Bpf performance tools chapter 4 bcc
1 like401 views
Chapter 4 of the BPF Performance Tools discusses the BPF Compiler Collection (bcc), a toolkit designed for efficient kernel tracing and manipulation. It outlines how to install bcc, develop programs using it, and provides examples of its functionality, specifically focusing on task switching and data retrieval. The chapter also covers alternative profiling tools and offers additional resources for programming with bcc.
![task_switch.py
[/path/to/bcc/examples/tracing]% sudo python task_switch.py
task_switch[ 0-> 2520]=10
task_switch[14980-> 0]=1
task_switch[ 1096-> 0]=1
task_switch[19347->14055]=1
task_switch[14423-> 0]=1
task_switch[ 0-> 53]=1
task_switch[ 0->28879]=60](https://image.slidesharecdn.com/bpfperformancetoolschapter4-bcc-200223205012/85/Bpf-performance-tools-chapter-4-bcc-8-320.jpg)
Bpf performance tools chapter 4 bcc
- 1. BPF Performance Tools chapter 4 - bcc Viller Hsiao Feb. 17, 2020
- 2. What’s in Chapter 4
- 3. BPF Compiler Collection (BCC) BCC is a toolkit for creating efficient kernel tracing and manipulation programs, and includes several useful tools and examples. It makes use of extended BPF (Berkeley Packet Filters), formally known as eBPF, a new feature that was first added to Linux 3.15. Much of what BCC uses requires Linux 4.1 and above. (4.9 and up is better)
- 4. Overview (1/3) ● Use bcc ○ How to install bcc ■ with man page ■ example files ○ Tools overview ● Develop bcc program ○ bcc internals ○ debugging bcc
- 5. Overview (2/3) ● Use bcc ○ How to install bcc ○ Tools overview ● Develop bcc program ○ bcc internals ○ debugging bcc
- 6. Overview (3/3) ● Use bcc ○ How to install bcc ○ Tools overview ● Develop bcc program ○ bcc internals ○ debugging bcc
- 8. task_switch.py [/path/to/bcc/examples/tracing]% sudo python task_switch.py task_switch[ 0-> 2520]=10 task_switch[14980-> 0]=1 task_switch[ 1096-> 0]=1 task_switch[19347->14055]=1 task_switch[14423-> 0]=1 task_switch[ 0-> 53]=1 task_switch[ 0->28879]=60
- 10. Main Parts 1. BPF program to run in kernel 2. Kernel tracing tool to use 3. Retrieve data and do some post processing
- 11. What’s the Program Do? Translation When kernel run to <target>, use <tracing mechanism> to execute <handler>. The handler record some <statistics> or do <something>. (Like a function decorator in Python)
- 12. Actions When kernel run to finish_task_switch, use kprobe to execute cond_sched. The handler store counts of task switch as hash map, which is indexed by (prev_pid, curr_pid) pairs. static struct rq * finish_task_switch(struct task_struct *prev) BPF helper
- 13. Recorded Data Manipulation When kernel run to finish_task_switch, use kprobe to execute cond_sched. The handler store counts of task switch as hash map, which is indexed by (prev_pid, curr_pid) pairs.
- 14. 翻訳コンニャク When kernel run to finish_task_switch, use kprobe to execute cond_sched. The handler store counts of task switch as hash map, which is indexed by (prev_pid, curr_pid) pairs.
- 15. Resources for bcc Programming ● bcc Reference Guide ○ BPF C ○ bcc Python ● bpftrace -l
- 16. Other resources ● If it’s hard to use bpftrace on your machine ... ● /sys/kernel/tracing ○ available_events ■ tracepoint ○ tracepoint format ■ /sys/kernel/tracing/<type>/<event>/format ■ e.g. events/irq/softirq_entry/format ○ available_filter_functions ■ kprobe on function entry ● “perf list” ○ pmu events
- 18. Alternative Profiling Tools ● bpftrace ● ftrace / perf ○ perf-tools, by Brendan Gregg, before bcc ○ iosnoop vs biosnoop-bpfcc ● Other frontends ○ systemtap, LTTng and so on
- 19. Q & A