rbbcc 0.11.5 → 0.11.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4757d8938ba54c8aaab6d26a1d8cf824c325b8591130d1cf65ee13c0e411e99f
-  data.tar.gz: e41edc20c58336f5aa3e1670f2f001a9cdc829291a8bd63ab53d309790b81f5c
+  metadata.gz: 4bd5c0ae3d72c8e4e931d4ecb48872212c1389dd56897a5c16ca3626a1a7a725
+  data.tar.gz: c117a487cbc4c1b5fed3df4eea8813d4b6c16ea3c6dcd306e41b504fb2776bc3
 SHA512:
-  metadata.gz: 43cb1ba2fa891fc6fd970b5a48b45c28d9fff967e25ef02ed5cb7b09ddc96a91dc0e4740dbc59b9bc78f312613b76f6b7f68de9ee41bf860caddf1fb0a948c15
-  data.tar.gz: e6e8321874553ba7df4f0529477d6bea3a35f4956b704bd32bfeb409d7f43a1a59f4f9484619891e1351ed278eee42c4edda7a17d176c3b911e4c5a1dee5716a
+  metadata.gz: 1c11515d0a7b919ffaa6c0001cc74b96f0bbc217e07fa46c2fe6b37398499a6cb81fac23425e45f32b8802b6b90a6c107f845ef3b610ea7838d8b29178129adc
+  data.tar.gz: 253c500eebc928aa13327496b4cdb96f844a91df06aa5c4bf85561a1958f2c181f792e24262b1ae9d5ac0562796ffb475ae178b2a88a8451f17e50f6c1f7f727

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rbbcc (0.11.5)
+    rbbcc (0.11.6)
       fiddle
 
 GEM

data/examples/ringbuf_pin_a.rb

@@ -0,0 +1,51 @@
+#!/usr/bin/env ruby
+require 'rbbcc'
+include RbBCC
+
+PIN_PATH = "/sys/fs/bpf/pinned_ringbuf"
+
+if File.exist?(PIN_PATH)
+  puts "Removing old pinned map at #{PIN_PATH}..."
+  File.unlink(PIN_PATH)
+end
+
+bpf_text = <<~CLANG
+#include <uapi/linux/ptrace.h>
+
+struct data_t {
+    u32 pid;
+    char comm[16];
+};
+
+BPF_RINGBUF_OUTPUT(events, 4);
+
+int trace_uname(struct pt_regs *ctx) {
+    struct data_t *data = events.ringbuf_reserve(sizeof(struct data_t));
+    if (!data) return 0;
+
+    data->pid = bpf_get_current_pid_tgid() >> 32;
+    bpf_get_current_comm(&data->comm, sizeof(data->comm));
+
+    events.ringbuf_submit(data, 0);
+    return 0;
+}
+CLANG
+
+puts "Process A (Ruby): Loading BPF and attaching tracepoint..."
+b = BCC.new(text: bpf_text)
+b.attach_tracepoint(tp: "syscalls:sys_enter_newuname", fn_name: "trace_uname")
+
+puts "Process A (Ruby): Pinning ringbuf map to #{PIN_PATH}..."
+b["events"].pin!(PIN_PATH)
+
+puts "\n[Process A Active] Kept alive to feed events. Press Ctrl+C to stop."
+begin
+  loop do
+    sleep 1
+  end
+ensure
+  if File.exist?(PIN_PATH)
+    puts "\nUnpinning map..."
+    File.unlink(PIN_PATH)
+  end
+end

data/examples/ringbuf_pin_b.rb

@@ -0,0 +1,29 @@
+#!/usr/bin/env ruby
+require 'rbbcc'
+include RbBCC
+
+PIN_PATH = "/sys/fs/bpf/pinned_ringbuf"
+
+type = "struct data_t {
+    u32 pid;
+    char comm[16];
+};"
+
+puts "Process B (Ruby): Initializing consumer client..."
+buf = RingBuf.from_pin(PIN_PATH, type, 4)
+
+# ring_buffer listner
+buf.open_ring_buffer do |cpu, data, size|
+  event = buf.event(data)
+  puts "[Process B Captured] PID: #{event.pid.to_s.ljust(6)} | COMMAND: #{event.comm}"
+end
+
+puts "\n[Process B Active] Successfully hooked to pinned map (FD: #{buf.map_fd}). Listening for events...\n\n"
+
+begin
+  loop do
+    buf.ring_buffer_poll()
+  end
+rescue Interrupt
+  puts "\nExiting Process B."
+end

data/lib/rbbcc/consts.rb

@@ -1,5 +1,9 @@
 module RbBCC
-  module BPF
+  class BCC
+  end
+  BPF = BCC # avoid confuse from python port
+
+  class BPF
     # From bpf_prog_type in uapi/linux/bpf.h
     SOCKET_FILTER = 1
     KPROBE = 2

data/lib/rbbcc/table.rb

@@ -40,6 +40,8 @@ module RbBCC
           fields << [field_type, field_name].join(" ")
         end
       end
+      return nil if fields.empty?
+
       klass = Fiddle::Importer.struct(fields)
       char_ps = fields.select {|f| f =~ /^char\[(\d+)\] ([_a-zA-Z0-9]+)/ }
       unless char_ps.empty?
@@ -280,6 +282,11 @@ module RbBCC
       false # TODO: implement me in the future
     end
 
+    # Just a wrapper to BCC class method
+    def pin!(path)
+      BCC.pin!(self.map_fd, path)
+    end
+
     private
     def normalize_key(key)
       case key
@@ -368,7 +375,7 @@ module RbBCC
     end
 
     def event(data)
-      @event_class ||= get_event_class
+      @event_class ||= (get_event_class || self.leaftype)
       ev = @event_class.malloc
       Fiddle::Pointer.new(ev.to_ptr)[0, @event_class.size] = data[0, @event_class.size]
       return ev
@@ -429,7 +436,28 @@ module RbBCC
 
   class RingBuf < TableBase
     include EventTypeSupported
-    
+
+    # Make a dynamic BCC program to load the pinned ringbuf map
+    def self.from_pin(path, leaftype, size, name: "events")
+      map_fd = Clib.bpf_obj_get(path)
+      if map_fd < 0
+        raise SystemCallError.new("Could not open pinned map", Fiddle.last_error)
+      end
+      leaftype_typename = case leaftype
+      when /\Astruct\s+(\w+)\s+{/m
+        "struct #{Regexp.last_match(1)}"
+      else
+        leaftype
+      end
+      
+      prog = <<~CLANG
+        #{leaftype}
+        BPF_TABLE_PINNED("ringbuf", u32, #{leaftype_typename}, #{name}, #{size}, "#{path}");
+      CLANG
+      b = BCC.new(text: prog)
+      b[name.to_s]
+    end
+
     def initialize(bpf, map_id, map_fd, keytype, leaftype, name: nil)
       super
       @_ringbuf = nil
@@ -438,7 +466,7 @@ module RbBCC
     end
 
     def event(data)
-      @event_class ||= get_event_class
+      @event_class ||= (get_event_class || self.leaftype)
       ev = @event_class.malloc
       Fiddle::Pointer.new(ev.to_ptr)[0, @event_class.size] = data[0, @event_class.size]
       return ev
@@ -470,6 +498,10 @@ module RbBCC
       @bpf._open_ring_buffer(@map_fd, fn, ctx)
       nil
     end
+
+    def ring_buffer_poll(timeout=-1)
+      @bpf.ring_buffer_poll(timeout)
+    end
   end
 
   class StackTrace < TableBase

data/lib/rbbcc/version.rb

@@ -1,3 +1,3 @@
 module RbBCC
-  VERSION = "0.11.5"
+  VERSION = "0.11.6"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rbbcc
 version: !ruby/object:Gem::Version
-  version: 0.11.5
+  version: 0.11.6
 platform: ruby
 authors:
 - Uchio Kondo
@@ -99,6 +99,8 @@ files:
 - examples/pin_maps_a.rb
 - examples/pin_maps_b.rb
 - examples/py-orig/sockblock.py
+- examples/ringbuf_pin_a.rb
+- examples/ringbuf_pin_b.rb
 - examples/ruby_usdt.rb
 - examples/sbrk_trace.rb
 - examples/ssl_http_trace.rb