eBPF Talk: 使用 drgn 学习 bpf

drgn 是 Linux 系统可编程的调试器，基于 Python 脚本简单、便利地读取内核数据结构和变量。

理所当然地，drgn 可以用来学习 bpf，用来 inspect bpf map、bpf program、bpf link 等对象。

P.S. 以下内容基于 drgn PR 提供的功能。

inspect bpf map

类似 bpftool map list，可以使用 drgn 来查看 bpf map 的信息。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


# drgn ./contrib/bpf_inspect.py m
     2: BPF_MAP_TYPE_PROG_ARRAY          hid_jmp_table
  4207: BPF_MAP_TYPE_PROG_ARRAY          jmp_table
  4208: BPF_MAP_TYPE_ARRAY               tailcall.bss
  4247: BPF_MAP_TYPE_PROG_ARRAY          jmp_table
  4248: BPF_MAP_TYPE_ARRAY               tailcall.bss
  5092: BPF_MAP_TYPE_ARRAY               .rodata

# drgn ./contrib/bpf_inspect.py m --show-details
     2: BPF_MAP_TYPE_PROG_ARRAY          hid_jmp_table
    owner:    BPF_PROG_TYPE_TRACING            JITed
  4207: BPF_MAP_TYPE_PROG_ARRAY          jmp_table
    owner:    BPF_PROG_TYPE_SCHED_CLS          JITed
    poke:       2295: BPF_PROG_TYPE_EXT                entry                            tail_call_reachable
  4208: BPF_MAP_TYPE_ARRAY               tailcall.bss
  4247: BPF_MAP_TYPE_PROG_ARRAY          jmp_table
    owner:    BPF_PROG_TYPE_SCHED_CLS          JITed
    poke:       2400: BPF_PROG_TYPE_EXT                entry                            tail_call_reachable
  4248: BPF_MAP_TYPE_ARRAY               tailcall.bss
  5092: BPF_MAP_TYPE_ARRAY               .rodata

如果想要 inspect 具体的 bpf map 呢？

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53


# drgn ./contrib/bpf_inspect.py i
For help, type help(drgn).
>>> import drgn
>>> from drgn import NULL, Object, cast, container_of, execscript, offsetof, reinterpret, sizeof, stack_trace
>>> from drgn.helpers.common import *
>>> from drgn.helpers.linux import *
>>> list_bpf_maps()
     2: BPF_MAP_TYPE_PROG_ARRAY          hid_jmp_table
  4207: BPF_MAP_TYPE_PROG_ARRAY          jmp_table
  4208: BPF_MAP_TYPE_ARRAY               tailcall.bss
  4247: BPF_MAP_TYPE_PROG_ARRAY          jmp_table
  4248: BPF_MAP_TYPE_ARRAY               tailcall.bss
  5092: BPF_MAP_TYPE_ARRAY               .rodata
>>> m = get_bpf_map_by_id(4247)
>>> print(m.map.format_())
*(struct bpf_map *)0xffff990290259400 = {
    .ops = (const struct bpf_map_ops *)prog_array_map_ops+0x0 = 0xffffffff8583cc20,
    .inner_map_meta = (struct bpf_map *)0x0,
    .security = (void *)0x0,
    .map_type = (enum bpf_map_type)BPF_MAP_TYPE_PROG_ARRAY,
    .key_size = (u32)4,
    .value_size = (u32)4,
    .max_entries = (u32)1,
    .map_extra = (u64)0,
    .map_flags = (u32)0,
    .id = (u32)4247,
    .record = (struct btf_record *)0x0,
    .numa_node = (int)-1,
    .btf_key_type_id = (u32)0,
    .btf_value_type_id = (u32)0,
    .btf_vmlinux_value_type_id = (u32)0,
    .btf = (struct btf *)0x0,
    .objcg = (struct obj_cgroup *)0xffff990290f48540,
    .name = (char [16])"jmp_table",
    // ...
}
>>> arr = BpfProgArrayMap(m.map)
>>> print(arr.prog_array.format_())
*(struct bpf_array *)0xffff990290259400 = {
    .map = (struct bpf_map){
        .ops = (const struct bpf_map_ops *)prog_array_map_ops+0x0 = 0xffffffff8583cc20,
        // ...
    },
    .elem_size = (u32)8,
    .index_mask = (u32)0,
    .aux = (struct bpf_array_aux *)0xffff9902885134e0,
    .__empty_value = (struct <anonymous>){},
    .value = (char []){},
    .__empty_ptrs = (struct <anonymous>){},
    .ptrs = (void *[]){},
    .__empty_pptrs = (struct <anonymous>){},
    .pptrs = (void *[]){},
}

inspect bpf program

类似 bpftool prog list，可以使用 drgn 来查看 bpf program 的信息。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


# drgn ./contrib/bpf_inspect.py p
     2: BPF_PROG_TYPE_TRACING            hid_tail_call
  2295: BPF_PROG_TYPE_EXT                entry                            tail_call_reachable
  2400: BPF_PROG_TYPE_EXT                entry                            tail_call_reachable
  4235: BPF_PROG_TYPE_SCHED_CLS          entry1

# drgn ./contrib/bpf_inspect.py p --show-details
     2: BPF_PROG_TYPE_TRACING            hid_tail_call
    used map:      2: BPF_MAP_TYPE_PROG_ARRAY          hid_jmp_table
    ksym:     bpf_prog_7cc47bbf07148bfe_hid_tail_call  0x00ffffffffc009e948 105 bytes
  2295: BPF_PROG_TYPE_EXT                entry                            tail_call_reachable
    used map:   4208: BPF_MAP_TYPE_ARRAY               tailcall.bss
    used map:   4207: BPF_MAP_TYPE_PROG_ARRAY          jmp_table
    ksym:     bpf_prog_0c0f4c2413ef19b1_entry          0x00ffffffffc00b4720 74 bytes
    func[ 1]:      0: BPF_PROG_TYPE_EXT                subprog_tail
    funcksym: bpf_prog_3a140cef239a4b4f_subprog_tail   0x00ffffffffc00b4788 76 bytes
  2400: BPF_PROG_TYPE_EXT                entry                            tail_call_reachable
    used map:   4248: BPF_MAP_TYPE_ARRAY               tailcall.bss
    used map:   4247: BPF_MAP_TYPE_PROG_ARRAY          jmp_table
    ksym:     bpf_prog_0c0f4c2413ef19b1_entry          0x00ffffffffc00af864 74 bytes
    func[ 1]:      0: BPF_PROG_TYPE_EXT                subprog_tail
    funcksym: bpf_prog_3a140cef239a4b4f_subprog_tail   0x00ffffffffc00b3fdc 76 bytes
  4235: BPF_PROG_TYPE_SCHED_CLS          entry1
    used map:   5092: BPF_MAP_TYPE_ARRAY               .rodata
    ksym:     bpf_prog_e20a685998fd41c8_entry1         0x00ffffffffc009ece0 26 bytes
    func[ 1]:      0: BPF_PROG_TYPE_SCHED_CLS          subprog1
    funcksym: bpf_prog_9e6e84b2270d0b1f_subprog1       0x00ffffffffc009ed0c 36 bytes
    func[ 2]:      0: BPF_PROG_TYPE_SCHED_CLS          subprog2
    funcksym: bpf_prog_9e6e84b2270d0b1f_subprog2       0x00ffffffffc009ed48 36 bytes

如果想要 inspect 具体的 bpf program 呢？

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


# drgn ./contrib/bpf_inspect.py i
For help, type help(drgn).
>>> import drgn
>>> from drgn import NULL, Object, cast, container_of, execscript, offsetof, reinterpret, sizeof, stack_trace
>>> from drgn.helpers.common import *
>>> from drgn.helpers.linux import *
>>> list_bpf_progs()
     2: BPF_PROG_TYPE_TRACING            hid_tail_call
  2295: BPF_PROG_TYPE_EXT                entry                            tail_call_reachable
  2400: BPF_PROG_TYPE_EXT                entry                            tail_call_reachable
  4235: BPF_PROG_TYPE_SCHED_CLS          entry1
>>> p = get_bpf_prog_by_id(2400)
>>> print(p.prog.format_())
*(struct bpf_prog *)0xffffb2e08075a000 = {
    .pages = (u16)1,
    .jited = (u16)1,
    .jit_requested = (u16)1,
    .gpl_compatible = (u16)1,
    .cb_access = (u16)1,
    .dst_needed = (u16)0,
    .blinding_requested = (u16)0,
    .blinded = (u16)0,
    .is_func = (u16)0,
    .kprobe_override = (u16)0,
    .has_callchain_buf = (u16)0,
    .enforce_expected_attach_type = (u16)0,
    .call_get_stack = (u16)0,
    .call_get_func_ip = (u16)0,
    .tstamp_type_access = (u16)0,
    .type = (enum bpf_prog_type)BPF_PROG_TYPE_EXT,
    .expected_attach_type = (enum bpf_attach_type)BPF_CGROUP_INET_INGRESS,
    .len = (u32)20,
    .jited_len = (u32)74,
    .tag = (u8 [8]){ 12, 15, 76, 36, 19, 239, 25, 177 },
    .stats = (struct bpf_prog_stats *)0x4a590,
    .active = (int *)0x4a24c,
    .bpf_func = (unsigned int (*)(const void *, const struct bpf_insn *))0xffffffffc00af864,
    .aux = (struct bpf_prog_aux *)0xffff9902bbdbb800,
    .orig_prog = (struct sock_fprog_kern *)0x0,
    .__empty_insns = (struct <anonymous>){},
    .insns = (struct sock_filter []){},
    .__empty_insnsi = (struct <anonymous>){},
    .insnsi = (struct bpf_insn []){},
}
>>> print(p.prog.aux.format_())
*(struct bpf_prog_aux *)0xffff9902bbdbb800 = {
    .refcnt = (atomic64_t){
        .counter = (s64)1,
    },
    .used_map_cnt = (u32)2,
    // ...
    .stack_depth = (u32)0,
    .id = (u32)2400,
    // ...
    .name = (char [16])"entry",
    // ...
}

inspect bpf link

类似 bpftool link list，可以使用 drgn 来查看 bpf link 的信息。

1
2
3
4


# drgn ./contrib/bpf_inspect.py l --show-details
     1: BPF_LINK_TYPE_TRACING
    prog:        2: BPF_PROG_TYPE_TRACING            hid_tail_call
    attach:   __hid_bpf_tail_call

如果想要 inspect 具体的 bpf link 呢？

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


# drgn ./contrib/bpf_inspect.py i
For help, type help(drgn).
>>> import drgn
>>> from drgn import NULL, Object, cast, container_of, execscript, offsetof, reinterpret, sizeof, stack_trace
>>> from drgn.helpers.common import *
>>> from drgn.helpers.linux import *
>>> list_bpf_links()
     1: BPF_LINK_TYPE_TRACING
    prog:        2: BPF_PROG_TYPE_TRACING            hid_tail_call
    attach:   __hid_bpf_tail_call
>>> l = get_bpf_link_by_id(1)
>>> print(l.link.format_())
*(struct bpf_link *)0xffff990282c31200 = {
    .refcnt = (atomic64_t){
        .counter = (s64)1,
    },
    .id = (u32)1,
    .type = (enum bpf_link_type)BPF_LINK_TYPE_TRACING,
    .ops = (const struct bpf_link_ops *)bpf_tracing_link_lops+0x0 = 0xffffffff85839000,
    .prog = (struct bpf_prog *)0xffffb2e080075000,
    // ...
}
>>> t = BpfTracingLink(l.link)
>>> print(t.tracing.format_())
*(struct bpf_tracing_link *)0xffff990282c31200 = {
    .link = (struct bpf_tramp_link){
        .link = (struct bpf_link){
            .refcnt = (atomic64_t){
                .counter = (s64)1,
            },
            .id = (u32)1,
            .type = (enum bpf_link_type)BPF_LINK_TYPE_TRACING,
            .ops = (const struct bpf_link_ops *)bpf_tracing_link_lops+0x0 = 0xffffffff85839000,
            .prog = (struct bpf_prog *)0xffffb2e080075000,
            // ...
        },
        .tramp_hlist = (struct hlist_node){
            .next = (struct hlist_node *)0x0,
            .pprev = (struct hlist_node **)0xffff990282c30ed0,
        },
        .cookie = (u64)0,
    },
    .attach_type = (enum bpf_attach_type)BPF_MODIFY_RETURN,
    .trampoline = (struct bpf_trampoline *)0xffff990282c30e40,
    .tgt_prog = (struct bpf_prog *)0x0,
}

总结

drgn 是一个强大的调试工具，可以用来 inspect bpf map、bpf program、bpf link 等对象。

eBPF Talk: 使用 drgn 学习 bpf

文章目录

inspect bpf map

inspect bpf program

inspect bpf link

总结

知识星球

星球里的专栏：

《XDP 进阶手册》