Skip to content

Conversation

gllghr
Copy link
Contributor

@gllghr gllghr commented Feb 9, 2020

Cherry-pick upstream change iovisor/bcc#2746 to allow us to build a -dbgsym package for libbcc.

ab-pre-push: http://selfservice.jenkins.delphix.com/job/devops-gate/job/master/job/appliance-build-orchestrator-pre-push/2846/console

@pzakha
Copy link
Contributor

pzakha commented Feb 10, 2020

I think we should sync bcc with upstream instead and verify that bpftrace still works.

@gllghr
Copy link
Contributor Author

gllghr commented Feb 10, 2020

Yeah, I agree. We also probably want to have some way of reminding ourselves to regularly check whether we want to pull in upstream changes. I think that those things can be done independently of this though.

Copy link
Contributor

@pzakha pzakha left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given that there are issues with latest BCC, I'm fine cherry-picking this one for now.

@pzakha pzakha merged commit 1433792 into delphix:master Feb 10, 2020
@gllghr gllghr deleted the debianPkgFix branch February 10, 2020 23:19
pzakha pushed a commit to pzakha/bcc that referenced this pull request Oct 28, 2020
* Python BPF disassembler and map layout parser

Debugging eBPF programs can be tricky. The clang debug flags are not
supported in all the code-loading branches yet - e.g., only load_prog()
supports BPF_DEBUG or DEBUG_BPF_REGISTER_STATE, but compiling a kprobe
with BPF(...) doesn't.

This built-in disassembler can disassemble and print the BPF code in a
similar syntax than the kernel, whenever and the number of times the
user needs it. The BPF ISA is relatively stable so it doesn't require
much maintenance.

In addition, this parser is agnostic from the original source language
(C, B, Go, etc.), and doesn't depend on a particular compiler.

Example output for trace_pid_start() in biotop:

Disassemble of BPF program trace_pid_start:
   0: (79) r1 = *(u64*)(r1 +112)
   1: (7b) *(u64*)(r10 -8) = r1
   2: (b7) r1 = 0
   3: (63) *(u32*)(r10 -16) = r1
   4: (7b) *(u64*)(r10 -24) = r1
   5: (7b) *(u64*)(r10 -32) = r1
   6: (bf) r1 = r10
   7: (07) r1 += -28
   8: (b7) r2 = 16
   9: (85) call bpf_get_current_comm#16
  10: (67) r0 <<= 32
  11: (77) r0 >>= 32
  12: (55) if r0 != 0 goto +10 <23>
  13: (85) call bpf_get_current_pid_tgid#14
  14: (63) *(u32*)(r10 -32) = r0
  15: (18) r1 = <map at fd delphix#3>
  17:      (64-bit upper word)
  17: (bf) r2 = r10
  18: (07) r2 += -8
  19: (bf) r3 = r10
  20: (07) r3 += -32
  21: (b7) r4 = 0
  22: (85) call bpf_map_update_elem#2
  23: (b7) r0 = 0
  24: (95) exit

The fields, types and memory layouts of maps can also be printed, which
is something that can be really helpful when dealing with unaligned
accesses or packed vs unpacked structures, and currently not supported
by clang.

For a map with key:

  struct {int a; short b; struct {int c:4; int d:8;};});

and value u64 the example output is:

Layout of BPF type HASH map test_map (ID 0):
  struct {
    [0 +4] int a;
    [4 +2] short b;
    [6 +2] char[2] __pad_2;
    [8 +4] struct {
      int c:4;
      int d:8;
    } __anon0;
  } key;
  unsigned long long value;

The [X +Y] is optional and denotes the offset and the size of each
field. Note that bit-fields and padding fields are shown.

Signed-off-by: Oriol Arcas <oriol@starflownetworks.com>
prakashsurya pushed a commit that referenced this pull request Nov 8, 2022
There are two pass managers in LLVM. Currently BCC uses the legacy one.
Switch to the new pass manager because the legacy one will be removed
in upcoming releases of LLVM.

Running the following script:
```

from bcc import BPF

bpf_text = '''
static int foobar()
{
    bpf_trace_printk("enter vfs_read");
    return 0;
}

KFUNC_PROBE(vfs_read)
{
    return foobar();
}
'''

BPF(text=bpf_text, debug=1)
```

The IR output is the same with or without this change using LLVM 15:

    ; ModuleID = 'sscanf'
    source_filename = "sscanf"
    ; ModuleID = '/virtual/main.c'
    source_filename = "/virtual/main.c"
    target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
    target triple = "bpf-pc-linux"

    @_version = dso_local global i32 332032, section "version", align 4, !dbg !0
    @_license = dso_local global [4 x i8] c"GPL\00", section "license", align 1, !dbg !5
    @__const.foobar._fmt = private unnamed_addr constant [15 x i8] c"enter vfs_read\00", align 1
    @llvm.compiler.used = appending global [2 x ptr] [ptr @_license, ptr @_version], section "llvm.metadata"

    ; Function Attrs: alwaysinline nounwind
    define dso_local i32 @kfunc__vfs_read(ptr nocapture noundef readnone %0) local_unnamed_addr #0 section ".bpf.fn.kfunc__vfs_read" !dbg !33 {
    %2 = alloca [15 x i8], align 1
    call void @llvm.dbg.value(metadata ptr %0, metadata !39, metadata !DIExpression()), !dbg !41
    call void @llvm.dbg.value(metadata ptr undef, metadata !42, metadata !DIExpression()) #4, !dbg !45
    call void @llvm.lifetime.start.p0(i64 15, ptr nonnull %2) #4, !dbg !47
    call void @llvm.dbg.declare(metadata ptr %2, metadata !53, metadata !DIExpression()) #4, !dbg !58
    call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(15) %2, ptr noundef nonnull align 1 dereferenceable(15) @__const.foobar._fmt, i64 15, i1 false) #4, !dbg !58
    %3 = call i32 (ptr, i64, ...) inttoptr (i64 6 to ptr)(ptr noundef nonnull %2, i64 noundef 15) #4, !dbg !59
    call void @llvm.lifetime.end.p0(i64 15, ptr nonnull %2) #4, !dbg !60
    call void @llvm.dbg.value(metadata i32 0, metadata !40, metadata !DIExpression()), !dbg !41
    ret i32 0, !dbg !61
    }

    ; Function Attrs: alwaysinline mustprogress nocallback nofree nosync nounwind readnone speculatable willreturn
    declare void @llvm.dbg.declare(metadata, metadata, metadata) #1

    ; Function Attrs: alwaysinline argmemonly mustprogress nocallback nofree nosync nounwind willreturn
    declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #2

    ; Function Attrs: alwaysinline argmemonly mustprogress nocallback nofree nosync nounwind willreturn
    declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #2

    ; Function Attrs: alwaysinline argmemonly mustprogress nofree nounwind willreturn
    declare void @llvm.memcpy.p0.p0.i64(ptr noalias nocapture writeonly, ptr noalias nocapture readonly, i64, i1 immarg) #3

    ; Function Attrs: alwaysinline mustprogress nocallback nofree nosync nounwind readnone speculatable willreturn
    declare void @llvm.dbg.value(metadata, metadata, metadata) #1

    attributes #0 = { alwaysinline nounwind "frame-pointer"="none" "min-legal-vector-width"="0" "no-jump-tables"="true" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
    attributes #1 = { alwaysinline mustprogress nocallback nofree nosync nounwind readnone speculatable willreturn }
    attributes #2 = { alwaysinline argmemonly mustprogress nocallback nofree nosync nounwind willreturn }
    attributes #3 = { alwaysinline argmemonly mustprogress nofree nounwind willreturn }
    attributes #4 = { nounwind }

    !llvm.dbg.cu = !{!2}
    !llvm.module.flags = !{!27, !28, !29, !30, !31}
    !llvm.ident = !{!32}

    !0 = !DIGlobalVariableExpression(var: !1, expr: !DIExpression())
    !1 = distinct !DIGlobalVariable(name: "_version", scope: !2, file: !14, line: 526, type: !26, isLocal: false, isDefinition: true)
    !2 = distinct !DICompileUnit(language: DW_LANG_C99, file: !3, producer: "Ubuntu clang version 15.0.0-++20220426083628+d738d4717f6d-1~exp1~20220426203725.435", isOptimized: true, runtimeVersion: 0, emissionKind: FullDebug, globals: !4, splitDebugInlining: false, nameTableKind: None)
    !3 = !DIFile(filename: "/virtual/main.c", directory: "/home/ubuntu/sources/bpf-next")
    !4 = !{!0, !5, !12}
    !5 = !DIGlobalVariableExpression(var: !6, expr: !DIExpression())
    !6 = distinct !DIGlobalVariable(name: "_license", scope: !2, file: !7, line: 26, type: !8, isLocal: false, isDefinition: true)
    !7 = !DIFile(filename: "/virtual/include/bcc/footer.h", directory: "")
    !8 = !DICompositeType(tag: DW_TAG_array_type, baseType: !9, size: 32, elements: !10)
    !9 = !DIBasicType(name: "char", size: 8, encoding: DW_ATE_signed_char)
    !10 = !{!11}
    !11 = !DISubrange(count: 4)
    !12 = !DIGlobalVariableExpression(var: !13, expr: !DIExpression())
    !13 = distinct !DIGlobalVariable(name: "bpf_trace_printk_", scope: !2, file: !14, line: 542, type: !15, isLocal: true, isDefinition: true)
    !14 = !DIFile(filename: "/virtual/include/bcc/helpers.h", directory: "")
    !15 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !16, size: 64)
    !16 = !DISubroutineType(types: !17)
    !17 = !{!18, !19, !21, null}
    !18 = !DIBasicType(name: "int", size: 32, encoding: DW_ATE_signed)
    !19 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !20, size: 64)
    !20 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !9)
    !21 = !DIDerivedType(tag: DW_TAG_typedef, name: "u64", file: !22, line: 23, baseType: !23)
    !22 = !DIFile(filename: "include/asm-generic/int-ll64.h", directory: "/home/ubuntu/sources/bpf-next")
    !23 = !DIDerivedType(tag: DW_TAG_typedef, name: "__u64", file: !24, line: 31, baseType: !25)
    !24 = !DIFile(filename: "include/uapi/asm-generic/int-ll64.h", directory: "/home/ubuntu/sources/bpf-next")
    !25 = !DIBasicType(name: "unsigned long long", size: 64, encoding: DW_ATE_unsigned)
    !26 = !DIBasicType(name: "unsigned int", size: 32, encoding: DW_ATE_unsigned)
    !27 = !{i32 7, !"Dwarf Version", i32 4}
    !28 = !{i32 2, !"Debug Info Version", i32 3}
    !29 = !{i32 1, !"wchar_size", i32 4}
    !30 = !{i32 7, !"PIC Level", i32 2}
    !31 = !{i32 7, !"PIE Level", i32 2}
    !32 = !{!"Ubuntu clang version 15.0.0-++20220426083628+d738d4717f6d-1~exp1~20220426203725.435"}
    !33 = distinct !DISubprogram(name: "kfunc__vfs_read", scope: !34, file: !34, line: 23, type: !35, scopeLine: 23, flags: DIFlagPrototyped | DIFlagAllCallsDescribed, spFlags: DISPFlagDefinition | DISPFlagOptimized, unit: !2, retainedNodes: !38)
    !34 = !DIFile(filename: "/virtual/main.c", directory: "")
    !35 = !DISubroutineType(types: !36)
    !36 = !{!18, !37}
    !37 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !25, size: 64)
    !38 = !{!39, !40}
    !39 = !DILocalVariable(name: "ctx", arg: 1, scope: !33, file: !34, line: 23, type: !37)
    !40 = !DILocalVariable(name: "__ret", scope: !33, file: !34, line: 23, type: !18)
    !41 = !DILocation(line: 0, scope: !33)
    !42 = !DILocalVariable(name: "ctx", arg: 1, scope: !43, file: !34, line: 23, type: !37)
    !43 = distinct !DISubprogram(name: "____kfunc__vfs_read", scope: !34, file: !34, line: 23, type: !35, scopeLine: 24, flags: DIFlagPrototyped | DIFlagAllCallsDescribed, spFlags: DISPFlagLocalToUnit | DISPFlagDefinition | DISPFlagOptimized, unit: !2, retainedNodes: !44)
    !44 = !{!42}
    !45 = !DILocation(line: 0, scope: !43, inlinedAt: !46)
    !46 = distinct !DILocation(line: 23, column: 1, scope: !33)
    !47 = !DILocation(line: 15, column: 5, scope: !48, inlinedAt: !57)
    !48 = distinct !DILexicalBlock(scope: !49, file: !34, line: 15, column: 3)
    !49 = distinct !DISubprogram(name: "foobar", scope: !34, file: !34, line: 13, type: !50, scopeLine: 14, flags: DIFlagAllCallsDescribed, spFlags: DISPFlagLocalToUnit | DISPFlagDefinition | DISPFlagOptimized, unit: !2, retainedNodes: !52)
    !50 = !DISubroutineType(types: !51)
    !51 = !{!18}
    !52 = !{!53}
    !53 = !DILocalVariable(name: "_fmt", scope: !48, file: !34, line: 15, type: !54)
    !54 = !DICompositeType(tag: DW_TAG_array_type, baseType: !9, size: 120, elements: !55)
    !55 = !{!56}
    !56 = !DISubrange(count: 15)
    !57 = distinct !DILocation(line: 25, column: 9, scope: !43, inlinedAt: !46)
    !58 = !DILocation(line: 15, column: 10, scope: !48, inlinedAt: !57)
    !59 = !DILocation(line: 15, column: 37, scope: !48, inlinedAt: !57)
    !60 = !DILocation(line: 15, column: 76, scope: !49, inlinedAt: !57)
    !61 = !DILocation(line: 23, column: 1, scope: !33)

Closes #3947.

References:
  [0]: https://llvm.org/docs/NewPassManager.html
  [1]: https://blog.llvm.org/posts/2021-03-26-the-new-pass-manager/

Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>
prakashsurya pushed a commit that referenced this pull request Nov 8, 2022
…for -v option

Add additional information and change format of backtrace
- add symbol base offset, dso name, dso base offset
- symbol and dso info is included if it's available in target binary
- changed format:
INDEX ADDR [SYMBOL+OFFSET] (MODULE+OFFSET)

Print backtrace of ip if it failed to get syms.

Before:
  # offcputime -v
    psiginfo
    vscanf
    __snprintf_chk
    [unknown]
    [unknown]
    [unknown]
    [unknown]
    [unknown]
    sd_event_exit
    sd_event_dispatch
    sd_event_run
    [unknown]
    __libc_start_main
    [unknown]
    -                systemd-journal (204)
        1

    xas_load
    xas_find
    filemap_map_pages
    __handle_mm_fault
    handle_mm_fault
    do_page_fault
    do_translation_fault
    do_mem_abort
    do_el0_ia_bp_hardening
    el0_ia
    xas_load
    --
failed to get syms
      -                PmLogCtl (138757)
        1

After:
  # offcputime -v
    #0  0xffffffc01018b7e8 __arm64_sys_clock_nanosleep+0x0
    #1  0xffffffc01009a93c el0_svc_handler+0x34
    #2  0xffffffc010084a08 el0_svc+0x8
    #3  0xffffffc01018b7e8 __arm64_sys_clock_nanosleep+0x0
    --
    #4  0x0000007fa0bffd14 clock_nanosleep+0x94 (/usr/lib/libc-2.31.so+0x9ed14)
    #5  0x0000007fa0c0530c nanosleep+0x1c (/usr/lib/libc-2.31.so+0xa430c)
    #6  0x0000007fa0c051e4 sleep+0x34 (/usr/lib/libc-2.31.so+0xa41e4)
    #7  0x000000558a5a9608 flb_loop+0x28 (/usr/bin/fluent-bit+0x52608)
    #8  0x000000558a59f1c4 flb_main+0xa84 (/usr/bin/fluent-bit+0x481c4)
    #9  0x0000007fa0b85124 __libc_start_main+0xe4 (/usr/lib/libc-2.31.so+0x24124)
    #10 0x000000558a59d828 _start+0x34 (/usr/bin/fluent-bit+0x46828)
    -                fluent-bit (1238)
        1

    #0  0xffffffc01027daa4 generic_copy_file_checks+0x334
    #1  0xffffffc0102ba634 __handle_mm_fault+0x8dc
    #2  0xffffffc0102baa20 handle_mm_fault+0x168
    #3  0xffffffc010ad23c0 do_page_fault+0x148
    #4  0xffffffc010ad27c0 do_translation_fault+0xb0
    #5  0xffffffc0100816b0 do_mem_abort+0x50
    #6  0xffffffc0100843b0 el0_da+0x1c
    #7  0xffffffc01027daa4 generic_copy_file_checks+0x334
    --
    #8  0x0000007f8dc12648 [unknown]
    #9  0x0000007f8dc0aef8 [unknown]
    #10 0x0000007f8dc1c990 [unknown]
    #11 0x0000007f8dc08b0c [unknown]
    #12 0x0000007f8dc08e48 [unknown]
    #13 0x0000007f8dc081c8 [unknown]
    -                PmLogCtl (2412)
        1

Fixed: #3884
Signed-off-by: Eunseon Lee <es.lee@lge.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants