Python bcc.USDT类代码示例

    def test_attach1(self):
        # enable USDT probe from given PID and verifier generated BPF programs
        u = USDT(pid=int(self.app.pid))
        u.enable_probe(probe="probe", fn_name="do_trace")
        b = BPF(text=self.bpf_text, usdt_contexts=[u])

        # processing events
        self.probe_value_1 = 0
        self.probe_value_2 = 0
        self.probe_value_3 = 0
        self.probe_value_other = 0

        def print_event(cpu, data, size):
            result = ct.cast(data, ct.POINTER(ct.c_int)).contents
            if result.value == 1:
                self.probe_value_1 = 1
            elif result.value == 2:
                self.probe_value_2 = 1
            elif result.value == 3:
                self.probe_value_3 = 1
            else:
                self.probe_value_other = 1

        b["event"].open_perf_buffer(print_event)
        for i in range(10):
            b.perf_buffer_poll()

        self.assertTrue(self.probe_value_1 != 0)
        self.assertTrue(self.probe_value_2 != 0)
        self.assertTrue(self.probe_value_3 != 0)
        self.assertTrue(self.probe_value_other == 0)

def print_usdt(pid, lib):
        reader = USDT(path=lib, pid=pid)
        probes_seen = []
        for probe in reader.enumerate_probes():
                probe_name = probe.short_name()
                if not args.filter or fnmatch.fnmatch(probe_name, args.filter):
                        if probe_name in probes_seen:
                                continue
                        probes_seen.append(probe_name)
                        print_usdt_details(probe)

def print_usdt(pid, lib):
        reader = USDT(path=lib, pid=pid)
        probes_seen = []
        for probe in reader.enumerate_probes():
                probe_name = probe.short_name()
                if not args.filter or fnmatch.fnmatch(probe_name, args.filter):
                        if probe_name in probes_seen:
                                continue
                        probes_seen.append(probe_name)
                        if args.variables:
                                print(probe)
                        else:
                                print("%s %s:%s" % (probe.bin_path,
                                                    probe.provider, probe.name))

 def _enable_probes(self):
     self.usdts = []
     for pid in self.targets:
         usdt = USDT(pid=pid)
         for event in self.events:
             try:
                 usdt.enable_probe(event, "%s_%s" % (self.language, event))
             except Exception:
                 # This process might not have a recent version of the USDT
                 # probes enabled, or might have been compiled without USDT
                 # probes at all. The process could even have been shut down
                 # and the pid been recycled. We have to gracefully handle
                 # the possibility that we can't attach probes to it at all.
                 pass
         self.usdts.append(usdt)

 def _find_usdt_probe(self):
     target = Probe.pid if Probe.pid and Probe.pid != -1 else Probe.tgid
     self.usdt = USDT(path=self.library, pid=target)
     for probe in self.usdt.enumerate_probes():
         if probe.name == self.usdt_name:
             return  # Found it, will enable later
     self._bail("unrecognized USDT probe %s" % self.usdt_name)

 def _enable_probes(self):
     self.usdts = []
     for pid in self.targets:
         try:
             usdt = USDT(pid=pid)
         except USDTException:
             # avoid race condition on pid going away.
             print("failed to instrument %d" % pid, file=sys.stderr)
             continue
         for event in self.events:
             try:
                 usdt.enable_probe(event, "%s_%s" % (self.language, event))
             except Exception:
                 # This process might not have a recent version of the USDT
                 # probes enabled, or might have been compiled without USDT
                 # probes at all. The process could even have been shut down
                 # and the pid been recycled. We have to gracefully handle
                 # the possibility that we can't attach probes to it at all.
                 pass
         self.usdts.append(usdt)

def do_object_creation_probes():
    # load BPF program
    bpf_text = """
    #include <uapi/linux/ptrace.h>

    struct key_t {
        char objectname[128];
    };

    BPF_HASH(objmap, struct key_t, u64);

    int do_count(struct pt_regs *ctx) {
        struct key_t key = {};

        bpf_probe_read(&key.objectname, sizeof(key.objectname), (void *)(unsigned long)ctx->r13);
        objmap.increment(key);

        return 0;
    }
    """

    u = USDT(pid=args.pid)
    u.enable_probe(probe="object__create", fn_name="do_count")

    b = BPF(text=bpf_text, usdt=u)

    print("Press Ctrl-C to display/exit")
    try:
        sleep(99999999)
    except KeyboardInterrupt:
        pass

    data = b.get_table("objmap")
    data = sorted(data.items(), key=lambda kv: kv[1].value)
    for key, value in data:
        print("\t%-10s %s" % \
              (str(value.value), str(key.objectname.decode())))

 def _generate_functions(self, template):
     self.usdt = None
     text = ""
     if self.type == "p" and not self.library:
         functions = BPF.get_kprobe_functions(self.pattern)
         verify_limit(len(functions))
         for function in functions:
             text += self._add_function(template, function)
     elif self.type == "p" and self.library:
         # uprobes are tricky because the same function may have multiple
         # addresses, and the same address may be mapped to multiple
         # functions. We aren't allowed to create more than one uprobe
         # per address, so track unique addresses and ignore functions that
         # map to an address that we've already seen. Also ignore functions
         # that may repeat multiple times with different addresses.
         addresses, functions = (set(), set())
         functions_and_addresses = BPF.get_user_functions_and_addresses(
                                     self.library, self.pattern)
         verify_limit(len(functions_and_addresses))
         for function, address in functions_and_addresses:
             if address in addresses or function in functions:
                 continue
             addresses.add(address)
             functions.add(function)
             text += self._add_function(template, function)
     elif self.type == "t":
         tracepoints = BPF.get_tracepoints(self.pattern)
         verify_limit(len(tracepoints))
         for tracepoint in tracepoints:
             text += self._add_function(template, tracepoint)
     elif self.type == "u":
         self.usdt = USDT(path=self.library, pid=self.pid)
         matches = []
         for probe in self.usdt.enumerate_probes():
             if not self.pid and (probe.bin_path != self.library):
                 continue
             if re.match(self.pattern, probe.name):
                 matches.append(probe.name)
         verify_limit(len(matches))
         for match in matches:
             new_func = "trace_count_%d" % self.matched
             text += self._add_function(template, match)
             self.usdt.enable_probe(match, new_func)
         if debug:
             print(self.usdt.get_text())
     return text

    info->num_calls += 1;
    info->total_ns += bpf_ktime_get_ns() - e->timestamp;
    sysentry.delete(&pid);
    return 0;
}
#endif  // LATENCY
#endif  // SYSCALLS
""".replace("READ_CLASS", read_class) \
   .replace("READ_METHOD", read_method) \
   .replace("PID_FILTER", "if ((pid >> 32) != %d) { return 0; }" % args.pid) \
   .replace("DEFINE_NOLANG", "#define NOLANG" if not language else "") \
   .replace("DEFINE_LATENCY", "#define LATENCY" if args.latency else "") \
   .replace("DEFINE_SYSCALLS", "#define SYSCALLS" if args.syscalls else "")

if language:
    usdt = USDT(pid=args.pid)
    usdt.enable_probe_or_bail(entry_probe, "trace_entry")
    if args.latency:
        usdt.enable_probe_or_bail(return_probe, "trace_return")
else:
    usdt = None

if args.ebpf or args.verbose:
    if args.verbose and usdt:
        print(usdt.get_text())
    print(program)
    if args.ebpf:
        exit()

bpf = BPF(text=program, usdt_contexts=[usdt] if usdt else [])
if args.syscalls:

    timestampp = temp.lookup(&pid);
    if (!timestampp)
        return 0;

    u64 delta = bpf_ktime_get_ns() - *timestampp;
    if (delta/1000000 < %d)
        return 0;

    delta /= %d;
    latency.increment(bpf_log2l(delta));
    temp.delete(&pid);
    return 0;
}
""" % (args.threshold, 1000000 if args.milliseconds else 1000)

usdt = USDT(pid=int(dbpid))
usdt.enable_probe("query__start", "probe_start")
usdt.enable_probe("query__done", "probe_end")

bpf = BPF(text=program, usdt_contexts=[usdt])
if args.verbose:
    print(usdt.get_text())
    print(program)

print("Tracing database queries slower than %dms for PID %d... Ctrl+C to quit."
        % (args.threshold, dbpid))

try:
    sleep(999999999999)
except KeyboardInterrupt:
    pass

    def test_attach1(self):
        # Enable USDT probe from given PID and verifier generated BPF programs.
        u = USDT(pid=int(self.app.pid))
        u.enable_probe(probe="probe_point_1", fn_name="do_trace1")
        u.enable_probe(probe="probe_point_2", fn_name="do_trace2")
        u2 = USDT(pid=int(self.app2.pid))
        u2.enable_probe(probe="probe_point_2", fn_name="do_trace2")
        u2.enable_probe(probe="probe_point_3", fn_name="do_trace3")
        self.bpf_text = self.bpf_text.replace("FILTER", "pid == %d" % self.app.pid)
        b = BPF(text=self.bpf_text, usdt_contexts=[u, u2])

        # Event states for each event:
        # 0 - probe not caught, 1 - probe caught with correct value,
        # 2 - probe caught with incorrect value
        self.evt_st_1 = 0
        self.evt_st_2 = 0
        self.evt_st_3 = 0
        self.evt_st_4 = 0
        self.evt_st_5 = 0
        self.evt_st_6 = 0

        def check_event_val(data, event_state, expected_val):
            result = ct.cast(data, ct.POINTER(ct.c_int)).contents
            if result.value == expected_val:
                if (event_state == 0 or event_state == 1):
                    return 1
            return 2

        def print_event1(cpu, data, size):
            self.evt_st_1 = check_event_val(data, self.evt_st_1, 1)

        def print_event2(cpu, data, size):
            self.evt_st_2 = check_event_val(data, self.evt_st_2, 2)

        def print_event3(cpu, data, size):
            self.evt_st_3 = check_event_val(data, self.evt_st_3, 3)

        def print_event4(cpu, data, size):
            self.evt_st_4 = check_event_val(data, self.evt_st_4, 11)

        def print_event5(cpu, data, size):
            self.evt_st_5 = check_event_val(data, self.evt_st_5, 12)

        def print_event6(cpu, data, size):
            self.evt_st_6 = check_event_val(data, self.evt_st_6, 13)

        # loop with callback to print_event
        b["event1"].open_perf_buffer(print_event1)
        b["event2"].open_perf_buffer(print_event2)
        b["event3"].open_perf_buffer(print_event3)
        b["event4"].open_perf_buffer(print_event4)
        b["event5"].open_perf_buffer(print_event5)
        b["event6"].open_perf_buffer(print_event6)

        # three iterations to make sure we get some probes and have time to process them
        for i in range(3):
            b.perf_buffer_poll()

        # note that event1 and event4 do not really fire, so their state should be 0
        # use separate asserts so that if test fails we know which one is the culprit
        self.assertTrue(self.evt_st_1 == 1)
        self.assertTrue(self.evt_st_2 == 1)
        self.assertTrue(self.evt_st_3 == 0)
        self.assertTrue(self.evt_st_4 == 0)
        self.assertTrue(self.evt_st_5 == 1)
        self.assertTrue(self.evt_st_6 == 1)

#.........这里部分代码省略.........
        parts = spec.split(":")
        # Two special cases: 'func' means 'p::func', 'lib:func' means
        # 'p:lib:func'. Other combinations need to provide an empty
        # value between delimiters, e.g. 'r::func' for a kretprobe on
        # the function func.
        if len(parts) == 1:
            parts = ["p", "", parts[0]]
        elif len(parts) == 2:
            parts = ["p", parts[0], parts[1]]
        if len(parts[0]) == 0:
            self.probe_type = "p"
        elif parts[0] in ["p", "r", "t", "u"]:
            self.probe_type = parts[0]
        else:
            self._bail("probe type must be '', 'p', 't', 'r', " + "or 'u', but got '%s'" % parts[0])
        if self.probe_type == "t":
            self.tp_category = parts[1]
            self.tp_event = parts[2]
            self.library = ""  # kernel
            self.function = ""  # from TRACEPOINT_PROBE
        elif self.probe_type == "u":
            self.library = parts[1]
            self.usdt_name = parts[2]
            self.function = ""  # no function, just address
            # We will discover the USDT provider by matching on
            # the USDT name in the specified library
            self._find_usdt_probe()
        else:
            self.library = parts[1]
            self.function = parts[2]

    def _find_usdt_probe(self):
        target = Probe.pid if Probe.pid and Probe.pid != -1 else Probe.tgid
        self.usdt = USDT(path=self.library, pid=target)
        for probe in self.usdt.enumerate_probes():
            if probe.name == self.usdt_name:
                return  # Found it, will enable later
        self._bail("unrecognized USDT probe %s" % self.usdt_name)

    def _parse_filter(self, filt):
        self.filter = self._rewrite_expr(filt)

    def _parse_types(self, fmt):
        for match in re.finditer(r"[^%]%(s|u|d|llu|lld|hu|hd|x|llx|c|K|U)", fmt):
            self.types.append(match.group(1))
        fmt = re.sub(r"([^%]%)(u|d|llu|lld|hu|hd)", r"\1d", fmt)
        fmt = re.sub(r"([^%]%)(x|llx)", r"\1x", fmt)
        fmt = re.sub("%K|%U", "%s", fmt)
        self.python_format = fmt.strip('"')

    def _parse_action(self, action):
        self.values = []
        self.types = []
        self.python_format = ""
        if len(action) == 0:
            return

        action = action.strip()
        match = re.search(r"(\".*?\"),?(.*)", action)
        if match is None:
            self._bail('expected format string in "s')

        self.raw_format = match.group(1)
        self._parse_types(self.raw_format)
        for part in re.split('(?<!"),', match.group(2)):
            part = self._rewrite_expr(part)

class Probe(object):
    def __init__(self, pattern, kernel_stack, user_stack, use_regex=False,
                 pid=None, per_pid=False):
        """Init a new probe.

        Init the probe from the pattern provided by the user. The supported
        patterns mimic the 'trace' and 'argdist' tools, but are simpler because
        we don't have to distinguish between probes and retprobes.

            func            -- probe a kernel function
            lib:func        -- probe a user-space function in the library 'lib'
            p::func         -- same thing as 'func'
            p:lib:func      -- same thing as 'lib:func'
            t:cat:event     -- probe a kernel tracepoint
            u:lib:probe     -- probe a USDT tracepoint
        """
        self.kernel_stack = kernel_stack
        self.user_stack = user_stack
        parts = pattern.split(':')
        if len(parts) == 1:
            parts = ["p", "", parts[0]]
        elif len(parts) == 2:
            parts = ["p", parts[0], parts[1]]
        elif len(parts) == 3:
            if parts[0] == "t":
                parts = ["t", "", "%s:%s" % tuple(parts[1:])]
            if parts[0] not in ["p", "t", "u"]:
                raise Exception("Type must be 'p', 't', or 'u', but got %s" %
                                parts[0])
        else:
            raise Exception("Too many ':'-separated components in pattern %s" %
                            pattern)

        (self.type, self.library, self.pattern) = parts
        if not use_regex:
            self.pattern = self.pattern.replace('*', '.*')
            self.pattern = '^' + self.pattern + '$'

        if (self.type == "p" and self.library) or self.type == "u":
            libpath = BPF.find_library(self.library)
            if libpath is None:
                # This might be an executable (e.g. 'bash')
                libpath = BPF.find_exe(self.library)
            if libpath is None or len(libpath) == 0:
                raise Exception("unable to find library %s" % self.library)
            self.library = libpath

        self.pid = pid
        self.per_pid = per_pid
        self.matched = 0

    def is_kernel_probe(self):
        return self.type == "t" or (self.type == "p" and self.library == "")

    def attach(self):
        if self.type == "p":
            if self.library:
                self.bpf.attach_uprobe(name=self.library,
                                       sym_re=self.pattern,
                                       fn_name="trace_count",
                                       pid=self.pid or -1)
                self.matched = self.bpf.num_open_uprobes()
            else:
                self.bpf.attach_kprobe(event_re=self.pattern,
                                       fn_name="trace_count")
                self.matched = self.bpf.num_open_kprobes()
        elif self.type == "t":
            self.bpf.attach_tracepoint(tp_re=self.pattern,
                                       fn_name="trace_count")
            self.matched = self.bpf.num_open_tracepoints()
        elif self.type == "u":
            pass    # Nothing to do -- attach already happened in `load`

        if self.matched == 0:
            raise Exception("No functions matched by pattern %s" %
                            self.pattern)

    def load(self):
        ctx_name = "ctx"
        stack_trace = ""
        if self.user_stack:
                stack_trace += """
                    key.user_stack_id = stack_traces.get_stackid(
                      %s, BPF_F_REUSE_STACKID | BPF_F_USER_STACK
                    );""" % (ctx_name)
        else:
                stack_trace += "key.user_stack_id = -1;"
        if self.kernel_stack:
                stack_trace += """
                    key.kernel_stack_id = stack_traces.get_stackid(
                      %s, BPF_F_REUSE_STACKID
                    );""" % (ctx_name)
        else:
                stack_trace += "key.kernel_stack_id = -1;"

        trace_count_text = """
int trace_count(void *ctx) {
    FILTER
    struct key_t key = {};
    key.tgid = GET_TGID;
#.........这里部分代码省略.........

    hash_leaf->average = hash_leaf->total / hash_leaf->count;

    return 0;
}
"""

bpf_text = bpf_text.replace("SAMPLE_COUNT", str(this_count))
bpf_text = bpf_text.replace("FILTER_STRING", this_filter)
if this_filter:
    bpf_text = bpf_text.replace("FILTER", "if (!filter(start_data.input)) { return 0; }")
else:
    bpf_text = bpf_text.replace("FILTER", "")

# Create USDT context
print("Attaching probes to pid %d" % this_pid)
usdt_ctx = USDT(pid=this_pid)
usdt_ctx.enable_probe(probe="operation_start", fn_name="trace_operation_start")
usdt_ctx.enable_probe(probe="operation_end", fn_name="trace_operation_end")

# Create BPF context, load BPF program
bpf_ctx = BPF(text=bpf_text, usdt_contexts=[usdt_ctx], debug=debugLevel)

print("Tracing... Hit Ctrl-C to end.")

lat_hash = bpf_ctx.get_table("lat_hash")
while (1):
    try:
        sleep(this_interval)
    except KeyboardInterrupt:
        exit()

 def _enable_usdt_probe(self):
         self.usdt_ctx = USDT(path=self.library, pid=self.pid)
         self.usdt_ctx.enable_probe(
                 self.function, self.probe_func_name)