【eBPF-03】进阶：BCC 框架中 BPF 映射的应用 v1.0

from bcc import BPF
from bcc.utils import printb
from time import strftime

# define BPF program
bpf_text = """
#include <uapi/linux/ptrace.h>
#include <linux/sched.h>

struct val_t {
	u32 pid;
	int sig;
	int tpid;
	char comm[TASK_COMM_LEN];
};

struct data_t {
	u32 pid;
	int tpid;
	int sig;
	int ret;
	char comm[TASK_COMM_LEN];
};
// 定义 BPF_HASH 名称为 infotmp，key 类型为 u32，val 类型为 struct val_t
BPF_HASH(infotmp, u32, struct val_t);
BPF_PERF_OUTPUT(events);

int syscall__kill(struct pt_regs *ctx, int tpid, int sig) {
	u64 pid_tgid = bpf_get_current_pid_tgid();
	u32 pid = pid_tgid >> 32;
	u32 tid = (u32)pid_tgid;

	struct val_t val = {.pid = pid};
	if (bpf_get_current_comm(&val.comm, sizeof(val.comm)) == 0) {
		val.tpid = tpid;
		val.sig = sig;
		infotmp.update(&tid, &val);		// 根据 (key, val) 更新 BPF_HASH
	}

	return 0;
};

int do_ret_sys_kill(struct pt_regs *ctx) {
	struct data_t data = {};
	struct val_t *valp;
	u64 pid_tgid = bpf_get_current_pid_tgid();
	u32 pid = pid_tgid >> 32;
	u32 tid = (u32)pid_tgid;

	valp = infotmp.lookup(&tid);		// 根据 key 查找 BPF_HASH
	if (valp == 0) {
		// missed entry
		return 0;
	}

	bpf_probe_read_kernel(&data.comm, sizeof(data.comm), valp->comm);
	data.pid = pid;
	data.tpid = valp->tpid;
	data.ret = PT_REGS_RC(ctx);
	data.sig = valp->sig;

	events.perf_submit(ctx, &data, sizeof(data));
	infotmp.delete(&tid);		// 根据 key 删除 BPF_HASH 记录

	return 0;
}
"""
# initialize BPF
b = BPF(text=bpf_text)
kill_fnname = b.get_syscall_fnname("kill")
b.attach_kprobe(event=kill_fnname, fn_name="syscall__kill")
b.attach_kretprobe(event=kill_fnname, fn_name="do_ret_sys_kill")
# header
print("%-9s %-16s %-16s %-4s %-16s %s" % ("TIME", "PID", "COMM", "SIG",  "TPID", "RESULT"))

# process event
def print_event(cpu, data, size):
    event = b["events"].event(data)
    printb(b"%-9s %-16d %-16s %-4d %-16d %d" % (strftime("%H:%M:%S").encode('ascii'), event.pid, event.comm, event.sig, event.tpid, event.ret))

# loop with callback to print_event
b["events"].open_perf_buffer(print_event)
while 1:
    try:
        b.perf_buffer_poll()
    except KeyboardInterrupt:
        exit()

#!/usr/bin/python3
from bcc import BPF
from time import sleep, strftime

# define BPF program
bpf_text = """
#include <uapi/linux/ptrace.h>
#include <linux/blkdev.h>
// the key for the output summary
struct info_t {
	unsigned long inode;
	dev_t dev;
	dev_t rdev;
	u32 pid;
	u32 name_len;
	char comm[TASK_COMM_LEN];		// 进程名
	// de->d_name.name may point to de->d_iname so limit len accordingly
	char name[DNAME_INLINE_LEN];		// 文件名
	char type;
};
// the value of the output summary
struct val_t {
	u64 reads;
	u64 writes;
	u64 rbytes;
	u64 wbytes;
};
BPF_HASH(counts, struct info_t, struct val_t);		// 定义 HASH 表，key 和 val 均为一个结构体

static int do_entry(struct pt_regs *ctx, struct file *file, char __user *buf, size_t count, int is_read) {
	u32 tgid = bpf_get_current_pid_tgid() >> 32;
	u32 pid = bpf_get_current_pid_tgid();

	// skip I/O lacking a filename
	struct dentry *de = file->f_path.dentry;
	int mode = file->f_inode->i_mode;
	struct qstr d_name = de->d_name;
	if (d_name.len == 0)
		return 0;

	// store counts and sizes by pid & file
	struct info_t info = {
		.pid = pid,
		.inode = file->f_inode->i_ino,
		.dev = file->f_inode->i_sb->s_dev,
		.rdev = file->f_inode->i_rdev,
	};
	bpf_get_current_comm(&info.comm, sizeof(info.comm));
	info.name_len = d_name.len;
	bpf_probe_read_kernel(&info.name, sizeof(info.name), d_name.name);
	// 区分操作的类型
	if (S_ISREG(mode)) {
		info.type = 'R';
	} else if (S_ISSOCK(mode)) {
		info.type = 'S';
	} else {
		info.type = 'O';
	}

	struct val_t *valp, zero = {};
	valp = counts.lookup_or_try_init(&info, &zero);		// 内核态尝试获取指定 key 的 val，若 val == NULL，则赋予一个默认值
	if (valp) {
		if (is_read) {
			valp->reads++;
			valp->rbytes += count;
		} else {
			valp->writes++;
			valp->wbytes += count;
		}
	}
	return 0;
}

int trace_read_entry(struct pt_regs *ctx, struct file *file, char __user *buf, size_t count) {
	return do_entry(ctx, file, buf, count, 1);
}

int trace_write_entry(struct pt_regs *ctx, struct file *file, char __user *buf, size_t count) {
	return do_entry(ctx, file, buf, count, 0);
}
"""

# initialize BPF
b = BPF(text=bpf_text)
b.attach_kprobe(event="vfs_read", fn_name="trace_read_entry")
b.attach_kprobe(event="vfs_write", fn_name="trace_write_entry")

# check whether hash table batch ops is supported
htab_batch_ops = True if BPF.kernel_struct_has_field(b'bpf_map_ops', b'map_lookup_and_delete_batch') == 1 else False
DNAME_INLINE_LEN = 32  # linux/dcache.h
interval = 1
exiting = 0

def sort_fn(counts):
	return (counts[1].rbytes + counts[1].wbytes + counts[1].reads + counts[1].writes)

while 1:
	try:
		sleep(interval)
	except KeyboardInterrupt:
		exit()

	print('Tracing... Output every %d secs. Hit Ctrl-C to end' % interval)
	print("%-7s %-16s %-6s %-6s %-7s %-7s %1s %s" % ("TID", "COMM", "READS", "WRITES", "R_Kb", "W_Kb", "T", "FILE"))

	# 用户态获取 BPF_HASH
	counts = b.get_table("counts")
	# 这里遍历整个 BPF_HASH
	for k, v in reversed(sorted(counts.items_lookup_and_delete_batch()
                                if htab_batch_ops else counts.items(),
                                key=sort_fn)):
		name = k.name.decode('utf-8', 'replace')
		if k.name_len > DNAME_INLINE_LEN:
			name = name[:-3] + "..."

        # print line
		print("%-7d %-16s %-6d %-6d %-7d %-7d %1s %s" % (k.pid,
			k.comm.decode('utf-8', 'replace'), v.reads, v.writes,
			v.rbytes / 1024, v.wbytes / 1024,
			k.type.decode('utf-8', 'replace'), name))
	# 用户态清空 BPF_HASH
	if not htab_batch_ops:
		counts.clear()

#!/usr/bin/python3
from bcc import BPF
from ctypes import *

bpf_text = '''
struct user_msg_t {
	char message[12];
};

BPF_HASH(config, u32, struct user_msg_t);
BPF_PERF_OUTPUT(events);

struct data_t {
	int pid;
	int uid;
	char command[16];
	char message[12];
};

int check_user(void *ctx) {
	struct data_t data = {};
	struct user_msg_t *p;
	char message[12] = "Hello World";

	data.pid = bpf_get_current_pid_tgid() >> 32;
	data.uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
	bpf_get_current_comm(&data.command, sizeof(data.command));

	p = config.lookup(&data.uid);
	if (p != 0) {
		bpf_probe_read_kernel(&data.message, sizeof(data.message), p->message);
	} else {
		bpf_probe_read_kernel(&data.message, sizeof(data.message), message);
	}

	events.perf_submit(ctx, &data, sizeof(data));
	return 0;
}
'''

# initialize BPF
b = BPF(text=bpf_text)
execve_fnname = b.get_syscall_fnname("execve")
b.attach_kprobe(event=execve_fnname, fn_name="check_user")
# 用户态获取 HASH
config = b.get_table("config")
# 用户态修改 HASH
config[c_int(0)] = create_string_buffer(b"Hello, Root!")
config[c_int(1000)] = create_string_buffer(b"Hello, User 501!")

print("%-10s %-10s %-16s %s" % ("PID", "UID", "COMM", "MSG"))
def print_event(cpu, data, size):
	event = b["events"].event(data)
	print("%-10d %-10d %-16s %s" % (event.pid, event.uid, event.command.decode('utf-8'), event.message.decode('utf-8')))

b["events"].open_perf_buffer(print_event)
while 1:
	try:
		b.perf_buffer_poll()
	except KeyboardInterrupt:
		exit()

#!/usr/bin/python3
from bcc import BPF
from ctypes import c_int
from time import sleep, strftime

# load BPF program
b = BPF(text="""
#include <uapi/linux/ptrace.h>
enum stat_types {
	S_COUNT = 1,
	S_MAXSTAT
};
BPF_ARRAY(stats, u64, S_MAXSTAT);		// 创建 ARRAY，名称为 stats，val 的类型为 u64，val 的最大数量为 S_MAXSTAT = 2

static void stats_increment(int key) {
	stats.atomic_increment(key);		// 索引为 key 的 val 原子自增操作
}

void do_count(struct pt_regs *ctx) { stats_increment(S_COUNT); }
""")
b.attach_kprobe(event="sched_fork", fn_name="do_count")

# stat indexes
S_COUNT = c_int(1)
interval = 1		# 打印周期

# header
print("Tracing... Ctrl-C to end.")
# output
while (1):
	try:
		sleep(interval)
	except KeyboardInterrupt:
		exit()

	print("%s: PIDs/sec: %d" % (strftime("%H:%M:%S"),
		b["stats"][S_COUNT].value))
	b["stats"].clear()

from bcc import BPF
from time import sleep

bpf_src = '''
#include <uapi/linux/ptrace.h>
BPF_HASH(start, u32);
BPF_HISTOGRAM(dist);		// 创建一个直方图映射，名称为 dist

int do_entry(struct pt_regs *ctx) {
	u32 pid;
	u64 ts;
	pid = bpf_get_current_pid_tgid();
	ts = bpf_ktime_get_ns();
	start.update(&pid, &ts);
	return 0;
}
int do_return(struct pt_regs *ctx) {
	u32 pid;
	u64 *tsp, delta;
	pid = bpf_get_current_pid_tgid();
	tsp = start.lookup(&pid);
	if (tsp != 0) {
		delta = bpf_ktime_get_ns() - *tsp;
		dist.increment(bpf_log2l(delta / 1000));	// 修改直方图数据，key 为 bpf_log2l(delta / 1000)，即 千分之差值的 2 的对数
		start.delete(&pid);
	}
	return 0;
}
'''
# load BPF program
b = BPF(text = bpf_src)
b.attach_kprobe(event="vfs_read", fn_name="do_entry")
b.attach_kretprobe(event="vfs_read", fn_name="do_return")
# header
print("Tracing... Hit Ctrl-C to end.")

interval = 5
count = -1
loop = 0
while (1):
	if count > 0:
		loop += 1
		if loop > count:
			exit()
	try:
		sleep(interval)
	except KeyboardInterrupt:
		pass; exit()

	print()
	b["dist"].print_log2_hist("usecs")		# 打印直方图
	b["dist"].clear()

from __future__ import print_function
from bcc import BPF
import argparse
import time

parser = argparse.ArgumentParser(
	description="Trace and print kernel stack traces for a kernel function",
	formatter_class=argparse.RawDescriptionHelpFormatter)
parser.add_argument("function", help="kernel function name")

function = parser.parse_args().function
offset = False

# define BPF program
bpf_text = """
#include <uapi/linux/ptrace.h>
#include <linux/sched.h>

struct data_t {
	u64 stack_id;
	u32 pid;
	char comm[TASK_COMM_LEN];
};
BPF_STACK_TRACE(stack_traces, 128);		// 定义跟踪栈
BPF_PERF_OUTPUT(events);

void trace_stack(struct pt_regs *ctx) {
	u32 pid = bpf_get_current_pid_tgid() >> 32;
	struct data_t data = {};
	data.stack_id = stack_traces.get_stackid(ctx, 0);		遍历通过 ctx 找到的堆栈，返回它的唯一 ID
	data.pid = pid;
	bpf_get_current_comm(&data.comm, sizeof(data.comm));
	events.perf_submit(ctx, &data, sizeof(data));
}
"""
# initialize BPF
b = BPF(text=bpf_text)
b.attach_kprobe(event=function, fn_name="trace_stack")

TASK_COMM_LEN = 16  # linux/sched.h

matched = b.num_open_kprobes()		# 判断输入的 function 是否合法
if matched == 0:
	print("Function \"%s\" not found. Exiting." % function)
	exit()

stack_traces = b.get_table("stack_traces")		# 获取跟踪栈
start_ts = time.time()

# header
print("%-18s %-12s %-6s %-3s %s" % ("TIME(s)", "COMM", "PID", "CPU", "FUNCTION"))

def print_event(cpu, data, size):
	event = b["events"].event(data)
	ts = time.time() - start_ts
	print("%-18.9f %-12.12s %-6d %-3d %s" % (ts, event.comm.decode('utf-8', 'replace'), event.pid, cpu, function))

	for addr in stack_traces.walk(event.stack_id):		# 根据 stack.id 遍历堆栈
		sym = b.ksym(addr, show_offset=offset).decode('utf-8', 'replace')		# 将一个内核地址翻译成内核函数名
		print("\t%s" % sym)

	print()

b["events"].open_perf_buffer(print_event)
while 1:
	try:
		b.perf_buffer_poll()
	except KeyboardInterrupt:
		exit()