后端技术_bpf对内核功能的观测
内核模块编写
1 | // kernel_module.c |
- Makefile
1
2
3
4
5
6obj-m := kernel_module.o
KERNELBUILD := /lib/modules/$(shell uname -r)/build
default:
make -C $(KERNELBUILD) M*(shell pwd) modules - 插入内核
1
2
3
4
5
6
7
8
9
10make
insmod kernel_module.ko # 已经插入成功了
dmsg # 查看printk内容
rmmod kernel_module.ko # 移除模块
dmsg # 查看printk内容
insmod kernel_module.ko debug=1 pid=1144
dmsg
# kernel_module_init
# debug is true
# name: sshd - 上面的模块可以检测到所有进程的信息，但只能工作在内核模块里，想要在应用层进行这种功能的开发需要应用libbpf-bootstrap
libbpf-bootstrap
- bpf可以把代码植入内核，革命性技术，给内核开放以全新的想象空间；
- XDP：基于bpf的一种网络框架；
- dpdk：对网卡做旁路处理，使得网络数据，不走网卡走dpdk；
- 两种bpf通信方式:1.通过变量，2.通过文件
1 | cp hello.bpf.c task.bpf.c # 将examples里面的代码复制一份 |
共同需要的部分
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21// task.h
struct task_vm { // 准备将进程的信息传递出去
unsigned long start_code;
unsigned long end_code;
unsigned long start_data;
unsigned long end_data;
unsigned long start_brk;
unsigned long brk;
unsigned long start_stack;
unsigned long arg_start;
unsigned long arg_end;
unsigned long env_start;
unsigned long env_end;
int pid;
};
struct task_info{
char comm[32];
pid_t pid;
};植入内核的部分
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72// bpftrace/libbpf-bootstrap/examples/c/task.bpf.c
#
#
#
#
#
struct {
__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); // __uint == int(*arg1)[arg2] int指针数组
__uint(key_size, sizeof(u32));
__uint(value_size, sizeof(u32));
} output SEC(".maps");
// 由这个结构体通知到应用程序
// 添加上面这个结构体，会使得生成的task.skel.h多出一段代码
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 1024);
__type(key, pid_t);
__type(value, struct task_info);
__uint(pinning, LIBBPF_PIN_BY_NAME);
} taskcomm SEC(.maps);
// 再添加一个内容
SEC("tracepoint/syscalls/sys_enter_execve")
// 当内核执行sys_enter_execve时就会植入下面的代码
int bpf_prog(void *ctx) {
struct task_struct *task = (struct task_struct *)bpf_get_current_task();
if (!task) return 0;
// char comm[16] = {0};
// bpf_get_current_comm(&comm, sizeof(comm));
int counter = BPF_CORE_READ(task, files, count.counter);
struct task_vm vm;
vm.start_code = BPF_CORE_READ(task, mm, start_code);
vm.end_code = BPF_CORE_READ(task, mm, end_code);
vm.start_data = BPF_CORE_READ(task, mm, start_data);
vm.end_data = BPF_CORE_READ(task, mm, end_data);
vm.start_brk = BPF_CORE_READ(task, mm, start_brk);
vm.brk = BPF_CORE_READ(task, mm, brk);
vm.start_stack = BPF_CORE_READ(task, mm, start_stack);
vm.arg_start = BPF_CORE_READ(task, mm, arg_start);
vm.arg_end = BPF_CORE_READ(task, mm, arg_end);
vm.env_start = BPF_CORE_READ(task, mm, env_start);
vm.env_end = BPF_CORE_READ(task, mm, env_end);
vm.pid = pid;
__bpf_printk(" comm: %s, counter %d\n", &comm, counter);
bpf_perf_event_output(ctx, &output, BPF_F_CURRENT_CPU, &vm, sizeof(vm)); // 这里执行完后会向.maps结构体抛一个事件
__u64 id = bpf_get_current_pid_tgid();
pid_t pid = id >> 32; // 固定规则
struct task_info info = {0};
bpf_get_current_comm(&info.comm, sizeof(info.comm));
info.pid = pid;
bpf_map_update_elem(&taskcomm, &pid, &info, BPF_ANY); // 这里会在/sys/fs/bpf下面创建一个taskcomm文件，然后存储该数据
return 0;
}
char LICENSE[] SEC("license") = "Dual BSD/GPL";应用程序的代码（获得植入内核的部分得到的数据），实现内核与应用程序的通信
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99// bpftrace/libbpf-bootstrap/examples/c/task.c
#
#
#
#
#
#
#
static int libbpf_print_fn(enum libbpf_print_level level, const char *format, va_list args)
{
return vfprintf(stderr, format, args);
}
void task_handle_event(void *ctx, int cpu, void *data, __u32 size){
// 数据 从 data 里传过来了
// char *comm = data;
// printf("task_handle_event : %s\n", comm);
struct task_vm *vm = data;
int count = sizeof(struct task_vm) / sizeof(unsigned long);
int i;
for(i = 0; i < count; i++){
printf("addr : 0x%lx\n", *(unsigned long*)((char*)vm+i*sizeof(unsigned long)));
}
// 从taskcomm文件中取出更多数据
int taskMap = bpf_obj_get("/sys/fs/bpf/taskcomm");
if(taskMap < 0)
{
return;
}
struct task_info info;
int err = bpf_map_lookup_elem(taskMap, &vm->pid, &info);
if(err != 0){
return;
}
printf("comm : %s, pid :%d \n", info.comm, info.pid);
}
void task_lost_event(void *ctx, int cpu, __u64 cnt){
}
int main(int argc, char **argv)
{
struct task_bpf *skel;
int err;
libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
/* Set up libbpf errors and debug info callback */
libbpf_set_print(libbpf_print_fn);
/* Open BPF application */
skel = task_bpf__open();
if (!skel) {
fprintf(stderr, "Failed to open BPF skeleton\n");
return 1;
}
/* Load & verify BPF programs */
err = task_bpf__load(skel);
if (err) {
fprintf(stderr, "Failed to load and verify BPF skeleton\n");
goto cleanup;
}
err = task_bpf__attach(skel);
if (err) {
fprintf(stderr, "Failed to attach BPF skeleton\n");
goto cleanup;
}
/**
printf("Successfully started! Please run `sudo cat /sys/kernel/debug/tracing/trace_pipe` "
"to see output of the BPF programs.\n");
for (;;) {
// trigger our BPF program
fprintf(stderr, ".");
sleep(1);
}
**/
int mapfd = bpf_map__fd(skel->maps.output); // 这样就能获得通知产生的结构体
struct perf_buffer *pb = perf_buffer__new(mapfd, 8, task_handle_event, task_lost_event, NULL, NULL);
if(!pb)
{
goto cleanup;
}
while(1){
perf_buffer__poll(pb, 1000); // 1000 timeout没有触发事件
}
perf_buffer__free(pb);
cleanup:
task_bpf__destroy(skel);
return -err;
}