Learning eBPF

#!/usr/bin/python
from bcc import BPF
from time import sleep

program_hello_map = r"""
// define a hash table to store counter data.
BPF_HASH(counter_table);

int hello(void *ctx) {
    u64 uid;
    u64 counter = 0;
    u64 *p;

    // a ebpf helper function to obtain uid of current process
    uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
    // update hashtable
    p = counter_table.lookup(&uid);
    if (p != 0) {
        counter = *p;
    }
    counter ++;
    counter_table.update(&uid, &counter);
    return 0;
}
"""

b = BPF(text=program_hello_map)
# execve is only an interface in linux kernel, 
# the specific function names vary across different architectures,
# thus we should find the function name before attaching it.
syscall = b.get_syscall_fnname("execve")
# attach to execve syscall
b.attach_kprobe(event=syscall, fn_name=b"hello")

while True:
    sleep(2)
    s = ""
    # read from hash table
    for k,v in b["counter_table"].items():
        s += f"ID: {k.value} - {v.value}\t"
    print(s)

from bcc import BPF

bpf_code = r"""
BPF_RINGBUF_OUTPUT(output,1);

struct data_t {
    int pid;
    int uid;
    char command[16];
    char message[12];
};

int hello(void *ctx) {
    struct data_t data = {};
    char message[] = "Hello, perf_event!";
    data.pid = bpf_get_current_pid_tgid() >> 32;
    data.uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;

    bpf_get_current_comm(&data.command, sizeof(data.command));
    bpf_probe_read_kernel(&data.message, sizeof(data.message), message);
    // write data into ring buffer
    output.ringbuf_output(&data, sizeof(data), 0);
    return 0;
}
"""

b = BPF(text=bpf_code)
syscall = b.get_syscall_fnname("execve")
b.attach_kprobe(event=syscall, fn_name=b"hello")

def print_event(cpu, data, size):
    # generate the data structure from C declaration automatically
    # This conversion allows the Python program to access the fields (pid, uid, command, message) of the data_t structure as attributes of the data object in Python.
    data = b["output"].event(data)
    print(f"{data.pid} {data.uid} {data.command.decode()} {data.message.decode()}")

# callback function after reading data
b["output"].open_ring_buffer(print_event)
while True:
    # read from ring buffer, every execution will trigger callback function print_event
    b.ring_buffer_poll()

from bcc import BPF
import ctypes as ct

bpf_code = """
// define maps of type BPF_MAP_TYPE_PROG_ARRAY
BPF_PROG_ARRAY(syscall, 300);

int hello(struct bpf_raw_tracepoint_args *ctx) {
    // get opcode of syscall
    int opcode = ctx->args[1];
    // different tail call according to opcode
    // This line will be replaced with bpf_tail_call() helper function by bcc bofore compiling.
    syscall.call(ctx, opcode);
    // If there is no matched program, then continue execution.
    bpf_trace_printk("Another syscall: %d", opcode);
    return 0;
}

int hello_exec(void *ctx) {
    bpf_trace_printk("execve syscall");
    return 0;
}

int hello_timer(struct bpf_raw_tracepoint_args *ctx) {
    if (ctx->args[1] == 222) {
        bpf_trace_printk("Create a timer");
    } else if (ctx->args[1] == 226) {
        bpf_trace_printk("Delete a timer");
    } else {
        bpf_trace_printk("Aome other timer opration");
    }
    return 0;
}

int ignore_opcode(void *ctx) {
    return 0;
}
"""

b = BPF(text=bpf_code)

# This time, we attach ebpf program to tracepoint named sys_enter rather than a kprobe
b.attach_raw_tracepoint(tp=b"sys_enter", fn_name=b"hello")

# Get file descriptors of functions
ignore_fn = b.load_func("ignore_opcode", BPF.RAW_TRACEPOINT)
exec_fn = b.load_func("hello_exec", BPF.RAW_TRACEPOINT)
timer_fn = b.load_func("hello_timer", BPF.RAW_TRACEPOINT)

prog_array = b.get_table("syscall")

# put descriptors into map of syscalls
prog_array[ct.c_int(59)] = ct.c_int(exec_fn.fd)
prog_array[ct.c_int(222)] = ct.c_int(timer_fn.fd)
prog_array[ct.c_int(223)] = ct.c_int(timer_fn.fd)
prog_array[ct.c_int(224)] = ct.c_int(timer_fn.fd)
prog_array[ct.c_int(225)] = ct.c_int(timer_fn.fd)
prog_array[ct.c_int(226)] = ct.c_int(timer_fn.fd)

# Ignore some syscalls that come up a lot
prog_array[ct.c_int(21)] = ct.c_int(ignore_fn.fd)
# ......
prog_array[ct.c_int(291)] = ct.c_int(ignore_fn.fd)

b.trace_print()

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

int counter = 0;

// define that this is an eXpress Data Path (XDP) program
SEC("xdp")
int hello(void *ctx) {
	counter++;
    // same as bpf_trace_printk() in bcc, both of them are wrappers around kernel function `bpf_trace_printk` 
	bpf_printk("Helloworld %d", counter);
	return XDP_PASS;
}

// define license for this program
char _license[] SEC("license") = "GPL";

# compile, here we got the bytecode of the program
clang -O2 -target bpf -c hello.bpf.c -o hello.bpf.o
# load program into kernel, here the bytecode will be transformed to machine code.
bpftool prog load hello.bpf.o /sys/fs/bpf/hello
# inspect the loaded program
bpftool prog list
bpftool prog show id 95 --pretty
bpftool prog show name hello
# attach to XDP event on a network interface
bpftool net attach xdp id 95 dev enp0s31f6
# check the program
bpftool net list
# check the output
cat /sys/kernel/debug/tracing/trace_pipe
# check the global variable counter
bpftool map dump name hello.bss
# detach the program
bpftool net detach xdp dev enp0s31f6

# load program into kernel
bpftool prog load hello.bpf.o /sys/fs/bpf/hello
# inspect the loaded program
bpftool prog list
bpftool prog show id 95 --pretty
bpftool prog show name hello
# attach to XDP event on a network interface
bpftool net attach xdp id 95 dev enp0s31f6
# check the program
bpftool net list
# check the global variable counter
bpftool map dump name hello.bss
# detach the program
bpftool net detach xdp dev enp0s31f6

# list btf (bpf type format)
bpftool btf list
# inspect  the contents of BTF information
bpftool btf dump id 251
# generate header file from BTF information
bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>

char message[12] = "Hello World";

struct {
    __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
    __uint(key_size, sizeof(u32));
    __uint(value_size, sizeof(u32));
} output SEC(".maps");

struct data_t {
   int pid;
   int uid;
   char command[16];
   char message[12];
   char path[16];
};

struct user_msg_t {
    char message[12];
};

// This structure is used to define the map, not map itself
// however, my_config can be the map's reference
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 10240);
    __type(key, u32);
    __type(value, struct user_msg_t);
} my_config SEC(".maps");

// Tells the loader to attach to the program to the kprobe in the execve syscall
// BPF_KPROBE_SYSCALL is a macro that expands to the correct BPF program type
// The first argument is the name of the program: hello
// The second argument is the executable pathname for execve syscall
SEC("ksyscall/execve")
int BPF_KPROBE_SYSCALL(hello, const char *pathname) {
    struct data_t data = {};
    struct user_msg_t *p;

    data.pid = bpf_get_current_pid_tgid() >> 32;
    data.uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;

    bpf_get_current_comm(&data.command, sizeof(data.command));
    bpf_probe_read_user_str(&data.path, sizeof(data.path), pathname);

    // my_config is the map's reference
    p = bpf_map_lookup_elem(&my_config, &data.uid);
    if (p != 0) {
        bpf_probe_read_kernel_str(&data.message, sizeof(data.message),
                                  p->message);
    } else {
        bpf_probe_read_kernel_str(&data.message, sizeof(data.message), message);
    }

	// submit the data to the user space
    bpf_perf_event_output(ctx, &output, BPF_F_CURRENT_CPU, &data, sizeof(data));
    return 0;
}

char LICENSE[] SEC("license") = "Dual BSD/GPL";

bpftool prog load hello.bpf.o /sys/fs/bpf/hello