bcc 0.0.12

Idiomatic Rust bindings for BPF Compiler Collection (BCC)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

use bcc_sys::bccapi::*;
use failure::*;
use libc::{c_void, free};

use std::ffi::CStr;
use std::ffi::CString;
use std::mem;
use std::ptr;

pub fn resolve_symbol_path(
    module: &str,
    symname: &str,
    addr: u64,
    pid: pid_t,
) -> Result<(String, u64), Error> {
    let pid: pid_t = match pid {
        -1 => 0,
        x => x,
    };

    resolve_symname(module, symname, addr, pid)
}

pub fn resolve_symname(
    module: &str,
    symname: &str,
    addr: u64,
    pid: pid_t,
) -> Result<(String, u64), Error> {
    let mut symbol = unsafe { mem::zeroed::<bcc_symbol>() };
    let cmodule = CString::new(module)?;
    let csymname = CString::new(symname)?;

    let res = unsafe {
        bcc_resolve_symname(
            cmodule.as_ptr(),
            csymname.as_ptr(),
            addr,
            pid,
            ptr::null_mut(),
            &mut symbol as *mut bcc_symbol,
        )
    };
    if res < 0 {
        Err(format_err!(
            "unable to locate symbol {} in module {}: {}",
            &symname,
            module,
            res
        ))
    } else {
        let module = unsafe {
            CStr::from_ptr(symbol.module as *mut i8)
                .to_str()?
                .to_string()
        };
        // symbol.module was allocated somewhere inside `bcc_resolve_symname`
        // so we need to free it manually
        unsafe { free(symbol.module as *mut c_void) };
        Ok((module, symbol.offset))
    }
}