rbbcc 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b6eda25040fa0dc56bed7b9d672af03ab3f6dbd70a4ebca3e5310331c1f9098c
-  data.tar.gz: ef43f8bd481718f9baf21e2ba79c2a3d35b18d2767fc9572d436338244e83731
+  metadata.gz: 403f2664a61a40bce19ee3ca85f9637822b2172fb8123e7758f49342e022725f
+  data.tar.gz: 81f005eeb8d5c53faedffe8b01874b952faff8d81cda3b5319bc3fdde0044d6d
 SHA512:
-  metadata.gz: f9e19d1eb21813f2aef023ca6bb8c71e51052bf1dfe6b66013e4918129b8f538390098fca5f60f50fbba305482e2f23c2d378ca2f8b7422dc34c31e2d70bf8c3
-  data.tar.gz: 4f506d2a3350304fcad7de75d02b832c11a204588540ca8d210322fa7aef677587b855f2fa64fbeba3a63ba5a35c6a50f480b6d8095f6b081d4e12d383eca0b5
+  metadata.gz: 1ea74e38ea3bf6668c6d17b2907e7fe08497c913eff17776b77194cbb2285a79b9259f6412564ae5ec16c4979a321abcdf299d7735f363c5304ce0f665465e09
+  data.tar.gz: 46e964f12ddce367941db82c6efd33dbcf0ad6c396b51e39c4ea0e2ebc26dd0568558ebc44794144104f0b30def56d5ebae7173a9fe78fa883e7579226a0f588

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rbbcc (0.4.0)
+    rbbcc (0.4.2)
 
 GEM
   remote: https://rubygems.org/

data/examples/ruby_usdt.rb

@@ -0,0 +1,105 @@
+#!/usr/bin/env ruby
+# To run this example, please build the target ruby with an `--enable-dtrace` option in advance.
+# To build via rbenv, sample command is:
+#     $ RUBY_CONFIGURE_OPTS='--enable-dtrace' rbenv install 2.7.0
+#
+# Example autput:
+#     # bundle exec ruby examples/ruby_usdt.rb $(pidof irb)
+#     TIME(s)            COMM   KLASS                    PATH
+#     0.000000000        irb    Struct::Key              /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/reline.rb
+#     0.000055206        irb    Array                    /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/reline/line_editor.rb
+#     0.000088588        irb    Ripper::Lexer            /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.000117740        irb    Ripper::Lexer::Elem      /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.000126697        irb    Ripper::Lexer::State     /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.000213388        irb    Array                    /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/reline/line_editor.rb
+#     0.000225678        irb    Ripper::Lexer            /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.000243638        irb    Array                    /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/reline/line_editor.rb
+#     0.000254680        irb    Range                    /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/irb/ruby-lex.rb
+#     0.000264707        irb    Ripper::Lexer            /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.000275579        irb    Ripper::Lexer::Elem      /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.000282438        irb    Ripper::Lexer::State     /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.000326136        irb    String                   /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/irb.rb
+#     0.001353621        irb    Array                    /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/reline/line_editor.rb
+#     0.001385320        irb    IRB::Color::SymbolState  /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/irb/color.rb
+#     0.001397043        irb    Ripper::Lexer            /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/irb/color.rb
+#     0.001416420        irb    Ripper::Lexer::Elem      /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.001423861        irb    Ripper::Lexer::State     /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.001462010        irb    Ripper::Lexer::State     /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.001478995        irb    Array                    /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/reline/line_editor.rb
+#     0.001487499        irb    Range                    /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/irb/ruby-lex.rb
+#     0.001496666        irb    Ripper::Lexer            /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.001508224        irb    Ripper::Lexer::Elem      /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.001515143        irb    Ripper::Lexer::State     /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/ripper/lexer.rb
+#     0.001556170        irb    String                   /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/irb.rb
+#     0.001726273        irb    String                   /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/reline/line_editor.rb
+#     0.001946948        irb    Array                    /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/reline/line_editor.rb
+#     0.001956585        irb    String                   /root/.rbenv/versions/2.7.0/lib/ruby/2.7.0/reline.rb
+
+require 'rbbcc'
+include RbBCC
+
+pid = ARGV[0] || begin
+  puts("USAGE: #{$0} PID")
+  exit()
+end
+debug = !!ENV['DEBUG']
+
+bpf_text = <<BPF
+#include <uapi/linux/ptrace.h>
+#include <linux/sched.h>
+
+struct data_t {
+    u64 ts;
+    char comm[TASK_COMM_LEN];
+    char klass[64];
+    char path[256];
+};
+BPF_PERF_OUTPUT(events);
+
+int do_trace_create_object(struct pt_regs *ctx) {
+    struct data_t data = {};
+    uint64_t addr, addr2;
+
+    data.ts = bpf_ktime_get_ns();
+
+    bpf_get_current_comm(&data.comm, sizeof(data.comm));
+    bpf_usdt_readarg_p(1, ctx, &data.klass, sizeof(data.klass));
+    bpf_usdt_readarg_p(2, ctx, &data.path, sizeof(data.path));
+
+    events.perf_submit(ctx, &data, sizeof(data));
+
+    return 0;
+};
+BPF
+
+u = USDT.new(pid: pid.to_i)
+u.enable_probe(probe: "object__create", fn_name: "do_trace_create_object")
+if debug
+  puts(u.get_text)
+  puts(bpf_text)
+end
+
+# initialize BPF
+b = BCC.new(text: bpf_text, usdt_contexts: [u])
+
+puts("%-18s %-6s %-24s %s" % ["TIME(s)", "COMM", "KLASS", "PATH"])
+
+# process event
+start = 0
+b["events"].open_perf_buffer do |cpu, data, size|
+  event = b["events"].event(data)
+  if start == 0
+    start = event.ts
+  end
+
+  time_s = ((event.ts - start).to_f) / 1000000000
+  puts(
+    "%-18.9f %-6s %-24s %s" %
+    [time_s, event.comm, event.klass, event.path]
+  )
+end
+
+Signal.trap(:INT) { puts "\nDone."; exit }
+loop do
+  b.perf_buffer_poll()
+end

data/examples/sbrk_trace.rb

@@ -0,0 +1,204 @@
+#!/usr/bin/env ruby
+# Trace example for libc's USDT:
+# - memory_sbrk_more
+# - memory_sbrk_less
+# - memory_mallopt_free_dyn_thresholds
+# Description is here: https://www.gnu.org/software/libc/manual/html_node/Memory-Allocation-Probes.html
+#
+# Example output:
+# bundle exec ruby examples/sbrk_trace.rb -c ruby
+# !! Trace start.
+# [       0.000000000] pid=32756 comm=ruby probe=memory_sbrk_more addr=0x55f34b979000 size=135168
+# [       0.036549804] pid=32756 comm=ruby probe=memory_sbrk_more addr=0x557fd9760000 size=135168
+# [       0.036804183] pid=32756 comm=ruby probe=memory_sbrk_more addr=0x557fd9781000 size=143360
+# [       0.036855378] pid=32756 comm=ruby probe=memory_sbrk_less addr=0x557fd97a0000 size=16384
+# [       0.036931376] pid=32756 comm=ruby probe=memory_sbrk_more addr=0x557fd97a0000 size=147456
+# [       0.036940382] pid=32756 comm=ruby probe=memory_sbrk_less addr=0x557fd97c0000 size=16384
+# [       0.037022971] pid=32756 comm=ruby probe=memory_sbrk_more addr=0x557fd97c0000 size=151552
+# [       0.038602464] pid=32756 comm=ruby probe=memory_sbrk_more addr=0x557fd97e5000 size=204800
+# [       0.039398297] pid=32756 comm=ruby probe=memory_sbrk_more addr=0x557fd9817000 size=135168
+# [       0.039909594] pid=32756 comm=ruby probe=memory_sbrk_more addr=0x557fd9838000 size=135168
+# [       0.040536005] pid=32756 comm=ruby probe=memory_sbrk_more addr=0x557fd9859000 size=163840
+# ...
+
+require 'rbbcc'
+include RbBCC
+
+def usage
+  puts("USAGE: #{$0} [-p PID|-c COMM]")
+  exit()
+end
+
+def find_libc_location
+  if File.exist?('/lib/x86_64-linux-gnu/libc.so.6')
+    '/lib/x86_64-linux-gnu/libc.so.6'
+  else
+    `find /lib -name 'libc.so*' | grep -v musl | head -1`.chomp
+  end
+end
+
+usage if ARGV.size != 0 && ARGV.size != 2
+
+pid = comm = nil
+path = find_libc_location
+case ARGV[0]
+when '-p', '--pid'
+  pid = ARGV[1].to_i
+when '-c', '--comm'
+  comm = ARGV[1]
+when nil
+  # nop
+else
+  usage
+end
+
+debug = !!ENV['DEBUG']
+
+bpf_text = <<BPF
+#include <uapi/linux/ptrace.h>
+#include <linux/sched.h>
+
+struct data_t {
+    u32 type;
+    u64 ts;
+    u32 pid;
+    char comm[TASK_COMM_LEN];
+    u64 addr;
+    u32 sbrk_size;
+    u32 adjusted_mmap;
+    u32 trim_thresholds;
+};
+BPF_PERF_OUTPUT(events);
+
+static inline bool streq(uintptr_t str) {
+    char needle[] = "{{NEEDLE}}";
+    char haystack[sizeof(needle)];
+    bpf_probe_read(&haystack, sizeof(haystack), (void *)str);
+    for (int i = 0; i < sizeof(needle) - 1; ++i) {
+        if (needle[i] != haystack[i]) {
+            return false;
+        }
+    }
+    return true;
+}
+
+#define PROBE_TYPE_more 1
+#define PROBE_TYPE_less 2
+#define PROBE_TYPE_free 3
+
+{{FUNC_MORE}}
+
+{{FUNC_LESS}}
+
+int trace_memory_free(struct pt_regs *ctx) {
+    struct data_t data = {};
+    long buf;
+
+    data.type = PROBE_TYPE_free;
+    data.ts = bpf_ktime_get_ns();
+    data.pid = bpf_get_current_pid_tgid();
+    bpf_get_current_comm(&data.comm, sizeof(data.comm));
+
+    {{NEEDLE_START}}
+    bpf_usdt_readarg(1, ctx, &buf);
+    data.adjusted_mmap = buf;
+
+    bpf_usdt_readarg(2, ctx, &buf);
+    data.trim_thresholds = buf;
+
+    events.perf_submit(ctx, &data, sizeof(data));
+    {{NEEDLE_END}}
+
+    return 0;
+};
+
+BPF
+
+trace_fun_sbrk = <<FUNC
+int trace_memory_sbrk_{{TYPE}}(struct pt_regs *ctx) {
+    struct data_t data = {};
+    long buf;
+
+    data.type = PROBE_TYPE_{{TYPE}};
+    data.ts = bpf_ktime_get_ns();
+    data.pid = bpf_get_current_pid_tgid();
+    bpf_get_current_comm(&data.comm, sizeof(data.comm));
+
+    {{NEEDLE_START}}
+    bpf_usdt_readarg(1, ctx, &buf);
+    data.addr = buf;
+
+    bpf_usdt_readarg(2, ctx, &buf);
+    data.sbrk_size = buf;
+
+    events.perf_submit(ctx, &data, sizeof(data));
+    {{NEEDLE_END}}
+
+    return 0;
+};
+FUNC
+
+PROBE_TYPE_more = 1
+PROBE_TYPE_less = 2
+PROBE_TYPE_free = 3
+PROBE_MAP = {
+  PROBE_TYPE_more => 'memory_sbrk_more',
+  PROBE_TYPE_less => 'memory_sbrk_less',
+  PROBE_TYPE_free => 'memory_mallopt_free_dyn_thresholds'
+}
+
+bpf_text.sub!('{{FUNC_MORE}}', trace_fun_sbrk.gsub('{{TYPE}}', 'more'))
+bpf_text.sub!('{{FUNC_LESS}}', trace_fun_sbrk.gsub('{{TYPE}}', 'less'))
+
+if comm
+  bpf_text.sub!('{{NEEDLE}}', comm)
+  bpf_text.gsub!('{{NEEDLE_START}}', "if(streq((uintptr_t)data.comm)) {")
+  bpf_text.gsub!('{{NEEDLE_END}}', "}")
+else
+  bpf_text.sub!('{{NEEDLE}}', "")
+  bpf_text.gsub!('{{NEEDLE_START}}', "")
+  bpf_text.gsub!('{{NEEDLE_END}}', "")
+end
+
+u = USDT.new(pid: pid, path: path)
+u.enable_probe(probe: "memory_sbrk_more", fn_name: "trace_memory_sbrk_more")
+u.enable_probe(probe: "memory_sbrk_less", fn_name: "trace_memory_sbrk_less")
+if pid
+  # FIXME: Only available when PID is specified
+  # otherwise got an error:
+  #     bpf: Failed to load program: Invalid argument
+  #     last insn is not an exit or jmp
+  # It seems libbcc won't generate proper readarg helper
+  u.enable_probe(probe: "memory_mallopt_free_dyn_thresholds", fn_name: "trace_memory_free")
+end
+
+# initialize BPF
+b = BCC.new(text: bpf_text, usdt_contexts: [u])
+
+puts "!! Trace start."
+# process event
+start = 0
+b["events"].open_perf_buffer do |cpu, data, size|
+  event = b["events"].event(data)
+  if start == 0
+    start = event.ts
+  end
+
+  time_s = ((event.ts - start).to_f) / 1000000000
+  if [PROBE_TYPE_more, PROBE_TYPE_less].include?(event.type)
+    puts(
+      "[%18.9f] pid=%d comm=%s probe=%s addr=%#x size=%d" %
+      [time_s, event.pid, event.comm, PROBE_MAP[event.type], event.addr, event.sbrk_size]
+    )
+  else
+    puts(
+      "[%18.9f] pid=%d comm=%s probe=%s adjusted_mmap=%d trim_thresholds=%d" %
+      [time_s, event.pid, event.comm, PROBE_MAP[event.type], event.adjusted_mmap, event.trim_thresholds]
+    )
+  end
+end
+
+Signal.trap(:INT) { puts "\n!! Done."; exit }
+loop do
+  b.perf_buffer_poll()
+end

data/lib/rbbcc/bcc.rb

@@ -1,6 +1,7 @@
 require 'rbbcc/consts'
 require 'rbbcc/table'
 require 'rbbcc/symbol_cache'
+require 'rbbcc/debug'
 
 module RbBCC
   SYSCALL_PREFIXES = [
@@ -217,6 +218,7 @@ module RbBCC
           text = code + text
         end
 
+        # Util.debug text
         @module = Clib.bpf_module_create_c_from_string(
           text,
           debug,
@@ -282,7 +284,7 @@ module RbBCC
       if fd < 0
         raise SystemCallError.new("Failed to attach BPF program #{fn_name} to tracepoint #{tp}", Fiddle.last_error)
       end
-      puts "Attach: #{tp}"
+      Util.debug "Attach: #{tp}"
       @tracepoint_fds[tp] = fd
       self
     end
@@ -297,7 +299,7 @@ module RbBCC
       if fd < 0
         raise SystemCallError.new("Failed to attach BPF program #{fn_name} to raw tracepoint #{tp}", Fiddle.last_error)
       end
-      puts "Attach: #{tp}"
+      Util.debug "Attach: #{tp}"
       @raw_tracepoint_fds[tp] = fd
       self
     end
@@ -309,7 +311,7 @@ module RbBCC
       if fd < 0
         raise SystemCallError.new("Failed to attach BPF program #{fn_name} to kprobe #{event}", Fiddle.last_error)
       end
-      puts "Attach: #{ev_name}"
+      Util.debug "Attach: #{ev_name}"
       @kprobe_fds[ev_name] = fd
       [ev_name, fd]
     end
@@ -322,7 +324,7 @@ module RbBCC
       if fd < 0
         raise SystemCallError.new("Failed to attach BPF program #{fn_name} to kretprobe #{event}", Fiddle.last_error)
       end
-      puts "Attach: #{ev_name}"
+      Util.debug "Attach: #{ev_name}"
       @kprobe_fds[ev_name] = fd
       [ev_name, fd]
     end
@@ -336,7 +338,7 @@ module RbBCC
       if fd < 0
         raise SystemCallError.new(Fiddle.last_error)
       end
-      puts "Attach: #{ev_name}"
+      Util.debug "Attach: #{ev_name}"
 
       @uprobe_fds[ev_name] = fd
       [ev_name, fd]
@@ -351,7 +353,7 @@ module RbBCC
       if fd < 0
         raise SystemCallError.new(Fiddle.last_error)
       end
-      puts "Attach: #{ev_name}"
+      Util.debug "Attach: #{ev_name}"
 
       @uprobe_fds[ev_name] = fd
       [ev_name, fd]
@@ -552,7 +554,7 @@ module RbBCC
         else
           next
         end
-        puts "Found fnc: #{func_name}"
+        Util.debug "Found fnc: #{func_name}"
         if func_name.start_with?("kprobe__")
           fn = load_func(func_name, BPF::KPROBE)
           attach_kprobe(

data/lib/rbbcc/clib.rb

@@ -120,10 +120,11 @@ module RbBCC
     extern 'char * bpf_perf_event_field(void *program, const char *event, size_t i)'
 
     extern 'void * bcc_usdt_new_frompid(int, char *)'
+    extern 'void * bcc_usdt_new_frompath(char *path)'
     extern 'int bcc_usdt_enable_probe(void *, char *, char *)'
     extern 'char * bcc_usdt_genargs(void **, int)'
     extern 'void bcc_usdt_foreach_uprobe(void *, void *)'
-
+    extern 'void bcc_usdt_close(void *usdt)'
     BCCSymbol = struct([
                          "const char *name",
                          "const char *demangle_name",

data/lib/rbbcc/debug.rb

@@ -0,0 +1,17 @@
+if ENV['RBBCC_DEBUG'] || ENV['BCC_DEBUG']
+  module RbBCC
+    module Util
+      def self.debug(msg)
+        puts msg
+      end
+    end
+  end
+else
+  module RbBCC
+    module Util
+      def self.debug(msg)
+        # nop
+      end
+    end
+  end
+end

data/lib/rbbcc/usdt.rb

@@ -4,15 +4,21 @@ module RbBCC
   USDTProbe = Struct.new(:binpath, :fn_name, :addr, :pid)
 
   class USDT
-    # TODO path:
-    def initialize(pid:)
+    def initialize(pid: nil, path: nil)
       @pid = pid
-      @context = Clib.bcc_usdt_new_frompid(pid, nil)
+      @path = path
+      if pid
+        @context = Clib.bcc_usdt_new_frompid(pid, path)
+      elsif path
+        @context = Clib.bcc_usdt_new_frompath(path)
+      else
+        raise "Either a pid or a binary path must be specified"
+      end
       if !@context || @context.null?
         raise SystemCallError.new(Fiddle.last_error)
       end
     end
-    attr_reader :pid, :context
+    attr_reader :pid, :path, :context
 
     def enable_probe(probe:, fn_name:)
       ret = Clib.bcc_usdt_enable_probe(@context, probe, fn_name)
@@ -33,5 +39,16 @@ module RbBCC
 
       return probes
     end
+
+    private
+    def __del__
+      lambda { Clib.bcc_usdt_close(@context); Util.debug("USDT GC'ed.") }
+    end
+  end
+end
+
+at_exit do
+  ObjectSpace.each_object(RbBCC::USDT) do |o|
+    o.send(:__del__).call
   end
 end

data/lib/rbbcc/version.rb

@@ -1,3 +1,3 @@
 module RbBCC
-  VERSION = "0.4.1"
+  VERSION = "0.4.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rbbcc
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - Uchio Kondo
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-03-20 00:00:00.000000000 Z
+date: 2020-03-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -123,6 +123,8 @@ files:
 - examples/mallocstack.rb
 - examples/networking/http_filter/http-parse-simple.c
 - examples/networking/http_filter/http-parse-simple.rb
+- examples/ruby_usdt.rb
+- examples/sbrk_trace.rb
 - examples/tools/execsnoop.rb
 - examples/tools/runqlat.rb
 - examples/urandomread-explicit.rb
@@ -134,6 +136,7 @@ files:
 - lib/rbbcc/clib.rb
 - lib/rbbcc/consts.rb
 - lib/rbbcc/cpu_helper.rb
+- lib/rbbcc/debug.rb
 - lib/rbbcc/disp_helper.rb
 - lib/rbbcc/fiddle_ext.rb
 - lib/rbbcc/symbol_cache.rb