{"id":113049,"date":"2024-01-22T17:28:02","date_gmt":"2024-01-22T15:28:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-bpftime-razvivaet-realizacziyu-ebpf-rabotayushhuyu-v-prostranstve-polzovatelya"},"modified":"2024-01-22T17:28:02","modified_gmt":"2024-01-22T15:28:04","slug":"proekt-bpftime-razvivaet-realizacziyu-ebpf-rabotayushhuyu-v-prostranstve-polzovatelya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/proekt-bpftime-razvivaet-realizacziyu-ebpf-rabotayushhuyu-v-prostranstve-polzovatelya","title":{"rendered":"O projeto bpftime desenvolve a implementa\u00e7\u00e3o do eBPF, funcionando no espa\u00e7o do usu\u00e1rio.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Apresentado o projeto bpftime, que desenvolve runtime e m\u00e1quina virtual para executar manipuladores eBPF no espa\u00e7o do usu\u00e1rio. O bpftime permite a execu\u00e7\u00e3o completa de programas eBPF de rastreamento e interfer\u00eancia nos processos, utilizando recursos como uprobe e intercepta\u00e7\u00e3o de chamadas de sistema. Destaca-se que, ao eliminar mudan\u00e7as de contexto desnecess\u00e1rias, o bpftime possibilita uma redu\u00e7\u00e3o de dez vezes nas sobrecargas em compara\u00e7\u00e3o com a funcionalidade uprobe e uretprobe fornecida pelo n\u00facleo do Linux. Al\u00e9m disso, o bpftime simplifica significativamente a depura\u00e7\u00e3o, podendo ser aplicado em sistemas sem n\u00facleo do Linux e n\u00e3o requer permiss\u00f5es elevadas necess\u00e1rias para carregar aplica\u00e7\u00f5es eBPF no n\u00facleo. O c\u00f3digo do projeto \u00e9 escrito em C\/C++ e \u00e9 distribu\u00eddo sob a licen\u00e7a MIT. <\/p>\n

A intercepta\u00e7\u00e3o de chamadas de sistema e a integra\u00e7\u00e3o de verifica\u00e7\u00f5es uprobe s\u00e3o implementadas utilizando a t\u00e9cnica de reescrita de c\u00f3digo execut\u00e1vel (binary rewriting), onde as chamadas de sistema, pontos de entrada e fun\u00e7\u00f5es locais s\u00e3o substitu\u00eddos por saltos para manipuladores de depura\u00e7\u00e3o atrav\u00e9s da modifica\u00e7\u00e3o do c\u00f3digo de m\u00e1quina da aplica\u00e7\u00e3o em execu\u00e7\u00e3o, o que \u00e9 consideravelmente mais eficiente do que a organiza\u00e7\u00e3o de intercepta\u00e7\u00e3o utilizando uprobe no n\u00edvel do n\u00facleo Linux. <\/p>\n

S\u00e3o suportadas opera\u00e7\u00f5es de substitui\u00e7\u00e3o ou altera\u00e7\u00e3o de fun\u00e7\u00f5es, anexa\u00e7\u00e3o de manipuladores (hooks) e filtros, redirecionamento, bloqueio ou substitui\u00e7\u00e3o de par\u00e2metros de chamadas de sistema, intercepta\u00e7\u00e3o de pontos de entrada e sa\u00edda de fun\u00e7\u00f5es, assim como a substitui\u00e7\u00e3o de manipuladores em qualquer deslocamento no c\u00f3digo. O bpftime pode ser anexado a qualquer processo em execu\u00e7\u00e3o no sistema sem a necessidade de reiniciar ou recompilar. A inser\u00e7\u00e3o do bpftime em processos pode ser realizada para processos em execu\u00e7\u00e3o atrav\u00e9s do ptrace, e para processos carregados atrav\u00e9s do LD_PRELOAD. <\/p>\n

Dentro do bpftime, est\u00e1 em desenvolvimento um runtime que permite anexar programas eBPF a pontos de rastreamento de chamadas de sistema e uprobe; m\u00e1quina virtual<\/a> eBPF com JIT para execu\u00e7\u00e3o isolada de programas eBPF no n\u00edvel do processo do usu\u00e1rio (suporte adicional para compila\u00e7\u00e3o AOT); um processo em segundo plano para interagir com o n\u00facleo e organizar a compatibilidade com o subsistema uprobe do n\u00facleo (bpftime suporta o modo de carregar eBPF no espa\u00e7o do usu\u00e1rio a partir do n\u00facleo para trabalhar em conjunto com programas eBPF no n\u00facleo, utilizados, por exemplo, para processamento de kprobe ou para aplicar filtros de rede). <\/p>\n

A m\u00e1quina virtual eBPF \u00e9 estruturada como uma biblioteca plug\u00e1vel e fornece uma API semelhante ao ubpf, permitindo sua utiliza\u00e7\u00e3o para integrar funcionalidades eBPF em outros projetos. Para agrega\u00e7\u00e3o de dados de v\u00e1rios processos, \u00e9 suportada a cria\u00e7\u00e3o de eBPF Maps compartilhados, alocados na mem\u00f3ria compartilhada. Juntamente com bpftime, podem ser utilizados manipuladores eBPF padr\u00e3o, escritos para uso no n\u00facleo, e ferramentas padr\u00e3o baseadas em clang e libbpf podem ser aplicadas para compila\u00e7\u00e3o. <\/p>\n

Com bpftime no espa\u00e7o do usu\u00e1rio, podem ser executados sistemas de rastreamento como BCC, bpftrace e Deepflow. Por exemplo, foi demonstrado o uso do script sslsniff do framework BCC para an\u00e1lise e armazenamento de tr\u00e1fego criptografado em nginx. Nos testes realizados, o desempenho do nginx ao executar sslsniff no lado do n\u00facleo diminui em 58%, enquanto a execu\u00e7\u00e3o do manipulador no espa\u00e7o do usu\u00e1rio reduz em 12,3%. <\/p>\n

Arquitetura de rastreamento de processos com uso do eBPF original no n\u00facleo:

\"O<\/center> <\/p>\n

Arquitetura de rastreamento no espa\u00e7o do usu\u00e1rio utilizando bpftime:

\"O<\/center> <\/p>\n

Modo h\u00edbrido, onde bpftime opera juntamente com eBPF no n\u00facleo, por exemplo, para estabelecer filtros de rede ou deslocar manipuladores espec\u00edficos para o espa\u00e7o do usu\u00e1rio:

\"O<\/center> <\/p>\n

Entre os planos futuros, destaca-se: a possibilidade de inje\u00e7\u00e3o de falhas (Fault Injection); a sobreposi\u00e7\u00e3o de patches (Hot Patching) para alterar a l\u00f3gica de opera\u00e7\u00e3o ou corrigir erros em compila\u00e7\u00f5es bin\u00e1rias; cria\u00e7\u00e3o de um m\u00f3dulo para Nginx, permitindo a constru\u00e7\u00e3o de extens\u00f5es usando programas eBPF (por exemplo, para sele\u00e7\u00e3o din\u00e2mica de rotas, cache, aplica\u00e7\u00e3o de pol\u00edticas de seguran\u00e7a e balanceamento de carga); amplia\u00e7\u00e3o das capacidades do subsistema FUSE (por exemplo, a cria\u00e7\u00e3o de extens\u00f5es em forma de programas eBPF para cache ou controle de acesso).
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u043f\u0440\u043e\u0435\u043a\u0442 bpftime, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 runtime \u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u043c\u0430\u0448\u0438\u043d\u0443 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 eBPF \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. Bpftime \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0446\u0435\u043b\u0438\u043a\u043e\u043c \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f eBPF-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438 \u0438 \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0442\u0430\u043a\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438, \u043a\u0430\u043a uprobe \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u043e\u0432. \u041e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u043b\u0438\u0448\u043d\u0438\u0445 \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0430 bpftime \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0434\u0435\u0441\u044f\u0442\u0438\u043a\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u043d\u0430\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0434\u043e\u0432 \u043f\u043e \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":113050,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113049","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47O projeto bpftime desenvolve a implementa\u00e7\u00e3o do eBPF, funcionando no espa\u00e7o do usu\u00e1rio | ProHoster","description":"Apresentado o projeto bpftime, que desenvolve um runtime e uma m\u00e1quina virtual para executar manipuladores eBPF no espa\u00e7o do usu\u00e1rio.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/proekt-bpftime-razvivaet-realizacziyu-ebpf-rabotayushhuyu-v-prostranstve-polzovatelya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0435\u043a\u0442 bpftime \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e eBPF, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0443\u044e \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u043f\u0440\u043e\u0435\u043a\u0442 bpftime, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 runtime \u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u043c\u0430\u0448\u0438\u043d\u0443 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 eBPF \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/proekt-bpftime-razvivaet-realizacziyu-ebpf-rabotayushhuyu-v-prostranstve-polzovatelya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-22T15:28:04+00:00","article:modified_time":"2024-01-22T15:28:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/113049","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=113049"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/113049\/revisions"}],"predecessor-version":[{"id":164070,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/113049\/revisions\/164070"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/113050"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=113049"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=113049"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=113049"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}