rbbcc 0.3.1 → 0.6.0

data/examples/tools/bashreadline.rb

@@ -0,0 +1,83 @@
+#!/usr/bin/env ruby
+#
+# bashreadline  Print entered bash commands from all running shells.
+#               For Linux, uses BCC, eBPF. Embedded C.
+#
+# USAGE: bashreadline [-s SHARED]
+# This works by tracing the readline() function using a uretprobe (uprobes).
+# When you failed to run the script directly with error:
+# `Exception: could not determine address of symbol b'readline'`,
+# you may need specify the location of libreadline.so library
+# with `-s` option.
+#
+# Original bashreadline.py:
+# Copyright 2016 Netflix, Inc.
+# Licensed under the Apache License, Version 2.0 (the "License")
+# And Ruby version follows.
+#
+# 28-Jan-2016    Brendan Gregg   Created bashreadline.py.
+# 12-Feb-2016    Allan McAleavy migrated to BPF_PERF_OUTPUT
+# 05-Jun-2020    Uchio Kondo     Ported bashreadline.rb
+
+require 'rbbcc'
+require 'optparse'
+include RbBCC
+
+args = {}
+opts = OptionParser.new
+opts.on("-s", "--shared=LIBREADLINE_PATH"){|v| args[:shared] = v }
+opts.parse!(ARGV)
+
+name = args[:shared] || "/bin/bash"
+
+# load BPF program
+bpf_text = <<BPF
+#include <uapi/linux/ptrace.h>
+#include <linux/sched.h>
+
+struct str_t {
+    u64 pid;
+    char str[80];
+};
+
+BPF_PERF_OUTPUT(events);
+
+int printret(struct pt_regs *ctx) {
+    struct str_t data  = {};
+    char comm[TASK_COMM_LEN] = {};
+    u32 pid;
+    if (!PT_REGS_RC(ctx))
+        return 0;
+    pid = bpf_get_current_pid_tgid();
+    data.pid = pid;
+    bpf_probe_read(&data.str, sizeof(data.str), (void *)PT_REGS_RC(ctx));
+
+    bpf_get_current_comm(&comm, sizeof(comm));
+    if (comm[0] == 'b' && comm[1] == 'a' && comm[2] == 's' && comm[3] == 'h' && comm[4] == 0 ) {
+        events.perf_submit(ctx,&data,sizeof(data));
+    }
+
+
+    return 0;
+};
+BPF
+
+b = BCC.new(text: bpf_text)
+b.attach_uretprobe(name: name, sym: "readline", fn_name: "printret")
+
+# header
+puts("%-9s %-6s %s" % ["TIME", "PID", "COMMAND"])
+
+b["events"].open_perf_buffer do |cpu, data, size|
+  event = b["events"].event(data)
+  puts("%-9s %-6d %s" % [
+         Time.now.strftime("%H:%M:%S"),
+         event.pid,
+         event.str
+       ])
+end
+
+trap(:INT) { puts; exit }
+loop do
+  b.perf_buffer_poll
+end

data/lib/rbbcc/bcc.rb

@@ -1,6 +1,7 @@
 require 'rbbcc/consts'
 require 'rbbcc/table'
 require 'rbbcc/symbol_cache'
+require 'rbbcc/debug'
 
 module RbBCC
   SYSCALL_PREFIXES = [
@@ -14,6 +15,20 @@ module RbBCC
 
   class BCC
     class << self
+      def _find_file(filename)
+        if filename
+          unless File.exist?(filename)
+            t = File.expand_path "../#{filename}", $0
+            if File.exist?(t)
+              filename = t
+            else
+              raise "Could not find file #{filename}"
+            end
+          end
+        end
+        return filename
+      end
+
       def ksym(addr, show_module: false, show_offset: false)
         self.sym(addr, -1, show_module: show_module, show_offset: show_offset, demangle: false)
       end
@@ -161,25 +176,63 @@ module RbBCC
         module_ = (show_module && module_) ? " [#{File.basename.basename(module_)}]" : ""
         return name + module_
       end
+
+      def attach_raw_socket(fn, dev)
+        unless fn.is_a?(Hash)
+          raise "arg 1 must be of BPF.Function Hash"
+        end
+        sock = Clib.bpf_open_raw_sock(dev)
+        if sock < 0
+          raise SystemCallError.new("Failed to open raw device %s" % dev, Fiddle.last_error)
+        end
+
+        res = Clib.bpf_attach_socket(sock, fn[:fd])
+        if res < 0
+          raise SystemCallError.new("Failed to attach BPF to device %s" % dev, Fiddle.last_error)
+        end
+        fn[:sock] = sock
+        fn
+      end
     end
 
-    def initialize(text:, debug: 0, cflags: [], usdt_contexts: [], allow_rlimit: 0)
+    def initialize(text: "", src_file: nil, hdr_file: nil, debug: 0, cflags: [], usdt_contexts: [], allow_rlimit: 0)
       @kprobe_fds = {}
       @uprobe_fds = {}
       @tracepoint_fds = {}
       @raw_tracepoint_fds = {}
-      @usdt_contexts = usdt_contexts
-      if code = gen_args_from_usdt
-        text = code + text
-      end
-
-      @module = Clib.bpf_module_create_c_from_string(
-        text,
-        debug,
-        cflags.pack('p*'),
-        cflags.size,
-        allow_rlimit
-      )
+
+      if src_file
+        src_file = BCC._find_file(src_file)
+        hdr_file = BCC._find_file(hdr_file)
+      end
+
+      if src_file && src_file.end_with?(".b")
+        @module = Clib.bpf_module_create_b(src_file, hdr_file, debug, device)
+      else
+        if src_file
+          text = File.read(src_file)
+        end
+
+        @usdt_contexts = usdt_contexts
+        if code = gen_args_from_usdt
+          text = code + text
+        end
+
+        # Util.debug text
+        cflags_p = if cflags.empty?
+                     nil
+                   else
+                     cflags.pack('p*')
+                   end
+
+        @module = Clib.bpf_module_create_c_from_string(
+          text,
+          debug,
+          cflags_p,
+          cflags.size,
+          allow_rlimit
+        )
+      end
       @funcs = {}
       @tables = {}
       @perf_buffers = {}
@@ -237,7 +290,7 @@ module RbBCC
       if fd < 0
         raise SystemCallError.new("Failed to attach BPF program #{fn_name} to tracepoint #{tp}", Fiddle.last_error)
       end
-      puts "Attach: #{tp}"
+      Util.debug "Attach: #{tp}"
       @tracepoint_fds[tp] = fd
       self
     end
@@ -252,7 +305,7 @@ module RbBCC
       if fd < 0
         raise SystemCallError.new("Failed to attach BPF program #{fn_name} to raw tracepoint #{tp}", Fiddle.last_error)
       end
-      puts "Attach: #{tp}"
+      Util.debug "Attach: #{tp}"
       @raw_tracepoint_fds[tp] = fd
       self
     end
@@ -264,7 +317,7 @@ module RbBCC
       if fd < 0
         raise SystemCallError.new("Failed to attach BPF program #{fn_name} to kprobe #{event}", Fiddle.last_error)
       end
-      puts "Attach: #{ev_name}"
+      Util.debug "Attach: #{ev_name}"
       @kprobe_fds[ev_name] = fd
       [ev_name, fd]
     end
@@ -277,7 +330,7 @@ module RbBCC
       if fd < 0
         raise SystemCallError.new("Failed to attach BPF program #{fn_name} to kretprobe #{event}", Fiddle.last_error)
       end
-      puts "Attach: #{ev_name}"
+      Util.debug "Attach: #{ev_name}"
       @kprobe_fds[ev_name] = fd
       [ev_name, fd]
     end
@@ -291,7 +344,7 @@ module RbBCC
       if fd < 0
         raise SystemCallError.new(Fiddle.last_error)
       end
-      puts "Attach: #{ev_name}"
+      Util.debug "Attach: #{ev_name}"
 
       @uprobe_fds[ev_name] = fd
       [ev_name, fd]
@@ -306,7 +359,7 @@ module RbBCC
       if fd < 0
         raise SystemCallError.new(Fiddle.last_error)
       end
-      puts "Attach: #{ev_name}"
+      Util.debug "Attach: #{ev_name}"
 
       @uprobe_fds[ev_name] = fd
       [ev_name, fd]
@@ -507,7 +560,7 @@ module RbBCC
         else
           next
         end
-        puts "Found fnc: #{func_name}"
+        Util.debug "Found fnc: #{func_name}"
         if func_name.start_with?("kprobe__")
           fn = load_func(func_name, BPF::KPROBE)
           attach_kprobe(

data/lib/rbbcc/clib.rb

@@ -25,7 +25,7 @@ module RbBCC
     end
 
     extend Fiddle::Importer
-    targets = %w(0.12.0 0.11.0 0.10.0)
+    targets = %w(0.14.0 0.13.0 0.12.0 0.11.0 0.10.0)
     if default_load = ENV['LIBBCC_VERSION']
       targets.unshift(default_load)
       targets.uniq!
@@ -45,6 +45,7 @@ module RbBCC
     typealias "size_t", "int"
 
     extern 'void * bpf_module_create_c_from_string(char *, unsigned int, char **, int, long)'
+    extern 'void * bpf_module_create_b(char *filename, char *proto_filename, unsigned int flags, char *dev_name)'
     extern 'int bpf_num_functions(void *)'
     extern 'char * bpf_function_name(void *, int)'
     extern 'void bpf_module_destroy(void *)'
@@ -119,10 +120,11 @@ module RbBCC
     extern 'char * bpf_perf_event_field(void *program, const char *event, size_t i)'
 
     extern 'void * bcc_usdt_new_frompid(int, char *)'
+    extern 'void * bcc_usdt_new_frompath(char *path)'
     extern 'int bcc_usdt_enable_probe(void *, char *, char *)'
     extern 'char * bcc_usdt_genargs(void **, int)'
     extern 'void bcc_usdt_foreach_uprobe(void *, void *)'
-
+    extern 'void bcc_usdt_close(void *usdt)'
     BCCSymbol = struct([
                          "const char *name",
                          "const char *demangle_name",
@@ -155,6 +157,9 @@ module RbBCC
     extern 'int perf_reader_poll(int num_readers, struct perf_reader **readers, int timeout)'
 
     extern 'void bcc_procutils_free(const char *ptr)'
+
+    extern 'int bpf_open_raw_sock(const char *name)'
+    extern 'int bpf_attach_socket(int sockfd, int progfd)'
   end
 end
 

data/lib/rbbcc/debug.rb

@@ -0,0 +1,17 @@
+if ENV['RBBCC_DEBUG'] || ENV['BCC_DEBUG']
+  module RbBCC
+    module Util
+      def self.debug(msg)
+        puts msg
+      end
+    end
+  end
+else
+  module RbBCC
+    module Util
+      def self.debug(msg)
+        # nop
+      end
+    end
+  end
+end

data/lib/rbbcc/table.rb

@@ -78,7 +78,9 @@ module RbBCC
       return next_key
     end
 
-    def [](key)
+    def [](_key)
+      key = normalize_key(_key)
+
       leaf = Fiddle::Pointer.malloc(self.leafsize)
       res = Clib.bpf_lookup_elem(self.map_fd, key, leaf)
       if res < 0
@@ -91,7 +93,8 @@ module RbBCC
       self[key] || raise(KeyError, "key not found")
     end
 
-    def []=(key, leaf)
+    def []=(_key, leaf)
+      key = normalize_key(_key)
       res = Clib.bpf_update_elem(self.map_fd, key, leaf, 0)
       if res < 0
         raise SystemCallError.new("Could not update table", Fiddle.last_error)
@@ -180,6 +183,17 @@ module RbBCC
     end
 
     private
+    def normalize_key(key)
+      case key
+      when Fiddle::Pointer
+        key
+      when Integer
+        byref(key, keysize)
+      else
+        raise KeyError, "#{key.inspect} must be integer or pointor"
+      end
+    end
+
     def byref(value, size=sizeof("int"))
       pack_fmt = case size
                  when sizeof("int") ; "i!"
@@ -207,14 +221,6 @@ module RbBCC
     end
     alias length size
 
-    def [](key)
-      super(normalize_key(key))
-    end
-
-    def []=(key, value)
-      super(normalize_key(key), value)
-    end
-
     def clearitem(key)
       self[key] = byref(0, @leafsize)
     end
@@ -229,18 +235,6 @@ module RbBCC
         b.call(v.to_bcc_value)
       end
     end
-
-    private
-    def normalize_key(key)
-      case key
-      when Fiddle::Pointer
-        key
-      when Integer
-        byref(key, keysize)
-      else
-        raise KeyError, "#{key.inspect} must be integer or pointor"
-      end
-    end
   end
 
   class PerfEventArray < TableBase

data/lib/rbbcc/usdt.rb

@@ -4,15 +4,21 @@ module RbBCC
   USDTProbe = Struct.new(:binpath, :fn_name, :addr, :pid)
 
   class USDT
-    # TODO path:
-    def initialize(pid:)
+    def initialize(pid: nil, path: nil)
       @pid = pid
-      @context = Clib.bcc_usdt_new_frompid(pid, nil)
+      @path = path
+      if pid
+        @context = Clib.bcc_usdt_new_frompid(pid, path)
+      elsif path
+        @context = Clib.bcc_usdt_new_frompath(path)
+      else
+        raise "Either a pid or a binary path must be specified"
+      end
       if !@context || @context.null?
         raise SystemCallError.new(Fiddle.last_error)
       end
     end
-    attr_reader :pid, :context
+    attr_reader :pid, :path, :context
 
     def enable_probe(probe:, fn_name:)
       ret = Clib.bcc_usdt_enable_probe(@context, probe, fn_name)
@@ -33,5 +39,16 @@ module RbBCC
 
       return probes
     end
+
+    private
+    def __del__
+      lambda { Clib.bcc_usdt_close(@context); Util.debug("USDT GC'ed.") }
+    end
+  end
+end
+
+at_exit do
+  ObjectSpace.each_object(RbBCC::USDT) do |o|
+    o.send(:__del__).call
   end
 end

data/lib/rbbcc/version.rb

@@ -1,3 +1,3 @@
 module RbBCC
-  VERSION = "0.3.1"
+  VERSION = "0.6.0"
 end

data/rbbcc.gemspec

@@ -7,6 +7,7 @@ Gem::Specification.new do |spec|
   spec.version       = RbBCC::VERSION
   spec.authors       = ["Uchio Kondo"]
   spec.email         = ["udzura@udzura.jp"]
+  spec.license       = "Apache-2.0"
 
   spec.summary       = %q{BCC port for MRI}
   spec.description   = %q{BCC port for MRI. See https://github.com/iovisor/bcc}
@@ -20,9 +21,4 @@ Gem::Specification.new do |spec|
   #spec.bindir        = "exe"
   #spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
-
-  spec.add_development_dependency "bundler", "~> 2.0"
-  spec.add_development_dependency "rake", "~> 10.0"
-  spec.add_development_dependency "pry"
-  spec.add_development_dependency "minitest"
 end

metadata

@@ -1,71 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: rbbcc
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.6.0
 platform: ruby
 authors:
 - Uchio Kondo
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-02-20 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '10.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '10.0'
-- !ruby/object:Gem::Dependency
-  name: pry
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
+date: 2020-07-17 00:00:00.000000000 Z
+dependencies: []
 description: BCC port for MRI. See https://github.com/iovisor/bcc
 email:
 - udzura@udzura.jp
@@ -85,7 +29,29 @@ files:
 - bin/console
 - bin/setup
 - docs/README.md
+- docs/answers/01-hello-world.rb
+- docs/answers/02-sys_sync.rb
+- docs/answers/03-hello_fields.rb
+- docs/answers/04-sync_timing.rb
+- docs/answers/05-sync_count.rb
+- docs/answers/06-disksnoop.rb
+- docs/answers/07-hello_perf_output.rb
+- docs/answers/08-sync_perf_output.rb
+- docs/answers/09-bitehist.rb
+- docs/answers/10-disklatency.rb
+- docs/answers/11-vfsreadlat.c
+- docs/answers/11-vfsreadlat.rb
+- docs/answers/12-urandomread.rb
+- docs/answers/13-disksnoop_fixed.rb
+- docs/answers/14-strlen_count.rb
+- docs/answers/15-nodejs_http_server.rb
+- docs/answers/16-task_switch.c
+- docs/answers/16-task_switch.rb
+- docs/answers/node-server.js
 - docs/getting_started.md
+- docs/projects_using_rbbcc.md
+- docs/tutorial_bcc_ruby_developer.md
+- docs/tutorial_bcc_ruby_developer_japanese.md
 - examples/bitehist.rb
 - examples/charty/Gemfile
 - examples/charty/Gemfile.lock
@@ -99,6 +65,11 @@ files:
 - examples/hello_world.rb
 - examples/kvm_hypercall.rb
 - examples/mallocstack.rb
+- examples/networking/http_filter/http-parse-simple.c
+- examples/networking/http_filter/http-parse-simple.rb
+- examples/ruby_usdt.rb
+- examples/sbrk_trace.rb
+- examples/tools/bashreadline.rb
 - examples/tools/execsnoop.rb
 - examples/tools/runqlat.rb
 - examples/urandomread-explicit.rb
@@ -110,6 +81,7 @@ files:
 - lib/rbbcc/clib.rb
 - lib/rbbcc/consts.rb
 - lib/rbbcc/cpu_helper.rb
+- lib/rbbcc/debug.rb
 - lib/rbbcc/disp_helper.rb
 - lib/rbbcc/fiddle_ext.rb
 - lib/rbbcc/symbol_cache.rb
@@ -120,7 +92,8 @@ files:
 - rbbcc.gemspec
 - semaphore.sh
 homepage: https://github.com/udzura/rbbcc
-licenses: []
+licenses:
+- Apache-2.0
 metadata: {}
 post_install_message: 
 rdoc_options: []
@@ -137,7 +110,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: BCC port for MRI