ืืขืื, ืืืืจ! ืืืจ ืืืืื ืืืื ืืืืืืืื ืื ืืืจ ืืจืืืื ืืื ื ืืื ืคืืจ ืืจืืืกืืขืืืด.".
ืืื ื ืื BPF ืืืืจืืืขื ืืึทืฉืื ืืืื ืฆื ืืืืึทืืื ืืื ืืื ืึทืงืืืืืื ืืขื ืืฆื ืืื ืคืืจ, ืืืจ ืืึธืื ืืืืขืจืืขืืขืฆื ืคึฟืึทืจ ืืืจ ืึทื ืึทืจืืืงื ืืืึธืก ืืืกืงืจืืืื ืืืึทื ืืืืคึผื ืงืืืคึผืึทืืืืึทืืื ืืื ืงืจืึทื ื ืฉืืึทื.
ืืื ืื ืืขืฆืืข ืืึธืจื, ืคึผืจืึธืืจืึทืืืื ื ืืืฉืืจืื ืืื ืืขืงื ืืงืก ืืึธืื ืืืขืจื ืื ืงืจืืกืื ืืื ืคืึธืืงืก ืฆื ืคืึทืจืืืืืงื ืื ืืืืืืืืฉืึทื ื ืคืื ืื ืืื ืืงืก ืงืขืจื ืืื ืงืึทืกืขืก ืืื ืืืื-ืคืึธืจืฉืืขืืื ื ืคึผืึทืงืึทื ืคึผืจืึทืกืขืกืื ื ืืื ืคืืจืืื ืื. ืืืื ืขืจ ืคืื ืื ืืขืจืกื ืคืึธืืงืก ืืขืงื ืืงืก ืคืื ืืขื ืืื ืืื ืืขืจืืคื ืงืขืจื ืืืืคึผืึทืก (ืงืขืจื ืขื ืืืืคึผืึทืก) ืืื ืึทืืึทืื, ืืืืคึผืึทืกืื ื ืื ืงืขืจื ื ืขืฅ ืฉืืืืข, ืฆื ืืืจืืคืืจื ืึทืืข ืคึผืึทืงืึทื ืคึผืจืึทืกืขืกืื ื ืคึฟืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ. ืืืืคึผืึทืกืื ื ืื ืงืขืจื ืืืื ืื ืืืึทืืืื ืงืึทื ืืจืึธืืืื ื ืื ื ืขืฅ ืงืึธืจื ืคึฟืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ. ืืื ืื ืืขืจืข ืืืขืจืืขืจ, ืืืขื ืืจืืขืื ืืื ืึท ื ืขืฅ ืงืึธืจื, ืืืจ ืคืึทืจืืึธืื ืืื ืื ืฉืึธืคืขืจ ืืึทื ืืฆืขืจ ืคึผืืึทืฅ.
ืืืจื ืืจืึทื ืกืคืขืจืื ื ืคืื ืงืึธื ืืจืึธื ืคืื ืื ื ืขืฅ ืงืึธืจื ืฆื ืึท ืืึทื ืืฆืขืจ-ืคึผืืึทืฅ ืคึผืจืึธืืจืึทื, ืืืจ ืจืขืืืฆืืจื ืงืขืจื ืขื ืึธืืืืขืจืืขื (ืงืึธื ืืขืงืกื ืกืืืืืฉืื ื, ื ืขืฅ ืฉืืืืข ืคึผืจืึทืกืขืกืื ื, ืื ืืขืจืึทืคึผืฅ, ืืื"ื ื), ืืืึธืก ืืื ืืึทื ืฅ ืืืืืืืง ืืืขื ืคืืืกื ืืืง ืืื ืกืคึผืืื ืคืื 10 ืื / s ืึธืืขืจ ืืขืืขืจ. ืงืขืจื ืขื ืืืืคึผืึทืก ืคึผืืืก ืึท ืงืึธืืืื ืึทืฆืืข ืคืื โโโโืื ืืขืจืข ืคึฟืขืึดืงืืืื (ืคึผืขืงื ืคึผืจืึทืกืขืกืื ื) ืืื ืึธืคึผืืขืืื ืคืึธืจืฉืืขืืื ื ืืื ืื ื (NUMA ืึทืงืึทืื ืืื ื, ืงืคึผื ืืคืืขืืื ืืขืจืืงืืื, ืืื"ื ื) ืฉืืืืขื ืฆื ืื ืคืึทื ืืึทืืขื ืืึทืื ืคืื ืืืื-ืคืึธืจืฉืืขืืื ื ื ืขืฅ ืคึผืจืึทืกืขืกืื ื ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ. ืืึธืืขืจ ืึท ืืืืขืืคึผืืขืจื ืืืึทืฉืคึผืื ืคืื ืืขื ื ืืึทืข ืฆืืืึทื ื ืฆื ืคึผืึทืงืึทื ืคึผืจืึทืกืขืกืื ื ืืื ืคึฟืื ืื ืืขื (ืืึทืืึท ืคึผืืืื ืื ืืืืืงืืื ื ืงืื), ืืึธืืฉ ืขืก ืืขื ืขื ืื ืืขืจืข ืืึทืืืืกื ืืืฉืืจืื ืืื ืืขืงื ืืงืก, ืึทืจืืึทื ืืขืจืขืื ื Cisco's VPP (Vector Packet Processing), Netmap ืืื, ืคืื ืงืืจืก, .
ืึธืจืืึทื ืืืืื ื ื ืขืฅ ืื ืืขืจืึทืงืฉืึทื ื ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ ืืื ืึท ื ืืืขืจ ืคืื ืืืกืึทืืืืึทื ืืืืืฉืื:
- ืื ืึทืก ืงืขืจื ืืื ืึท ืึทืืกืืจืึทืงืฆืืข ืฉืืืืข ืคึฟืึทืจ ืืึทืื ืืืึทืจื ืจืขืกืืจืกื. ืืืืึทื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ ืืืืื ืืึธืื ืฆื ืคืืจื ืืืืขืจ ืจืขืกืืจืกื ืืืืึทื, ืืื ืืืื ืืึธืื ืฆื ืคืืจื ืืืืขืจ ืืืืื ืืึทืื ืืืึทืจื. ืืขื ืึธืคื ืืืื ืืืจ ืืึทืจืคึฟื ืฆื ืคึผืจืึธืืจืึทื ืืืื ืืืืืขื ืข ืืจืืืืขืจืก.
- ืืืืึทื ืืืจ ืืขืื ืึทืจืืืฃ ืงืขืจื ืคึผืืึทืฅ ืืึธืจ, ืืืจ ืืืื ืืขืื ืึทืจืืืฃ ืึทืืข ืื ื ืขืืืืึธืจืงืื ื ืคืึทื ืืงืฉืึทื ืึทืืืื ืฆืืืขืฉืืขืื ืืืจื ืื ืงืขืจื. ืืึทื ืืฆืขืจ ืคึผืืึทืฅ ืืืืื ืืืื ืจืืืืคึผืืขืืขื ื ืคึฟืขืึดืงืืืื ืืืึธืก ืงืขื ืฉืืื ืืืื ืฆืืืขืฉืืขืื ืืืจื ืื ืงืขืจื ืึธืืขืจ ืึธืคึผืขืจืืืืื ื ืกืืกืืขื.
- ืืืืื ืึทืจืืขืื ืืื ืืึทืืืงืึทืกืื ืืึธืืข, ืืืึธืก ืึทืค ืึทื ืขืืขืก ืืืืึทืฅ ืืืืขืจ ืื ืืขืจืึทืงืฉืึทื ืืื ืคึผืจืืืืขื ืฅ ืืื ืคืื ืื ืืึทืืจืืืืื ื ืืื ืื ืืขืจืข ืคึผืึทืจืฅ ืคืื ืื ืึธืคึผืขืจืืืืื ื ืกืืกืืขื.
ืืื ืขืกืึทื ืก, ืืืขื ื ืขืืืืึธืจืงืื ื ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ, ืคืึธืจืฉืืขืืื ื ืืืื ื ืืขื ืขื ืึทืืฉืืืื ืืืจื ืืึธืืืื ื ืคึผืึทืงืึทื ืคึผืจืึทืกืขืกืื ื ืคืื ืื ืงืขืจื ืฆื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ. XDP ืืื ืคึผืื ืงื ืื ืคืึทืจืงืขืจื: ืขืก ืืืืืขืื ื ืขืืืืึธืจืงืื ื ืืืืื ืคืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ (ืคืืืืขืจืก, ืจืขืกืึธืืืืขืจืก, ืจืืืื ื, ืืื"ื ื) ืืื ืงืขืจื ืคึผืืึทืฅ. XDP ืึทืืึทืื ืืื ืื ืฆื ืืืจืืคืืจื ืึท ื ืขืฅ ืคืื ืงืฆืืึธื ืืจื ืืื ืืึทืื ืืื ืึท ืคึผืึทืงืึทื ืฉืืึธืื ืึท ื ืขืฅ ืฆืืืื ื ืืื ืืืืืขืจ ืขืก ืกืืึทืจืฅ ืฆื ืืึทื ืึทืจืืืฃ ืืื ืื ืงืขืจื ื ืขืฅ ืกืึทืืกืืกืืึทื. ืืื ืึท ืจืขืืืืืึทื, ืื ืคึผืึทืงืึทื ืคึผืจืึทืกืขืกืื ื ืืืืงืืึทื ืื ืงืจืืกืื ืืืืืืืืง. ืึธืืขืจ, ืืื ืงืขื ืืขืจ ืงืขืจื ืืขืจ ืืึทื ืืฆืขืจ ืฆื ืืืกืคืืจื ืืืืขืจ ืืืืื ืืื ืงืขืจื ืคึผืืึทืฅ? ืืืืืขืจ ืืืจ ืขื ืืคึฟืขืจื ืืขื ืงืฉืื, ืืึธืื ืืื ืื ืงืืง ืืื ืืืึธืก BPF ืืื.
BPF ืืื eBPF
ืืจืึธืฅ ืืขื ืงืึทื ืคืืืืื ื ื ืึธืืขื, BPF (Berkeley Packet Filtering) ืืื, ืืื ืคืึทืงื, ืึท ืืืืจืืืึทื ืืึทืฉืื ืืึธืืขื. ืืขืจ ืืืืจืืืขื ืืึทืฉืื ืืื ืขืจืืืืฉื ืึทืื ืืืืืื ื ืฆื ืฉืขืคึผื ืคึผืึทืงืึทื ืคึฟืืืืจืืจืื ื, ืืขืจืคืืจ ืืขืจ ื ืึธืืขื.
ืืืื ืขืจ ืคืื ืื ืืขืจืกื ืืึทืจืืื ืืืฉืืจืื ืืื BPF ืืื tcpdump. ืืืขื ืงืึทืคึผืืฉืขืจืื ื ืคึผืึทืงืืฅ ื ืืฆื tcpdump ืืขืจ ืืึทื ืืฆืขืจ ืงืขื ืขื ืกืคึผืขืฆืืคืืฆืืจื ืึทื ืืืืกืืจืืง ืฆื ืคืืืืขืจ ืคึผืึทืงืืฅ. ืืืืื ืคึผืึทืงืืฅ ืืืึธืก ืจืืืื ืืื ืฆื ืืขื ืืืืกืืจืืง ืืืขื ืืืื ืงืึทืคึผืืฉืขืจื. ืืืฉื, ืืขืจ ืืืืกืืจืืง "tcp dst port 80" ืจืขืคืขืจืก ืฆื ืึทืืข ืืงืคึผ ืคึผืึทืงืืฅ ืขืจืืืืืื ื ืืืืฃ ืคึผืึธืจื 80. ืืขืจ ืงืึทืืคึผืืืืขืจ ืงืขื ืขื ืคืึทืจืงืืจืฆื ืืขื ืืืืกืืจืืง ืืืจื ืงืึทื ืืืขืจืืื ื ืขืก ืฆื BPF ืืืืขืงืึธืืข.
$ sudo tcpdump -d "tcp dst port 80"
(000) ldh [12]
(001) jeq #0x86dd jt 2 jf 6
(002) ldb [20]
(003) jeq #0x6 jt 4 jf 15
(004) ldh [56]
(005) jeq #0x50 jt 14 jf 15
(006) jeq #0x800 jt 7 jf 15
(007) ldb [23]
(008) jeq #0x6 jt 9 jf 15
(009) ldh [20]
(010) jset #0x1fff jt 15 jf 11
(011) ldxb 4*([14]&0xf)
(012) ldh [x + 16]
(013) jeq #0x50 jt 14 jf 15
(014) ret #262144
(015) ret #0
ืืึธืก ืืื ืืืึธืก ืื ืืืืื ืคึผืจืึธืืจืึทื ืืืืกืืงืื ืืื:
- ืืืืขื (000): ืืึธืื ืื ืคึผืึทืงืึทื ืืื ืคืึธืืึธ 12, ืืื ืึท 16-ืืืกื ืืืึธืจื, ืืื ืื ืึทืงืืืืืึทืืึทืืึธืจ. ืคืึธืืึธ 12 ืงืึธืจืึทืกืคึผืึทื ืื ืฆื ืื ืขืืืขืจืืืคึผืข ืคืื โโืื ืคึผืึทืงืึทื.
- ืืืืขื (001): ืงืึทืืคึผืขืจื ืื ืืืขืจื ืืื ืื ืึทืงืืืืืึทืืึทืืึธืจ ืืื 0x86dd, ืืึธืก ืืื, ืืื ืื ืขืืืขืจืืืคึผืข ืืืขืจื ืคึฟืึทืจ IPv6. ืืืื ืืขืจ ืจืขืืืืืึทื ืืื ืืืช, ืืขืจ ืคึผืจืึธืืจืึทื ืืึธืืืึทื ืง ืืืื ืฆื ืืืืขื (002), ืืื ืืืื ื ืืฉื, ืืขืืึธืื (006).
- ืืืืขื (006): ืงืึทืืคึผืขืจื ืื ืืืขืจื ืืื 0x800 (ืขืืืขืจืืืคึผืข ืืืขืจื ืคึฟืึทืจ IPv4). ืืืื ืืขืจ ืขื ืืคืขืจ ืืื ืืืช, ืื ืคึผืจืึธืืจืึทื ืืืื ืฆื (007), ืืืื ื ืืฉื, ืืขืืึธืื ืฆื (015).
ืืื ืึทืืื ืืืืฃ ืืื ืื ืคึผืึทืงืึทื ืคึฟืืืืจืืจืื ื ืคึผืจืึธืืจืึทื ืงืขืจื ืึท ืจืขืืืืืึทื. ืืึธืก ืืื ืืืืฉืึทืืืึทืื ืึท ืืืืืึทื. ืฆืืจืืงืงืขืจื ืึท ื ืื-ื ืื ืืืขืจื (ืื ืกืืจืืงืืืึธื (014)) ืืืื ืึทื ืื ืคึผืึทืงืึทื ืืื ืื ืืขื ืืืขื, ืืื ืฆืืจืืงืงืืืขื ืึท ื ืื ืืืขืจื (ืื ืกืืจืืงืืืึธื (015)) ืืืื ืึทื ืื ืคึผืึทืงืึทื ืืื ื ืืฉื ืื ืืขื ืืืขื.
ืื BPF ืืืืจืืืขื ืืึทืฉืื ืืื ืืืึทื ืืืืืขืงืึธื ืืขื ืขื ืคืืจืืขืืืืื ืืืจื Steve McCann ืืื Van Jacobson ืืื ืฉืคึผืขื 1992 ืืืขื ืืืืขืจ ืฆืืืืื ื ืืื ืืจืืืก. , ืื ืืขืื ืึธืืึธืืืข ืืื ืืขืืืขื ืขืจืฉืืขืจ ืืขืจืืื ืื ืืื ืื ืืกืขื ืืงืก ืืืฆืื ื ืืื ืื ืืืื ืืขืจ ืคืื 1993.
ืืืืึทื BPF ืืื ืึท ืืืืจืืืึทื ืืึทืฉืื, ืขืก ืืืคืืื ื ืื ืกืืืืืืข ืืื ืืืึธืก ืืืืื ืืืืคื. ืืื ืึทืืืฉืึทื ืฆื ืื ืืืืขืงืึธืืข, ืขืก ืืืื ืืืคืืื ื ืื ืคึผืขืงื ืืืงืึธืจื ืืึธืืขื (ืืึทืกืข ืืื ืกืืจืืงืฆืืขืก ืืขื ืขื ืืืคึผืืืกืึทืืื ืืขืืืขื ืื ืฆื ืืขืจ ืคึผืขืงื), ืจืขืืืฉืืกืืขืจื (ื ืืื X; ืึทืงืืืืืึทืืึทืืึธืจ ืืื ืืื ืืขืงืก ืจืขืืืฉืืกืืขืจืก), ืงืจืึทืฆื ืืึผืจืื ืกืืึธืจืืืืฉ ืืื ืึท ืืืคึผืืืกืึทื ืคึผืจืึธืืจืึทื ืืึธืืืึทื ืง. ืื ืืขืจืขืกืืื ืืื, ืื BPF ืืืืขืงืึธืืข ืืื ืืึธืืขืืขื ื ืึธื ืื Motorola 6502 ISA. ืืื ืกืืืื ืืึทืงืึทื ืจืืงืึธืื ืืื ืืืื ืืื Sharkfest '11, ืขืจ ืืื ืืขืืืขื ืืึทืงืึทื ื ืืื ืืืืขื 6502 ืคึฟืื ืืืื ืืืื ืฉืืืข ืืขื ืคึผืจืึธืืจืึทืืืื ื ืืืืฃ ืื ืขืคึผื ืื, ืืื ืื ืืืืกื ืื ืคืืืึทื ืกื ืืืื ืึทืจืืขื ืืืืืื ืื ื ืื BPF ืืืืขืงืึธืืข.
BPF ืฉืืืฆื ืืื ืืืคึผืืึทืืขื ืึทื ืืื ืื ืืื ืืงืก ืงืขืจื ืืื ืืืขืจืกืืขืก ืื2.5 ืืื ืืขืืขืจ, ืืขืจ ืืืืคึผื ืฆืืืขืืขืื ืืืจื ืื ืืฉืชืืืืช ืคืื Jay Schullist. ืื BPF ืงืึธื ืืื ืืขืืืืื ืึทื ืืฉืืื ืืืฉื ืืื 2011, ืืืขื Eric Dumaset ืจืืืืืืื ื ืื BPF ืืืขืจืืขืฆืขืจ ืฆื ืืืืคื ืืื JIT ืืึธืืข (ืืงืืจ: ). ื ืึธื ืืขื, ืืขืจ ืงืขืจื, ืึทื ืฉืืึธื ืคืื ืื ืืขืจืคึผืจืขืืื ื BPF ืืืืขืงืึธืืข, ืงืขื ืืืืื ืืขืจ BPF ืืืืื ืฆื ืื ืฆืื ืึทืจืงืึทืืขืงืืฉืขืจ: x86, ARM, MIPS, ืขืืง.
ืฉืคึผืขืืขืจ, ืืื 2014, ืึทืืขืงืกืื ืกืืึทืจืึธืืืึธืืืึธืื ืคืืจืืขืืืืื ืึท ื ืืึทืข ืืืฉืื ืืขืงืึทื ืืืึทื ืคึฟืึทืจ BPF. ืืื ืคืึทืงื, ืื ื ืืึทืข JIT ืืื ืืขืืืืจื ืึท ื ืืึทืข BPF-ืืืืืจื ืึทืจืงืึทืืขืงืืฉืขืจ ืืื ืืื ืืขืจืืคื eBPF. ืืื ืืจืึทืืื ืืืืืข VMs ืงืึธืืืืืืกืืืจื ืคึฟืึทืจ ืขืืืขืืข ืืึธื, ืึธืืขืจ ืืขืจืืืืึทื ืคึผืึทืงืึทื ืคึฟืืืืจืืจืื ื ืืื ืืืคึผืืึทืืขื ืึทื ืืืืืจื ืืืืฃ eBPF. ืืื ืคืืืข ืืืืฉืคืืื ืคืื ืืึธืืขืจื ืืึทืงืืืืขื ืืืืฉืึทื, BPF ืืื ืคืืจืฉืืื ืขื ืฆื ืืืื eBPF, ืืื ืงืืึทืกืืฉ BPF ืืื ืืืึทื ื ืืืงืื ื ืืื cBPF.
eBPF ืืงืกืืขื ืื ืื ืงืืึทืกืืฉ BPF ืืืืจืืืึทื ืืึทืฉืื ืืื ืขืืืขืืข ืืืขืื:
- ืืืืืจื ืืืืฃ ืืึธืืขืจื 64-ืืืกื ืึทืจืงืึทืืขืงืืฉืขืจื. eBPF ื ืืฆื 64-ืืืกื ืจืขืืืฉืืกืืขืจื ืืื ืื ืงืจืืกืื ืื ื ืืืขืจ ืคืื ืื ืืืฆื ืจืขืืืฉืืกืืขืจื ืคืื 2 (ืึทืงืืืืืึทืืึทืืึธืจ ืืื X) ืฆื 10. eBPF ืืืื ืืื ื ืึธื ืึธืคึผืงืึธืืขืก (BPF_MOV, BPF_JNE, BPF_CALL...).
- ืืืืึทืืฉื ืคืื ืื ื ืขืฅ ืฉืืืืข ืกืึทืืกืืกืืึทื. BPF ืืื ืืขืืืขื ืืืื ืฆื ืื ืคึผืขืงื ืืึทืื ืืึธืืขื. ืืื ื ืขืก ืืื ืืขื ืืฆื ืคึฟืึทืจ ืคึผืึทืงืึทื ืคึฟืืืืจืืจืื ื, ืืืึทื ืงืึธื ืืื ืืขืืืขื ืืืื ืืื ืื ืกืึทืืกืืกืืขื ืืืึธืก ืืื ื ืขืฅ ืงืึธืืื ืืงืึทืฆืืข. ืึธืืขืจ, ืื eBPF ืืืืจืืืึทื ืืึทืฉืื ืืื ื ืื ืืขืจ ืืืื ืฆื ืื ืืึทืื ืืึธืืขื ืืื ืงืขื ืขื ืืืื ืืขืืืืื ื ืคึฟืึทืจ ืงืืื ืฆืื. ืืืฆื, ืื eBPF ืคึผืจืึธืืจืึทื ืงืขื ืขื ืืืื ืงืึธื ื ืขืงืืขื ืฆื ืืจืึทืกืขืคึผืึธืื ื ืึธืืขืจ kprobe. ืืึธืก ืึธืคึผืขื ืก ืืขื ืืืขื ืฆื eBPF ืื ืกืืจืึทืืขื ืืืืฉืึทื, ืคืึธืจืฉืืขืืื ื ืึทื ืึทืืืกืืก ืืื ืคืืืข ืื ืืขืจืข ื ืืฆื ืงืึทืกืขืก ืืื ืืขื ืงืึธื ืืขืงืกื ืคืื ืื ืืขืจืข ืงืขืจื ืกืึทืืกืืกืืึทืื. ืืืฆื ืื eBPF ืงืึธื ืืื ืืืื ืืื ืืืื ืืืืืขื ืข ืืจื: ืงืขืจื / bpf.
- ืืืืืืืข ืืึทืื ืกืืึธืจื ืืขืจืืคื ืืึทืคึผืก. ืืึทืคึผืก ืืขื ืขื ืฉืืืกื-ืืืขืจื ืกืืึธืจื ืืืึธืก ืืขืื ืืึทืื ืืืขืงืกื ืฆืืืืฉื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ ืืื ืงืขืจื ืคึผืืึทืฅ. eBPF ืืื ืขืืืขืืข ืืืืคึผืก ืคืื ืืึทืคึผืก.
- ืฆืืืืืืืง ืคืึทื ืืงืฉืึทื ื. ืืื ืืึทืืื ืืขืจ, ืฆื ืจืืจืืื ืึท ืคึผืขืงื, ืจืขืืขื ืขื ืึท ืืฉืขืงืงืกืื ืึธืืขืจ ืงืืึธืื ืึท ืคึผืขืงื. ืื ืคืึทื ืืงืฉืึทื ื ืืืืคื ืื ืืขืจ ืงืขืจื ืืื ืืขื ืขื ื ืืฉื ืืึทื ืืฆืขืจ-ืคึผืืึทืฅ ืืืืื. ืืืจ ืงืขื ืขื ืืืื ืืึทืื ืกืืกืืขื ืงืึทืืืก ืคึฟืื eBPF ืืืืื.
- ืกืืฃ ืงืึทืืืก. ืื ืคึผืจืึธืืจืึทื ืืจืืืก ืืื eBPF ืืื ืืืืืืขื ืฆื 4096 ืืืืขืก. ืื ืขืง ืจืืคื ืฉืืจืื ืึทืืึทืื ืึทื eBPF ืคึผืจืึธืืจืึทื ืฆื ืึทืจืืืขืจืคืืจื ืงืึธื ืืจืึธื ืฆื ืึท ื ืืึทืข eBPF ืคึผืจืึธืืจืึทื ืืื ืึทืืื ืืืืคึผืึทืก ืื ืืึทืืจืขื ืขืฆืื ื (ืึทืจืืืฃ ืฆื 32 ืืืืื ืงืขื ืขื ืืืื ืืื ืืงื ืืืืฃ ืืขื ืืืขื).
eBPF: ืืืึทืฉืคึผืื
ืขืก ืืขื ืขื ืขืืืขืืข ืืืืฉืคืืื ืคึฟืึทืจ eBPF ืืื ืื ืืื ืืงืก ืงืขืจื ืงืืืืื. ืืื ืืขื ืขื ืื ืืืฆื ืืื ืกืึทืืคึผืึทืื / bpf /. ืฆื ืืึทืืืขื ืื ืืืืฉืคืืื, ื ืึธืจ ืึทืจืืึทื:
$ sudo make samples/bpf/
ืืื ืืืขื ื ืืฉื ืฉืจืืึทืื ืึท ื ืืึทืข ืืืึทืฉืคึผืื ืคึฟืึทืจ eBPF ืืื, ืึธืืขืจ ืืื ืืืขื ื ืืฆื ืืืื ืขืจ ืคืื ืื ืกืึทืืคึผืึทืื ืื ืืืฆื ืืื ืกืึทืืคึผืึทืื / bpf /. ืืื ืืืขื ืงืืงื ืืื ืขืืืขืืข ืืืืื ืคืื ืื ืงืึธื ืืื ืืขืจืงืืขืจื ืืื ืขืก ืึทืจืืขื. ืืื ืึท ืืืึทืฉืคึผืื, ืืื ืืืืกืืขืจืืืืืื ืืขื ืคึผืจืึธืืจืึทื tracex4.
ืืื ืึทืืืขืืืื, ืืขืืขืจ ืคืื ืื ืืืืฉืคืืื ืืื ืกืึทืืคึผืึทืื / bpf / ืืืฉืืืื ืคืื ืฆืืืื ืืขืงืขืก. ืืื ืืขื ืคืึทื:
tracex4_kern.c, ืึผืืื ืื ืืงืืจ ืงืึธื ืฆื ืืืื ืขืงืกืึทืงืืืืึทื ืืื ืื ืงืขืจื ืืื eBPF ืืืืขืงืึธืืข.tracex4_user.c, ืึผืืื ืึท ืคึผืจืึธืืจืึทื ืคึฟืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ.
ืืื ืืขื ืคืึทื, ืืืจ ืืึทืจืคึฟื ืฆื ืืึทืืืขื tracex4_kern.c ืฆื eBPF ืืืืขืงืึธืืข. ืืืฆื ืืื gcc ืขืก ืืื ืงืืื ืืึทืงืขื ื ืคึฟืึทืจ eBPF. ืฆืื ืืืืง, clang ืงืขื ืขื ืจืขืืืืืึทื eBPF ืืืืขืงืึธืืข. ื ืืฆื clang ืคึฟืึทืจ ืืึทืืืื ื tracex4_kern.c ืฆื ืื ืืืืคืขืฅ ืืขืงืข.
ืืื ืืขืจืืื ื ืืืืื ืึทื ืืืื ืขืจ ืคืื ืื ืืขืจืกื ืืฉืืงืึทืืืข ืคึฟืขืึดืงืืืื ืคืื eBPF ืืขื ืขื ืืึทืคึผืก. tracex4_kern ืืืคืืื ื ืืืื ืืึทืคึผืข:
struct pair {
u64 val;
u64 ip;
};
struct bpf_map_def SEC("maps") my_map = {
.type = BPF_MAP_TYPE_HASH,
.key_size = sizeof(long),
.value_size = sizeof(struct pair),
.max_entries = 1000000,
};
BPF_MAP_TYPE_HASH ืืื ืืืื ืขืจ ืคืื ืื ืคืืืข ืืืืคึผืก ืคืื ืงืึทืจืืก ืืขืคึฟืื ื ืืืจื eBPF. ืืื ืืขื ืคืึทื, ืขืก ืืื ื ืึธืจ ืึท ืืึทืฉ. ืืืจ ืงืขื ืืืื ืืึธืื ืืืืขืจืงื ืึท ืึทื SEC("maps"). SEC ืืื ืึท ืืึทืงืจืึธื ืืขื ืืฆื ืฆื ืฉืึทืคึฟื ืึท ื ืืึทืข ืึธืคึผืืืืืื ื ืคืื ืึท ืืืื ืขืจื ืืขืงืข. ืึทืงืืืึทืืื, ืืื ืืขื ืืืึทืฉืคึผืื tracex4_kern ืฆืืืื ืืขืจ ืกืขืงืฉืึทื ื ืืขื ืขื ืืืคืืื ื:
SEC("kprobe/kmem_cache_free")
int bpf_prog1(struct pt_regs *ctx)
{
long ptr = PT_REGS_PARM2(ctx);
bpf_map_delete_elem(&my_map, &ptr);
return 0;
}
SEC("kretprobe/kmem_cache_alloc_node")
int bpf_prog2(struct pt_regs *ctx)
{
long ptr = PT_REGS_RC(ctx);
long ip = 0;
// ะฟะพะปััะฐะตะผ ip-ะฐะดัะตั ะฒัะทัะฒะฐััะตะน ััะพัะพะฝั kmem_cache_alloc_node()
BPF_KRETPROBE_READ_RET_IP(ip, ctx);
struct pair v = {
.val = bpf_ktime_get_ns(),
.ip = ip,
};
bpf_map_update_elem(&my_map, &ptr, &v, BPF_ANY);
return 0;
}
ืื ืฆืืืื ืคืึทื ืืงืฉืึทื ื ืืึธืื ืืืจ ืฆื ืืืกืืขืงื ืึท ืคึผืึธืืืฆืืข ืคืื โโืืขืจ ืืึทืคึผืข (kprobe/kmem_cache_free) ืืื ืืืืื ืึท ื ืืึทืข ืคึผืึธืืืฆืืข ืฆื ืืขืจ ืืึทืคึผืข (kretprobe/kmem_cache_alloc_node). ืึทืืข ืคึฟืื ืงืฆืืข ื ืขืืขื ืืขืฉืจืืื ืืื ืืืืคึผื ืืืชืืืช ืฉืืืืขื ืฆื ืืึทืงืจืึธืก ืืืคืืื ื ืืื .
ืืืื ืืื ืืึทืืคึผ ืื ืกืขืงืฉืึทื ื ืคืื ืื ืืืืคืขืฅ ืืขืงืข, ืืื ืืึธื ืืขื ืึทื ืื ื ืืึทืข ืกืขืงืฉืึทื ื ืืขื ืขื ืฉืืื ืืืคืืื ื:
$ objdump -h tracex4_kern.o
tracex4_kern.o: file format elf64-little
Sections:
Idx Name Size VMA LMA File off Algn
0 .text 00000000 0000000000000000 0000000000000000 00000040 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
1 kprobe/kmem_cache_free 00000048 0000000000000000 0000000000000000 00000040 2**3
CONTENTS, ALLOC, LOAD, RELOC, READONLY, CODE
2 kretprobe/kmem_cache_alloc_node 000000c0 0000000000000000 0000000000000000 00000088 2**3
CONTENTS, ALLOC, LOAD, RELOC, READONLY, CODE
3 maps 0000001c 0000000000000000 0000000000000000 00000148 2**2
CONTENTS, ALLOC, LOAD, DATA
4 license 00000004 0000000000000000 0000000000000000 00000164 2**0
CONTENTS, ALLOC, LOAD, DATA
5 version 00000004 0000000000000000 0000000000000000 00000168 2**2
CONTENTS, ALLOC, LOAD, DATA
6 .eh_frame 00000050 0000000000000000 0000000000000000 00000170 2**3
CONTENTS, ALLOC, LOAD, RELOC, READONLY, DATA
ื ืึธื ืืึธืื , ืืืืคึผื ืคึผืจืึธืืจืึทื. ืืืืกืืงืื, ืืขื ืคึผืจืึธืืจืึทื ืืืกืึทื ื ืฆื ืืขืฉืขืขื ืืฉื kmem_cache_alloc_node. ืืืขื ืึทืืึท ืึท ืืขืฉืขืขื ืืฉ ืึทืงืขืจื, ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื eBPF ืงืึธื ืืื ืขืงืกืึทืงืืืืึทื. ืืขืจ ืงืึธื ืกืึทืืืขืก ืื IP ืึทืืจืืืืื ืคืื ืื ืืืืคืขืฅ ืืื ืึท ืืึทืคึผืข, ืืื ืืขืจ ืืืืคืขืฅ ืืื ืืขืืึธืื ืืืคึผื ืืืจื ืื ืืืืคึผื ืคึผืจืึธืืจืึทื. ืืืึทืฉืคึผืื:
$ sudo ./tracex4
obj 0xffff8d6430f60a00 is 2sec old was allocated at ip ffffffff9891ad90
obj 0xffff8d6062ca5e00 is 23sec old was allocated at ip ffffffff98090e8f
obj 0xffff8d5f80161780 is 6sec old was allocated at ip ffffffff98090e8f
ืืื ืืขื ืขื ืึท ืืึทื ืืฆืขืจ ืคึผืืึทืฅ ืคึผืจืึธืืจืึทื ืืื ืึทื eBPF ืคึผืจืึธืืจืึทื ืฉืืึทืืืช? ืืืืฃ ืื ืืืืึทืืืืึทืืืึธื tracex4_user.c ืืึธืืื ืึท ืืืืคืขืฅ ืืขืงืข tracex4_kern.o ื ืืฆื ืื ืคึฟืื ืงืฆืืข load_bpf_file.
int main(int ac, char **argv)
{
struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY};
char filename[256];
int i;
snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);
if (setrlimit(RLIMIT_MEMLOCK, &r)) {
perror("setrlimit(RLIMIT_MEMLOCK, RLIM_INFINITY)");
return 1;
}
if (load_bpf_file(filename)) {
printf("%s", bpf_log_buf);
return 1;
}
for (i = 0; ; i++) {
print_old_objects(map_fd[1]);
sleep(1);
}
return 0;
}
ืืืจื ืืื ืคึผืจืึธืืขืก ืืืคืืื ื ืืื ืื eBPF ืืขืงืข ืืขื ืขื ืืืกืืฃ ืฆื /sys/kernel/debug/tracing/kprobe_events. ืืืฆื ืืืจ ืืขืจื ืคึฟืึทืจ ืื ืืขืฉืขืขื ืืฉื ืืื ืืื ืืืขืจ ืคึผืจืึธืืจืึทื ืงืขื ืขื ืืึธื ืขืคึผืขืก ืืืขื ืืื ืคึผืึทืกืืจื.
$ sudo cat /sys/kernel/debug/tracing/kprobe_events
p:kprobes/kmem_cache_free kmem_cache_free
r:kprobes/kmem_cache_alloc_node kmem_cache_alloc_node
ืึทืืข ืื ืืขืจืข ืืืืื ืืื ืืืกืืขืจ / bpf / ืืขื ืขื ืกืืจืึทืงืืฉืขืจื ืกืืืึทืืขืจืื. ืืื ืฉืืขื ืืืง ืึทื ืืืึทืืื ืฆืืืื ืืขืงืขืก:
XXX_kern.c: eBPF ืคึผืจืึธืืจืึทื.XXX_user.c: ืืืืคึผื ืคึผืจืึธืืจืึทื.
ืื eBPF ืคึผืจืึธืืจืึทื ืืืืขื ืึทืคืืื ืืึทืคึผืก ืืื ืคืึทื ืืงืฉืึทื ื ืคึฟืึทืจืืื ืื ืืื ืึท ืึธืคึผืืืืืื ื. ืืืขื ืืขืจ ืงืขืจื ืึทืจืืืกืืขืื ืึท ืืขืฉืขืขื ืืฉ ืคืื ืึท ืืืืขืจ ืืืคึผ (ืืืฉื, tracepoint), ืื ืืขืืื ืื ืคืึทื ืืงืฉืึทื ื ืืขื ืขื ืขืงืกืึทืงืืืืึทื. ืื ืงืึทืจืืก ืฆืืฉืืขืื ืงืึธืืื ืืงืึทืฆืืข ืฆืืืืฉื ืื ืงืขืจื ืคึผืจืึธืืจืึทื ืืื ืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ ืคึผืจืึธืืจืึทื.
ืกืึธืฃ
ืืขืจ ืึทืจืืืงื ืืืกืงืึทืกื BPF ืืื eBPF ืืื ืึทืืืขืืืื ืืขืจืืื ืขื. ืืื ืืืืกื ืึทื ืขืก ืืื ืึท ืคึผืืึทืฅ ืคืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืื ืจืขืกืืจืกื ืืืขืื eBPF ืืืึทื ื, ืึทืืื ืืื ืืืขื ืจืขืงืึธืืขื ืืืจื ืึท ืืืกื ืืขืจ ืจืขืกืืจืกื ืคึฟืึทืจ ืืืืึทืืขืจ ืืขืจื ืขื
ืืื ืจืขืงืึธืืขื ืืืจื ืืืืขื ืขื:
- ืืื ืชื ืงืึธืจืืขื. ืึท ืืงืืื ืฆื BPF ืืื ืืื ืขืก ืืืืึทืืืื ืืื eBPF.
- ืืจืขื ืืึทื ืืจืขื. ืึทืจืืืงื ืคึฟืื LWN.net. ืืจืขื ืืึทื ืืืืขืขืฅ ืึธืคื ืืืขืื eBPF ืืื ืืืื ืึท ืจืฉืืื ืคืื ืจืขืกืืจืกื ืืืืฃ ืืขืจ ืืขืืข ืืืืฃ ืืืื ืืขืืข .
- ืืืฉืืืืึท ืขืืืึทื ืก. ืืึทืืขืจืงืื ืืขื ืืืืฃ ืื ืคึผืจืขืืขื ืืืจืื ื ืคืื Suchakra Sharma "ืื BSD ืคึผืึทืงืึทื ืคึฟืืืืจืืจ: ื ื ืืึทืข ืึทืจืืฉืืืขืงืืืจืข ืคึฟืึทืจ ืืึทื ืืฆืขืจ-ืืืจืื ืคึผืึทืงืึทื ืงืึทืคึผืืืจืข". ืื ืืึทืืขืจืงืื ืืขื ืืขื ืขื ืืื ืืื ืืึทืงืข ืืขืืคึฟื ืืืจ ืคึฟืึทืจืฉืืืื ืื ืกืืืืื.
- ืคืขืจืืก ืขืืืก. ืืื ื ืจืขื ืืื , ืึธืืขืจ ืขืก ืืื ืืืขืจื ืืืืขื ืขื. ืืืื ืขืจ ืคืื ืื ืืขืกืืขืจ ืึทืจืืืงืืขื ืืืึธืก ืืื ืืึธืื ืืขืคึฟืื ืขื ืืืืฃ eBPF.
ืืงืืจ: www.habr.com