ldorau / strace.ebpf Goto Github PK

View Code? Open in Web Editor NEW

3.0 3.0 2.0 856 KB

Tool tracing syscalls in a fast way using eBPF linux kernel feature

Home Page: https://github.com/pmem/vltrace

syscall syscalls kprobes tracepoints ebpf ebpf-programs bcc

strace.ebpf's Introduction

'strace.ebpf' was renamed to 'vltrace' and moved to pmem:

https://github.com/pmem/vltrace

strace.ebpf's People

Contributors

Stargazers

Watchers

Forkers

mramotowski jdschmitz

strace.ebpf's Issues

compilation: strace.epbf gives warning when compiled with gcc 6.2.0

Strace.epbf gives warning when compiled with gcc 6.2.0

/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c: In function ‘test_unsupported_syscalls’:
/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c:126:2: warning: ignoring return value of ‘chroot’, declared with attribute warn_unused_result [-Wunused-result]
chroot(NON_EXIST_PATH_1);
^~~~~~~~~~~~~~~~~~~~~~~~
/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c: In function ‘test_basic_syscalls’:
/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c:94:2: warning: ignoring return value of ‘write’, declared with attribute warn_unused_result [-Wunused-result]
write(fd, buffer, BUF_LEN);
^~~~~~~~~~~~~~~~~~~~~~~~~~
/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c:96:2: warning: ignoring return value of ‘read’, declared with attribute warn_unused_result [-Wunused-result]
read(fd, buffer, BUF_LEN);
^~~~~~~~~~~~~~~~~~~~~~~~~
/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c:113:2: warning: ignoring return value of ‘write’, declared with attribute warn_unused_result [-Wunused-result]
write(0x101, buffer, 1);
^~~~~~~~~~~~~~~~~~~~~~~
/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c:114:2: warning: ignoring return value of ‘read’, declared with attribute warn_unused_result [-Wunused-result]
read (0x102, buffer, 2);
^~~~~~~~~~~~~~~~~~~~~~~

/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c: In function ‘test_unsupported_syscalls’:
/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c:126:2: warning: ignoring return value of ‘chroot’, declared with attribute warn_unused_result [-Wunused-result]
chroot(NON_EXIST_PATH_1);
^~~~~~~~~~~~~~~~~~~~~~~~
/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c: In function ‘test_basic_syscalls’:
/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c:94:2: warning: ignoring return value of ‘write’, declared with attribute warn_unused_result [-Wunused-result]
write(fd, buffer, BUF_LEN);
^~~~~~~~~~~~~~~~~~~~~~~~~~
/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c:96:2: warning: ignoring return value of ‘read’, declared with attribute warn_unused_result [-Wunused-result]
read(fd, buffer, BUF_LEN);
^~~~~~~~~~~~~~~~~~~~~~~~~
/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c:113:2: warning: ignoring return value of ‘write’, declared with attribute warn_unused_result [-Wunused-result]
write(0x101, buffer, 1);
^~~~~~~~~~~~~~~~~~~~~~~
/home/mramotow/repos/pmemfile/strace.ebpf/test/test_syscalls.c:114:2: warning: ignoring return value of ‘read’, declared with attribute warn_unused_result [-Wunused-result]
read (0x102, buffer, 2);
^~~~~~~~~~~~~~~~~~~~~~~

strace.ebpf should wait for all children of the traced process until they exit

src/utils.c - dead code

Value stored to 'res' is never read in line 114 in src/utils.c

cmake: make uninstall is not implemented

Make uninstall is not implemented.

utils/file_sc_bench.c - possible division by 0

Possible division by zero in line 94 in utils/file_sc_bench.c

cmake: errors when trying to make

mramotow@mramotow:~/home/mramotow/strace.ebpf/build (master)$ make
Scanning dependencies of target check_license_executable
[  2%] Building C object CMakeFiles/check_license_executable.dir/utils/check_license/check-license.c.o
[  4%] Linking C executable CMakeFiles/check_license_executable
[  4%] Built target check_license_executable
Scanning dependencies of target test_syscalls
[  7%] Building C object test/CMakeFiles/test_syscalls.dir/test_syscalls.c.o
[  9%] Linking C executable test_syscalls
[  9%] Built target test_syscalls
[  9%] Built target syscalls_64
Scanning dependencies of target ebpf
[ 11%] Building C object src/ebpf/CMakeFiles/ebpf.dir/ebpf_file_set.c.o
[ 14%] Linking C static library ../nondebug/libebpf.a
[ 64%] Built target ebpf
Scanning dependencies of target strace.ebpf
[ 66%] Building C object src/CMakeFiles/strace.ebpf.dir/strace.ebpf.c.o
[ 69%] Building C object src/CMakeFiles/strace.ebpf.dir/txt.c.o
[ 71%] Building C object src/CMakeFiles/strace.ebpf.dir/cl_parser.c.o
[ 73%] Building C object src/CMakeFiles/strace.ebpf.dir/bpf_ctx.c.o
[ 76%] Building C object src/CMakeFiles/strace.ebpf.dir/utils.c.o
[ 78%] Building C object src/CMakeFiles/strace.ebpf.dir/attach_probes.c.o
[ 80%] Building C object src/CMakeFiles/strace.ebpf.dir/ebpf_syscalls.c.o
/home/mramotow/strace.ebpf/src/ebpf_syscalls.c:490:15: error: use of undeclared identifier '__NR_pkey_mprotect'
        EBPF_SYSCALL(__NR_pkey_mprotect, SyS_pkey_mprotect, 6),
                     ^
/home/mramotow/strace.ebpf/src/ebpf_syscalls.c:491:15: error: use of undeclared identifier '__NR_pkey_alloc'
        EBPF_SYSCALL(__NR_pkey_alloc, SyS_pkey_alloc, 6),
                     ^
/home/mramotow/strace.ebpf/src/ebpf_syscalls.c:492:15: error: use of undeclared identifier '__NR_pkey_free'
        EBPF_SYSCALL(__NR_pkey_free, SyS_pkey_free, 6),
                     ^
3 errors generated.
src/CMakeFiles/strace.ebpf.dir/build.make:218: recipe for target 'src/CMakeFiles/strace.ebpf.dir/ebpf_syscalls.c.o' failed
make[2]: *** [src/CMakeFiles/strace.ebpf.dir/ebpf_syscalls.c.o] Error 1
CMakeFiles/Makefile2:415: recipe for target 'src/CMakeFiles/strace.ebpf.dir/all' failed
make[1]: *** [src/CMakeFiles/strace.ebpf.dir/all] Error 2
Makefile:138: recipe for target 'all' failed
make: *** [all] Error 2

src/strace.ebpf.c - dead code

Value stored to 'stop_tracing' is never read in line 270 and 277 in src/strace.ebpf.c

cmake: make install works but do nothing

make install
[ 4%] Built target check_license_executable
[ 9%] Built target test_syscalls
[ 25%] Built target strace
[ 79%] Built target ebpf
[ 95%] Built target strace.ebpf
[100%] Built target file_sc_bench
Install the project...
-- Install configuration: ""
make uninstall
make: *** No rule to make target 'uninstall'. Stop.

Implement one more way to attach, using hack with seccomp

iovisor/bcc#786

Remove PID of exited children from the children’s hash map

build: repository does not build

Found on revision: d80a218 with gcc 5.4 on kernel 4.8.0-34 and 4.9.4-rc4. On kernel 4.9.4 it is building.

/home/mramotow/repos/pmemfile/strace.ebpf/src/bpf_ctx.c: In function ‘attach_callback_to_perf_output’:
/home/mramotow/repos/pmemfile/strace.ebpf/src/bpf_ctx.c:141:41: warning: passing argument 3 of ‘bpf_open_perf_buffer’ makes pointer from integer without a cast [-Wint-conversion]
bpf_open_perf_buffer(callback, NULL, -1, cpu,
^
In file included from /home/mramotow/repos/pmemfile/strace.ebpf/src/bpf_ctx.c:46:0:
/usr/include/bcc/libbpf.h:72:8: note: expected ‘void *’ but argument is of type ‘int’
void * bpf_open_perf_buffer(perf_reader_raw_cb raw_cb,
^
/home/mramotow/repos/pmemfile/strace.ebpf/src/bpf_ctx.c:141:4: error: too few arguments to function ‘bpf_open_perf_buffer’
bpf_open_perf_buffer(callback, NULL, -1, cpu,
^
In file included from /home/mramotow/repos/pmemfile/strace.ebpf/src/bpf_ctx.c:46:0:
/usr/include/bcc/libbpf.h:72:8: note: declared here
void * bpf_open_perf_buffer(perf_reader_raw_cb raw_cb,
^
src/CMakeFiles/strace.ebpf.dir/build.make:146: recipe for target 'src/CMakeFiles/strace.ebpf.dir/bpf_ctx.c.o' failed
make[2]: *** [src/CMakeFiles/strace.ebpf.dir/bpf_ctx.c.o] Error 1
CMakeFiles/Makefile2:314: recipe for target 'src/CMakeFiles/strace.ebpf.dir/all' failed
make[1]: *** [src/CMakeFiles/strace.ebpf.dir/all] Error 2
Makefile:138: recipe for target 'all' failed
make: *** [all] Error 2

make: warning: too many arguments for format [-Wformat-extra-args]

Found on 3b3b8d9

/home/mramotow/repos/pmemfile/strace.ebpf/src/utils.c: In function ‘check_bpf_jit_status’:
/home/mramotow/repos/pmemfile/strace.ebpf/src/utils.c:241:17: warning: too many arguments for format [-Wformat-extra-args]
fprintf(file, "ERROR: cannot read status of "
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Implement fast mode of follow-fork

Maybe use session ID?

compilation: strace.ebpf do not compile under gcc-4.8.5

strace.ebpf do not compile under gcc-4.8.5

/home/mramotow/repos/pmemfile/strace.ebpf/src/libstrace/strace_bpf.c: In function ‘attach_callback_to_perf_output’:
/home/mramotow/repos/pmemfile/strace.ebpf/src/libstrace/strace_bpf.c:139:2: error: ‘for’ loop initial declarations are only allowed in C99 mode
for (int cpu = 0; cpu < cpu_qty; cpu++) {
^
/home/mramotow/repos/pmemfile/strace.ebpf/src/libstrace/strace_bpf.c:139:2: note: use option -std=c99 or -std=gnu99 to compile your code
/home/mramotow/repos/pmemfile/strace.ebpf/src/libstrace/strace_bpf.c: In function ‘detach_all’:
/home/mramotow/repos/pmemfile/strace.ebpf/src/libstrace/strace_bpf.c:191:2: error: ‘for’ loop initial declarations are only allowed in C99 mode
for (unsigned i = 0; i < b->pr_arr_qty; i++) {
^
src/libstrace/CMakeFiles/strace.dir/build.make:62: recipe for target 'src/libstrace/CMakeFiles/strace.dir/strace_bpf.c.o' failed
make[2]: *** [src/libstrace/CMakeFiles/strace.dir/strace_bpf.c.o] Error 1
CMakeFiles/Makefile2:547: recipe for target 'src/libstrace/CMakeFiles/strace.dir/all' failed
make[1]: *** [src/libstrace/CMakeFiles/strace.dir/all] Error 2
Makefile:138: recipe for target 'all' failed
make: *** [all] Error 2