rbbcc 0.11.0 → 0.11.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cafb82823139848b9c16a2182ef4ba3c86c391126700ee6cbb31ab0a427da85
-  data.tar.gz: 711be4b7c0bf09879445d02b7bf0379b9c51dc186f56129227c416a0515e00ff
+  metadata.gz: 30e4967edcbc916ed8e11549202d7c6dd8283554e9d75a3e3f88ac1a58466110
+  data.tar.gz: 6668b27c98059c41509b33b9fe8d8effff4001a709df2b6ec944687f020591da
 SHA512:
-  metadata.gz: 007c4273121411d6548b071fe48fda59c36af94a36c7de183a8fbacceba722c837115af8a2892ec79277957217b5152b58ec12ce4dd56c153293a2ac6fae9894
-  data.tar.gz: 94da55a1738a534d0bffc95ac2ebabcb431e5ea98785506a0006e1d249b83d602f8bbcaec47890124afbf42a9a11f394f986b9795b194db0acb101a8d536ca26
+  metadata.gz: 8a08a60ce0dcd05c27be3388eb9e8fbe9c6cba7b877d0e55b0df348d6023586a90d4d4d7b52ec5312c2b8241fd1dbc09cd350153ecc6f9fc0fb852c1c89655a9
+  data.tar.gz: 689770db707201cc089c43fb4997a685c05af2b4d717c25c8891d4e5351909c9eb4c5ca0e8d19e86fe2a88e60e30dde1bd5a4eec359dc0e775ed39f32054e485

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rbbcc (0.11.0)
+    rbbcc (0.11.2)
       fiddle
 
 GEM

data/examples/pin_maps_a.rb

@@ -0,0 +1,88 @@
+#!/usr/bin/env ruby
+#
+# pin_maps_a.rb
+# Program A: create HashMap/ArrayMap, hook execve, count up, and pin maps.
+#
+# Usage (root):
+#   sudo ruby examples/pin_maps_a.rb --pin-dir /sys/fs/bpf/rbbcc_pin_demo
+
+require 'rbbcc'
+require 'optparse'
+require 'fileutils'
+
+include RbBCC
+
+BPF_TEXT = <<~CLANG
+  BPF_HASH(pin_hash_map, u32, u64, 1024);
+  BPF_ARRAY(pin_array_map, u64, 1);
+
+  int trace_execve(void *ctx) {
+    u64 zero = 0;
+    u32 pid = bpf_get_current_pid_tgid();
+    u32 idx = 0;
+    u64 *hval;
+    u64 *aval;
+
+    hval = pin_hash_map.lookup_or_try_init(&pid, &zero);
+    if (hval) {
+      __sync_fetch_and_add(hval, 1);
+    }
+
+    aval = pin_array_map.lookup(&idx);
+    if (aval) {
+      __sync_fetch_and_add(aval, 1);
+    }
+
+    return 0;
+  }
+CLANG
+
+options = {
+  pin_dir: '/sys/fs/bpf/rbbcc_pin_demo'
+}
+
+OptionParser.new do |opts|
+  opts.banner = 'Usage: pin_maps_a.rb [options]'
+
+  opts.on('--pin-dir DIR', 'Pin directory under bpffs') do |v|
+    options[:pin_dir] = v
+  end
+end.parse!
+
+b = BCC.new(text: BPF_TEXT)
+b.attach_kprobe(
+  event: b.get_syscall_fnname('execve'),
+  fn_name: 'trace_execve'
+)
+
+hash_map = b['pin_hash_map']
+array_map = b['pin_array_map']
+
+# Initialize global counter slot.
+array_map[0] = 0
+
+FileUtils.mkdir_p(options[:pin_dir])
+hash_path = File.join(options[:pin_dir], 'pin_hash_map')
+array_path = File.join(options[:pin_dir], 'pin_array_map')
+
+File.unlink(hash_path) if File.exist?(hash_path)
+File.unlink(array_path) if File.exist?(array_path)
+
+BCC.pin!(hash_map.map_fd, hash_path)
+BCC.pin!(array_map.map_fd, array_path)
+
+puts 'Pinned maps created.'
+puts "  hash map:  #{hash_path}"
+puts "  array map: #{array_path}"
+puts 'kprobe attached to execve. Run some commands in another terminal.'
+puts 'Press Ctrl-C to stop Program A.'
+
+begin
+  loop do
+    sleep 1
+    total = array_map[0]&.to_bcc_value || 0
+    puts "execve total count: #{total}"
+  end
+rescue Interrupt
+  puts '\nStopping Program A...'
+end

data/examples/pin_maps_b.rb

@@ -0,0 +1,71 @@
+#!/usr/bin/env ruby
+#
+# pin_maps_b.rb
+# Program B: open pinned HashMap/ArrayMap with from_pin and read/update values.
+#
+# Usage (root):
+#   sudo ruby examples/pin_maps_b.rb --pin-dir /sys/fs/bpf/rbbcc_pin_demo
+
+require 'rbbcc'
+require 'optparse'
+
+include RbBCC
+
+options = {
+  pin_dir: '/sys/fs/bpf/rbbcc_pin_demo'
+}
+
+OptionParser.new do |opts|
+  opts.banner = 'Usage: pin_maps_b.rb [options]'
+
+  opts.on('--pin-dir DIR', 'Pin directory under bpffs') do |v|
+    options[:pin_dir] = v
+  end
+end.parse!
+
+hash_path = File.join(options[:pin_dir], 'pin_hash_map')
+array_path = File.join(options[:pin_dir], 'pin_array_map')
+
+unless File.exist?(hash_path) && File.exist?(array_path)
+  abort("Pinned map files are missing. Run pin_maps_a.rb first: #{options[:pin_dir]}")
+end
+
+# Explicitly pass key/leaf type and size; no type detection is performed.
+hash_map = HashTable.from_pin(
+  hash_path,
+  'unsigned int',
+  'unsigned long long',
+  keysize: 4,
+  leafsize: 8
+)
+array_map = ArrayTable.from_pin(
+  array_path,
+  'unsigned int',
+  'unsigned long long',
+  keysize: 4,
+  leafsize: 8
+)
+
+puts 'Loaded pinned maps.'
+puts "  hash map fd:  #{hash_map.map_fd}"
+puts "  array map fd: #{array_map.map_fd}"
+puts "  hash ttype:   #{hash_map.ttype}"
+puts "  array ttype:  #{array_map.ttype}"
+
+puts 'Read existing values:'
+puts "  hash[1] = #{hash_map[1]&.to_bcc_value.inspect}"
+puts "  hash[2] = #{hash_map[2]&.to_bcc_value.inspect}"
+puts "  array[0] = #{array_map[0]&.to_bcc_value.inspect}"
+puts "  array[1] = #{array_map[1]&.to_bcc_value.inspect}"
+
+hash_map[3] = 1
+array_map[0] = (array_map[0]&.to_bcc_value || 0) + 1
+
+puts 'Updated values:'
+puts "  hash[3] = #{hash_map[3]&.to_bcc_value.inspect}"
+puts "  array[0] = #{array_map[0]&.to_bcc_value.inspect}"
+
+puts 'Iterate hash entries:'
+hash_map.each_pair do |k, v|
+  puts "  #{k.to_bcc_value} => #{v.to_bcc_value}"
+end

data/lib/rbbcc/bcc.rb

@@ -242,6 +242,7 @@ module RbBCC
       @uprobe_fds = {}
       @tracepoint_fds = {}
       @raw_tracepoint_fds = {}
+      @lsm_fds = {}
 
       if src_file
         src_file = BCC._find_file(src_file)
@@ -433,6 +434,34 @@ module RbBCC
       @tracepoint_fds.delete(tp)
     end
 
+    def attach_lsm(fn_name: "")
+      if @lsm_fds.keys.include?(fn_name)
+        raise "LSM #{fn_name} has been attached"
+      end
+
+      fn = load_func(fn_name, BPF::LSM)
+      fd = Clib.bpf_attach_lsm(fn[:fd])
+      if fd < 0
+        raise SystemCallError.new("Failed to attach LSM #{fn_name}", Fiddle.last_error)
+      end
+      Util.debug "Attach: #{fn_name}"
+      @lsm_fds[fn_name] = fd
+      self
+    end
+
+    def detach_lsm(fn_name)
+      unless @lsm_fds.keys.include?(fn_name)
+        raise "LSM #{fn_name} is not attached"
+      end
+
+      begin
+        File.for_fd(@lsm_fds[fn_name]).close
+      rescue => e
+        warn "Closing fd failed: #{e.inspect}. Ignore and skip"
+      end
+      @lsm_fds.delete(fn_name)
+    end
+
     def detach_kprobe_event(ev_name)
       unless @kprobe_fds.keys.include?(ev_name)
         raise "Event #{ev_name} not registered"
@@ -471,6 +500,10 @@ module RbBCC
       @tracepoint_fds.size
     end
 
+    def num_open_lsms
+      @lsm_fds.size
+    end
+
     def tracefile
       @tracefile ||= File.open("#{TRACEFS}/trace_pipe", "rb")
     end
@@ -528,6 +561,10 @@ module RbBCC
         detach_raw_tracepoint(k)
       end
 
+      @lsm_fds.each do |k, v|
+        detach_lsm(k)
+      end
+
       if @module
         Clib.bpf_module_destroy(@module)
       end
@@ -644,8 +681,7 @@ module RbBCC
             fn_name: fn[:name]
           )
         elsif func_name.start_with?("lsm__")
-          # LSM_PROBE programs are attached by libbcc while loading.
-          load_func(func_name, BPF::LSM)
+          attach_lsm(fn_name: func_name)
         end
       end
     end

data/lib/rbbcc/clib.rb

@@ -114,6 +114,7 @@ module RbBCC
     extern 'int bpf_attach_tracepoint(int progfd, char *tp_category, char *tp_name)'
     extern 'int bpf_detach_tracepoint(char *tp_category, char *tp_name)'
     extern 'int bpf_attach_raw_tracepoint(int progfd, char *tp_name)'
+    extern 'int bpf_attach_lsm(int progfd)'
     extern 'int bpf_open_perf_event(unsigned int, unsigned long, int, int)'
     extern 'int bpf_close_perf_event_fd(int)'
     extern 'int bpf_get_first_key(int, void *, int)'
@@ -193,6 +194,7 @@ module RbBCC
     extern 'int bpf_open_raw_sock(const char *name)'
     extern 'int bpf_attach_socket(int sockfd, int progfd)'
     extern 'int bpf_obj_pin(int fd, const char *pathname)'
+    extern 'int bpf_obj_get(const char *pathname)'
   end
 end
 

data/lib/rbbcc/table.rb

@@ -115,13 +115,36 @@ module RbBCC
     include CPUHelper
     include Enumerable
 
-    def initialize(bpf, map_id, map_fd, keytype, leaftype, name: nil)
+    class << self
+      def from_pin(path, keytype, leaftype, keysize: nil, leafsize: nil, **kwargs)
+        map_fd = Clib.bpf_obj_get(path)
+        if map_fd < 0
+          raise SystemCallError.new("Could not open pinned map", Fiddle.last_error)
+        end
+
+        new(nil, nil, map_fd, keytype, leaftype,
+            keysize: keysize, leafsize: leafsize, **kwargs)
+      end
+    end
+
+    def initialize(bpf, map_id, map_fd, keytype, leaftype, name: nil, keysize: nil, leafsize: nil)
       @bpf, @map_id, @map_fd, @keysize, @leafsize = \
-                                        bpf, map_id, map_fd, sizeof(keytype), sizeof(leaftype)
+                                        bpf, map_id, map_fd,
+                                        keysize || sizeof(keytype),
+                                        leafsize || sizeof(leaftype)
       @keytype = keytype
       @leaftype = leaftype
-      @ttype = Clib.bpf_table_type_id(self.bpf.module, self.map_id)
-      @flags = Clib.bpf_table_flags_id(self.bpf.module, self.map_id)
+      if @bpf
+        @ttype = Clib.bpf_table_type_id(self.bpf.module, self.map_id)
+        @flags = Clib.bpf_table_flags_id(self.bpf.module, self.map_id)
+      else
+        @ttype = case self
+                 when HashTable
+                   Table::BPF_MAP_TYPE_HASH
+                 when ArrayTable
+                   Table::BPF_MAP_TYPE_ARRAY
+                 end
+      end
       @name = name
     end
     attr_reader :bpf, :map_id, :map_fd, :keysize, :keytype, :leafsize, :leaftype, :ttype, :flags, :name
@@ -275,7 +298,7 @@ module RbBCC
         leaf.bcc_value_type = leaftype
         leaf
       when Integer
-        ret = byref(leaf, keysize)
+        ret = byref(leaf, leafsize)
         ret.bcc_value_type = leaftype
         ret
       else
@@ -300,9 +323,9 @@ module RbBCC
   end
 
   class ArrayTable < TableBase
-    def initialize(bpf, map_id, map_fd, keytype, leaftype, name: nil)
+    def initialize(bpf, map_id, map_fd, keytype, leaftype, name: nil, keysize: nil, leafsize: nil)
       super
-      @max_entries = Clib.bpf_table_max_entries_id(bpf.module, map_id)
+      @max_entries = Clib.bpf_table_max_entries_id(bpf.module, map_id) if bpf
     end
 
     # We now emulate the Array class of Ruby

data/lib/rbbcc/version.rb

@@ -1,3 +1,3 @@
 module RbBCC
-  VERSION = "0.11.0"
+  VERSION = "0.11.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rbbcc
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.11.2
 platform: ruby
 authors:
 - Uchio Kondo
@@ -96,6 +96,8 @@ files:
 - examples/mallocstack.rb
 - examples/networking/http_filter/http-parse-simple.c
 - examples/networking/http_filter/http-parse-simple.rb
+- examples/pin_maps_a.rb
+- examples/pin_maps_b.rb
 - examples/py-orig/sockblock.py
 - examples/ruby_usdt.rb
 - examples/sbrk_trace.rb