ruby interpreter: fix latest offsets and execution context discovery (open-telemetry#710)

Co-authored-by: Dale Hamel <dale.hamel@shopify.com>

Author: manuelfelipe

interpreter/apmint/apmint.go

@@ -19,6 +19,7 @@ import (
 	"go.opentelemetry.io/ebpf-profiler/host"
 	"go.opentelemetry.io/ebpf-profiler/interpreter"
 	"go.opentelemetry.io/ebpf-profiler/libpf"
+	"go.opentelemetry.io/ebpf-profiler/libpf/pfelf"
 	"go.opentelemetry.io/ebpf-profiler/libpf/pfunsafe"
 	"go.opentelemetry.io/ebpf-profiler/remotememory"
 	"go.opentelemetry.io/ebpf-profiler/support"
@@ -76,13 +77,18 @@ func Loader(_ interpreter.EbpfHandler, info *interpreter.LoaderInfo) (interprete
 		return nil, fmt.Errorf("process storage export has wrong size %d", procStorageSym.Size)
 	}
 
-	// Resolve thread info TLS export.
-	tlsDescs, err := ef.TLSDescriptors()
-	if err != nil {
-		return nil, errors.New("failed to extract TLS descriptors")
+	var tlsDescElfAddr libpf.Address
+	if err = ef.VisitTLSRelocations(func(r pfelf.ElfReloc, symName string) bool {
+		if symName == tlsExport {
+			tlsDescElfAddr = libpf.Address(r.Off)
+			return false
+		}
+		return true
+	}); err != nil {
+		return nil, errors.New(fmt.Sprintf("failed to visit TLS descriptor: %v", err))
 	}
-	tlsDescElfAddr, ok := tlsDescs[tlsExport]
-	if !ok {
+
+	if tlsDescElfAddr == 0 {
 		return nil, errors.New("failed to locate TLS descriptor")
 	}
 

interpreter/ruby/ruby.go

@@ -26,6 +26,7 @@ import (
 	"go.opentelemetry.io/ebpf-profiler/libpf/pfelf"
 	"go.opentelemetry.io/ebpf-profiler/libpf/pfunsafe"
 	"go.opentelemetry.io/ebpf-profiler/metrics"
+	npsr "go.opentelemetry.io/ebpf-profiler/nopanicslicereader"
 	"go.opentelemetry.io/ebpf-profiler/remotememory"
 	"go.opentelemetry.io/ebpf-profiler/successfailurecounter"
 	"go.opentelemetry.io/ebpf-profiler/support"
@@ -88,6 +89,9 @@ type rubyData struct {
 	// eBPF program to build ruby backtraces.
 	currentCtxPtr libpf.Address
 
+	// Address to the ruby_current_ec variable in TLS, as an offset from tpbase
+	currentEcTpBaseTlsOffset libpf.Address
+
 	// version of the currently used Ruby interpreter.
 	// major*0x10000 + minor*0x100 + release (e.g. 3.0.1 -> 0x30001)
 	version uint32
@@ -176,10 +180,18 @@ func rubyVersion(major, minor, release uint32) uint32 {
 
 func (r *rubyData) Attach(ebpf interpreter.EbpfHandler, pid libpf.PID, bias libpf.Address,
 	rm remotememory.RemoteMemory) (interpreter.Instance, error) {
+
+	var tlsOffset uint64
+	if r.currentEcTpBaseTlsOffset != 0 {
+		// Read TLS offset from the TLS descriptor.
+		tlsOffset = rm.Uint64(bias + r.currentEcTpBaseTlsOffset + 8)
+	}
+
 	cdata := support.RubyProcInfo{
 		Version: r.version,
 
-		Current_ctx_ptr: uint64(r.currentCtxPtr + bias),
+		Current_ctx_ptr:              uint64(r.currentCtxPtr + bias),
+		Current_ec_tpbase_tls_offset: tlsOffset,
 
 		Vm_stack:      r.vmStructs.execution_context_struct.vm_stack,
 		Vm_stack_size: r.vmStructs.execution_context_struct.vm_stack_size,
@@ -289,21 +301,43 @@ func (r *rubyInstance) readPathObjRealPath(addr libpf.Address) (string, error) {
 	flags := r.rm.Ptr(addr)
 	switch flags & rubyTMask {
 	case rubyTString:
-		// nothing to do
+		return r.readRubyString(addr)
 	case rubyTArray:
-		var err error
-		addr, err = r.readRubyArrayDataPtr(addr)
-		if err != nil {
-			return "", err
+		vms := &r.r.vmStructs
+		arrData, e := r.readRubyArrayDataPtr(addr)
+		if e != nil {
+			return "", e
+		}
+
+		// Read contiguous pointer values into a buffer to be more efficient
+		dataBytes := make([]byte, 2 * vms.size_of_value)
+		if err := r.rm.Read(arrData, dataBytes); err != nil {
+			return "", fmt.Errorf("failed to read array data bytes: %v", err)
 		}
 
-		addr += pathObjRealPathIdx * libpf.Address(r.r.vmStructs.size_of_value)
-		addr = r.rm.Ptr(addr) // deref VALUE -> RString object
+		var relTag, absTag uint64
+		relVal := npsr.Ptr(dataBytes, 0)
+		absVal := npsr.Ptr(dataBytes, uint(vms.size_of_value))
+		if absVal != 0 {
+			absTag = uint64(r.rm.Ptr(absVal)) & uint64(rubyTMask)
+		}
+
+		var candidate libpf.Address
+		if absVal != 0 && absTag == uint64(rubyTString) {
+			candidate = absVal
+		} else if relVal != 0 {
+			relTag = uint64(r.rm.Ptr(relVal)) & uint64(rubyTMask)
+			if relTag == uint64(rubyTString) {
+				candidate = relVal
+			}
+		} else {
+			return "", fmt.Errorf("pathobj array has no string entries: relTag=0x%x absTag=0x%x", relTag, absTag)
+		}
+
+		return r.readRubyString(candidate)
 	default:
 		return "", fmt.Errorf("unexpected pathobj type tag: 0x%X", flags&rubyTMask)
 	}
-
-	return r.readRubyString(addr)
 }
 
 // readRubyString extracts a Ruby string from the given addr.
@@ -718,17 +752,18 @@ func Loader(ebpf interpreter.EbpfHandler, info *interpreter.LoaderInfo) (interpr
 	// Reason for lowest supported version:
 	// - Ruby 2.5 is still commonly used at time of writing this code.
 	//   https://www.jetbrains.com/lp/devecosystem-2020/ruby/
-	// Reason for maximum supported version 3.2.x:
+	// Reason for maximum supported version 3.5.x:
 	// - this is currently the newest stable version
-
-	minVer, maxVer := rubyVersion(2, 5, 0), rubyVersion(3, 3, 0)
+	minVer, maxVer := rubyVersion(2, 5, 0), rubyVersion(3, 6, 0)
 	if version < minVer || version >= maxVer {
 		return nil, fmt.Errorf("unsupported Ruby %d.%d.%d (need >= %d.%d.%d and <= %d.%d.%d)",
 			(version>>16)&0xff, (version>>8)&0xff, version&0xff,
 			(minVer>>16)&0xff, (minVer>>8)&0xff, minVer&0xff,
 			(maxVer>>16)&0xff, (maxVer>>8)&0xff, maxVer&0xff)
 	}
 
+	log.Debugf("Ruby %d.%d.%d detected", (version>>16)&0xff, (version>>8)&0xff, version&0xff)
+
 	// Before Ruby 2.5 the symbol ruby_current_thread was used for the current execution
 	// context but got replaced in [0] with ruby_current_execution_context_ptr.
 	// With [1] the Ruby internal execution model changed and the symbol
@@ -740,26 +775,83 @@ func Loader(ebpf interpreter.EbpfHandler, info *interpreter.LoaderInfo) (interpr
 	if version < rubyVersion(3, 0, 0) {
 		currentCtxSymbol = "ruby_current_execution_context_ptr"
 	}
-	currentCtxPtr, err := ef.LookupSymbolAddress(currentCtxSymbol)
-	if err != nil {
-		return nil, fmt.Errorf("%v not found: %v", currentCtxSymbol, err)
-	}
+
+	var currentEcTpBaseTlsOffset libpf.Address
+	var interpRanges []util.Range
 
 	// rb_vm_exec is used to execute the Ruby frames in the Ruby VM and is called within
 	// ruby_run_node  which is the main executor function since Ruby v1.9.0
 	// https://github.com/ruby/ruby/blob/587e6800086764a1b7c959976acef33e230dccc2/main.c#L47
-	symbolName := libpf.SymbolName("rb_vm_exec")
+	interpSymbolName := libpf.SymbolName("rb_vm_exec")
 	if version < rubyVersion(2, 6, 0) {
-		symbolName = libpf.SymbolName("ruby_exec_node")
+		interpSymbolName = libpf.SymbolName("ruby_exec_node")
 	}
-	interpRanges, err := info.GetSymbolAsRanges(symbolName)
+
+	var rubyCurrentEcTlsSymbol = "ruby_current_ec"
+	var currentEcSymbolAddress libpf.SymbolValue
+
+	currentEcSymbolName := libpf.SymbolName(rubyCurrentEcTlsSymbol)
+
+	log.Debugf("Ruby %d.%d.%d detected, looking for currentCtxPtr=%q, currentEcSymbol=%q",
+		(version>>16)&0xff, (version>>8)&0xff, version&0xff, currentCtxSymbol, currentEcSymbolName)
+
+	// Symbol discovery strategy:
+	// - Ruby < 3.0.4: Uses currentCtxPtr (global/ractor-based execution context)
+	// - Ruby >= 3.0.4: Uses currentEcSymbol (TLS-based execution context via ruby_current_ec)
+	// When direct lookup fails, VisitSymbols scans all symbols as fallback.
+	// eBPF selects the appropriate method based on version at runtime.
+	currentCtxPtr, err := ef.LookupSymbolAddress(currentCtxSymbol)
 	if err != nil {
-		return nil, err
+		log.Debugf("Direct lookup of %v failed: %v, will try fallback", currentCtxSymbol, err)
+	}
+
+	interpRanges, err = info.GetSymbolAsRanges(interpSymbolName)
+	if err != nil {
+		log.Debugf("Direct lookup of %v failed: %v, will try fallback", interpSymbolName, err)
+	}
+
+	if err = ef.VisitSymbols(func(s libpf.Symbol) bool {
+		if s.Name == currentEcSymbolName {
+			currentEcSymbolAddress = s.Address
+		}
+		if s.Name == currentCtxSymbol {
+			currentCtxPtr = s.Address
+		}
+		if len(interpRanges) == 0 && s.Name == interpSymbolName {
+			interpRanges = []util.Range{{
+				Start: uint64(s.Address),
+				End:   uint64(s.Address) + s.Size,
+			}}
+		}
+		if len(interpRanges) > 0 && currentEcSymbolAddress != 0 && currentCtxPtr != 0 {
+			return false
+		}
+		return true
+	}); err != nil {
+		log.Warnf("failed to visit symbols: %v", err)
+	}
+
+	// NOTE for ruby 3.3.0+, if ruby is stripped, we have no way of locating
+	// ruby_current_ec TLS symbol.
+	// We could potentially add a fallback for this in the future, but for now
+	// only unstripped ruby is supported. Many distro supplied rubies are stripped.
+	if err = ef.VisitTLSRelocations(func(r pfelf.ElfReloc, symName string) bool {
+		if symName == rubyCurrentEcTlsSymbol ||
+			libpf.SymbolValue(r.Addend) == currentEcSymbolAddress {
+			currentEcTpBaseTlsOffset = libpf.Address(r.Off)
+			return false
+		}
+		return true
+	}); err != nil {
+		log.Warnf("failed to locate TLS descriptor: %v", err)
 	}
 
+	log.Debugf("Discovered EC tls tpbase offset %x, fallback ctx %x, interp ranges: %v", currentEcTpBaseTlsOffset, currentCtxPtr, interpRanges)
+
 	rid := &rubyData{
-		version:       version,
-		currentCtxPtr: libpf.Address(currentCtxPtr),
+		version:            version,
+		currentEcTpBaseTlsOffset:     libpf.Address(currentEcTpBaseTlsOffset),
+		currentCtxPtr:      libpf.Address(currentCtxPtr),
 	}
 
 	vms := &rid.vmStructs
@@ -781,10 +873,14 @@ func Loader(ebpf interpreter.EbpfHandler, info *interpreter.LoaderInfo) (interpr
 		// With Ruby 2.6 the field bp was added to rb_control_frame_t
 		// https://github.com/ruby/ruby/commit/ed935aa5be0e5e6b8d53c3e7d76a9ce395dfa18b
 		vms.control_frame_struct.size_of_control_frame_struct = 56
-	default:
+	case version < rubyVersion(3, 3, 0):
 		// 3.1 adds new jit_return field at the end.
 		// https://github.com/ruby/ruby/commit/9d8cc01b758f9385bd4c806f3daff9719e07faa0
 		vms.control_frame_struct.size_of_control_frame_struct = 64
+	default:
+		// 3.3+ bp field was removed
+		// https://github.com/ruby/ruby/commit/f302e725e10ae05e613e2c24cae0741f65f2db91
+		vms.control_frame_struct.size_of_control_frame_struct = 56
 	}
 	vms.iseq_struct.body = 16
 
@@ -803,11 +899,21 @@ func Loader(ebpf interpreter.EbpfHandler, info *interpreter.LoaderInfo) (interpr
 		vms.iseq_constant_body.insn_info_size = 136
 		vms.iseq_constant_body.succ_index_table = 144
 		vms.iseq_constant_body.size_of_iseq_constant_body = 312
-	default:
+	case version < rubyVersion(3, 3, 0):
 		vms.iseq_constant_body.insn_info_body = 112
 		vms.iseq_constant_body.insn_info_size = 128
 		vms.iseq_constant_body.succ_index_table = 136
 		vms.iseq_constant_body.size_of_iseq_constant_body = 320
+	case version >= rubyVersion(3, 4, 0) && version < rubyVersion(3, 5, 0):
+		vms.iseq_constant_body.insn_info_body = 112
+		vms.iseq_constant_body.insn_info_size = 128
+		vms.iseq_constant_body.succ_index_table = 136
+		vms.iseq_constant_body.size_of_iseq_constant_body = 352
+	default: // 3.3.x and 3.5.x have the same values
+		vms.iseq_constant_body.insn_info_body = 112
+		vms.iseq_constant_body.insn_info_size = 128
+		vms.iseq_constant_body.succ_index_table = 136
+		vms.iseq_constant_body.size_of_iseq_constant_body = 344
 	}
 	vms.iseq_location_struct.pathobj = 0
 	vms.iseq_location_struct.base_label = 8
@@ -854,10 +960,18 @@ func Loader(ebpf interpreter.EbpfHandler, info *interpreter.LoaderInfo) (interpr
 	vms.size_of_value = 8
 
 	if version >= rubyVersion(3, 0, 0) {
-		if runtime.GOARCH == "amd64" {
-			vms.rb_ractor_struct.running_ec = 0x208
+		if version >= rubyVersion(3, 3, 0) {
+			if runtime.GOARCH == "amd64" {
+				vms.rb_ractor_struct.running_ec = 0x180
+			} else {
+				vms.rb_ractor_struct.running_ec = 0x190
+			}
 		} else {
-			vms.rb_ractor_struct.running_ec = 0x218
+			if runtime.GOARCH == "amd64" {
+				vms.rb_ractor_struct.running_ec = 0x208
+			} else {
+				vms.rb_ractor_struct.running_ec = 0x218
+			}
 		}
 	}