Skip to content

Add libbpf-based tools #2755

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Feb 13, 2020
Merged

Conversation

anakryiko
Copy link
Contributor

With BPF Compile Once - Run Everywhere (CO-RE), global variables, BPF skeleton, and other BPF features developed over last year, it's now feasible to build equivalents of BCC tools without the need to perform BPF code compilation in runtime and without dependency on installed kernel-devel package. This change adds a first such tool (runqslower), converted from its Python origin to a pure C-based tool, using BPF CO-RE. It also sets up a build flow to simplify adding/converting more such tools easily for people willing to help.

It seems like a good idea to keep such tools close to their progenitors and let users choose what works best for them: BCC-based tools are great for experimentation and quick prototyping and customizing to ad-hoc user needs, but sometimes require a high toll w.r.t. runtime resource usage (Clang/LLVM/Python dependency) and assumptions about kernel headers availability. On the other hand, libbpf- and CO-RE-based tools are small, fast and with almost no extra dependencies, but rely on more recent kernel versions. Having both will help better address user needs and will hopefully grow user community further.

See README.md for some more details on a build setup and conventions.

Check in bpftool binary to be used for BPF skeleton generation for
libbpf-based tools.

Signed-off-by: Andrii Nakryiko <andriin@fb.com>
Check in vmlinux.h generated from Linux 5.5 version with default config. This
is used from libbpf-based tools.

Signed-off-by: Andrii Nakryiko <andriin@fb.com>
@brendangregg
Copy link
Member

Thanks, I'll check it out, and have a go at porting some myself (like execsnoop(8), opensnoop(8), biosnoop(8), biolatency(8), ...).

I like to preserve the history of the tools we use. Could runqslower.c have a comment line at the top to say something like:

// Based on runqslower(8) from BCC by Ivan Babrou.
// 11-Feb-2020  Andrii Nakryiko  Created This.

And the man/man8/runqslower.8 file could say something like:

.SH AUTHOR
Ivan Babrou, original BCC Python version
Andrii Nakryiko, CO-RE version

@anakryiko
Copy link
Contributor Author

Sounds good, will add!

… tool

Add runqslower as a first tool converted from BCC to libbpf, utilizing BPF
CO-RE (Compile Once - Run Everywhere) approach and BPF skeleton for
interfacing with BPF programs. Current set up is Makefile based and is set up
in such a way as to enable easy addition for more tools, based on a simple and
convenient naming pattern. General build infrastructure takes case of BPF
skeleton generation, tracking dependencies, clean up, etc.

Signed-off-by: Andrii Nakryiko <andriin@fb.com>
@anakryiko
Copy link
Contributor Author

Added history, updated man page. Added -t TID option, backported next->comm fix. Should be identical to Python version.

@yonghong-song
Copy link
Collaborator

[buildbot, test this please]

@yonghong-song
Copy link
Collaborator

Thanks! This is good enough for folks to start experiments!

@yonghong-song yonghong-song merged commit 0d0d353 into iovisor:master Feb 13, 2020
@anakryiko anakryiko deleted the libbpf-based-tools branch February 13, 2020 17:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants