Skip to content

Commit 1166899

Browse files
menglongdongmenglongdong
authored
Merge pull request #57 from OpenCloudOS/dev
monitor mode
2 parents c591258 + e259427 commit 1166899

23 files changed

Lines changed: 326172 additions & 637 deletions

‎component/sys_utils.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ do { \
5454

5555
#define pr_info(fmt, args...) pr_level(0, stdout, fmt, ##args)
5656
#define pr_verb(fmt, args...) pr_level(1, stdout, fmt, ##args)
57-
#define pr_warn(fmt, args...) pr_level(1, stderr, "\033[0;34mWARN: "fmt"\033[0m", ##args)
57+
#define pr_warn(fmt, args...) pr_level(0, stderr, "\033[0;34mWARN: "fmt"\033[0m", ##args)
5858
#define pr_err(fmt, args...) pr_level(0, stderr, "\033[0;31mERROR: "fmt"\033[0m", ##args)
5959
#define pr_debug(fmt, args...) pr_level(2, stdout, "DEBUG: "fmt, ##args)
6060

‎shared/bpf/skb_shared.h‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,13 @@
1313
#define __nt_placehold_arg_3 3,
1414
#define __nt_placehold_arg_4 4,
1515
#define __nt_placehold_arg_5 5,
16+
#define __nt_placehold_arg_6 6,
17+
#define __nt_placehold_arg_7 7,
18+
#define __nt_placehold_arg_8 8,
19+
#define __nt_placehold_arg_9 9,
20+
#define __nt_placehold_arg_10 10,
21+
#define __nt_placehold_arg_11 11,
22+
#define __nt_placehold_arg_12 12,
1623

1724
#define ____nt_ternary_take(a, b, c) nt_take_2th(a b, c)
1825
#define __nt_ternary_take(a, b, c) \
@@ -33,7 +40,7 @@ typedef struct {
3340
u16 dport;
3441
} l4_min_t;
3542

36-
typedef struct __attribute__((__packed__)) {
43+
typedef struct {
3744
u64 ts;
3845
union {
3946
struct {
@@ -79,7 +86,7 @@ typedef struct __attribute__((__packed__)) {
7986
u8 pad;
8087
} packet_t;
8188

82-
typedef struct __attribute__((__packed__)) {
89+
typedef struct {
8390
u64 ts;
8491
union {
8592
struct {

‎shared/bpf/vmlinux_arm64.h‎

Lines changed: 40 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28180,7 +28180,46 @@ enum bpf_func_id {
2818028180
BPF_FUNC_timer_set_callback = 170,
2818128181
BPF_FUNC_timer_start = 171,
2818228182
BPF_FUNC_timer_cancel = 172,
28183-
__BPF_FUNC_MAX_ID = 173,
28183+
BPF_FUNC_get_func_ip = 173,
28184+
BPF_FUNC_get_attach_cookie = 174,
28185+
BPF_FUNC_task_pt_regs = 175,
28186+
BPF_FUNC_get_branch_snapshot = 176,
28187+
BPF_FUNC_trace_vprintk = 177,
28188+
BPF_FUNC_skc_to_unix_sock = 178,
28189+
BPF_FUNC_kallsyms_lookup_name = 179,
28190+
BPF_FUNC_find_vma = 180,
28191+
BPF_FUNC_loop = 181,
28192+
BPF_FUNC_strncmp = 182,
28193+
BPF_FUNC_get_func_arg = 183,
28194+
BPF_FUNC_get_func_ret = 184,
28195+
BPF_FUNC_get_func_arg_cnt = 185,
28196+
BPF_FUNC_get_retval = 186,
28197+
BPF_FUNC_set_retval = 187,
28198+
BPF_FUNC_xdp_get_buff_len = 188,
28199+
BPF_FUNC_xdp_load_bytes = 189,
28200+
BPF_FUNC_xdp_store_bytes = 190,
28201+
BPF_FUNC_copy_from_user_task = 191,
28202+
BPF_FUNC_skb_set_tstamp = 192,
28203+
BPF_FUNC_ima_file_hash = 193,
28204+
BPF_FUNC_kptr_xchg = 194,
28205+
BPF_FUNC_map_lookup_percpu_elem = 195,
28206+
BPF_FUNC_skc_to_mptcp_sock = 196,
28207+
BPF_FUNC_dynptr_from_mem = 197,
28208+
BPF_FUNC_ringbuf_reserve_dynptr = 198,
28209+
BPF_FUNC_ringbuf_submit_dynptr = 199,
28210+
BPF_FUNC_ringbuf_discard_dynptr = 200,
28211+
BPF_FUNC_dynptr_read = 201,
28212+
BPF_FUNC_dynptr_write = 202,
28213+
BPF_FUNC_dynptr_data = 203,
28214+
BPF_FUNC_tcp_raw_gen_syncookie_ipv4 = 204,
28215+
BPF_FUNC_tcp_raw_gen_syncookie_ipv6 = 205,
28216+
BPF_FUNC_tcp_raw_check_syncookie_ipv4 = 206,
28217+
BPF_FUNC_tcp_raw_check_syncookie_ipv6 = 207,
28218+
BPF_FUNC_ktime_get_tai_ns = 208,
28219+
BPF_FUNC_user_ringbuf_drain = 209,
28220+
BPF_FUNC_cgrp_storage_get = 210,
28221+
BPF_FUNC_cgrp_storage_delete = 211,
28222+
__BPF_FUNC_MAX_ID = 212,
2818428223
};
2818528224

2818628225
enum {

‎shared/bpf/vmlinux_x86.h‎

Lines changed: 40 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34236,7 +34236,46 @@ enum bpf_func_id {
3423634236
BPF_FUNC_timer_set_callback = 170,
3423734237
BPF_FUNC_timer_start = 171,
3423834238
BPF_FUNC_timer_cancel = 172,
34239-
__BPF_FUNC_MAX_ID = 173,
34239+
BPF_FUNC_get_func_ip = 173,
34240+
BPF_FUNC_get_attach_cookie = 174,
34241+
BPF_FUNC_task_pt_regs = 175,
34242+
BPF_FUNC_get_branch_snapshot = 176,
34243+
BPF_FUNC_trace_vprintk = 177,
34244+
BPF_FUNC_skc_to_unix_sock = 178,
34245+
BPF_FUNC_kallsyms_lookup_name = 179,
34246+
BPF_FUNC_find_vma = 180,
34247+
BPF_FUNC_loop = 181,
34248+
BPF_FUNC_strncmp = 182,
34249+
BPF_FUNC_get_func_arg = 183,
34250+
BPF_FUNC_get_func_ret = 184,
34251+
BPF_FUNC_get_func_arg_cnt = 185,
34252+
BPF_FUNC_get_retval = 186,
34253+
BPF_FUNC_set_retval = 187,
34254+
BPF_FUNC_xdp_get_buff_len = 188,
34255+
BPF_FUNC_xdp_load_bytes = 189,
34256+
BPF_FUNC_xdp_store_bytes = 190,
34257+
BPF_FUNC_copy_from_user_task = 191,
34258+
BPF_FUNC_skb_set_tstamp = 192,
34259+
BPF_FUNC_ima_file_hash = 193,
34260+
BPF_FUNC_kptr_xchg = 194,
34261+
BPF_FUNC_map_lookup_percpu_elem = 195,
34262+
BPF_FUNC_skc_to_mptcp_sock = 196,
34263+
BPF_FUNC_dynptr_from_mem = 197,
34264+
BPF_FUNC_ringbuf_reserve_dynptr = 198,
34265+
BPF_FUNC_ringbuf_submit_dynptr = 199,
34266+
BPF_FUNC_ringbuf_discard_dynptr = 200,
34267+
BPF_FUNC_dynptr_read = 201,
34268+
BPF_FUNC_dynptr_write = 202,
34269+
BPF_FUNC_dynptr_data = 203,
34270+
BPF_FUNC_tcp_raw_gen_syncookie_ipv4 = 204,
34271+
BPF_FUNC_tcp_raw_gen_syncookie_ipv6 = 205,
34272+
BPF_FUNC_tcp_raw_check_syncookie_ipv4 = 206,
34273+
BPF_FUNC_tcp_raw_check_syncookie_ipv6 = 207,
34274+
BPF_FUNC_ktime_get_tai_ns = 208,
34275+
BPF_FUNC_user_ringbuf_drain = 209,
34276+
BPF_FUNC_cgrp_storage_get = 210,
34277+
BPF_FUNC_cgrp_storage_delete = 211,
34278+
__BPF_FUNC_MAX_ID = 212,
3424034279
};
3424134280

3424234281
enum {

‎shared/bpf_utils.c‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
#include <unistd.h>
1212

1313
#include <sys_utils.h>
14+
#include <bpf/btf.h>
1415

1516
#include "bpf_utils.h"
1617

@@ -112,3 +113,35 @@ exist:;
112113

113114
return 0;
114115
}
116+
117+
static struct btf *local_btf;
118+
const struct btf_type *btf_get_type(char *name)
119+
{
120+
const struct btf_type *t;
121+
int id;
122+
123+
if (!local_btf)
124+
local_btf= btf__load_vmlinux_btf();
125+
126+
id = btf__find_by_name(local_btf, name);
127+
if (id < 0)
128+
return NULL;
129+
130+
t = btf__type_by_id(local_btf, id);
131+
return t;
132+
}
133+
134+
int btf_get_arg_count(char *name)
135+
{
136+
const struct btf_type *t;
137+
138+
t = btf_get_type(name);
139+
if (!t)
140+
return -ENOENT;
141+
142+
t = btf__type_by_id(local_btf, t->type);
143+
if (!t)
144+
return -ENOENT;
145+
146+
return btf_vlen(t);
147+
}

‎shared/bpf_utils.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,5 +63,7 @@ static inline int perf_output(int fd, perf_buffer_sample_fn fn)
6363
}
6464

6565
int compat_bpf_attach_kprobe(int fd, char *name, bool ret);
66+
const struct btf_type *btf_get_type(char *name);
67+
int btf_get_arg_count(char *name);
6668

6769
#endif

‎src/Makefile‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
11
ROOT ?= $(abspath ../)
2-
bpf_progs := progs/tracing progs/kprobe
2+
bpf_progs := progs/kprobe
33
progs := nettrace
44
prog-nettrace-origin = \
55
trace.c $(COMMON_SHARED) trace_probe.c trace_tracing.c \
66
analysis.c $(COMPONENT)/parse_sym.c trace_group.c \
77
dropreason.c
88
prog-nettrace = $(prog-nettrace-origin) nettrace.c
99

10+
ifndef COMPAT
11+
bpf_progs += progs/tracing progs/feat_args_ext
12+
endif
1013

1114
BPF_EXTRA_DEP := kheaders.h
1215
include ../common.mk
@@ -28,7 +31,7 @@ progs/kprobe_trace.h:
2831
trace_group.c: trace.yaml
2932
python3 gen_trace.py > trace_group.c
3033

31-
progs/kprobe.c: progs/kprobe_trace.h
34+
progs/*.c: progs/kprobe_trace.h
3235
@:
3336

3437
nettrace.c: $(prog-nettrace-origin)

‎src/analysis.c‎

Lines changed: 49 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -289,8 +289,8 @@ void analy_ctx_handle(analy_ctx_t *ctx)
289289
analy_ctx_free(ctx);
290290
}
291291

292-
static int try_run_analyzer(trace_t *trace, analyzer_t *analyzer,
293-
analy_entry_t *entry)
292+
static int try_run_entry(trace_t *trace, analyzer_t *analyzer,
293+
analy_entry_t *entry)
294294
{
295295
if (analyzer && (analyzer->mode & (1 << trace_ctx.mode)) &&
296296
analyzer->analy_entry)
@@ -299,6 +299,16 @@ static int try_run_analyzer(trace_t *trace, analyzer_t *analyzer,
299299
return RESULT_CONT;
300300
}
301301

302+
static int try_run_exit(trace_t *trace, analyzer_t *analyzer,
303+
analy_exit_t *exit)
304+
{
305+
if (analyzer && (analyzer->mode & (1 << trace_ctx.mode)) &&
306+
analyzer->analy_exit)
307+
return analyzer->analy_exit(trace, exit);
308+
309+
return RESULT_CONT;
310+
}
311+
302312
void tl_poll_handler(void *raw_ctx, int cpu, void *data, u32 size)
303313
{
304314
static char buf[1024], tinfo[128];
@@ -340,7 +350,7 @@ void tl_poll_handler(void *raw_ctx, int cpu, void *data, u32 size)
340350

341351
entry->ctx = analy_ctx;
342352
entry->fake_ctx = fake;
343-
switch (try_run_analyzer(trace, analyzer, entry)) {
353+
switch (try_run_entry(trace, analyzer, entry)) {
344354
case RESULT_CONSUME:
345355
goto check_pending;
346356
case RESULT_CONT:
@@ -349,7 +359,7 @@ void tl_poll_handler(void *raw_ctx, int cpu, void *data, u32 size)
349359
break;
350360
}
351361

352-
switch (try_run_analyzer(trace, trace->analyzer, entry)) {
362+
switch (try_run_entry(trace, trace->analyzer, entry)) {
353363
case RESULT_CONSUME:
354364
goto check_pending;
355365
case RESULT_CONT:
@@ -407,17 +417,33 @@ do_ret:;
407417
}
408418
}
409419

420+
static inline void do_basic_poll(analy_entry_t *entry)
421+
{
422+
trace_t *trace;
423+
424+
trace = get_trace_from_analy_entry(entry);
425+
try_run_entry(trace, trace->analyzer, entry);
426+
427+
if (trace_ctx.mode == TRACE_MODE_MONITOR) {
428+
analy_exit_t analy_exit = {
429+
.event = {
430+
.val = entry->event->retval,
431+
},
432+
.entry = entry,
433+
};
434+
try_run_exit(trace, trace->analyzer, &analy_exit);
435+
}
436+
437+
analy_entry_handle(entry);
438+
}
439+
410440
void basic_poll_handler(void *ctx, int cpu, void *data, u32 size)
411441
{
412442
analy_entry_t entry = {
413443
.event = data,
414444
.cpu = cpu
415445
};
416-
trace_t *trace;
417-
418-
trace = get_trace_from_analy_entry(&entry);
419-
try_run_analyzer(trace, trace->analyzer, &entry);
420-
analy_entry_handle(&entry);
446+
do_basic_poll(&entry);
421447
}
422448

423449
static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
@@ -439,9 +465,7 @@ static void *do_async_poll(void *arg)
439465
pthread_mutex_unlock(&mutex);
440466

441467
list_for_each_entry_safe(entry, pos, &head, list) {
442-
trace = get_trace_from_analy_entry(entry);
443-
try_run_analyzer(trace, trace->analyzer, entry);
444-
analy_entry_handle(entry);
468+
do_basic_poll(entry);
445469
list_del(&entry->list);
446470
analy_entry_free(entry);
447471
}
@@ -513,6 +537,8 @@ static inline void rule_run(analy_entry_t *entry, trace_t *trace, int ret)
513537
if (!hit)
514538
continue;
515539
entry->rule = rule;
540+
if (!mode_has_context())
541+
break;
516542
switch (rule->level) {
517543
case RULE_INFO:
518544
break;
@@ -540,7 +566,8 @@ DEFINE_ANALYZER_ENTRY(free, TRACE_MODE_TIMELINE_MASK | TRACE_MODE_DIAG_MASK)
540566
}
541567

542568
DEFINE_ANALYZER_ENTRY(drop, TRACE_MODE_TIMELINE_MASK | TRACE_MODE_DIAG_MASK |
543-
TRACE_MODE_DROP_MASK)
569+
TRACE_MODE_DROP_MASK |
570+
TRACE_MODE_MONITOR_MASK)
544571
{
545572
define_pure_event(drop_event_t, event, e->event);
546573
char *reason = NULL, *sym_str, *info;
@@ -550,7 +577,7 @@ DEFINE_ANALYZER_ENTRY(drop, TRACE_MODE_TIMELINE_MASK | TRACE_MODE_DIAG_MASK |
550577
sym = sym_parse(event->location);
551578
sym_str = sym ? sym->desc : "unknow";
552579

553-
if (trace_ctx.mode == TRACE_MODE_DROP) {
580+
if (!mode_has_context()) {
554581
info = malloc(1024);
555582
if (trace_ctx.drop_reason)
556583
sprintf(info, ", reason: %s, %s", reason, sym_str);
@@ -595,7 +622,8 @@ DEFINE_ANALYZER_EXIT(clone, TRACE_MODE_TIMELINE_MASK | TRACE_MODE_DIAG_MASK)
595622
return RESULT_CONSUME;
596623
}
597624

598-
DEFINE_ANALYZER_EXIT(ret, TRACE_MODE_DIAG_MASK)
625+
DEFINE_ANALYZER_EXIT(ret, TRACE_MODE_DIAG_MASK |
626+
TRACE_MODE_MONITOR_MASK)
599627
{
600628
int ret = (int) e->event.val;
601629

@@ -644,7 +672,8 @@ const char *pf_names[] = {
644672
};
645673
DEFINE_ANALYZER_ENTRY(nf, TRACE_MODE_DIAG_MASK |
646674
TRACE_MODE_BASIC_MASK |
647-
TRACE_MODE_TIMELINE_MASK)
675+
TRACE_MODE_TIMELINE_MASK |
676+
TRACE_MODE_MONITOR_MASK)
648677
{
649678
define_pure_event(nf_hooks_event_t, event, e->event);
650679
char *msg = malloc(1024), *extinfo;
@@ -681,7 +710,8 @@ DEFINE_ANALYZER_EXIT_FUNC_DEFAULT(nf)
681710

682711
DEFINE_ANALYZER_ENTRY(iptable, TRACE_MODE_DIAG_MASK |
683712
TRACE_MODE_BASIC_MASK |
684-
TRACE_MODE_TIMELINE_MASK)
713+
TRACE_MODE_TIMELINE_MASK |
714+
TRACE_MODE_MONITOR_MASK)
685715
{
686716
define_pure_event(nf_event_t, event, e->event);
687717
char *msg = malloc(1024);
@@ -702,7 +732,8 @@ DEFINE_ANALYZER_EXIT_FUNC_DEFAULT(iptable)
702732

703733
DEFINE_ANALYZER_ENTRY(qdisc, TRACE_MODE_DIAG_MASK |
704734
TRACE_MODE_BASIC_MASK |
705-
TRACE_MODE_TIMELINE_MASK)
735+
TRACE_MODE_TIMELINE_MASK |
736+
TRACE_MODE_MONITOR_MASK)
706737
{
707738
define_pure_event(qdisc_event_t, event, e->event);
708739
char *msg = malloc(1024);

0 commit comments

Comments
 (0)