New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add libbpf-based tools #2755
Add libbpf-based tools #2755
Conversation
Check in bpftool binary to be used for BPF skeleton generation for libbpf-based tools. Signed-off-by: Andrii Nakryiko <andriin@fb.com>
Check in vmlinux.h generated from Linux 5.5 version with default config. This is used from libbpf-based tools. Signed-off-by: Andrii Nakryiko <andriin@fb.com>
Thanks, I'll check it out, and have a go at porting some myself (like execsnoop(8), opensnoop(8), biosnoop(8), biolatency(8), ...). I like to preserve the history of the tools we use. Could runqslower.c have a comment line at the top to say something like: // Based on runqslower(8) from BCC by Ivan Babrou.
// 11-Feb-2020 Andrii Nakryiko Created This. And the man/man8/runqslower.8 file could say something like:
|
Sounds good, will add! |
… tool Add runqslower as a first tool converted from BCC to libbpf, utilizing BPF CO-RE (Compile Once - Run Everywhere) approach and BPF skeleton for interfacing with BPF programs. Current set up is Makefile based and is set up in such a way as to enable easy addition for more tools, based on a simple and convenient naming pattern. General build infrastructure takes case of BPF skeleton generation, tracking dependencies, clean up, etc. Signed-off-by: Andrii Nakryiko <andriin@fb.com>
d4fcb85
to
e1496e1
Compare
Added history, updated man page. Added |
[buildbot, test this please] |
Thanks! This is good enough for folks to start experiments! |
With BPF Compile Once - Run Everywhere (CO-RE), global variables, BPF skeleton, and other BPF features developed over last year, it's now feasible to build equivalents of BCC tools without the need to perform BPF code compilation in runtime and without dependency on installed kernel-devel package. This change adds a first such tool (runqslower), converted from its Python origin to a pure C-based tool, using BPF CO-RE. It also sets up a build flow to simplify adding/converting more such tools easily for people willing to help.
It seems like a good idea to keep such tools close to their progenitors and let users choose what works best for them: BCC-based tools are great for experimentation and quick prototyping and customizing to ad-hoc user needs, but sometimes require a high toll w.r.t. runtime resource usage (Clang/LLVM/Python dependency) and assumptions about kernel headers availability. On the other hand, libbpf- and CO-RE-based tools are small, fast and with almost no extra dependencies, but rely on more recent kernel versions. Having both will help better address user needs and will hopefully grow user community further.
See README.md for some more details on a build setup and conventions.