bpflint 0.1.3

Linting functionality for BPF C programs.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88

#include "vmlinux.h"
#include <bpf/bpf_core_read.h>
#include <bpf/bpf_helpers.h>
#include "task_longrun.h"

// Dummy instance to get skeleton to generate definition for `struct event`
struct event _event = {0};

struct {
    __uint(type, BPF_MAP_TYPE_STACK_TRACE);
    __uint(key_size, sizeof(u32));
    __uint(value_size, PERF_MAX_STACK_DEPTH * sizeof(u64));
    __uint(max_entries, __NR_STACKS__);
} stacks SEC(".maps");

struct {
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
    __type(key, u32);
    __type(value, struct running_task);
    __uint(max_entries, 1);
} running_tasks SEC(".maps");

struct {
    __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
    __uint(key_size, sizeof(u32));
    __uint(value_size, sizeof(u32));
} events SEC(".maps");

SEC("tp_btf/sched_switch")
int handle__sched_switch(u64 *ctx)
{
        // TP_PROTO(bool preempt, struct task_struct *prev, struct task_struct *next, struct rq_flags *rf)
        struct task_struct *prev = (struct task_struct *)ctx[1];
        struct task_struct *next = (struct task_struct *)ctx[2];
        s32 cpu = bpf_get_smp_processor_id();
        u64 now = bpf_ktime_get_ns();
        struct running_task *t;
        if (!(t = bpf_map_lookup_elem(&running_tasks, &cpu)))
                return 0;

        int prev_pid = 0;
        bpf_core_read(&prev_pid, sizeof(prev_pid), &prev->pid);
        int next_prev_pid = BPF_CORE_READ(next, pid);

        if (t->running_at && prev->pid) {
                s64 dur = now - t->running_at;
                if (dur > runtime_thresh_ns) {
                        struct event event = {0};
                        bpf_probe_read(event.comm, TASK_COMM_LEN, prev->comm);
                        bpf_probe_read(event.bt, sizeof(t->bt), t->bt);
                        event.pid = prev_pid;
                        event.duration = dur;
                        event.bt_sample_cnt = t->bt_sample_cnt;
                        bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &event, sizeof(event));
                }
        }

        t->running_at = 0;
        t->bt_at = 0;
        if (kthread_only && !(next->flags & PF_KTHREAD))
                return 0;
        if (percpu_only && next->nr_cpus_allowed != 1)
                return 0;
        t->running_at = now;
        t->bt_at = now;
        t->bt_sample_cnt = 0;
        return 0;
}


SEC("kprobe/scheduler_tick")
void handle__sched_tick(struct pt_regs *ctx)
{
        s32 cpu = bpf_get_smp_processor_id();
        u64 now = bpf_ktime_get_ns();
        struct running_task *t;
        u32 stkid, idx;
        if (!(t = bpf_map_lookup_elem(&running_tasks, &cpu)))
                return;
        if (!t->bt_at || now - t->bt_at < backtrace_interval_ns)
                return;

        idx = t->bt_sample_cnt++ % __NR_BTS__;
        t->bt[idx] = bpf_get_stackid(ctx, &stacks, BPF_F_REUSE_STACKID);
        t->bt_at = now;
}

char _license[] SEC("license") = "GPL";