do_show--->show_proc--->bpf_task_fd_query--->sys_bpf(BPF_TASK_FD_QUERY, &attr, sizeof(attr)); 从代码流程可得到bpftool perf可现实的类型有: raw_tracepoint, tracepoint, kprobe, kretprobe, uprobe, uretprobe 显示的信息方法为遍历/proc目录下的每个pid,然后系统调用sys_bpf查询该pid是否为我...
# 需要导入模块: from bcc import BPF [as 别名]# 或者: from bcc.BPF importget_kprobe_functions[as 别名]def_generate_functions(self, template):self.usdt =Nonetext =""ifself.type =="p"andnotself.library: functions = BPF.get_kprobe_functions(self.pattern) verify_limit(len(functions))forfunc...
# 需要导入模块: from bcc import BPF [as 别名]# 或者: from bcc.BPF importkprobe_poll[as 别名]deftest_perf_buffer_for_each_cpu(self):self.events = []classData(ct.Structure):_fields_ = [("cpu", ct.c_ulonglong)]defcb(cpu, data, size):self.assertGreater(size, ct.sizeof(Data)) e...
@@ -461,6 +461,7 @@ config KERNEL_BPF_EVENTS config KERNEL_BPF_KPROBE_OVERRIDE bool depends on KERNEL_KPROBES default n config KERNEL_AIO bool "Compile the kernel with asynchronous IO support" 0 comments on commit 4448b27 Please sign in to comment. Footer...
1 eBPF 的安全能力是检验其可持续发展的重要指标 日益严峻的 Linux 安全形势 根据安全分析机构 ESG...
struct bpf_kprobe_multi_run_ctx run_ctx = { .link = link, .entry_ip = entry_ip, }; struct bpf_run_ctx *old_run_ctx; + struct pt_regs *regs; int err; if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
> +static DEFINE_PER_CPU(struct pt_regs, bpf_kprobe_multi_pt_regs); this is a waste if CONFIG_HAVE_PT_REGS_TO_FTRACE_REGS_CAST=y, right? Can we guard it? > + > static int copy_user_syms(struct user_syms *us, unsigned long __user *usyms, ...
returnprog->enforce_expected_attach_type&& prog->expected_attach_type!=attach_type? -EINVAL:0; caseBPF_PROG_TYPE_KPROBE: if(prog->expected_attach_type==BPF_TRACE_KPROBE_MULTI&& attach_type!=BPF_TRACE_KPROBE_MULTI) return-EINVAL; return0; default: return0; } Expand Down...
b.attach_kprobe(event="blk_update_request", fn_name="probe_blk_update_request", pid=-1, cpu=0) 开发者ID:AoJ,项目名称:bcc,代码行数:9,代码来源:test_trace3.py 示例3: test_u32 ▲点赞 4▼ # 需要导入模块: from bcc import BPF [as 别名]# 或者: from bcc.BPF importattach_kprobe[as...
root@localhost:/tmp/bcc/examples# python3 hello_world.py create_probe_event: open(/sys/kernel/tracing/kprobe_events): No such file or directory Traceback (most recent call last): File "/tmp/bcc/examples/hello_world.py", line 12, in <module> BPF(text='int kprobe__sys_clone(void *ctx...