signature = [
|
||||
ir.PointerType(), # skb pointer
|
||||
ir.IntType(32), # offset
|
||||
ir.PointerType(), # from
|
||||
ir.IntType(32), # len
|
||||
ir.IntType(64), # flags
|
||||
]
|
||||
|
||||
if len(call.args) not in (3, 4):
|
||||
raise ValueError(
|
||||
f"skb_store_bytes expects 3 or 4 args (offset, from, len, flags), got {len(call.args)}"
|
||||
)
|
||||
|
||||
skb_ptr = func.args[0] # First argument to the function is skb
|
||||
offset_val = get_int_value_from_arg(
|
||||
call.args[0],
|
||||
func,
|
||||
module,
|
||||
builder,
|
||||
local_sym_tab,
|
||||
map_sym_tab,
|
||||
struct_sym_tab,
|
||||
)
|
||||
from_ptr = get_or_create_ptr_from_arg(
|
||||
func,
|
||||
module,
|
||||
call.args[1],
|
||||
builder,
|
||||
local_sym_tab,
|
||||
map_sym_tab,
|
||||
struct_sym_tab,
|
||||
args_signature[2],
|
||||
)
|
||||
len_val = get_int_value_from_arg(
|
||||
call.args[2],
|
||||
func,
|
||||
module,
|
||||
builder,
|
||||
local_sym_tab,
|
||||
map_sym_tab,
|
||||
struct_sym_tab,
|
||||
)
|
||||
if len(call.args) == 4:
|
||||
flags_val = get_flags_val(call.args[3], builder, local_sym_tab)
|
||||
else:
|
||||
flags_val = 0
|
||||
flags = ir.Constant(ir.IntType(64), flags_val)
|
||||
fn_type = ir.FunctionType(
|
||||
ir.IntType(64),
|
||||
args_signature,
|
||||
var_arg=False,
|
||||
)
|
||||
fn_ptr = builder.inttoptr(
|
||||
ir.Constant(ir.IntType(64), BPFHelperID.BPF_SKB_STORE_BYTES.value),
|
||||
ir.PointerType(fn_type),
|
||||
)
|
||||
result = builder.call(
|
||||
fn_ptr,
|
||||
[
|
||||
builder.bitcast(skb_ptr, ir.PointerType()),
|
||||
builder.trunc(offset_val, ir.IntType(32)),
|
||||
builder.bitcast(from_ptr, ir.PointerType()),
|
||||
builder.trunc(len_val, ir.IntType(32)),
|
||||
flags,
|
||||
],
|
||||
tail=False,
|
||||
)
|
||||
logger.info("Emitted bpf_skb_store_bytes call")
|
||||
return result, ir.IntType(64)
|
||||
|
||||
|
||||
def handle_helper_call(
|
||||
call,
|
||||
module,
|
||||
|
||||
@ -1,31 +1,17 @@
|
||||
from dataclasses import dataclass
|
||||
from llvmlite import ir
|
||||
from typing import Callable
|
||||
|
||||
|
||||
@dataclass
|
||||
class HelperSignature:
|
||||
"""Signature of a BPF helper function"""
|
||||
|
||||
arg_types: list[ir.Type]
|
||||
return_type: ir.Type
|
||||
func: Callable
|
||||
|
||||
|
||||
class HelperHandlerRegistry:
|
||||
"""Registry for BPF helpers"""
|
||||
|
||||
_handlers: dict[str, HelperSignature] = {}
|
||||
_handlers: dict[str, Callable] = {}
|
||||
|
||||
@classmethod
|
||||
def register(cls, helper_name, param_types=None, return_type=None):
|
||||
def register(cls, helper_name):
|
||||
"""Decorator to register a handler function for a helper"""
|
||||
|
||||
def decorator(func):
|
||||
helper_sig = HelperSignature(
|
||||
arg_types=param_types, return_type=return_type, func=func
|
||||
)
|
||||
cls._handlers[helper_name] = helper_sig
|
||||
cls._handlers[helper_name] = func
|
||||
return func
|
||||
|
||||
return decorator
|
||||
@ -33,29 +19,9 @@ class HelperHandlerRegistry:
|
||||
@classmethod
|
||||
def get_handler(cls, helper_name):
|
||||
"""Get the handler function for a helper"""
|
||||
handler = cls._handlers.get(helper_name)
|
||||
return handler.func if handler else None
|
||||
return cls._handlers.get(helper_name)
|
||||
|
||||
@classmethod
|
||||
def has_handler(cls, helper_name):
|
||||
"""Check if a handler function is registered for a helper"""
|
||||
return helper_name in cls._handlers
|
||||
|
||||
@classmethod
|
||||
def get_signature(cls, helper_name):
|
||||
"""Get the signature of a helper function"""
|
||||
return cls._handlers.get(helper_name)
|
||||
|
||||
@classmethod
|
||||
def get_param_type(cls, helper_name, index):
|
||||
"""Get the type of a parameter of a helper function by the index"""
|
||||
signature = cls.get_signature(helper_name)
|
||||
if signature and signature.arg_types and 0 <= index < len(signature.arg_types):
|
||||
return signature.arg_types[index]
|
||||
return None
|
||||
|
||||
@classmethod
|
||||
def get_return_type(cls, helper_name):
|
||||
"""Get the return type of a helper function"""
|
||||
signature = cls.get_signature(helper_name)
|
||||
return signature.return_type if signature else None
|
||||
|
||||
@ -14,43 +14,26 @@ class ScratchPoolManager:
|
||||
"""Manage the temporary helper variables in local_sym_tab"""
|
||||
|
||||
def __init__(self):
|
||||
self._counters = {}
|
||||
self._counter = 0
|
||||
|
||||
@property
|
||||
def counter(self):
|
||||
return sum(self._counters.values())
|
||||
return self._counter
|
||||
|
||||
def reset(self):
|
||||
self._counters.clear()
|
||||
self._counter = 0
|
||||
logger.debug("Scratch pool counter reset to 0")
|
||||
|
||||
def _get_type_name(self, ir_type):
|
||||
if isinstance(ir_type, ir.PointerType):
|
||||
return "ptr"
|
||||
elif isinstance(ir_type, ir.IntType):
|
||||
return f"i{ir_type.width}"
|
||||
elif isinstance(ir_type, ir.ArrayType):
|
||||
return f"[{ir_type.count}x{self._get_type_name(ir_type.element)}]"
|
||||
else:
|
||||
return str(ir_type).replace(" ", "")
|
||||
|
||||
def get_next_temp(self, local_sym_tab, expected_type=None):
|
||||
# Default to i64 if no expected type provided
|
||||
type_name = self._get_type_name(expected_type) if expected_type else "i64"
|
||||
if type_name not in self._counters:
|
||||
self._counters[type_name] = 0
|
||||
|
||||
counter = self._counters[type_name]
|
||||
temp_name = f"__helper_temp_{type_name}_{counter}"
|
||||
self._counters[type_name] += 1
|
||||
def get_next_temp(self, local_sym_tab):
|
||||
temp_name = f"__helper_temp_{self._counter}"
|
||||
self._counter += 1
|
||||
|
||||
if temp_name not in local_sym_tab:
|
||||
raise ValueError(
|
||||
f"Scratch pool exhausted or inadequate: {temp_name}. "
|
||||
f"Type: {type_name} Counter: {counter}"
|
||||
f"Current counter: {self._counter}"
|
||||
)
|
||||
|
||||
logger.debug(f"Using {temp_name} for type {type_name}")
|
||||
return local_sym_tab[temp_name].var, temp_name
|
||||
|
||||
|
||||
@ -77,73 +60,24 @@ def get_var_ptr_from_name(var_name, local_sym_tab):
|
||||
def create_int_constant_ptr(value, builder, local_sym_tab, int_width=64):
|
||||
"""Create a pointer to an integer constant."""
|
||||
|
||||
int_type = ir.IntType(int_width)
|
||||
ptr, temp_name = _temp_pool_manager.get_next_temp(local_sym_tab, int_type)
|
||||
# Default to 64-bit integer
|
||||
ptr, temp_name = _temp_pool_manager.get_next_temp(local_sym_tab)
|
||||
logger.info(f"Using temp variable '{temp_name}' for int constant {value}")
|
||||
const_val = ir.Constant(int_type, value)
|
||||
const_val = ir.Constant(ir.IntType(int_width), value)
|
||||
builder.store(const_val, ptr)
|
||||
return ptr
|
||||
|
||||
|
||||
def get_or_create_ptr_from_arg(
|
||||
func,
|
||||
module,
|
||||
arg,
|
||||
builder,
|
||||
local_sym_tab,
|
||||
map_sym_tab,
|
||||
struct_sym_tab=None,
|
||||
expected_type=None,
|
||||
func, module, arg, builder, local_sym_tab, map_sym_tab, struct_sym_tab=None
|
||||
):
|
||||
"""Extract or create pointer from the call arguments."""
|
||||
|
||||
logger.info(f"Getting pointer from arg: {ast.dump(arg)}")
|
||||
sz = None
|
||||
if isinstance(arg, ast.Name):
|
||||
# Stack space is already allocated
|
||||
ptr = get_var_ptr_from_name(arg.id, local_sym_tab)
|
||||
elif isinstance(arg, ast.Constant) and isinstance(arg.value, int):
|
||||
int_width = 64 # Default to i64
|
||||
if expected_type and isinstance(expected_type, ir.IntType):
|
||||
int_width = expected_type.width
|
||||
ptr = create_int_constant_ptr(arg.value, builder, local_sym_tab, int_width)
|
||||
elif isinstance(arg, ast.Attribute):
|
||||
# A struct field
|
||||
struct_name = arg.value.id
|
||||
field_name = arg.attr
|
||||
|
||||
if not local_sym_tab or struct_name not in local_sym_tab:
|
||||
raise ValueError(f"Struct '{struct_name}' not found")
|
||||
|
||||
struct_type = local_sym_tab[struct_name].metadata
|
||||
if not struct_sym_tab or struct_type not in struct_sym_tab:
|
||||
raise ValueError(f"Struct type '{struct_type}' not found")
|
||||
|
||||
struct_info = struct_sym_tab[struct_type]
|
||||
if field_name not in struct_info.fields:
|
||||
raise ValueError(
|
||||
f"Field '{field_name}' not found in struct '{struct_name}'"
|
||||
)
|
||||
|
||||
field_type = struct_info.field_type(field_name)
|
||||
struct_ptr = local_sym_tab[struct_name].var
|
||||
|
||||
# Special handling for char arrays
|
||||
if (
|
||||
isinstance(field_type, ir.ArrayType)
|
||||
and isinstance(field_type.element, ir.IntType)
|
||||
and field_type.element.width == 8
|
||||
):
|
||||
ptr, sz = get_char_array_ptr_and_size(
|
||||
arg, builder, local_sym_tab, struct_sym_tab
|
||||
)
|
||||
if not ptr:
|
||||
raise ValueError("Failed to get char array pointer from struct field")
|
||||
else:
|
||||
ptr = struct_info.gep(builder, struct_ptr, field_name)
|
||||
|
||||
ptr = create_int_constant_ptr(arg.value, builder, local_sym_tab)
|
||||
else:
|
||||
# NOTE: For any integer expression reaching this branch, it is probably a struct field or a binop
|
||||
# Evaluate the expression and store the result in a temp variable
|
||||
val = get_operand_value(
|
||||
func, module, arg, builder, local_sym_tab, map_sym_tab, struct_sym_tab
|
||||
@ -151,20 +85,13 @@ def get_or_create_ptr_from_arg(
|
||||
if val is None:
|
||||
raise ValueError("Failed to evaluate expression for helper arg.")
|
||||
|
||||
ptr, temp_name = _temp_pool_manager.get_next_temp(local_sym_tab, expected_type)
|
||||
# NOTE: We assume the result is an int64 for now
|
||||
# if isinstance(arg, ast.Attribute):
|
||||
# return val
|
||||
ptr, temp_name = _temp_pool_manager.get_next_temp(local_sym_tab)
|
||||
logger.info(f"Using temp variable '{temp_name}' for expression result")
|
||||
if (
|
||||
isinstance(val.type, ir.IntType)
|
||||
and expected_type
|
||||
and val.type.width > expected_type.width
|
||||
):
|
||||
val = builder.trunc(val, expected_type)
|
||||
builder.store(val, ptr)
|
||||
|
||||
# NOTE: For char arrays, also return size
|
||||
if sz:
|
||||
return ptr, sz
|
||||
|
||||
return ptr
|
||||
|
||||
|
||||
@ -347,23 +274,3 @@ def get_ptr_from_arg(
|
||||
raise ValueError(f"Expected pointer type, got {val_type}")
|
||||
|
||||
return val, val_type
|
||||
|
||||
|
||||
def get_int_value_from_arg(
|
||||
arg, func, module, builder, local_sym_tab, map_sym_tab, struct_sym_tab
|
||||
):
|
||||
"""Evaluate argument and return integer value"""
|
||||
|
||||
result = eval_expr(
|
||||
func, module, builder, arg, local_sym_tab, map_sym_tab, struct_sym_tab
|
||||
)
|
||||
|
||||
if not result:
|
||||
raise ValueError("Failed to evaluate argument")
|
||||
|
||||
val, val_type = result
|
||||
|
||||
if not isinstance(val_type, ir.IntType):
|
||||
raise ValueError(f"Expected integer type, got {val_type}")
|
||||
|
||||
return val
|
||||
|
||||
@ -27,31 +27,6 @@ def probe_read_str(dst, src):
|
||||
return ctypes.c_int64(0)
|
||||
|
||||
|
||||
def random():
|
||||
"""get a pseudorandom u32 number"""
|
||||
return ctypes.c_int32(0)
|
||||
|
||||
|
||||
def probe_read(dst, size, src):
|
||||
"""Safely read data from kernel memory"""
|
||||
return ctypes.c_int64(0)
|
||||
|
||||
|
||||
def smp_processor_id():
|
||||
"""get the current CPU id"""
|
||||
return ctypes.c_int32(0)
|
||||
|
||||
|
||||
def uid():
|
||||
"""get current user id"""
|
||||
return ctypes.c_int32(0)
|
||||
|
||||
|
||||
def skb_store_bytes(offset, from_buf, size, flags=0):
|
||||
"""store bytes into a socket buffer"""
|
||||
return ctypes.c_int64(0)
|
||||
|
||||
|
||||
XDP_ABORTED = ctypes.c_int64(0)
|
||||
XDP_DROP = ctypes.c_int64(1)
|
||||
XDP_PASS = ctypes.c_int64(2)
|
||||
|
||||
@ -4,7 +4,6 @@ import logging
|
||||
from llvmlite import ir
|
||||
from pythonbpf.expr import eval_expr, get_base_type_and_depth, deref_to_depth
|
||||
from pythonbpf.expr.vmlinux_registry import VmlinuxHandlerRegistry
|
||||
from pythonbpf.helper.helper_utils import get_char_array_ptr_and_size
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
@ -220,7 +219,7 @@ def _prepare_expr_args(expr, func, module, builder, local_sym_tab, struct_sym_ta
|
||||
"""Evaluate and prepare an expression to use as an arg for bpf_printk."""
|
||||
|
||||
# Special case: struct field char array needs pointer to first element
|
||||
char_array_ptr, _ = get_char_array_ptr_and_size(
|
||||
char_array_ptr = _get_struct_char_array_ptr(
|
||||
expr, builder, local_sym_tab, struct_sym_tab
|
||||
)
|
||||
if char_array_ptr:
|
||||
@ -243,6 +242,52 @@ def _prepare_expr_args(expr, func, module, builder, local_sym_tab, struct_sym_ta
|
||||
return ir.Constant(ir.IntType(64), 0)
|
||||
|
||||
|
||||
def _get_struct_char_array_ptr(expr, builder, local_sym_tab, struct_sym_tab):
|
||||
"""Get pointer to first element of char array in struct field, or None."""
|
||||
if not (isinstance(expr, ast.Attribute) and isinstance(expr.value, ast.Name)):
|
||||
return None
|
||||
|
||||
var_name = expr.value.id
|
||||
field_name = expr.attr
|
||||
|
||||
# Check if it's a valid struct field
|
||||
if not (
|
||||
local_sym_tab
|
||||
and var_name in local_sym_tab
|
||||
and struct_sym_tab
|
||||
and local_sym_tab[var_name].metadata in struct_sym_tab
|
||||
):
|
||||
return None
|
||||
|
||||
struct_type = local_sym_tab[var_name].metadata
|
||||
struct_info = struct_sym_tab[struct_type]
|
||||
|
||||
if field_name not in struct_info.fields:
|
||||
return None
|
||||
|
||||
field_type = struct_info.field_type(field_name)
|
||||
|
||||
# Check if it's a char array
|
||||
is_char_array = (
|
||||
isinstance(field_type, ir.ArrayType)
|
||||
and isinstance(field_type.element, ir.IntType)
|
||||
and field_type.element.width == 8
|
||||
)
|
||||
|
||||
if not is_char_array:
|
||||
return None
|
||||
|
||||
# Get field pointer and GEP to first element: [N x i8]* -> i8*
|
||||
struct_ptr = local_sym_tab[var_name].var
|
||||
field_ptr = struct_info.gep(builder, struct_ptr, field_name)
|
||||
|
||||
return builder.gep(
|
||||
field_ptr,
|
||||
[ir.Constant(ir.IntType(32), 0), ir.Constant(ir.IntType(32), 0)],
|
||||
inbounds=True,
|
||||
)
|
||||
|
||||
|
||||
def _handle_pointer_arg(val, func, builder):
|
||||
"""Convert pointer type for bpf_printk."""
|
||||
target, depth = get_base_type_and_depth(val.type)
|
||||
|
||||
15
pythonbpf/local_symbol.py
Normal file
15
pythonbpf/local_symbol.py
Normal file
@ -0,0 +1,15 @@
|
||||
import llvmlite.ir as ir
|
||||
from dataclasses import dataclass
|
||||
from typing import Any
|
||||
|
||||
|
||||
@dataclass
|
||||
class LocalSymbol:
|
||||
var: ir.AllocaInstr
|
||||
ir_type: ir.Type
|
||||
metadata: Any = None
|
||||
|
||||
def __iter__(self):
|
||||
yield self.var
|
||||
yield self.ir_type
|
||||
yield self.metadata
|
||||
@ -1,5 +1,5 @@
|
||||
from enum import Enum, auto
|
||||
from typing import Any, Dict, List, Optional
|
||||
from typing import Any, Dict, List, Optional, TypedDict
|
||||
from dataclasses import dataclass
|
||||
import llvmlite.ir as ir
|
||||
|
||||
@ -16,7 +16,7 @@ class AssignmentType(Enum):
|
||||
|
||||
|
||||
@dataclass
|
||||
class FunctionSignature:
|
||||
class FunctionSignature(TypedDict):
|
||||
return_type: str
|
||||
param_types: List[str]
|
||||
varargs: bool
|
||||
@ -24,7 +24,7 @@ class FunctionSignature:
|
||||
|
||||
# Thew name of the assignment will be in the dict that uses this class
|
||||
@dataclass
|
||||
class AssignmentInfo:
|
||||
class AssignmentInfo(TypedDict):
|
||||
value_type: AssignmentType
|
||||
python_type: type
|
||||
value: Optional[Any]
|
||||
|
||||
@ -86,19 +86,19 @@ def vmlinux_proc(tree: ast.AST, module):
|
||||
|
||||
if not import_statements:
|
||||
logger.info("No vmlinux imports found")
|
||||
return
|
||||
return None
|
||||
|
||||
# Import vmlinux module directly
|
||||
try:
|
||||
vmlinux_mod = importlib.import_module("vmlinux")
|
||||
except ImportError:
|
||||
logger.warning("Could not import vmlinux module")
|
||||
return
|
||||
return None
|
||||
|
||||
source_file = inspect.getsourcefile(vmlinux_mod)
|
||||
if source_file is None:
|
||||
logger.warning("Cannot find source for vmlinux module")
|
||||
return
|
||||
return None
|
||||
|
||||
with open(source_file, "r") as f:
|
||||
mod_ast = ast.parse(f.read(), filename=source_file)
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
import logging
|
||||
from llvmlite import ir
|
||||
|
||||
from pythonbpf.local_symbol import LocalSymbol
|
||||
from pythonbpf.vmlinux_parser.assignment_info import AssignmentType
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
@ -39,6 +40,16 @@ class VmlinuxHandler:
|
||||
and self.vmlinux_symtab[name]["value_type"] == AssignmentType.CONSTANT
|
||||
)
|
||||
|
||||
def get_vmlinux_struct_type(self, name):
|
||||
"""Check if name is a vmlinux struct type"""
|
||||
if (
|
||||
name in self.vmlinux_symtab
|
||||
and self.vmlinux_symtab[name]["value_type"] == AssignmentType.STRUCT
|
||||
):
|
||||
return self.vmlinux_symtab[name]["python_type"]
|
||||
else:
|
||||
raise ValueError(f"{name} is not a vmlinux struct type")
|
||||
|
||||
def is_vmlinux_struct(self, name):
|
||||
"""Check if name is a vmlinux struct"""
|
||||
return (
|
||||
@ -77,14 +88,37 @@ class VmlinuxHandler:
|
||||
self, struct_var_name, field_name, module, builder, local_sym_tab
|
||||
):
|
||||
"""Handle access to vmlinux struct fields"""
|
||||
# Check if it's a variable of vmlinux struct type
|
||||
if struct_var_name in local_sym_tab:
|
||||
var_info = local_sym_tab[struct_var_name] # noqa: F841
|
||||
# Need to check if this variable is a vmlinux struct
|
||||
# This will depend on how you track vmlinux struct types in your symbol table
|
||||
var_info: LocalSymbol = local_sym_tab[struct_var_name]
|
||||
logger.info(
|
||||
f"Attempting to access field {field_name} of possible vmlinux struct {struct_var_name}"
|
||||
)
|
||||
python_type: type = var_info.metadata
|
||||
globvar_ir, field_data = self.get_field_type(
|
||||
python_type.__name__, field_name
|
||||
)
|
||||
|
||||
# Return pointer to field and field type
|
||||
return None
|
||||
return None
|
||||
else:
|
||||
raise RuntimeError("Variable accessed not found in symbol table")
|
||||
|
||||
def has_field(self, struct_name, field_name):
|
||||
"""Check if a vmlinux struct has a specific field"""
|
||||
if self.is_vmlinux_struct(struct_name):
|
||||
python_type = self.vmlinux_symtab[struct_name]["python_type"]
|
||||
return hasattr(python_type, field_name)
|
||||
return False
|
||||
|
||||
def get_field_type(self, vmlinux_struct_name, field_name):
|
||||
"""Get the type of a field in a vmlinux struct"""
|
||||
if self.is_vmlinux_struct(vmlinux_struct_name):
|
||||
python_type = self.vmlinux_symtab[vmlinux_struct_name]["python_type"]
|
||||
if hasattr(python_type, field_name):
|
||||
return self.vmlinux_symtab[vmlinux_struct_name]["members"][field_name]
|
||||
else:
|
||||
raise ValueError(
|
||||
f"Field {field_name} not found in vmlinux struct {vmlinux_struct_name}"
|
||||
)
|
||||
else:
|
||||
raise ValueError(f"{vmlinux_struct_name} is not a vmlinux struct")
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
BPF_CLANG := clang
|
||||
CFLAGS := -O2 -emit-llvm -target bpf -c
|
||||
CFLAGS := -O0 -emit-llvm -target bpf -c
|
||||
|
||||
SRC := $(wildcard *.bpf.c)
|
||||
LL := $(SRC:.bpf.c=.bpf.ll)
|
||||
|
||||
@ -1,25 +0,0 @@
|
||||
#define __TARGET_ARCH_arm64
|
||||
|
||||
#include "vmlinux.h"
|
||||
#include <bpf/bpf_helpers.h>
|
||||
#include <bpf/bpf_tracing.h>
|
||||
#include <bpf/bpf_core_read.h>
|
||||
|
||||
// Map: key = struct request*, value = u64 timestamp
|
||||
struct {
|
||||
__uint(type, BPF_MAP_TYPE_HASH);
|
||||
__type(key, struct request *);
|
||||
__type(value, u64);
|
||||
__uint(max_entries, 1024);
|
||||
} start SEC(".maps");
|
||||
|
||||
// Attach to kprobe for blk_start_request
|
||||
SEC("kprobe/blk_start_request")
|
||||
int BPF_KPROBE(trace_start, struct request *req)
|
||||
{
|
||||
u64 ts = bpf_ktime_get_ns();
|
||||
bpf_map_update_elem(&start, &req, &ts, BPF_ANY);
|
||||
return 0;
|
||||
}
|
||||
|
||||
char LICENSE[] SEC("license") = "GPL";
|
||||
28
tests/c-form/struct_field_tests.bpf.c
Normal file
28
tests/c-form/struct_field_tests.bpf.c
Normal file
@ -0,0 +1,28 @@
|
||||
// SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
#include "vmlinux.h"
|
||||
#include <bpf/bpf_helpers.h>
|
||||
#include <bpf/bpf_tracing.h>
|
||||
|
||||
/*
|
||||
Information gained from reversing this (multiple kernel versions):
|
||||
There is no point of
|
||||
```llvm
|
||||
tail call void @llvm.dbg.value(metadata ptr %0, metadata !60, metadata !DIExpression()), !dbg !70
|
||||
```
|
||||
and the first argument of passthrough is fucking useless. It just needs to be a distinct integer:
|
||||
```llvm
|
||||
%9 = tail call ptr @llvm.bpf.passthrough.p0.p0(i32 3, ptr %8)
|
||||
```
|
||||
*/
|
||||
|
||||
SEC("tp/syscalls/sys_enter_execve")
|
||||
int handle_setuid_entry(struct trace_event_raw_sys_enter *ctx) {
|
||||
// Access each argument separately with clear variable assignments
|
||||
long int arg0 = ctx->id;
|
||||
bpf_printk("args[0]: %d", arg0);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
char LICENSE[] SEC("license") = "GPL";
|
||||
121617
tests/c-form/vmlinux.h
vendored
121617
tests/c-form/vmlinux.h
vendored
File diff suppressed because it is too large
Load Diff
21
tests/c-form/xdp_modify.bpf.c
Normal file
21
tests/c-form/xdp_modify.bpf.c
Normal file
@ -0,0 +1,21 @@
|
||||
// xdp_rewrite.c
|
||||
#include <linux/bpf.h>
|
||||
#include <bpf/bpf_helpers.h>
|
||||
#include <linux/if_ether.h>
|
||||
|
||||
SEC("xdp")
|
||||
int xdp_rewrite_mac(struct xdp_md *ctx)
|
||||
{
|
||||
void *data_end = (void *)(long)ctx->data_end;
|
||||
void *data = (void *)(long)ctx->data;
|
||||
|
||||
struct ethhdr *eth = data;
|
||||
if ((void*)(eth + 1) > data_end)
|
||||
return XDP_PASS;
|
||||
__u8 new_src[ETH_ALEN] = {0x02,0x00,0x00,0x00,0x00,0x02};
|
||||
for (int i = 0; i < ETH_ALEN; i++) eth->h_source[i] = new_src[i];
|
||||
|
||||
return XDP_PASS;
|
||||
}
|
||||
|
||||
char _license[] SEC("license") = "GPL";
|
||||
31
tests/failing_tests/vmlinux/struct_field_access.py
Normal file
31
tests/failing_tests/vmlinux/struct_field_access.py
Normal file
@ -0,0 +1,31 @@
|
||||
import logging
|
||||
|
||||
from pythonbpf import bpf, section, bpfglobal, compile_to_ir
|
||||
from pythonbpf import compile # noqa: F401
|
||||
from vmlinux import TASK_COMM_LEN # noqa: F401
|
||||
from vmlinux import struct_trace_event_raw_sys_enter # noqa: F401
|
||||
from ctypes import c_int64, c_void_p # noqa: F401
|
||||
|
||||
|
||||
# from vmlinux import struct_uinput_device
|
||||
# from vmlinux import struct_blk_integrity_iter
|
||||
|
||||
|
||||
@bpf
|
||||
@section("tracepoint/syscalls/sys_enter_execve")
|
||||
def hello_world(ctx: struct_trace_event_raw_sys_enter) -> c_int64:
|
||||
a = 2 + TASK_COMM_LEN + TASK_COMM_LEN
|
||||
b = ctx.id
|
||||
print(f"Hello, World{TASK_COMM_LEN} and {a}")
|
||||
print(f"This is context field {b}")
|
||||
return c_int64(TASK_COMM_LEN + 2)
|
||||
|
||||
|
||||
@bpf
|
||||
@bpfglobal
|
||||
def LICENSE() -> str:
|
||||
return "GPL"
|
||||
|
||||
|
||||
compile_to_ir("struct_field_access.py", "struct_field_access.ll", loglevel=logging.INFO)
|
||||
# compile()
|
||||
@ -1,4 +1,4 @@
|
||||
from pythonbpf import bpf, map, section, bpfglobal, compile, struct
|
||||
from pythonbpf import bpf, map, section, bpfglobal, compile, struct, compile_to_ir
|
||||
from ctypes import c_void_p, c_int64, c_int32, c_uint64
|
||||
from pythonbpf.maps import HashMap
|
||||
from pythonbpf.helper import ktime
|
||||
@ -71,4 +71,5 @@ def LICENSE() -> str:
|
||||
return "GPL"
|
||||
|
||||
|
||||
compile_to_ir("comprehensive.py", "comprehensive.ll")
|
||||
compile()
|
||||
|
||||
@ -1,29 +0,0 @@
|
||||
from pythonbpf import bpf, section, bpfglobal, compile, struct
|
||||
from ctypes import c_void_p, c_int64, c_uint64, c_uint32
|
||||
from pythonbpf.helper import probe_read
|
||||
|
||||
|
||||
@bpf
|
||||
@struct
|
||||
class data_t:
|
||||
pid: c_uint32
|
||||
value: c_uint64
|
||||
|
||||
|
||||
@bpf
|
||||
@section("tracepoint/syscalls/sys_enter_execve")
|
||||
def test_probe_read(ctx: c_void_p) -> c_int64:
|
||||
"""Test bpf_probe_read helper function"""
|
||||
data = data_t()
|
||||
probe_read(data.value, 8, ctx)
|
||||
probe_read(data.pid, 4, ctx)
|
||||
return 0
|
||||
|
||||
|
||||
@bpf
|
||||
@bpfglobal
|
||||
def LICENSE() -> str:
|
||||
return "GPL"
|
||||
|
||||
|
||||
compile()
|
||||
@ -1,25 +0,0 @@
|
||||
from pythonbpf import bpf, bpfglobal, section, BPF, trace_pipe
|
||||
from ctypes import c_void_p, c_int64
|
||||
from pythonbpf.helper import random
|
||||
|
||||
|
||||
@bpf
|
||||
@section("tracepoint/syscalls/sys_enter_clone")
|
||||
def hello_world(ctx: c_void_p) -> c_int64:
|
||||
r = random()
|
||||
print(f"Hello, World!, {r}")
|
||||
return 0 # type: ignore [return-value]
|
||||
|
||||
|
||||
@bpf
|
||||
@bpfglobal
|
||||
def LICENSE() -> str:
|
||||
return "GPL"
|
||||
|
||||
|
||||
# Compile and load
|
||||
b = BPF()
|
||||
b.load()
|
||||
b.attach_all()
|
||||
|
||||
trace_pipe()
|
||||
@ -1,40 +0,0 @@
|
||||
from pythonbpf import bpf, section, bpfglobal, compile, struct
|
||||
from ctypes import c_void_p, c_int64, c_uint32, c_uint64
|
||||
from pythonbpf.helper import smp_processor_id, ktime
|
||||
|
||||
|
||||
@bpf
|
||||
@struct
|
||||
class cpu_event_t:
|
||||
cpu_id: c_uint32
|
||||
timestamp: c_uint64
|
||||
|
||||
|
||||
@bpf
|
||||
@section("tracepoint/syscalls/sys_enter_execve")
|
||||
def trace_with_cpu(ctx: c_void_p) -> c_int64:
|
||||
"""Test bpf_get_smp_processor_id helper function"""
|
||||
|
||||
# Get the current CPU ID
|
||||
cpu = smp_processor_id()
|
||||
|
||||
# Print it
|
||||
print(f"Running on CPU {cpu}")
|
||||
|
||||
# Use it in a struct
|
||||
event = cpu_event_t()
|
||||
event.cpu_id = smp_processor_id()
|
||||
event.timestamp = ktime()
|
||||
|
||||
print(f"Event on CPU {event.cpu_id} at time {event.timestamp}")
|
||||
|
||||
return 0
|
||||
|
||||
|
||||
@bpf
|
||||
@bpfglobal
|
||||
def LICENSE() -> str:
|
||||
return "GPL"
|
||||
|
||||
|
||||
compile()
|
||||
@ -1,31 +0,0 @@
|
||||
from pythonbpf import bpf, section, bpfglobal, compile
|
||||
from ctypes import c_void_p, c_int64
|
||||
from pythonbpf.helper import uid, pid
|
||||
|
||||
|
||||
@bpf
|
||||
@section("tracepoint/syscalls/sys_enter_execve")
|
||||
def filter_by_user(ctx: c_void_p) -> c_int64:
|
||||
"""Filter events by specific user ID"""
|
||||
|
||||
current_uid = uid()
|
||||
|
||||
# Only trace root user (UID 0)
|
||||
if current_uid == 0:
|
||||
process_id = pid()
|
||||
print(f"Root process {process_id} executed")
|
||||
|
||||
# Or trace specific user (e.g., UID 1000)
|
||||
if current_uid == 1002:
|
||||
print("User 1002 executed something")
|
||||
|
||||
return 0
|
||||
|
||||
|
||||
@bpf
|
||||
@bpfglobal
|
||||
def LICENSE() -> str:
|
||||
return "GPL"
|
||||
|
||||
|
||||
compile()
|
||||
@ -144,8 +144,7 @@ mkdir -p examples
|
||||
cd examples || exit 1
|
||||
|
||||
echo "Fetching example files list..."
|
||||
FILES=$(curl -s "https://api.github.com/repos/pythonbpf/Python-BPF/contents/examples" | grep -E -o '"path": "examples/[^"]*(\.md|\.ipynb|\.py)"' | awk -F'"' '{print $4}')
|
||||
BCC_EXAMPLES=$(curl -s "https://api.github.com/repos/pythonbpf/Python-BPF/contents/BCC-Examples" | grep -E -o '"path": "BCC-Examples/[^"]*(\.md|\.ipynb|\.py)"' | awk -F'"' '{print $4}')
|
||||
FILES=$(curl -s "https://api.github.com/repos/pythonbpf/Python-BPF/contents/examples" | grep -o '"path": "examples/[^"]*"' | awk -F'"' '{print $4}')
|
||||
|
||||
if [ -z "$FILES" ]; then
|
||||
echo "Failed to fetch file list from repository. Using fallback method..."
|
||||
@ -167,20 +166,11 @@ if [ -z "$FILES" ]; then
|
||||
curl -s -O "https://raw.githubusercontent.com/pythonbpf/Python-BPF/master/examples/$example"
|
||||
done
|
||||
else
|
||||
mkdir examples && cd examples
|
||||
for file in $FILES; do
|
||||
filename=$(basename "$file")
|
||||
echo "Downloading: $filename"
|
||||
curl -s -o "$filename" "https://raw.githubusercontent.com/pythonbpf/Python-BPF/master/$file"
|
||||
done
|
||||
cd ..
|
||||
mkdir BCC-Examples && cd BCC-Examples
|
||||
for file in $BCC_EXAMPLES; do
|
||||
filename=$(basename "$file")
|
||||
echo "Downloading: $filename"
|
||||
curl -s -o "$filename" "https://raw.githubusercontent.com/pythonbpf/Python-BPF/master/$file"
|
||||
done
|
||||
cd ..
|
||||
fi
|
||||
|
||||
cd "$WORK_DIR" || exit 1
|
||||
|
||||
Reference in New Issue
Block a user