声明
这篇文章主要的聚焦点在BPF,经过2017年的快速发展后,现在到了eBPF阶段。
首先,参考这里
install
If you install the bcc from source code,now i have some terrible question to resolve it.So, i recommended you install it from package manager.
here To see section 5.1 bcc tools will be installed under /usr/share/bcc/tools
run
Way 1: run it under /usr/share/bcc/tools
Way 2: git clone iovisor, if it does right, you can run command of bcc directly.
BPF vertifier
Rules:
-
Providing a verdict for kernel whether safe to run
-
Simulation of exection of all paths of the program
-
Steps involved(extract):
-
Control flow graph
-
Out of range jumps, unreachable instructions
-
Contxt, initialized memory, stack spill
-
Pointer checking
-
Verifying helper function call arguments
-
Value and aligment tracking for data access
-
Living analysis register
-
Reducing verification complexity
-
Generlly, there is two check, The first check is : check_cfg()(Do you remember DFS?). It is check wheather is DAG(Directed Acyclic Graph).
The second check is do_check(): register, memory, function, branch(<1024),instructions < 96K
BPF JIT
C -> LLVM -> BPF -> loader -> verifier -> JIT -> tx/XDP -> offload
BPF registers mapped to CPU register 1:1
-
R0 -> return value from helper call
-
R1-R5 -> argument registers for helper call
-
R6-R9 -> callee saved, preserved on helper call
-
R10 -> Read only, as stack pointer
BPF encoding
MSB(most significant bit) 最高有效位 LSB(least significant bit) 最低有效位
From least significant to most significant bit:
MSB<——>LSB
8 bit opcode
4 bit destination register (dst)
4 bit source register (src)
16 bit offset
32 bit immediate (imm)
Notes: Most instructions do not use all of these fields. Unused fields should be zeroed.
llvm
The context will be describe in Documents/bpf/bpf_devel_QA.txt llvm section.
Reference
-
内核中高速包过滤 讨论了内核中包过滤的几种方式,尤其是bpf and xdp,介绍了DDos防御功能
http://www.brendangregg.com/blog/2015-05-15/ebpf-one-small-step.html
https://blog.yadutaf.fr/2016/03/30/turn-any-syscall-into-event-introducing-ebpf-kernel-probes/
http://www.brendangregg.com/Slides/Velocity2017_BPF_superpowers.pdf