Blog

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>

char LICENSE[] SEC("license") = "GPL";

const volatile __u32 target_tgid = 0;
__u64 hits = 0;

static __always_inline void hit(void)
{
	if ((bpf_get_current_pid_tgid() >> 32) == target_tgid)
		__sync_fetch_and_add(&hits, 1);
}

SEC("tp/syscalls/sys_enter_read")
int on_tp(void *ctx) { hit(); return 0; }

SEC("tp_btf/sys_enter")
int BPF_PROG(on_tp_btf, struct pt_regs *regs, long id) { hit(); return 0; }

SEC("kprobe/vfs_read")
int BPF_KPROBE(on_kprobe, struct file *file) { hit(); return 0; }

SEC("kretprobe/vfs_read")
int BPF_KRETPROBE(on_kretprobe, ssize_t ret) { hit(); return 0; }

SEC("fentry/vfs_read")
int BPF_PROG(on_fentry, struct file *file) { hit(); return 0; }

SEC("fexit/vfs_read")
int BPF_PROG(on_fexit, struct file *file, char *buf, size_t count, loff_t *pos, ssize_t ret) { hit(); return 0; }

SEC("uprobe")
int BPF_UPROBE(on_uprobe) { hit(); return 0; }

SEC("uretprobe")
int BPF_URETPROBE(on_uretprobe) { hit(); return 0; }

#include <stdio.h>
#include <string.h>
#include <fcntl.h>
#include <time.h>
#include <unistd.h>
#include <bpf/libbpf.h>
#include "hookbench.skel.h"

#define N 2000000

__attribute__((noinline)) int work(int x)
{
	asm volatile("" ::: "memory");
	return x + 1;
}

static double now(void)
{
	struct timespec t;
	clock_gettime(CLOCK_MONOTONIC, &t);
	return t.tv_sec + t.tv_nsec / 1e9;
}

int main(int argc, char **argv)
{
	const char *hook = argc > 1 ? argv[1] : "none";
	int user = !strncmp(hook, "uprobe", 6) || !strncmp(hook, "uretprobe", 9) || !strcmp(hook, "none-user");
	struct hookbench_bpf *skel = hookbench_bpf__open();
	struct bpf_program *prog;
	char name[32], buf[1];
	int fd = open("/dev/zero", O_RDONLY), sum = 0;
	double t0, t1;

	snprintf(name, sizeof(name), "on_%s", hook);
	bpf_object__for_each_program(prog, skel->obj)	/* 고른 훅 하나만 로드 */
		bpf_program__set_autoload(prog, !strcmp(bpf_program__name(prog), name));
	skel->rodata->target_tgid = getpid();
	if (hookbench_bpf__load(skel))
		return 1;

	if (!strcmp(hook, "uprobe") || !strcmp(hook, "uretprobe")) {
		LIBBPF_OPTS(bpf_uprobe_opts, uo, .func_name = "work",
			    .retprobe = !strcmp(hook, "uretprobe"));
		prog = !strcmp(hook, "uprobe") ? skel->progs.on_uprobe : skel->progs.on_uretprobe;
		if (!bpf_program__attach_uprobe_opts(prog, 0, "/proc/self/exe", 0, &uo))
			return 1;
	} else if (hookbench_bpf__attach(skel)) {
		return 1;
	}

	t0 = now();
	for (int i = 0; i < N; i++) {
		if (user)
			sum = work(sum);
		else
			sum += read(fd, buf, 1);
	}
	t1 = now();
	printf("%-10s %7.1f ns/op  hits=%llu\n", hook, (t1 - t0) * 1e9 / N,
	       (unsigned long long)skel->bss->hits);
	hookbench_bpf__destroy(skel);
	return 0;
}

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>

char LICENSE[] SEC("license") = "GPL";
char fsname[16];

#ifdef KPROBE_DIRECT
SEC("kprobe/vfs_read")
int BPF_KPROBE(kp, struct file *file)
{
	/* kprobe 인자는 타입 정보가 없는 스칼라라 직접 역참조 불가 */
	bpf_probe_read_kernel_str(fsname, sizeof(fsname), file->f_inode->i_sb->s_type->name);
	return 0;
}
#endif

#ifdef KPROBE_CORE
SEC("kprobe/vfs_read")
int BPF_KPROBE(kp, struct file *file)
{
	const char *name = BPF_CORE_READ(file, f_inode, i_sb, s_type, name);

	bpf_probe_read_kernel_str(fsname, sizeof(fsname), name);
	return 0;
}
#endif

#ifdef FENTRY_INLINED
SEC("fentry/new_sync_read")		/* 인라인돼 심볼이 없는 함수 */
int BPF_PROG(fe, struct file *filp)
{
	return 0;
}
#endif

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>

char LICENSE[] SEC("license") = "GPL";

#define MAX_SLOTS 24

struct {
	__uint(type, BPF_MAP_TYPE_HASH);
	__uint(max_entries, 10240);
	__type(key, u32);			/* tid */
	__type(value, u64);			/* 진입 시각 */
} start SEC(".maps");

struct hist_key {
	char fs[16];
	u32 slot;
};

struct {
	__uint(type, BPF_MAP_TYPE_HASH);
	__uint(max_entries, 1024);
	__type(key, struct hist_key);
	__type(value, u64);
} hist SEC(".maps");

static __always_inline u32 log2l(u64 v)
{
	u32 r = 0;

	while (v > 1 && r < MAX_SLOTS - 1) {
		v >>= 1;
		r++;
	}
	return r;
}

SEC("fentry/vfs_read")
int BPF_PROG(read_enter, struct file *file)
{
	u32 tid = bpf_get_current_pid_tgid();
	u64 ts = bpf_ktime_get_ns();

	bpf_map_update_elem(&start, &tid, &ts, BPF_ANY);
	return 0;
}

SEC("fexit/vfs_read")
int BPF_PROG(read_exit, struct file *file, char *buf, size_t count, loff_t *pos, ssize_t ret)
{
	u32 tid = bpf_get_current_pid_tgid();
	struct hist_key key = {};
	u64 *tsp, one = 1, *cnt;

	tsp = bpf_map_lookup_elem(&start, &tid);
	if (!tsp)
		return 0;
	/* BTF 덕분에 포인터를 바로 따라간다 (bpf_probe_read 불필요) */
	bpf_probe_read_kernel_str(key.fs, sizeof(key.fs), file->f_inode->i_sb->s_type->name);
	key.slot = log2l((bpf_ktime_get_ns() - *tsp) / 1000);	/* us */
	bpf_map_delete_elem(&start, &tid);

	cnt = bpf_map_lookup_elem(&hist, &key);
	if (cnt)
		__sync_fetch_and_add(cnt, 1);
	else
		bpf_map_update_elem(&hist, &key, &one, BPF_NOEXIST);
	return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <bpf/libbpf.h>
#include "readlat.skel.h"

struct hist_key { char fs[16]; unsigned int slot; };

int main(int argc, char **argv)
{
	struct readlat_bpf *skel = readlat_bpf__open_and_load();
	struct hist_key k, *prev = NULL, keys[1024];
	unsigned long long v;
	int n = 0;

	if (!skel || readlat_bpf__attach(skel))
		return 1;
	sleep(argc > 1 ? atoi(argv[1]) : 5);

	while (!bpf_map__get_next_key(skel->maps.hist, prev, &k, sizeof(k))) {
		keys[n++] = k;
		prev = &keys[n - 1];
	}
	for (const char *fs = NULL; ; fs = NULL) {	/* 파일시스템별로 모아 출력 */
		for (int i = 0; i < n; i++)
			if (keys[i].fs[0]) { fs = keys[i].fs; break; }
		if (!fs)
			break;
		char cur[16];
		strcpy(cur, fs);
		printf("\n%s\n", cur);
		for (unsigned int s = 0; s < 24; s++)
			for (int i = 0; i < n; i++)
				if (!strcmp(keys[i].fs, cur) && keys[i].slot == s) {
					bpf_map__lookup_elem(skel->maps.hist, &keys[i], sizeof(k), &v, sizeof(v), 0);
					printf("  %6llu - %-6llu us : %llu\n", s ? 1ULL << s : 0, (1ULL << (s + 1)) - 1, v);
				}
		for (int i = 0; i < n; i++)
			if (!strcmp(keys[i].fs, cur))
				keys[i].fs[0] = 0;
	}
	readlat_bpf__destroy(skel);
	return 0;
}

sync; echo 3 | sudo tee /proc/sys/vm/drop_caches
sudo ./readlat 30 &
for i in $(seq 200); do md5sum /proc/meminfo > /dev/null; done
seq 100000 | md5sum > /dev/null
find /usr/share/doc -type f | head -3000 | xargs -d '\n' md5sum > /dev/null

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>

char LICENSE[] SEC("license") = "GPL";

const volatile char target_comm[16] = "";
__u64 sizes[32];

static __always_inline bool is_target(void)
{
	char comm[16];

	bpf_get_current_comm(comm, sizeof(comm));
	for (int i = 0; i < 16; i++) {
		if (comm[i] != target_comm[i])
			return false;
		if (!comm[i])
			break;
	}
	return true;
}

SEC("uprobe/libc.so.6:malloc")
int BPF_UPROBE(malloc_enter, size_t size)
{
	u32 slot = 0;

	if (!is_target())
		return 0;
	while (size > 1 && slot < 31) {
		size >>= 1;
		slot++;
	}
	__sync_fetch_and_add(&sizes[slot], 1);
	return 0;
}

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <bpf/libbpf.h>
#include "ulat.skel.h"

int main(int argc, char **argv)
{
	struct ulat_bpf *skel = ulat_bpf__open();

	strncpy((char *)skel->rodata->target_comm, argv[1], 15);
	if (ulat_bpf__load(skel) || ulat_bpf__attach(skel))
		return 1;
	sleep(argc > 2 ? atoi(argv[2]) : 5);

	printf("malloc size histogram for '%s'\n", argv[1]);
	for (int s = 0; s < 32; s++)
		if (skel->bss->sizes[s])
			printf("  %8llu - %-8llu : %llu\n", s ? 1ULL << s : 0,
			       (1ULL << (s + 1)) - 1, skel->bss->sizes[s]);
	ulat_bpf__destroy(skel);
	return 0;
}