You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
68 lines
1.5 KiB
68 lines
1.5 KiB
#!/usr/bin/env python
|
|
#
|
|
# kvm_hypercall.py
|
|
#
|
|
# Demonstrates stateful kvm_entry and kvm_exit recording along with the
|
|
# associated hypercall when exit_reason is VMCALL. See kvm_hypercall.txt
|
|
# for usage
|
|
#
|
|
# REQUIRES: Linux 4.7+ (BPF_PROG_TYPE_TRACEPOINT support)
|
|
#
|
|
# Copyright (c) 2017 ShiftLeft Inc.
|
|
#
|
|
# Author(s):
|
|
# Suchakrapani Sharma <suchakra@shiftleft.io>
|
|
|
|
|
|
from __future__ import print_function
|
|
from bcc import BPF
|
|
|
|
# load BPF program
|
|
b = BPF(text="""
|
|
#define EXIT_REASON 18
|
|
BPF_HASH(start, u8, u8);
|
|
|
|
TRACEPOINT_PROBE(kvm, kvm_exit) {
|
|
u8 e = EXIT_REASON;
|
|
u8 one = 1;
|
|
if (args->exit_reason == EXIT_REASON) {
|
|
bpf_trace_printk("KVM_EXIT exit_reason : %d\\n", args->exit_reason);
|
|
start.update(&e, &one);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
TRACEPOINT_PROBE(kvm, kvm_entry) {
|
|
u8 e = EXIT_REASON;
|
|
u8 zero = 0;
|
|
u8 *s = start.lookup(&e);
|
|
if (s != NULL && *s == 1) {
|
|
bpf_trace_printk("KVM_ENTRY vcpu_id : %u\\n", args->vcpu_id);
|
|
start.update(&e, &zero);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
TRACEPOINT_PROBE(kvm, kvm_hypercall) {
|
|
u8 e = EXIT_REASON;
|
|
u8 zero = 0;
|
|
u8 *s = start.lookup(&e);
|
|
if (s != NULL && *s == 1) {
|
|
bpf_trace_printk("HYPERCALL nr : %d\\n", args->nr);
|
|
}
|
|
return 0;
|
|
};
|
|
""")
|
|
|
|
# header
|
|
print("%-18s %-16s %-6s %s" % ("TIME(s)", "COMM", "PID", "EVENT"))
|
|
|
|
# format output
|
|
while 1:
|
|
try:
|
|
(task, pid, cpu, flags, ts, msg) = b.trace_fields()
|
|
except ValueError:
|
|
continue
|
|
print("%-18.9f %-16s %-6d %s" % (ts, task, pid, msg))
|
|
|