rbbcc 0.11.5 → 0.11.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4757d8938ba54c8aaab6d26a1d8cf824c325b8591130d1cf65ee13c0e411e99f
-  data.tar.gz: e41edc20c58336f5aa3e1670f2f001a9cdc829291a8bd63ab53d309790b81f5c
+  metadata.gz: 59d0fb02bff1acabccf1f231bd3642bfa3da9ef1fc796c580d8c1d9c4c5098bc
+  data.tar.gz: 5e033fa5c3957b1d7e822eec06c4bff9f1158046a292897f61401206d56fff9d
 SHA512:
-  metadata.gz: 43cb1ba2fa891fc6fd970b5a48b45c28d9fff967e25ef02ed5cb7b09ddc96a91dc0e4740dbc59b9bc78f312613b76f6b7f68de9ee41bf860caddf1fb0a948c15
-  data.tar.gz: e6e8321874553ba7df4f0529477d6bea3a35f4956b704bd32bfeb409d7f43a1a59f4f9484619891e1351ed278eee42c4edda7a17d176c3b911e4c5a1dee5716a
+  metadata.gz: ca57cd8e17b0035c4e670e0a3fc18ee53544cd14b81a5cdf62b91a504b848b59b3ad1f38658ae68fff0c1cc33126f36ea708b73b5378a2d83223651ce0a5441d
+  data.tar.gz: d37158b96887c9500ee791209d44bc03902efda99466623eccff0d1de83c18dc6fca174beb37c50a4d36d0caa84f3dbf2b6e1aee21470a47e9cc2af7ce2fbc10

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rbbcc (0.11.5)
+    rbbcc (0.11.7)
       fiddle
 
 GEM

data/lib/rbbcc/consts.rb

@@ -1,5 +1,9 @@
 module RbBCC
-  module BPF
+  class BCC
+  end
+  BPF = BCC # avoid confuse from python port
+
+  class BPF
     # From bpf_prog_type in uapi/linux/bpf.h
     SOCKET_FILTER = 1
     KPROBE = 2

data/lib/rbbcc/table.rb

@@ -40,6 +40,8 @@ module RbBCC
           fields << [field_type, field_name].join(" ")
         end
       end
+      return nil if fields.empty?
+
       klass = Fiddle::Importer.struct(fields)
       char_ps = fields.select {|f| f =~ /^char\[(\d+)\] ([_a-zA-Z0-9]+)/ }
       unless char_ps.empty?
@@ -280,6 +282,11 @@ module RbBCC
       false # TODO: implement me in the future
     end
 
+    # Just a wrapper to BCC class method
+    def pin!(path)
+      BCC.pin!(self.map_fd, path)
+    end
+
     private
     def normalize_key(key)
       case key
@@ -368,7 +375,7 @@ module RbBCC
     end
 
     def event(data)
-      @event_class ||= get_event_class
+      @event_class ||= (get_event_class || self.leaftype)
       ev = @event_class.malloc
       Fiddle::Pointer.new(ev.to_ptr)[0, @event_class.size] = data[0, @event_class.size]
       return ev
@@ -429,7 +436,28 @@ module RbBCC
 
   class RingBuf < TableBase
     include EventTypeSupported
-    
+
+    # Make a dynamic BCC program to load the pinned ringbuf map
+    def self.from_pin(path, leaftype, size, name: "events")
+      map_fd = Clib.bpf_obj_get(path)
+      if map_fd < 0
+        raise SystemCallError.new("Could not open pinned map", Fiddle.last_error)
+      end
+      leaftype_typename = case leaftype
+      when /\Astruct\s+(\w+)\s+{/m
+        "struct #{Regexp.last_match(1)}"
+      else
+        leaftype
+      end
+      
+      prog = <<~CLANG
+        #{leaftype}
+        BPF_TABLE_PINNED("ringbuf", u32, #{leaftype_typename}, #{name}, #{size}, "#{path}");
+      CLANG
+      b = BCC.new(text: prog)
+      b[name.to_s]
+    end
+
     def initialize(bpf, map_id, map_fd, keytype, leaftype, name: nil)
       super
       @_ringbuf = nil
@@ -438,7 +466,7 @@ module RbBCC
     end
 
     def event(data)
-      @event_class ||= get_event_class
+      @event_class ||= (get_event_class || self.leaftype)
       ev = @event_class.malloc
       Fiddle::Pointer.new(ev.to_ptr)[0, @event_class.size] = data[0, @event_class.size]
       return ev
@@ -470,6 +498,10 @@ module RbBCC
       @bpf._open_ring_buffer(@map_fd, fn, ctx)
       nil
     end
+
+    def ring_buffer_poll(timeout=-1)
+      @bpf.ring_buffer_poll(timeout)
+    end
   end
 
   class StackTrace < TableBase

data/lib/rbbcc/version.rb

@@ -1,3 +1,3 @@
 module RbBCC
-  VERSION = "0.11.5"
+  VERSION = "0.11.7"
 end

data/rbbcc.gemspec

@@ -15,9 +15,12 @@ Gem::Specification.new do |spec|
 
   # Specify which files should be added to the gem when it is released.
   # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
-  spec.files         = Dir.chdir(File.expand_path('..', __FILE__)) do
-    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  spec.files = Dir.chdir(File.expand_path('..', __FILE__)) do
+    `git ls-files -z`.split("\x0").reject do |f|
+      f.match(%r{^(test|spec|features|docs|examples)/}) || f.match(/\.(gif|jpe?g|png)\Z/)
+    end
   end
+
   spec.bindir        = "exe"
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rbbcc
 version: !ruby/object:Gem::Version
-  version: 0.11.5
+  version: 0.11.7
 platform: ruby
 authors:
 - Uchio Kondo
@@ -53,64 +53,6 @@ files:
 - ci/Dockerfile.0.17.0-2.7.2
 - ci/Dockerfile.0.17.0-3.0.0
 - ci/Dockerfile.ci_base
-- docs/README.md
-- docs/answers/01-hello-world.rb
-- docs/answers/02-sys_sync.rb
-- docs/answers/03-hello_fields.rb
-- docs/answers/04-sync_timing.rb
-- docs/answers/05-sync_count.rb
-- docs/answers/06-disksnoop.rb
-- docs/answers/07-hello_perf_output.rb
-- docs/answers/08-sync_perf_output.rb
-- docs/answers/09-bitehist.rb
-- docs/answers/10-disklatency.rb
-- docs/answers/11-vfsreadlat.c
-- docs/answers/11-vfsreadlat.rb
-- docs/answers/12-urandomread.rb
-- docs/answers/13-disksnoop_fixed.rb
-- docs/answers/14-strlen_count.rb
-- docs/answers/15-nodejs_http_server.rb
-- docs/answers/16-task_switch.c
-- docs/answers/16-task_switch.rb
-- docs/answers/node-server.js
-- docs/getting_started.md
-- docs/projects_using_rbbcc.md
-- docs/tutorial_bcc_ruby_developer.md
-- docs/tutorial_bcc_ruby_developer_japanese.md
-- examples/bitehist.rb
-- examples/charty/Gemfile
-- examples/charty/Gemfile.lock
-- examples/charty/bitehist-unicode.rb
-- examples/collectsyscall.rb
-- examples/dddos.rb
-- examples/disksnoop.rb
-- examples/dns_blocker.rb
-- examples/example.gif
-- examples/extract_arg.rb
-- examples/hello_fields.rb
-- examples/hello_perf_output.rb
-- examples/hello_ring_buffer.rb
-- examples/hello_world.rb
-- examples/kvm_hypercall.rb
-- examples/lsm_sockblock.rb
-- examples/mallocstack.rb
-- examples/networking/http_filter/http-parse-simple.c
-- examples/networking/http_filter/http-parse-simple.rb
-- examples/pin_maps_a.rb
-- examples/pin_maps_b.rb
-- examples/py-orig/sockblock.py
-- examples/ruby_usdt.rb
-- examples/sbrk_trace.rb
-- examples/ssl_http_trace.rb
-- examples/syscalluname.rb
-- examples/table.rb
-- examples/tools/bashreadline.rb
-- examples/tools/execsnoop.rb
-- examples/tools/runqlat.rb
-- examples/urandomread-explicit.rb
-- examples/urandomread.rb
-- examples/usdt-test.rb
-- examples/usdt.rb
 - exe/rbbcc
 - lib/rbbcc.rb
 - lib/rbbcc/bcc.rb
@@ -147,7 +89,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.10
 specification_version: 4
 summary: BCC port for MRI
 test_files: []

data/docs/README.md

@@ -1,7 +0,0 @@
-# RbBCC Docs
-
-* [Getting Started](getting_started.md)
-* [Ruby Tutorial](tutorial_bcc_ruby_developer.md)
-* [Projects Using RbBCC](projects_using_rbbcc.md)
-
-**Please see also [BCC itself's README](https://github.com/iovisor/bcc/#readme) and [docs](https://github.com/iovisor/bcc/tree/master/docs).** 

data/docs/answers/01-hello-world.rb

@@ -1,16 +0,0 @@
-#!/usr/bin/env ruby
-# Original hello_world.py:
-# Copyright (c) PLUMgrid, Inc.
-# Licensed under the Apache License, Version 2.0 (the "License")
-#
-# This Ruby version follows the Apache License 2.0
-
-# run in project examples directory with:
-# sudo ./hello_world.rb"
-# see trace_fields.rb for a longer example
-
-require "rbbcc"
-include RbBCC
-
-# This may not work for 4.17 on x64, you need replace kprobe__sys_clone with kprobe____x64_sys_clone
-BCC.new(text: 'int kprobe__sys_clone(void *ctx) { bpf_trace_printk("Hello, World!\\n"); return 0; }').trace_print

data/docs/answers/02-sys_sync.rb

@@ -1,18 +0,0 @@
-#!/usr/bin/env ruby
-# Licensed under the Apache License, Version 2.0 (the "License")
-
-require "rbbcc"
-include RbBCC
-
-puts "Tracing sys_sync()... Ctrl-C to end."
-begin
-  BCC.new(text: <<~BPF).trace_print
-    int kprobe__sys_sync(void *ctx) {
-      bpf_trace_printk("sys_sync() called\\n");
-      return 0;
-    }
-  BPF
-rescue Interrupt
-  puts
-  puts "Done"
-end

data/docs/answers/03-hello_fields.rb

@@ -1,33 +0,0 @@
-#!/usr/bin/env ruby
-# Licensed under the Apache License, Version 2.0 (the "License")
-
-require "rbbcc"
-include RbBCC
-
-# define BPF program
-prog = <<BPF
-int hello(void *ctx) {
-    bpf_trace_printk("Hello, World!\\n");
-    return 0;
-}
-BPF
-
-# load BPF program
-b = BCC.new(text: prog)
-b.attach_kprobe(event: b.get_syscall_fnname("clone"), fn_name: "hello")
-
-# header
-puts("%-18s %-16s %-6s %s" % ["TIME(s)", "COMM", "PID", "MESSAGE"])
-
-# format output
-begin
-  b.trace_fields do |task, pid, cpu, flags, ts, msg|
-    print("%-18.9f %-16s %-6d %s" % [ts, task, pid, msg])
-  end
-rescue Interrupt
-  puts
-  puts "Done"
-rescue => e
-  p e
-  retry
-end

data/docs/answers/04-sync_timing.rb

@@ -1,46 +0,0 @@
-#!/usr/bin/env ruby
-# Original sync_timing.py:
-# Licensed under the Apache License, Version 2.0 (the "License")
-#
-# This Ruby version follows the Apache License 2.0
-
-require "rbbcc"
-include RbBCC
-
-# load BPF program
-b = BCC.new(text: <<BPF)
-#include <uapi/linux/ptrace.h>
-
-BPF_HASH(last);
-
-int do_trace(struct pt_regs *ctx) {
-    u64 ts, *tsp, delta, key = 0;
-
-    // attempt to read stored timestamp
-    tsp = last.lookup(&key);
-    if (tsp != 0) {
-        delta = bpf_ktime_get_ns() - *tsp;
-        if (delta < 1000000000) {
-            // output if time is less than 1 second
-            bpf_trace_printk("%d\\n", delta / 1000000);
-        }
-        last.delete(&key);
-    }
-
-    // update stored timestamp
-    ts = bpf_ktime_get_ns();
-    last.update(&key, &ts);
-    return 0;
-}
-BPF
-
-b.attach_kprobe(event: b.get_syscall_fnname("sync"), fn_name: "do_trace")
-puts("Tracing for quick sync's... Ctrl-C to end")
-
-# format output
-start = 0
-b.trace_fields do |task, pid, cpu, flags, ts, ms|
-  start = ts.to_f if start.zero?
-  ts = ts.to_f - start
-  puts("At time %.2f s: multiple syncs detected, last %s ms ago" % [ts, ms.chomp])
-end

data/docs/answers/05-sync_count.rb

@@ -1,54 +0,0 @@
-#!/usr/bin/env ruby
-# Licensed under the Apache License, Version 2.0 (the "License")
-
-require "rbbcc"
-include RbBCC
-
-# load BPF program
-b = BCC.new(text: <<BPF)
-#include <uapi/linux/ptrace.h>
-
-BPF_HASH(last);
-
-int do_trace(struct pt_regs *ctx) {
-    u64 ts, *tsp, delta, key = 0, counter_key = 1, zero = 0;
-
-    // initialize counter key
-    if (last.lookup_or_try_init(&counter_key, &zero))
-        last.increment(counter_key);
-
-    // attempt to read stored timestamp
-    tsp = last.lookup(&key);
-    if (tsp != 0) {
-        delta = bpf_ktime_get_ns() - *tsp;
-        if (delta < 1000000000) {
-            // output if time is less than 1 second
-            bpf_trace_printk("%d\\n", delta / 1000000);
-        }
-        last.delete(&key);
-    }
-
-    // update stored timestamp
-    ts = bpf_ktime_get_ns();
-    last.update(&key, &ts);
-    return 0;
-}
-BPF
-
-COUNTER_KEY = 1
-
-b.attach_kprobe(event: b.get_syscall_fnname("sync"), fn_name: "do_trace")
-puts("Tracing for quick sync's... Ctrl-C to end")
-
-# format output
-start = 0
-begin
-  b.trace_fields do |task, pid, cpu, flags, ts, ms|
-    start = ts.to_f if start.zero?
-    ts = ts.to_f - start
-    puts("At time %.2f s: multiple syncs detected, last %s ms ago" % [ts, ms.chomp])
-  end
-rescue Interrupt
-  table = b["last"]
-  puts "Count of sys_sync: %d" % table[COUNTER_KEY].to_bcc_value
-end

data/docs/answers/06-disksnoop.rb

@@ -1,71 +0,0 @@
-#!/usr/bin/env ruby
-#
-# disksnoop.rb	Trace block device I/O: basic version of iosnoop.
-#		For Linux, uses BCC, eBPF. Embedded C.
-# This is ported from original disksnoop.py
-#
-# Written as a basic example of tracing latency.
-#
-# Licensed under the Apache License, Version 2.0 (the "License")
-#
-# 11-Aug-2015	Brendan Gregg	Created disksnoop.py
-
-require 'rbbcc'
-include RbBCC
-
-REQ_WRITE = 1		# from include/linux/blk_types.h
-
-# load BPF program
-b = BCC.new(text: <<CLANG)
-#include <uapi/linux/ptrace.h>
-#include <linux/blkdev.h>
-
-BPF_HASH(start, struct request *);
-
-void trace_start(struct pt_regs *ctx, struct request *req) {
-  // stash start timestamp by request ptr
-  u64 ts = bpf_ktime_get_ns();
-
-  start.update(&req, &ts);
-}
-
-void trace_completion(struct pt_regs *ctx, struct request *req) {
-  u64 *tsp, delta;
-
-  tsp = start.lookup(&req);
-  if (tsp != 0) {
-    delta = bpf_ktime_get_ns() - *tsp;
-    bpf_trace_printk("%d %x %d\\n", req->__data_len,
-        req->cmd_flags, delta / 1000);
-    start.delete(&req);
-  }
-}
-CLANG
-
-b.attach_kprobe(event: "blk_start_request", fn_name: "trace_start") if BCC.get_kprobe_functions('blk_start_request')
-b.attach_kprobe(event: "blk_mq_start_request", fn_name: "trace_start")
-b.attach_kprobe(event: "blk_account_io_completion", fn_name: "trace_completion")
-
-# header
-puts("%-18s %-2s %-7s %8s" % ["TIME(s)", "T", "BYTES", "LAT(ms)"])
-
-# format output
-loop do
-  begin
-    task, pid, cpu, flags, ts, msg = b.trace_fields
-    bytes_s, bflags_s, us_s = msg.split
-
-    if (bflags_s.to_i(16) & REQ_WRITE).nonzero?
-      type_s = "W"
-    elsif bytes_s == "0" # see blk_fill_rwbs() for logic
-      type_s = "M"
-    else
-      type_s = "R"
-    end
-    ms = us_s.to_i.to_f / 1000
-
-    puts("%-18.9f %-2s %-7s %8.2f" % [ts, type_s, bytes_s, ms])
-  rescue Interrupt
-    exit
-  end
-end

data/docs/answers/07-hello_perf_output.rb

@@ -1,59 +0,0 @@
-#!/usr/bin/env ruby
-#
-# This is a Hello World example that uses BPF_PERF_OUTPUT.
-# Ported from hello_perf_output.py
-
-require 'rbbcc'
-include RbBCC
-
-# define BPF program
-prog = """
-#include <linux/sched.h>
-
-// define output data structure in C
-struct data_t {
-    u32 pid;
-    u64 ts;
-    char comm[TASK_COMM_LEN];
-};
-BPF_PERF_OUTPUT(events);
-
-int hello(struct pt_regs *ctx) {
-    struct data_t data = {};
-
-    data.pid = bpf_get_current_pid_tgid();
-    data.ts = bpf_ktime_get_ns();
-    bpf_get_current_comm(&data.comm, sizeof(data.comm));
-
-    events.perf_submit(ctx, &data, sizeof(data));
-
-    return 0;
-}
-"""
-
-# load BPF program
-b = BCC.new(text: prog)
-b.attach_kprobe(event: b.get_syscall_fnname("clone"), fn_name: "hello")
-
-# header
-puts("%-18s %-16s %-6s %s" % ["TIME(s)", "COMM", "PID", "MESSAGE"])
-
-# process event
-start = 0
-print_event = lambda { |cpu, data, size|
-  event = b["events"].event(data)
-  if start == 0
-    start = event.ts
-  end
-
-  time_s = ((event.ts - start).to_f) / 1000000000
-  puts("%-18.9f %-16s %-6d %s" % [time_s, event.comm, event.pid,
-                                  "Hello, perf_output!"])
-}
-
-# loop with callback to print_event
-b["events"].open_perf_buffer(&print_event)
-
-loop do
-  b.perf_buffer_poll()
-end

data/docs/answers/08-sync_perf_output.rb

@@ -1,60 +0,0 @@
-#!/usr/bin/env ruby
-# Licensed under the Apache License, Version 2.0 (the "License")
-
-require "rbbcc"
-include RbBCC
-
-# load BPF program
-b = BCC.new(text: <<BPF)
-#include <uapi/linux/ptrace.h>
-
-struct data_t {
-    u32 pid;
-    u64 ts;
-    u64 delta;
-};
-BPF_PERF_OUTPUT(events);
-BPF_HASH(last);
-
-int do_trace(struct pt_regs *ctx) {
-    u64 ts, *tsp, delta, key = 0;
-
-    // attempt to read stored timestamp
-    tsp = last.lookup(&key);
-    if (tsp != 0) {
-        struct data_t data = {};
-        delta = bpf_ktime_get_ns() - *tsp;
-        if (delta < 1000000000) {
-            data.pid = bpf_get_current_pid_tgid();
-            data.ts = bpf_ktime_get_ns();
-            data.delta = delta;
-            events.perf_submit(ctx, &data, sizeof(data));
-        }
-        last.delete(&key);
-    }
-
-    // update stored timestamp
-    ts = bpf_ktime_get_ns();
-    last.update(&key, &ts);
-    return 0;
-}
-BPF
-
-b.attach_kprobe(event: b.get_syscall_fnname("sync"), fn_name: "do_trace")
-puts("Tracing for quick sync's... Ctrl-C to end")
-
-# format output
-start = 0
-b["events"].open_perf_buffer do |_, data, _|
-  event = b["events"].event(data)
-  if start == 0
-    start = event.ts
-  end
-
-  time_s = ((event.ts - start).to_f) / 1_000_000_000
-  puts("At time %.2f s: multiple syncs detected, last %s ms ago" % [time_s, event.delta / 1_000_000])
-end
-
-loop do
-  b.perf_buffer_poll()
-end

data/docs/answers/09-bitehist.rb

@@ -1,32 +0,0 @@
-#!/usr/bin/env ruby
-# Licensed under the Apache License, Version 2.0 (the "License")
-
-require 'rbbcc'
-include RbBCC
-
-# load BPF program
-b = BCC.new(text: <<BPF)
-#include <uapi/linux/ptrace.h>
-#include <linux/blkdev.h>
-
-BPF_HISTOGRAM(dist);
-
-int kprobe__blk_account_io_completion(struct pt_regs *ctx, struct request *req)
-{
-  dist.increment(bpf_log2l(req->__data_len / 1024));
-  return 0;
-}
-BPF
-
-# header
-puts("Tracing... Hit Ctrl-C to end.")
-
-# trace until Ctrl-C
-begin
-  loop { sleep 0.1 }
-rescue Interrupt
-  puts
-end
-
-# output
-b["dist"].print_log2_hist("kbytes")

data/docs/answers/10-disklatency.rb

@@ -1,51 +0,0 @@
-#!/usr/bin/env ruby
-# Licensed under the Apache License, Version 2.0 (the "License")
-
-require 'rbbcc'
-include RbBCC
-
-b = BCC.new(text: <<BPF)
-#include <uapi/linux/ptrace.h>
-#include <linux/blkdev.h>
-
-BPF_HASH(start, struct request *);
-BPF_HISTOGRAM(dist);
-
-// note this program mixes R/W
-// For next step, handle req->cmd_flags and prepare hist hash per op.
-
-void trace_start(struct pt_regs *ctx, struct request *req) {
-  // stash start timestamp by request ptr
-  u64 ts = bpf_ktime_get_ns();
-
-  start.update(&req, &ts);
-}
-
-void trace_completion(struct pt_regs *ctx, struct request *req) {
-  u64 *tsp, delta;
-
-  tsp = start.lookup(&req);
-  if (tsp != 0) {
-    delta = bpf_ktime_get_ns() - *tsp;
-    dist.increment(bpf_log2l(delta / 1000)); // us
-    start.delete(&req);
-  }
-}
-BPF
-
-b.attach_kprobe(event: "blk_start_request", fn_name: "trace_start") if BCC.get_kprobe_functions('blk_start_request')
-b.attach_kprobe(event: "blk_mq_start_request", fn_name: "trace_start")
-b.attach_kprobe(event: "blk_account_io_completion", fn_name: "trace_completion")
-
-# header
-puts("Tracing... Hit Ctrl-C to end.")
-
-# trace until Ctrl-C
-begin
-  loop { sleep 0.1 }
-rescue Interrupt
-  puts
-end
-
-# output
-b["dist"].print_log2_hist("usec")