bpfql 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd92fdeedd7501b48699058bf9a466287d511beb9ebebaa865dd53f171f4f0e7
-  data.tar.gz: 485ece1c48041ea20293838d9bfc6c5ee88fac2b6edfffccc6d696de6f425520
+  metadata.gz: b134a056eb4c5c02472903a1f49c68ebd9c3a9af551ce8024c681ac4113581ae
+  data.tar.gz: e0d3921a0b4861c7edd9c392f4117470ae4d6165b40298d0a9bd06bc3d232f56
 SHA512:
-  metadata.gz: 852f267f0bc56295861c35eb7a18fce76c228f4a896589cf5f51ecf3e69e9b1d0ee19b78192e8e45a1a801b9b778e121af8dc43e9f0eabf20076efa935c28d8a
-  data.tar.gz: 1d013db8052f28175fde7f166e3afa350b74a840a2b4012ba4435d629140352a10a01da5c94787c5f1185a92a26805a91d867d416b2f7fd0c31a198bd2141165
+  metadata.gz: a27deed2b4d0bcef159899d388fee10cfcdf7ba40c2f21f6f2226ddba29df53f2348ef0f09db321d5338f2b6cb3357d4d7b9f73cccad2b5af2aac0100353a59a
+  data.tar.gz: c62284c1237a94a3b1831d5320cff0240838ab1efbcc47ee4bec56a21754ee5149da1d711a604b8d0dad917dfc9aa2ded4000b2d4c159985e2641de6f4e2c3d1

data/README.md

@@ -1,5 +1,7 @@
 # BPFQL
 
+[![Gem Version](https://badge.fury.io/rb/bpfql.svg)](https://badge.fury.io/rb/bpfql)
+
 eBPF query runner. Choose a format in:
 
 * Ruby DSL
@@ -36,7 +38,7 @@ end
 ```ruby
 BPFQL do
   select "count()"
-  from "tracepoint:syscalls:sys_clone_enter"
+  from "tracepoint:syscalls:sys_enter_clone"
   group_by "comm"
   interval "15s"
 end
@@ -47,7 +49,7 @@ end
 ```yaml
 BPFQL:
 - select: count()
-  from: tracepoint:syscalls:sys_clone_enter
+  from: tracepoint:syscalls:sys_enter_clone
   group_by: comm
   stop_after: "30s"
 ```
@@ -55,12 +57,14 @@ BPFQL:
 ```yaml
 BPFQL:
 - select: count()
-  from: tracepoint:syscalls:sys_clone_enter
+  from: tracepoint:syscalls:sys_enter_clone
   where:
     - comm is "ruby"
     - pid is 12345
 ```
 
+* See [examples/](examples/) to find working examples.
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/examples/read-simple.rb

@@ -0,0 +1,9 @@
+BPFQL do
+  select "ts", "comm", "pid", "__syscall_nr", "ret"
+  from "tracepoint:syscalls:sys_exit_read"
+  if ENV['TARGET_COMM']
+    where "comm", is: ENV['TARGET_COMM']
+  elsif ENV['TARGET_PID']
+    where "pid", is: ENV['TARGET_PID']
+  end
+end

data/lib/bpfql.rb

@@ -1,5 +1,6 @@
 require "bpfql/version"
 require "bpfql/query"
+require "bpfql/dsl"
 require "bpfql/runner"
 
 module Bpfql

data/lib/bpfql/cli.rb

@@ -14,8 +14,16 @@ module Bpfql
         exit 1
       end
 
-      yaml_file = argv[0]
-      q = Bpfql::Query.parse_yaml(File.read yaml_file)
+      file = argv[0]
+      q = nil
+      case File.extname(file)
+      when ".rb", ".bpfql"
+        dsl = File.read(file)
+        q = [eval(dsl)]
+      when ".yml", ".yaml"
+        q = Bpfql::Query.parse_yaml(File.read file)
+      end
+
       r = Bpfql::Runner.new(q[0])
       r.run
     end

data/lib/bpfql/dsl.rb

@@ -0,0 +1,71 @@
+require 'bpfql/query'
+
+module Bpfql
+  class DSL
+    def initialize(qb)
+      @builder = qb
+      @_where_continue = false
+    end
+    attr_reader :builder
+
+    def select(*members)
+      builder.select = Query::SelectOption.new(members)
+    end
+
+    def from(probe)
+      builder.from = Query::ProbeOption.new(probe)
+    end
+
+    def where(*filter, **options)
+      builder.where = []
+      builder.where << eval_where(*filter, **options)
+      @_where_continue = true
+    end
+
+    def _and(*filter, **options)
+      if @_where_continue
+        builder.where << eval_where(*filter, **options)
+      else
+        raise ArgumentError, "Cannot invoke _and() before where()"
+      end
+    end
+
+    def group_by(var)
+      builder.group_by = var
+    end
+
+    def interval(timing)
+      builder.interval = timing
+    end
+
+    def stop_after(timing)
+      builder.stop = Query::StopOption.new(:after, timing)
+    end
+
+    private
+    def eval_where(*filter, **options)
+      case filter.size
+      when 1
+        if (options.keys & %i(is not lt gt lteq gteq)).empty?
+          raise ArgumentError, "Invalid parameter: #{filter}, #{options}"
+        end
+        %i(is not lt gt lteq gteq).each do |ope|
+          if options.has_key?(ope)
+            return Query::FilterOption.new(filter[0], ope.to_s, options[ope])
+          end
+        end
+      when 3
+        return Query::FilterOption.new(*filter)
+      else
+        raise ArgumentError, "Invalid parameter: #{filter}, #{options}"
+      end
+    end
+  end
+end
+
+def BPFQL(&b)
+  query = Bpfql::Query.new
+  evaluator = Bpfql::DSL.new(query)
+  evaluator.instance_eval(&b)
+  query
+end

data/lib/bpfql/query.rb

@@ -21,7 +21,7 @@ module Bpfql
     end
 
     def initialize(&b)
-      b.call(self)
+      b.call(self) if b
     end
     attr_accessor :select, :from, :where, :group_by, :interval, :stop
     alias probe from

data/lib/bpfql/runner.rb

@@ -10,6 +10,7 @@ module Bpfql
     end
 
     def run
+      $stderr.puts bpf_source if ENV['BPFQL_DEBUG']
       @module = RbBCC::BCC.new(text: bpf_source)
       puts(@fmt.gsub(/(\.\d+f|d)/, 's') % tracepoint_fields_sorted.map(&:upcase))
 
@@ -83,12 +84,16 @@ module Bpfql
         src = <<~FUNCTION
           TRACEPOINT_PROBE(#{qb.probe.arg1}, #{qb.probe.arg2}) {
             struct data_t data = {};
+
             __ASSIGN_PID__
             __ASSIGN_TS__
             __ASSIGN_COMM__
 
             __ASSIGN_FIELDS__
-            events.perf_submit(args, &data, sizeof(data));
+
+            __FILTER__
+              events.perf_submit(args, &data, sizeof(data));
+            __FILTER_END__
             return 0;
           }
         FUNCTION
@@ -104,12 +109,70 @@ module Bpfql
           }.join("\n")
           src.sub!('__ASSIGN_FIELDS__', assigner)
         end
+
+        if qb.where && !qb.where.empty?
+          src.sub!('__FILTER__', filter_clause)
+          src.sub!('__FILTER_END__', filter_end_clause)
+        else
+          src.sub!('__FILTER__', "")
+          src.sub!('__FILTER_END__', "")
+        end
         src
       else
         raise NotImplementedError, "unsupported probe: #{qb.probe.to_s}"
       end
     end
 
+    def filter_clause
+      conds = []
+      needle_section = ""
+      qb.where.each do |filter|
+        if filter[0] == "comm" # || field_maps[filter[0]] =~ /^const char \* #{filter[0]}$/
+          ope = case filter[1].to_s
+                when "is"; ""
+                when "not"; "!"
+                else
+                  raise "String comparation supports only == or !=; You put: #{filter}"
+                end
+          filter_string = %Q<"#{filter[2]}">
+          needle_section = <<~NEEDLE
+            bool matched   = true;
+            char needle[] = #{filter_string};
+            char haystack[sizeof(needle)] = {};
+            bpf_probe_read(&haystack, sizeof(haystack), (void*)data.#{filter[0]});
+            for (int i = 0; i < sizeof(needle) - 1; ++i) {
+              if (needle[i] != haystack[i]) {
+                matched = false;
+              }
+            }
+          NEEDLE
+          conds << %Q<#{ope}matched>
+        else
+          lhs = "data.#{filter[0]}"
+          ope = case filter[1].to_s
+                when "is"; "=="
+                when "not"; "!="
+                when "lt"; "<"
+                when "gt"; ">"
+                when "lteq"; "<="
+                when "gteq"; ">="
+                else
+                  raise "[BPFQL BUG] Cannot evaluate ope: #{filter}; This may be a bug"
+                end
+          rhs = filter[2]
+        conds << [lhs, ope, rhs].join(" ")
+        end
+      end
+      return <<~FILTER
+        #{needle_section}
+        if (#{conds.join("&&")}) {
+      FILTER
+    end
+
+    def filter_end_clause
+      return "}"
+    end
+
     def tracepoint_fields
       @fields ||= begin
                     if qb.select.members[0] == '*'

data/lib/bpfql/version.rb

@@ -1,3 +1,3 @@
 module Bpfql
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bpfql
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Uchio Kondo
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-03-03 00:00:00.000000000 Z
+date: 2020-03-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rbbcc
@@ -42,9 +42,11 @@ files:
 - bin/setup
 - bpfql.gemspec
 - examples/random-simple.yml
+- examples/read-simple.rb
 - exe/bpfql
 - lib/bpfql.rb
 - lib/bpfql/cli.rb
+- lib/bpfql/dsl.rb
 - lib/bpfql/query.rb
 - lib/bpfql/runner.rb
 - lib/bpfql/version.rb