mirror of
https://github.com/eunomia-bpf/bpf-developer-tutorial.git
synced 2026-02-04 02:34:16 +08:00
add full index
This commit is contained in:
yunwei37
@@ -1,18 +1,20 @@
|
||||
# eBPF 入门开发实践指南一：介绍与快速上手
|
||||
# eBPF 入门开发实践指南一：介绍 eBPF 的基本概念、常见的开发工具
|
||||
|
||||
<!-- TOC -->
|
||||
|
||||
- [1. 什么是eBPF](#1-什么是ebpf)
|
||||
- [1.1. 起源](#11-起源)
|
||||
- [1.2. 执行逻辑](#12-执行逻辑)
|
||||
- [1.3. 架构](#13-架构)
|
||||
- [1.3.1. 寄存器设计](#131-寄存器设计)
|
||||
- [1.3.2. 指令编码格式](#132-指令编码格式)
|
||||
- [1.4. 本节参考文章](#14-本节参考文章)
|
||||
- [2. 如何使用eBPF编程](#2-如何使用ebpf编程)
|
||||
- [2.1. BCC](#21-bcc)
|
||||
- [2.2. libbpf-bootstrap](#22-libbpf-bootstrap)
|
||||
- [2.3 eunomia-bpf](#23-eunomia-bpf)
|
||||
- [eBPF 入门开发实践指南一：介绍 eBPF 的基本概念、常见的开发工具](#ebpf-入门开发实践指南一介绍-ebpf-的基本概念常见的开发工具)
|
||||
- [1. 什么是eBPF](#1-什么是ebpf)
|
||||
- [1.1. 起源](#11-起源)
|
||||
- [1.2. 执行逻辑](#12-执行逻辑)
|
||||
- [1.3. 架构](#13-架构)
|
||||
- [1.3.1. 寄存器设计](#131-寄存器设计)
|
||||
- [1.3.2. 指令编码格式](#132-指令编码格式)
|
||||
- [1.4. 本节参考文章](#14-本节参考文章)
|
||||
- [2. 如何使用eBPF编程](#2-如何使用ebpf编程)
|
||||
- [2.1. BCC](#21-bcc)
|
||||
- [2.2. libbpf-bootstrap](#22-libbpf-bootstrap)
|
||||
- [2.3 eunomia-bpf](#23-eunomia-bpf)
|
||||
- [参考资料](#参考资料)
|
||||
|
||||
<!-- /TOC -->
|
||||
|
||||
@@ -1,4 +1,34 @@
|
||||
# eBPF 入门开发实践指南二：Hello World，基本框架和开发流程
|
||||
|
||||
eBPF (Extended Berkeley Packet Filter) 是 Linux 内核上的一个强大的网络和性能分析工具。它允许开发者在内核运行时动态加载、更新和运行用户定义的代码。
|
||||
|
||||
本文是 eBPF 入门开发实践指南的第二篇，主要介绍 eBPF 的基本框架和开发流程。
|
||||
|
||||
## Hello World - minimal eBPF program
|
||||
|
||||
```c
|
||||
/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
|
||||
#define BPF_NO_GLOBAL_DATA
|
||||
#include <linux/bpf.h>
|
||||
#include <bpf/bpf_helpers.h>
|
||||
#include <bpf/bpf_tracing.h>
|
||||
|
||||
typedef unsigned int u32;
|
||||
typedef int pid_t;
|
||||
const pid_t pid_filter = 0;
|
||||
|
||||
char LICENSE[] SEC("license") = "Dual BSD/GPL";
|
||||
|
||||
SEC("tp/syscalls/sys_enter_write")
|
||||
int handle_tp(void *ctx)
|
||||
{
|
||||
pid_t pid = bpf_get_current_pid_tgid() >> 32;
|
||||
if (pid_filter && pid != pid_filter)
|
||||
return 0;
|
||||
bpf_printk("BPF triggered from PID %d.\n", pid);
|
||||
return 0;
|
||||
}
|
||||
```
|
||||
|
||||
`minimal` is just that – a minimal practical BPF application example. It
|
||||
doesn't use or require BPF CO-RE, so should run on quite old kernels. It
|
||||
@@ -23,7 +53,7 @@ $ sudo cat /sys/kernel/debug/tracing/trace_pipe
|
||||
`minimal` is great as a bare-bones experimental playground to quickly try out
|
||||
new ideas or BPF features.
|
||||
|
||||
## Compile and Run
|
||||
## Compile and Run with eunomia-bpf
|
||||
|
||||
|
||||
|
||||
@@ -45,4 +75,4 @@ Run:
|
||||
|
||||
```console
|
||||
sudo ecli ./package.json
|
||||
```
|
||||
```
|
||||
|
||||
0
10-hardirqs/README.md
Normal file
0
10-hardirqs/README.md
Normal file
16
10-hardirqs/hardirq.h
Normal file
16
10-hardirqs/hardirq.h
Normal file
@@ -0,0 +1,16 @@
|
||||
/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
|
||||
#ifndef __HARDIRQS_H
|
||||
#define __HARDIRQS_H
|
||||
|
||||
#define MAX_SLOTS 20
|
||||
|
||||
struct irq_key {
|
||||
char name[32];
|
||||
};
|
||||
|
||||
struct info {
|
||||
__u64 count;
|
||||
__u32 slots[MAX_SLOTS];
|
||||
};
|
||||
|
||||
#endif /* __HARDIRQS_H */
|
||||
130
10-hardirqs/hardirqs.bpf.c
Normal file
130
10-hardirqs/hardirqs.bpf.c
Normal file
@@ -0,0 +1,130 @@
|
||||
// SPDX-License-Identifier: GPL-2.0
|
||||
// Copyright (c) 2020 Wenbo Zhang
|
||||
#include <vmlinux.h>
|
||||
#include <bpf/bpf_core_read.h>
|
||||
#include <bpf/bpf_helpers.h>
|
||||
#include <bpf/bpf_tracing.h>
|
||||
#include "hardirqs.h"
|
||||
#include "bits.bpf.h"
|
||||
#include "maps.bpf.h"
|
||||
|
||||
#define MAX_ENTRIES 256
|
||||
|
||||
const volatile bool filter_cg = false;
|
||||
const volatile bool targ_dist = false;
|
||||
const volatile bool targ_ns = false;
|
||||
const volatile bool do_count = false;
|
||||
|
||||
struct {
|
||||
__uint(type, BPF_MAP_TYPE_CGROUP_ARRAY);
|
||||
__type(key, u32);
|
||||
__type(value, u32);
|
||||
__uint(max_entries, 1);
|
||||
} cgroup_map SEC(".maps");
|
||||
|
||||
struct {
|
||||
__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
|
||||
__uint(max_entries, 1);
|
||||
__type(key, u32);
|
||||
__type(value, u64);
|
||||
} start SEC(".maps");
|
||||
|
||||
struct {
|
||||
__uint(type, BPF_MAP_TYPE_HASH);
|
||||
__uint(max_entries, MAX_ENTRIES);
|
||||
__type(key, struct irq_key);
|
||||
__type(value, struct info);
|
||||
} infos SEC(".maps");
|
||||
|
||||
static struct info zero;
|
||||
|
||||
static int handle_entry(int irq, struct irqaction *action)
|
||||
{
|
||||
if (filter_cg && !bpf_current_task_under_cgroup(&cgroup_map, 0))
|
||||
return 0;
|
||||
|
||||
if (do_count) {
|
||||
struct irq_key key = {};
|
||||
struct info *info;
|
||||
|
||||
bpf_probe_read_kernel_str(&key.name, sizeof(key.name), BPF_CORE_READ(action, name));
|
||||
info = bpf_map_lookup_or_try_init(&infos, &key, &zero);
|
||||
if (!info)
|
||||
return 0;
|
||||
info->count += 1;
|
||||
return 0;
|
||||
} else {
|
||||
u64 ts = bpf_ktime_get_ns();
|
||||
u32 key = 0;
|
||||
|
||||
if (filter_cg && !bpf_current_task_under_cgroup(&cgroup_map, 0))
|
||||
return 0;
|
||||
|
||||
bpf_map_update_elem(&start, &key, &ts, BPF_ANY);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
static int handle_exit(int irq, struct irqaction *action)
|
||||
{
|
||||
struct irq_key ikey = {};
|
||||
struct info *info;
|
||||
u32 key = 0;
|
||||
u64 delta;
|
||||
u64 *tsp;
|
||||
|
||||
if (filter_cg && !bpf_current_task_under_cgroup(&cgroup_map, 0))
|
||||
return 0;
|
||||
|
||||
tsp = bpf_map_lookup_elem(&start, &key);
|
||||
if (!tsp)
|
||||
return 0;
|
||||
|
||||
delta = bpf_ktime_get_ns() - *tsp;
|
||||
if (!targ_ns)
|
||||
delta /= 1000U;
|
||||
|
||||
bpf_probe_read_kernel_str(&ikey.name, sizeof(ikey.name), BPF_CORE_READ(action, name));
|
||||
info = bpf_map_lookup_or_try_init(&infos, &ikey, &zero);
|
||||
if (!info)
|
||||
return 0;
|
||||
|
||||
if (!targ_dist) {
|
||||
info->count += delta;
|
||||
} else {
|
||||
u64 slot;
|
||||
|
||||
slot = log2(delta);
|
||||
if (slot >= MAX_SLOTS)
|
||||
slot = MAX_SLOTS - 1;
|
||||
info->slots[slot]++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
SEC("tp_btf/irq_handler_entry")
|
||||
int BPF_PROG(irq_handler_entry_btf, int irq, struct irqaction *action)
|
||||
{
|
||||
return handle_entry(irq, action);
|
||||
}
|
||||
|
||||
SEC("tp_btf/irq_handler_exit")
|
||||
int BPF_PROG(irq_handler_exit_btf, int irq, struct irqaction *action)
|
||||
{
|
||||
return handle_exit(irq, action);
|
||||
}
|
||||
|
||||
SEC("raw_tp/irq_handler_entry")
|
||||
int BPF_PROG(irq_handler_entry, int irq, struct irqaction *action)
|
||||
{
|
||||
return handle_entry(irq, action);
|
||||
}
|
||||
|
||||
SEC("raw_tp/irq_handler_exit")
|
||||
int BPF_PROG(irq_handler_exit, int irq, struct irqaction *action)
|
||||
{
|
||||
return handle_exit(irq, action);
|
||||
}
|
||||
|
||||
char LICENSE[] SEC("license") = "GPL";
|
||||
3
12-bindsnoop/.gitignore
vendored
3
12-bindsnoop/.gitignore
vendored
@@ -1,3 +0,0 @@
|
||||
.vscode
|
||||
package.json
|
||||
ecli
|
||||
@@ -1,106 +0,0 @@
|
||||
---
|
||||
layout: post
|
||||
title: bindsnoop
|
||||
date: 2022-10-10 16:18
|
||||
category: bpftools
|
||||
author: yunwei37
|
||||
tags: [bpftools, syscall, kprobe, perf-event]
|
||||
summary: This tool traces the kernel function performing socket binding and print socket options set before the system call.
|
||||
---
|
||||
|
||||
## origin
|
||||
|
||||
origin from:
|
||||
|
||||
https://github.com/iovisor/bcc/blob/master/libbpf-tools/bindsnoop.bpf.c
|
||||
|
||||
## Compile and Run
|
||||
|
||||
Compile:
|
||||
|
||||
```shell
|
||||
docker run -it -v `pwd`/:/src/ yunwei37/ebpm:latest
|
||||
```
|
||||
|
||||
Run:
|
||||
|
||||
```shell
|
||||
sudo ./ecli run examples/bpftools/bindsnoop/package.json
|
||||
```
|
||||
|
||||
## details in bcc
|
||||
|
||||
Demonstrations of bindsnoop, the Linux eBPF/bcc version.
|
||||
|
||||
This tool traces the kernel function performing socket binding and
|
||||
print socket options set before the system call invocation that might
|
||||
```console
|
||||
impact bind behavior and bound interface:
|
||||
SOL_IP IP_FREEBIND F....
|
||||
SOL_IP IP_TRANSPARENT .T...
|
||||
SOL_IP IP_BIND_ADDRESS_NO_PORT ..N..
|
||||
SOL_SOCKET SO_REUSEADDR ...R.
|
||||
SOL_SOCKET SO_REUSEPORT ....r
|
||||
```
|
||||
```console
|
||||
# ./bindsnoop.py
|
||||
Tracing binds ... Hit Ctrl-C to end
|
||||
PID COMM PROT ADDR PORT OPTS IF
|
||||
3941081 test_bind_op TCP 192.168.1.102 0 F.N.. 0
|
||||
3940194 dig TCP :: 62087 ..... 0
|
||||
3940219 dig UDP :: 48665 ..... 0
|
||||
3940893 Acceptor Thr TCP :: 35343 ...R. 0
|
||||
```
|
||||
The output shows four bind system calls:
|
||||
two "test_bind_op" instances, one with IP_FREEBIND and IP_BIND_ADDRESS_NO_PORT
|
||||
options, dig process called bind for TCP and UDP sockets,
|
||||
and Acceptor called bind for TCP with SO_REUSEADDR option set.
|
||||
|
||||
|
||||
The -t option prints a timestamp column
|
||||
```console
|
||||
# ./bindsnoop.py -t
|
||||
TIME(s) PID COMM PROT ADDR PORT OPTS IF
|
||||
0.000000 3956801 dig TCP :: 49611 ..... 0
|
||||
0.011045 3956822 dig UDP :: 56343 ..... 0
|
||||
2.310629 3956498 test_bind_op TCP 192.168.1.102 39609 F...r 0
|
||||
```
|
||||
|
||||
The -U option prints a UID column:
|
||||
```console
|
||||
# ./bindsnoop.py -U
|
||||
Tracing binds ... Hit Ctrl-C to end
|
||||
UID PID COMM PROT ADDR PORT OPTS IF
|
||||
127072 3956498 test_bind_op TCP 192.168.1.102 44491 F...r 0
|
||||
127072 3960261 Acceptor Thr TCP :: 48869 ...R. 0
|
||||
0 3960729 Acceptor Thr TCP :: 44637 ...R. 0
|
||||
0 3959075 chef-client UDP :: 61722 ..... 0
|
||||
```
|
||||
|
||||
The -u option filtering UID:
|
||||
```console
|
||||
# ./bindsnoop.py -Uu 0
|
||||
Tracing binds ... Hit Ctrl-C to end
|
||||
UID PID COMM PROT ADDR PORT OPTS IF
|
||||
0 3966330 Acceptor Thr TCP :: 39319 ...R. 0
|
||||
0 3968044 python3.7 TCP ::1 59371 ..... 0
|
||||
0 10224 fetch TCP 0.0.0.0 42091 ...R. 0
|
||||
```
|
||||
|
||||
The --cgroupmap option filters based on a cgroup set.
|
||||
It is meant to be used with an externally created map.
|
||||
```console
|
||||
# ./bindsnoop.py --cgroupmap /sys/fs/bpf/test01
|
||||
```
|
||||
For more details, see docs/special_filtering.md
|
||||
|
||||
|
||||
In order to track heavy bind usage one can use --count option
|
||||
```console
|
||||
# ./bindsnoop.py --count
|
||||
Tracing binds ... Hit Ctrl-C to end
|
||||
LADDR LPORT BINDS
|
||||
0.0.0.0 6771 4
|
||||
0.0.0.0 4433 4
|
||||
127.0.0.1 33665 1
|
||||
```
|
||||
@@ -1,151 +0,0 @@
|
||||
/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
|
||||
/* Copyright (c) 2021 Hengqi Chen */
|
||||
#include <vmlinux.h>
|
||||
#include <bpf/bpf_helpers.h>
|
||||
#include <bpf/bpf_core_read.h>
|
||||
#include <bpf/bpf_tracing.h>
|
||||
#include <bpf/bpf_endian.h>
|
||||
#include "bindsnoop.bpf.h"
|
||||
|
||||
#define MAX_ENTRIES 10240
|
||||
#define MAX_PORTS 1024
|
||||
|
||||
const volatile bool filter_cg = false;
|
||||
const volatile pid_t target_pid = 0;
|
||||
const volatile bool ignore_errors = true;
|
||||
const volatile bool filter_by_port = false;
|
||||
|
||||
struct {
|
||||
__uint(type, BPF_MAP_TYPE_CGROUP_ARRAY);
|
||||
__type(key, u32);
|
||||
__type(value, u32);
|
||||
__uint(max_entries, 1);
|
||||
} cgroup_map SEC(".maps");
|
||||
|
||||
struct {
|
||||
__uint(type, BPF_MAP_TYPE_HASH);
|
||||
__uint(max_entries, MAX_ENTRIES);
|
||||
__type(key, __u32);
|
||||
__type(value, struct socket *);
|
||||
} sockets SEC(".maps");
|
||||
|
||||
struct {
|
||||
__uint(type, BPF_MAP_TYPE_HASH);
|
||||
__uint(max_entries, MAX_PORTS);
|
||||
__type(key, __u16);
|
||||
__type(value, __u16);
|
||||
} ports SEC(".maps");
|
||||
|
||||
struct {
|
||||
__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
|
||||
__uint(key_size, sizeof(__u32));
|
||||
__uint(value_size, sizeof(__u32));
|
||||
} events SEC(".maps");
|
||||
|
||||
static int probe_entry(struct pt_regs *ctx, struct socket *socket)
|
||||
{
|
||||
__u64 pid_tgid = bpf_get_current_pid_tgid();
|
||||
__u32 pid = pid_tgid >> 32;
|
||||
__u32 tid = (__u32)pid_tgid;
|
||||
|
||||
if (target_pid && target_pid != pid)
|
||||
return 0;
|
||||
|
||||
bpf_map_update_elem(&sockets, &tid, &socket, BPF_ANY);
|
||||
return 0;
|
||||
};
|
||||
|
||||
static int probe_exit(struct pt_regs *ctx, short ver)
|
||||
{
|
||||
__u64 pid_tgid = bpf_get_current_pid_tgid();
|
||||
__u32 pid = pid_tgid >> 32;
|
||||
__u32 tid = (__u32)pid_tgid;
|
||||
struct socket **socketp, *socket;
|
||||
struct inet_sock *inet_sock;
|
||||
struct sock *sock;
|
||||
union bind_options opts;
|
||||
struct bind_event event = {};
|
||||
__u16 sport = 0, *port;
|
||||
int ret;
|
||||
|
||||
socketp = bpf_map_lookup_elem(&sockets, &tid);
|
||||
if (!socketp)
|
||||
return 0;
|
||||
|
||||
ret = PT_REGS_RC(ctx);
|
||||
if (ignore_errors && ret != 0)
|
||||
goto cleanup;
|
||||
|
||||
socket = *socketp;
|
||||
sock = BPF_CORE_READ(socket, sk);
|
||||
inet_sock = (struct inet_sock *)sock;
|
||||
|
||||
sport = bpf_ntohs(BPF_CORE_READ(inet_sock, inet_sport));
|
||||
port = bpf_map_lookup_elem(&ports, &sport);
|
||||
if (filter_by_port && !port)
|
||||
goto cleanup;
|
||||
|
||||
opts.fields.freebind = BPF_CORE_READ_BITFIELD_PROBED(inet_sock, freebind);
|
||||
opts.fields.transparent = BPF_CORE_READ_BITFIELD_PROBED(inet_sock, transparent);
|
||||
opts.fields.bind_address_no_port = BPF_CORE_READ_BITFIELD_PROBED(inet_sock, bind_address_no_port);
|
||||
opts.fields.reuseaddress = BPF_CORE_READ_BITFIELD_PROBED(sock, __sk_common.skc_reuse);
|
||||
opts.fields.reuseport = BPF_CORE_READ_BITFIELD_PROBED(sock, __sk_common.skc_reuseport);
|
||||
event.opts = opts.data;
|
||||
event.ts_us = bpf_ktime_get_ns() / 1000;
|
||||
event.pid = pid;
|
||||
event.port = sport;
|
||||
event.bound_dev_if = BPF_CORE_READ(sock, __sk_common.skc_bound_dev_if);
|
||||
event.ret = ret;
|
||||
event.proto = BPF_CORE_READ_BITFIELD_PROBED(sock, sk_protocol);
|
||||
bpf_get_current_comm(&event.task, sizeof(event.task));
|
||||
if (ver == 4) {
|
||||
event.ver = ver;
|
||||
bpf_probe_read_kernel(&event.addr, sizeof(event.addr), &inet_sock->inet_saddr);
|
||||
} else { /* ver == 6 */
|
||||
event.ver = ver;
|
||||
bpf_probe_read_kernel(&event.addr, sizeof(event.addr), sock->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
|
||||
}
|
||||
bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &event, sizeof(event));
|
||||
|
||||
cleanup:
|
||||
bpf_map_delete_elem(&sockets, &tid);
|
||||
return 0;
|
||||
}
|
||||
|
||||
SEC("kprobe/inet_bind")
|
||||
int BPF_KPROBE(ipv4_bind_entry, struct socket *socket)
|
||||
{
|
||||
if (filter_cg && !bpf_current_task_under_cgroup(&cgroup_map, 0))
|
||||
return 0;
|
||||
|
||||
return probe_entry(ctx, socket);
|
||||
}
|
||||
|
||||
SEC("kretprobe/inet_bind")
|
||||
int BPF_KRETPROBE(ipv4_bind_exit)
|
||||
{
|
||||
if (filter_cg && !bpf_current_task_under_cgroup(&cgroup_map, 0))
|
||||
return 0;
|
||||
|
||||
return probe_exit(ctx, 4);
|
||||
}
|
||||
|
||||
SEC("kprobe/inet6_bind")
|
||||
int BPF_KPROBE(ipv6_bind_entry, struct socket *socket)
|
||||
{
|
||||
if (filter_cg && !bpf_current_task_under_cgroup(&cgroup_map, 0))
|
||||
return 0;
|
||||
|
||||
return probe_entry(ctx, socket);
|
||||
}
|
||||
|
||||
SEC("kretprobe/inet6_bind")
|
||||
int BPF_KRETPROBE(ipv6_bind_exit)
|
||||
{
|
||||
if (filter_cg && !bpf_current_task_under_cgroup(&cgroup_map, 0))
|
||||
return 0;
|
||||
|
||||
return probe_exit(ctx, 6);
|
||||
}
|
||||
|
||||
char LICENSE[] SEC("license") = "Dual BSD/GPL";
|
||||
@@ -1,31 +0,0 @@
|
||||
/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
|
||||
#ifndef __BINDSNOOP_H
|
||||
#define __BINDSNOOP_H
|
||||
|
||||
#define TASK_COMM_LEN 16
|
||||
|
||||
struct bind_event {
|
||||
unsigned __int128 addr;
|
||||
unsigned long long ts_us;
|
||||
unsigned int pid;
|
||||
unsigned int bound_dev_if;
|
||||
int ret;
|
||||
unsigned short port;
|
||||
unsigned short proto;
|
||||
unsigned char opts;
|
||||
unsigned char ver;
|
||||
char task[TASK_COMM_LEN];
|
||||
};
|
||||
|
||||
union bind_options {
|
||||
unsigned char data;
|
||||
struct {
|
||||
unsigned char freebind : 1;
|
||||
unsigned char transparent : 1;
|
||||
unsigned char bind_address_no_port : 1;
|
||||
unsigned char reuseaddress : 1;
|
||||
unsigned char reuseport : 1;
|
||||
} fields;
|
||||
};
|
||||
|
||||
#endif /* __BINDSNOOP_H */
|
||||
@@ -1,95 +0,0 @@
|
||||
## eBPF 入门实践教程：编写 eBPF 程序 Bindsnoopn 监控 socket 端口绑定事件
|
||||
|
||||
### 背景
|
||||
|
||||
Bindsnoop 会跟踪操作 socket 端口绑定的内核函数，并且在可能会影响端口绑定的系统调用发生之前，打印
|
||||
现有的 socket 选项。
|
||||
|
||||
### 实现原理
|
||||
|
||||
Bindsnoop 通过kprobe实现。其主要挂载点为 inet_bind 和 inet6_bind。inet_bind 为处理 IPV4 类型
|
||||
socket 端口绑定系统调用的接口，inet6_bind 为处理IPV6类型 socket 端口绑定系统调用的接口。
|
||||
|
||||
```c
|
||||
SEC("kprobe/inet_bind")
|
||||
int BPF_KPROBE(ipv4_bind_entry, struct socket *socket)
|
||||
{
|
||||
if (filter_cg && !bpf_current_task_under_cgroup(&cgroup_map, 0))
|
||||
return 0;
|
||||
|
||||
return probe_entry(ctx, socket);
|
||||
}
|
||||
SEC("kretprobe/inet_bind")
|
||||
|
||||
int BPF_KRETPROBE(ipv4_bind_exit)
|
||||
{
|
||||
if (filter_cg && !bpf_current_task_under_cgroup(&cgroup_map, 0))
|
||||
return 0;
|
||||
|
||||
return probe_exit(ctx, 4);
|
||||
}
|
||||
|
||||
SEC("kprobe/inet6_bind")
|
||||
int BPF_KPROBE(ipv6_bind_entry, struct socket *socket)
|
||||
{
|
||||
if (filter_cg && !bpf_current_task_under_cgroup(&cgroup_map, 0))
|
||||
return 0;
|
||||
|
||||
return probe_entry(ctx, socket);
|
||||
}
|
||||
|
||||
SEC("kretprobe/inet6_bind")
|
||||
int BPF_KRETPROBE(ipv6_bind_exit)
|
||||
{
|
||||
if (filter_cg && !bpf_current_task_under_cgroup(&cgroup_map, 0))
|
||||
return 0;
|
||||
|
||||
return probe_exit(ctx, 6);
|
||||
}
|
||||
```
|
||||
|
||||
当系统试图进行socket端口绑定操作时, kprobe挂载的处理函数会被触发。在进入绑定函数时，`probe_entry`会先被
|
||||
调用，它会以 tid 为主键将 socket 信息存入 map 中。
|
||||
|
||||
```c
|
||||
static int probe_entry(struct pt_regs *ctx, struct socket *socket)
|
||||
{
|
||||
__u64 pid_tgid = bpf_get_current_pid_tgid();
|
||||
__u32 pid = pid_tgid >> 32;
|
||||
__u32 tid = (__u32)pid_tgid;
|
||||
|
||||
if (target_pid && target_pid != pid)
|
||||
return 0;
|
||||
|
||||
bpf_map_update_elem(&sockets, &tid, &socket, BPF_ANY);
|
||||
return 0;
|
||||
};
|
||||
```
|
||||
在执行完绑定函数后，`probe_exit`函数会被调用。该函数会读取tid对应的socket信息，将其和其他信息一起
|
||||
写入 event 结构体并输出到用户态。
|
||||
|
||||
```c
|
||||
struct bind_event {
|
||||
unsigned __int128 addr;
|
||||
__u64 ts_us;
|
||||
__u32 pid;
|
||||
__u32 bound_dev_if;
|
||||
int ret;
|
||||
__u16 port;
|
||||
__u16 proto;
|
||||
__u8 opts;
|
||||
__u8 ver;
|
||||
char task[TASK_COMM_LEN];
|
||||
};
|
||||
```
|
||||
|
||||
当用户停止该工具时，其用户态代码会读取存入的数据并按要求打印。
|
||||
|
||||
### Eunomia中使用方式
|
||||
|
||||
|
||||
|
||||
|
||||
### 总结
|
||||
|
||||
Bindsnoop 通过 kprobe 挂载点，实现了对 socket 端口的监视，增强了 Eunomia 的应用范围。
|
||||
0
21-tc/.gitignore → 20-tc/.gitignore
vendored
0
21-tc/.gitignore → 20-tc/.gitignore
vendored
0
21-xdp/README.md
Normal file
0
21-xdp/README.md
Normal file
31
9-runqlat/bits.bpf copy.h
Normal file
31
9-runqlat/bits.bpf copy.h
Normal file
@@ -0,0 +1,31 @@
|
||||
/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
|
||||
#ifndef __BITS_BPF_H
|
||||
#define __BITS_BPF_H
|
||||
|
||||
#define READ_ONCE(x) (*(volatile typeof(x) *)&(x))
|
||||
#define WRITE_ONCE(x, val) ((*(volatile typeof(x) *)&(x)) = val)
|
||||
|
||||
static __always_inline u64 log2(u32 v)
|
||||
{
|
||||
u32 shift, r;
|
||||
|
||||
r = (v > 0xFFFF) << 4; v >>= r;
|
||||
shift = (v > 0xFF) << 3; v >>= shift; r |= shift;
|
||||
shift = (v > 0xF) << 2; v >>= shift; r |= shift;
|
||||
shift = (v > 0x3) << 1; v >>= shift; r |= shift;
|
||||
r |= (v >> 1);
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
static __always_inline u64 log2l(u64 v)
|
||||
{
|
||||
u32 hi = v >> 32;
|
||||
|
||||
if (hi)
|
||||
return log2(hi) + 32;
|
||||
else
|
||||
return log2(v);
|
||||
}
|
||||
|
||||
#endif /* __BITS_BPF_H */
|
||||
26
9-runqlat/maps.bpf copy.h
Normal file
26
9-runqlat/maps.bpf copy.h
Normal file
@@ -0,0 +1,26 @@
|
||||
// SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
|
||||
// Copyright (c) 2020 Anton Protopopov
|
||||
#ifndef __MAPS_BPF_H
|
||||
#define __MAPS_BPF_H
|
||||
|
||||
#include <bpf/bpf_helpers.h>
|
||||
#include <asm-generic/errno.h>
|
||||
|
||||
static __always_inline void *
|
||||
bpf_map_lookup_or_try_init(void *map, const void *key, const void *init)
|
||||
{
|
||||
void *val;
|
||||
long err;
|
||||
|
||||
val = bpf_map_lookup_elem(map, key);
|
||||
if (val)
|
||||
return val;
|
||||
|
||||
err = bpf_map_update_elem(map, key, init, BPF_NOEXIST);
|
||||
if (err && err != -EEXIST)
|
||||
return 0;
|
||||
|
||||
return bpf_map_lookup_elem(map, key);
|
||||
}
|
||||
|
||||
#endif /* __MAPS_BPF_H */
|
||||
48
README.md
48
README.md
@@ -4,30 +4,34 @@
|
||||
|
||||
在学习 eBPF 的过程中，我们受到了 [tutorial_bcc_python_developer](https://github.com/iovisor/bcc/blob/master/docs/tutorial_bcc_python_developer.md) 的许多启发和帮助，但从 2022 年的角度出发，使用 libbpf 开发 eBPF 的应用是目前相对更好的选择。但目前似乎很少有基于 libbpf 和 BPF CO-RE 出发的、通过案例和工具介绍 eBPF 开发的教程，因此我们发起了这个项目。
|
||||
|
||||
本项目主要基于 [libbpf-boostrap](https://github.com/libbpf/libbpf-bootstrap) 和 [eunomia-bpf](https://github.com/eunomia-bpf/eunomia-bpf) 两个框架完成，并使用 eunomia-bpf 帮助简化一部分 eBPF 用户态代码的编写。
|
||||
|
||||
教程主要关注于可观察性，并简要介绍了 eBPF 的其他应用。
|
||||
|
||||
## 目录
|
||||
|
||||
- [lesson 0-introduce](0-introduce/introduce.md) 介绍 eBPF 的基本概念和常见的开发工具
|
||||
- [lesson 1-helloworld](1-helloworld/README.md) 演示如何使用 eBPF 开发最简单的「Hello World」程序，介绍 eBPF 的基本框架和开发流程
|
||||
- [lesson 2-fentry-unlink](2-fentry-unlink/README.md) 基于 eBPF 的 fentry hook，演示了如何捕获并记录 unlink 系统调用
|
||||
- [lesson 3-kprobe-unlink](3-kprobe-unlink/README.md) 基于 eBPF 的 kprobe hook，演示了如何捕获并记录 unlink 系统调用
|
||||
- [lesson 4-opensnoop](4-opensnoop/README.md)
|
||||
- [lesson 5-uprobe-bashreadline](5-uprobe-bashreadline/README.md)
|
||||
- [lesson 6-sigsnoop](6-sigsnoop/README.md)
|
||||
- [lesson 7-execsnoop](7-execsnoop/README.md)
|
||||
- [lesson 8-runqslower](8-runqslower/README.md)
|
||||
- [lesson 9-runqlat](9-runqlat/README.md)
|
||||
- [lesson 10-hardirqs](20-hardirqs/README.md)
|
||||
- [lesson 11-llcstat](21-llcstat/README.md)
|
||||
- [lesson 12-bindsnoop](12-bindsnoop/README.md)
|
||||
- [lesson 13-tcpconnlat](13-tcpconnlat/README.md)
|
||||
- [lesson 14-tcpstates](14-tcpstates/README.md)
|
||||
- [lesson 15-tcprtt](15-tcprtt/README.md)
|
||||
- [lesson 16-profile](16-profile/README.md)
|
||||
- [lesson 17-memleak](17-memleak/README.md)
|
||||
- [lesson 18-biopattern](18-biopattern/README.md)
|
||||
- [lesson 19-syscount](19-syscount/README.md)
|
||||
- [lesson 20-lsm-connect](20-lsm-connect/README.md)
|
||||
- [lesson 21-tc](21-tc/README.md)
|
||||
- [lesson 0-introduce](0-introduce/README.md) 介绍 eBPF 的基本概念和常见的开发工具
|
||||
- [lesson 1-helloworld](1-helloworld/README.md) 使用 eBPF 开发最简单的「Hello World」程序，介绍 eBPF 的基本框架和开发流程
|
||||
- [lesson 2-fentry-unlink](2-fentry-unlink/README.md) 在 eBPF 中使用 fentry 捕获 unlink 系统调用
|
||||
- [lesson 3-kprobe-unlink](3-kprobe-unlink/README.md) 在 eBPF 中使用 kprobe 捕获 unlink 系统调用
|
||||
- [lesson 4-opensnoop](4-opensnoop/README.md) 捕获进程打开文件的系统调用集合，使用全局变量在 eBPF 中过滤进程 pid
|
||||
- [lesson 5-uprobe-bashreadline](5-uprobe-bashreadline/README.md) 使用 uprobe 捕获 bash 的 readline 函数调用
|
||||
- [lesson 6-sigsnoop](6-sigsnoop/README.md) 捕获进程发送信号的系统调用集合，使用 hash map 保存状态
|
||||
- [lesson 7-execsnoop](7-execsnoop/README.md) 捕获进程执行/退出时间，通过 perf event array 向用户态打印输出
|
||||
- [lesson 8-runqslower](8-runqslower/README.md) 捕获进程调度事件，使用 ring buffer 向用户态打印输出
|
||||
- [lesson 9-runqlat](9-runqlat/README.md) 捕获进程调度延迟，以直方图方式记录
|
||||
- [lesson 10-hardirqs](20-hardirqs/README.md) 使用 hardirqs 或 softirqs 捕获中断事件
|
||||
- [lesson 11-llcstat](21-llcstat/README.md) 通过 PID 统计 cache references and misses
|
||||
- [lesson 12-profile](12-profile/README.md) 使用 eBPF 进行性能分析
|
||||
- [lesson 13-tcpconnlat](13-tcpconnlat/README.md) 记录 TCP 连接延迟
|
||||
- [lesson 14-tcpstates](14-tcpstates/README.md) 记录 TCP 连接状态
|
||||
- [lesson 15-tcprtt](15-tcprtt/README.md) 以直方图方式记录 TCP RTT
|
||||
- [lesson 16-memleak](16-memleak/README.md) 检测内存泄漏
|
||||
- [lesson 17-biopattern](17-biopattern/README.md) 捕获磁盘 IO 模式
|
||||
- [lesson 18-further-reading](18-further-reading/README.md) 更进一步的相关资料？
|
||||
- [lesson 19-lsm-connect](19-lsm-connect/README.md) 使用 LSM 进行安全检测防御
|
||||
- [lesson 20-tc](20-tc/README.md) 使用 eBPF 进行 tc 流量控制
|
||||
- [lesson 21-xdp](20-xdp/README.md) 使用 eBPF 进行 XDP 报文处理
|
||||
|
||||
## 为什么需要基于 libbpf 和 BPF CO-RE 的教程？
|
||||
|
||||
|
||||
Reference in New Issue
Block a user