varun-r-mallya/python-bpf
1
0
Fork 0
mirror of https://github.com/varun-r-mallya/Python-BPF.git synced 2025-12-31 21:06:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

add ringbuf map type

Browse Source
This commit is contained in:
varun-r-mallya
2025-10-01 23:51:18 +05:30
parent 8ceb1d1ac3
commit da9df2e6bf
3 changed files with 114 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
tests/c-form/ringbuf.bpf.c
View File

@ -1,30 +1,51 @@
#include "vmlinux.h"
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>
#include <linux/types.h>
// Define the structure to be sent via ringbuf
struct event {
__u32 pid;
__u32 uid;
__u64 timestamp;
char comm[16]; // Process name
};
// Define the ringbuffer map
struct {
__uint(type, BPF_MAP_TYPE_RINGBUF);
__uint(max_entries, 1 << 24); // 16 MB
} rb SEC(".maps");
__uint(max_entries, 256 * 1024); // 256 KB
} events SEC(".maps");
//struct msg {
// u32 pid;
// char comm[16];
//};
// Tracepoint for execve system calls
SEC("tracepoint/syscalls/sys_enter_execve")
int trace_execve(void *ctx)
{
struct event *e;
__u64 pid_tgid;
__u64 uid_gid;
//SEC("tracepoint/syscalls/sys_enter_execve")
//int handle_execve(struct trace_event_raw_sys_enter *ctx)
//{
// struct msg *m;
// m = bpf_ringbuf_reserve(&rb, sizeof(*m), 0);
// if (!m)
// return 0;
//
// m->pid = bpf_get_current_pid_tgid() >> 32;
// bpf_get_current_comm(&m->comm, sizeof(m->comm));
// bpf_ringbuf_submit(m, 0);
// return 0;
//}
// Reserve space in the ringbuffer
e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
if (!e)
return 0;
//char LICENSE[] SEC("license") = "GPL";
// Fill the struct with data
pid_tgid = bpf_get_current_pid_tgid();
e->pid = pid_tgid >> 32;
uid_gid = bpf_get_current_uid_gid();
e->uid = uid_gid & 0xFFFFFFFF;
e->timestamp = bpf_ktime_get_ns();
bpf_get_current_comm(&e->comm, sizeof(e->comm));
// Submit the event to ringbuffer
bpf_ringbuf_submit(e, 0);
return 0;
}
char LICENSE[] SEC("license") = "GPL";