Skip to content

Commit

Permalink
Merge 6a0022e into af40de8
Browse files Browse the repository at this point in the history
  • Loading branch information
Officeyutong authored Mar 12, 2023
2 parents af40de8 + 6a0022e commit e265bad
Show file tree
Hide file tree
Showing 34 changed files with 1,517 additions and 1,460 deletions.
2 changes: 1 addition & 1 deletion .clang-format
Original file line number Diff line number Diff line change
@@ -1 +1 @@
{BasedOnStyle: Chromium, IndentWidth: 4}
{BasedOnStyle: Chromium, IndentWidth: 4, ReflowComments: false, SortIncludes: "Never"}
29 changes: 29 additions & 0 deletions .github/scripts/clang-format.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
#! /usr/bin/env bash

# Usage: ./clang-format.sh /usr/bin/clang-format(version >= 10.0) [-f]
# Specify -f to format all c/cxx files, instead of check if the files satisfy the format file

lint() {
local targets="examples wasm-sdk runtime/cpp/include runtime/cpp/test runtime/cpp/src"
local clang_format="${1}"

if [ "$#" -lt 1 ]; then
echo "please provide clang-format command. Usage ${0} `which clang-format`"
exit 1
fi

if [ ! -f "${clang_format}" ]; then
echo "clang-format not found. Please install clang-format first"
exit 1
fi
local ext_args="-Werror --dry-run"
if [ "${2}" = "-f" ]; then
ext_args=""
fi
find ${targets} -type f -iname *.[ch] -o -iname *.cpp -o -iname *.[ch]xx \
| xargs -n1 ${clang_format} -i -style=file ${ext_args}

exit $?
}

lint $@
19 changes: 19 additions & 0 deletions .github/workflows/c-cpp-lint.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
name: "c-cpp-lint"

on:
push:
branches: "main"
pull_request:
branches: "*"

jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: install deps
run: |
sudo apt-get install clang-format
- name: Run clang-format
run: |
./.github/scripts/clang-format.sh `which clang-format`
175 changes: 87 additions & 88 deletions examples/bootstrap/bootstrap.bpf.c
Original file line number Diff line number Diff line change
Expand Up @@ -9,103 +9,102 @@
char LICENSE[] SEC("license") = "Dual BSD/GPL";

struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 8192);
__type(key, pid_t);
__type(value, u64);
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 8192);
__type(key, pid_t);
__type(value, u64);
} exec_start SEC(".maps");

struct {
__uint(type, BPF_MAP_TYPE_RINGBUF);
__uint(max_entries, 256 * 1024);
__uint(type, BPF_MAP_TYPE_RINGBUF);
__uint(max_entries, 256 * 1024);
} rb SEC(".maps");

const volatile unsigned long long min_duration_ns = 0;

SEC("tp/sched/sched_process_exec")
int handle_exec(struct trace_event_raw_sched_process_exec *ctx)
{
struct task_struct *task;
unsigned fname_off;
struct event *e;
pid_t pid;
u64 ts;

/* remember time exec() was executed for this PID */
pid = bpf_get_current_pid_tgid() >> 32;
ts = bpf_ktime_get_ns();
bpf_map_update_elem(&exec_start, &pid, &ts, BPF_ANY);

/* don't emit exec events when minimum duration is specified */
if (min_duration_ns)
return 0;

/* reserve sample from BPF ringbuf */
e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
if (!e)
return 0;

/* fill out the sample with data */
task = (struct task_struct *)bpf_get_current_task();

e->exit_event = false;
e->pid = pid;
e->ppid = BPF_CORE_READ(task, real_parent, tgid);
bpf_get_current_comm(&e->comm, sizeof(e->comm));

fname_off = ctx->__data_loc_filename & 0xFFFF;
bpf_probe_read_str(&e->filename, sizeof(e->filename), (void *)ctx + fname_off);

/* successfully submit it to user-space for post-processing */
bpf_ringbuf_submit(e, 0);
return 0;
int handle_exec(struct trace_event_raw_sched_process_exec* ctx) {
struct task_struct* task;
unsigned fname_off;
struct event* e;
pid_t pid;
u64 ts;

/* remember time exec() was executed for this PID */
pid = bpf_get_current_pid_tgid() >> 32;
ts = bpf_ktime_get_ns();
bpf_map_update_elem(&exec_start, &pid, &ts, BPF_ANY);

/* don't emit exec events when minimum duration is specified */
if (min_duration_ns)
return 0;

/* reserve sample from BPF ringbuf */
e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
if (!e)
return 0;

/* fill out the sample with data */
task = (struct task_struct*)bpf_get_current_task();

e->exit_event = false;
e->pid = pid;
e->ppid = BPF_CORE_READ(task, real_parent, tgid);
bpf_get_current_comm(&e->comm, sizeof(e->comm));

fname_off = ctx->__data_loc_filename & 0xFFFF;
bpf_probe_read_str(&e->filename, sizeof(e->filename),
(void*)ctx + fname_off);

/* successfully submit it to user-space for post-processing */
bpf_ringbuf_submit(e, 0);
return 0;
}

SEC("tp/sched/sched_process_exit")
int handle_exit(struct trace_event_raw_sched_process_template* ctx)
{
struct task_struct *task;
struct event *e;
pid_t pid, tid;
u64 id, ts, *start_ts, duration_ns = 0;

/* get PID and TID of exiting thread/process */
id = bpf_get_current_pid_tgid();
pid = id >> 32;
tid = (u32)id;

/* ignore thread exits */
if (pid != tid)
return 0;

/* if we recorded start of the process, calculate lifetime duration */
start_ts = bpf_map_lookup_elem(&exec_start, &pid);
if (start_ts)
duration_ns = bpf_ktime_get_ns() - *start_ts;
else if (min_duration_ns)
return 0;
bpf_map_delete_elem(&exec_start, &pid);

/* if process didn't live long enough, return early */
if (min_duration_ns && duration_ns < min_duration_ns)
return 0;

/* reserve sample from BPF ringbuf */
e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
if (!e)
return 0;

/* fill out the sample with data */
task = (struct task_struct *)bpf_get_current_task();

e->exit_event = true;
e->duration_ns = duration_ns;
e->pid = pid;
e->ppid = BPF_CORE_READ(task, real_parent, tgid);
e->exit_code = (BPF_CORE_READ(task, exit_code) >> 8) & 0xff;
bpf_get_current_comm(&e->comm, sizeof(e->comm));

/* send data to user-space for post-processing */
bpf_ringbuf_submit(e, 0);
return 0;
int handle_exit(struct trace_event_raw_sched_process_template* ctx) {
struct task_struct* task;
struct event* e;
pid_t pid, tid;
u64 id, ts, *start_ts, duration_ns = 0;

/* get PID and TID of exiting thread/process */
id = bpf_get_current_pid_tgid();
pid = id >> 32;
tid = (u32)id;

/* ignore thread exits */
if (pid != tid)
return 0;

/* if we recorded start of the process, calculate lifetime duration */
start_ts = bpf_map_lookup_elem(&exec_start, &pid);
if (start_ts)
duration_ns = bpf_ktime_get_ns() - *start_ts;
else if (min_duration_ns)
return 0;
bpf_map_delete_elem(&exec_start, &pid);

/* if process didn't live long enough, return early */
if (min_duration_ns && duration_ns < min_duration_ns)
return 0;

/* reserve sample from BPF ringbuf */
e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
if (!e)
return 0;

/* fill out the sample with data */
task = (struct task_struct*)bpf_get_current_task();

e->exit_event = true;
e->duration_ns = duration_ns;
e->pid = pid;
e->ppid = BPF_CORE_READ(task, real_parent, tgid);
e->exit_code = (BPF_CORE_READ(task, exit_code) >> 8) & 0xff;
bpf_get_current_comm(&e->comm, sizeof(e->comm));

/* send data to user-space for post-processing */
bpf_ringbuf_submit(e, 0);
return 0;
}
38 changes: 16 additions & 22 deletions examples/bootstrap/bootstrap.c
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@ static struct env {
long min_duration_ms;
} env;

const char *argp_program_version = "bootstrap 0.0";
const char *argp_program_bug_address = "<[email protected]>";
const char* argp_program_version = "bootstrap 0.0";
const char* argp_program_bug_address = "<[email protected]>";
const char argp_program_doc[] =
"BPF bootstrap demo application.\n"
"\n"
Expand All @@ -21,18 +21,14 @@ const char argp_program_doc[] =
"\n"
"USAGE: ./bootstrap [-d <min-duration-ms>] -v\n";

static void
print_usage(void)
{
static void print_usage(void) {
printf("%s\n", argp_program_version);
printf("%s\n", argp_program_doc);
}

static int
handle_event(void *ctx, void *data, size_t data_sz)
{
const struct event *e = data;
struct tm *tm;
static int handle_event(void* ctx, void* data, size_t data_sz) {
const struct event* e = data;
struct tm* tm;
char ts[32];
time_t t;

Expand All @@ -46,8 +42,7 @@ handle_event(void *ctx, void *data, size_t data_sz)
if (e->duration_ns)
printf(" (%llums)", e->duration_ns / 1000000);
printf("\n");
}
else {
} else {
printf("%-8s %-5s %-16s %-7d %-7d %s\n", ts, "EXEC", e->comm, e->pid,
e->ppid, e->filename);
}
Expand All @@ -57,20 +52,19 @@ handle_event(void *ctx, void *data, size_t data_sz)

static bool exiting = false;

int
main(int argc, char **argv)
{
struct bpf_buffer *rb = NULL;
struct bootstrap_bpf *skel;
int main(int argc, char** argv) {
struct bpf_buffer* rb = NULL;
struct bootstrap_bpf* skel;
int err;

// parse the args manually for demo purpose
if (argc > 3 || strcmp(argv[1], "-h") == 0 || strcmp(argv[1], "--help") == 0) {
// parse the args manually for demo purpose
if (argc > 3 || strcmp(argv[1], "-h") == 0 ||
strcmp(argv[1], "--help") == 0) {
print_usage();
return 0;
}
else if ((strcmp(argv[1], "-d") == 0 || strcmp(argv[1], "--duration") == 0)
&& argc == 3) {
} else if ((strcmp(argv[1], "-d") == 0 ||
strcmp(argv[1], "--duration") == 0) &&
argc == 3) {
env.min_duration_ms = strtol(argv[2], NULL, 10);
}

Expand Down
14 changes: 7 additions & 7 deletions examples/bootstrap/bootstrap.h
Original file line number Diff line number Diff line change
Expand Up @@ -7,13 +7,13 @@
#define MAX_FILENAME_LEN 127

struct event {
int pid;
int ppid;
unsigned exit_code;
unsigned long long duration_ns;
char comm[TASK_COMM_LEN];
char filename[MAX_FILENAME_LEN];
char exit_event;
int pid;
int ppid;
unsigned exit_code;
unsigned long long duration_ns;
char comm[TASK_COMM_LEN];
char filename[MAX_FILENAME_LEN];
char exit_event;
};

#endif /* __BOOTSTRAP_H */
2 changes: 0 additions & 2 deletions examples/bootstrap/bootstrap.wasm.h
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,4 @@ struct event {
} __attribute__((packed));
static_assert(sizeof(struct event) == 168, "Size of event is not 168");


#endif /* __VMLINUX_H__ */

10 changes: 5 additions & 5 deletions examples/execve/execve.bpf.c
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,13 @@ struct {
struct execve_args {
struct trace_entry common;
int unused;
char *file;
char *const *argv;
char *const *envp;
char* file;
char* const* argv;
char* const* envp;
};

SEC("tp/syscalls/sys_enter_execve")
int sys_enter_execve(struct execve_args *ctx) {
int sys_enter_execve(struct execve_args* ctx) {
struct comm_event comm;
comm.pid = (int)(bpf_get_current_pid_tgid() & 0xFFFFFFFF);
bpf_get_current_comm(&(comm.parent_proc[0]), sizeof(comm.parent_proc));
Expand All @@ -27,7 +27,7 @@ int sys_enter_execve(struct execve_args *ctx) {
int start = 0;
int end = COMM_SIZE - 1;

char *args[MAX_ARG_NUM];
char* args[MAX_ARG_NUM];
int idx = 0;
for (; idx < MAX_ARG_NUM; idx++) {
if (bpf_probe_read_user(&args[idx], sizeof(args[idx]),
Expand Down
3 changes: 1 addition & 2 deletions examples/execve/execve.c
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,7 @@
#include "execve.h"
static int handle_event(void* ctx, void* data, size_t data_sz) {
struct comm_event* st = (struct comm_event*)data;
printf("[%d] %s -> %s\n", st->pid, st->parent_proc,
st->command);
printf("[%d] %s -> %s\n", st->pid, st->parent_proc, st->command);
return 0;
}

Expand Down
Loading

0 comments on commit e265bad

Please sign in to comment.