kvm_watcher:添加对容器的系统调用相关信息采集

eBPF_Supermarket/kvm_watcher/include/bpf/container.h

@@ -0,0 +1,127 @@
+// Copyright 2023 The LMP Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://github.com/linuxkerneltravel/lmp/blob/develop/LICENSE
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// author: [email protected]
+//
+// Kernel space BPF program used for counting container sys_entry/sys_exit info.
+
+#ifndef __CONTAINER_H
+#define __CONTAINER_H
+
+#include "common.h"
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_core_read.h>
+#include <bpf/bpf_tracing.h>
+struct {
+    __uint(type,BPF_MAP_TYPE_HASH);
+    __uint(max_entries, 8192);
+    __type(key, pid_t);
+    __type(value, u64);
+}time_info SEC(".maps");
+struct {
+    __uint(type,BPF_MAP_TYPE_HASH);
+    __uint(max_entries, 8192);
+    __type(key, pid_t);
+    __type(value, u64);
+}id SEC(".maps");
+static int trace_container_sys_entry(struct trace_event_raw_sys_enter *args){
+    u64 st = bpf_ktime_get_ns();
+    pid_t pid = bpf_get_current_pid_tgid();
+    u64 syscall_id = (u64)args->id;
+    bpf_map_update_elem(&time_info,&pid,&st,BPF_ANY);
+    bpf_map_update_elem(&id,&pid,&syscall_id,BPF_ANY);
+    return 0;
+}
+static int trace_container_sys_exit(struct trace_event_raw_sys_exit *args,void *rb,struct common_event *e){
+    u64 exit_time = bpf_ktime_get_ns();
+    pid_t pid = bpf_get_current_pid_tgid();
+    //bpf_printk("pid=%15d\n",pid);
+    u64 delay,start_time,syscallid;
+    u64 *st = bpf_map_lookup_elem(&time_info,&pid);
+    if( st !=0){
+        start_time = *st;
+		delay = (exit_time - start_time)/1000;
+		bpf_map_delete_elem(&time_info, &pid);
+	}else{ 
+		return 0;
+	}
+    u64 *sc_id = bpf_map_lookup_elem(&id,&pid);
+    if( sc_id !=0){
+        syscallid = *sc_id;
+		bpf_map_delete_elem(&id, &pid);
+	}else{ 
+		return 0;
+	}
+    RESERVE_RINGBUF_ENTRY(rb, e);
+    e->syscall_data.delay = delay;
+    //bpf_get_current_comm(&e->syscall_data.comm, sizeof(e->syscall_data.comm));
+    e->syscall_data.pid = pid;
+    e->syscall_data.syscall_id = syscallid;
+    bpf_ringbuf_submit(e, 0);
+    return 0;
+}
+#define MAX_NODENAME_LEN 64
+struct data_t {
+    char nodename[MAX_NODENAME_LEN];
+};
+// 字符串比较函数
+static bool str_not_equal(const char *s1, const char *s2) {
+    #pragma clang loop unroll(full)
+    for (int i = 0; i < MAX_NODENAME_LEN; i++) {
+        if (s1[i] != s2[i]) {
+            return true;
+        }
+        if (s1[i] == '\0') {
+            break;
+        }
+    }
+    return false;
+}
+static bool is_container_task(){
+    struct task_struct *task;
+    struct nsproxy *ns;
+    struct uts_namespace *uts;
+    struct data_t data = {};
+
+    // 获取当前任务的 task_struct
+    task = (struct task_struct *)bpf_get_current_task();
+
+    // 获取 nsproxy
+    bpf_probe_read_kernel(&ns, sizeof(ns), &task->nsproxy);
+    if (!ns) {
+        return false;
+    }
+
+    // 获取 uts_namespace
+    bpf_probe_read_kernel(&uts, sizeof(uts), &ns->uts_ns);
+    if (!uts) {
+        return false;
+    }
+
+    // 读取主机名
+    bpf_probe_read_kernel_str(&data.nodename, sizeof(data.nodename), uts->name.nodename);
+
+    // 打印主机名
+    //bpf_printk("Hostname: %s\n", data.nodename);
+    const char target_nodename[] = "yys-virtual-machine";
+    if (str_not_equal(data.nodename, target_nodename)) {
+        bpf_printk("Hostname: %s\n", data.nodename);
+        return true;
+    } else {
+        return false;
+    }
+
+}
+#endif /* __CONTAINER_H */

eBPF_Supermarket/kvm_watcher/include/common.h

@@ -1,4 +1,4 @@
-// Copyright 2023 The LMP Authors.
+// Copyright 2023 The LMP Authors.#define TASK_COMM_
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -94,6 +94,7 @@ static const char binary_path[] = "/bin/qemu-system-x86_64";
 
 #define PFERR_RSVD_MASK (1UL << 3)  // mmio
 
+
 // 定时器模式
 #define APIC_LVT_TIMER_ONESHOT (0 << 17)      // 单次触发
 #define APIC_LVT_TIMER_PERIODIC (1 << 17)     // 周期性触发模式
@@ -232,6 +233,7 @@ struct process {
     char comm[TASK_COMM_LEN];
 };
 
+
 enum EventType {
     NONE_TYPE,
     VCPU_WAKEUP,
@@ -244,6 +246,7 @@ enum EventType {
     IRQ_INJECT,
     HYPERCALL,
     IOCTL,
+    CONTAINER_SYSCALL,
     TIMER,
 } event_type;
 
@@ -342,6 +345,13 @@ struct common_event {
             __u32 vcpu_id;
             // HYPERCALL 特有成员
         } hypercall_data;
+
+        struct{
+            __u64 pid;
+            __u64 syscall_id;
+            __u64 delay;
+
+        } syscall_data;
     };
 };
 

eBPF_Supermarket/kvm_watcher/src/kvm_watcher.bpf.c

@@ -27,6 +27,7 @@
 #include "kvm_mmu.h"
 #include "kvm_irq.h"
 #include "kvm_hypercall.h"
+#include "container.h"
 
 char LICENSE[] SEC("license") = "Dual BSD/GPL";
 
@@ -243,3 +244,27 @@ int BPF_KPROBE(kp_start_sw_timer, struct kvm_lapic *apic) {
     CHECK_PID(vm_pid);
     return trace_start_sw_timer(apic);
 }
+
+//采集容器的系统用调用信息
+SEC("tracepoint/raw_syscalls/sys_enter")
+int tp_container_sys_entry(struct trace_event_raw_sys_enter *args){
+    //过滤进程
+    bool is_container = is_container_task();
+    if(is_container){
+        return trace_container_sys_entry(args);
+    }else{
+        return 0;
+    }
+
+}
+SEC("tracepoint/raw_syscalls/sys_exit")
+int tracepoint__syscalls__sys_exit(struct trace_event_raw_sys_exit *args){
+    //过滤进程
+    bool is_container = is_container_task();
+    if(is_container){
+        return trace_container_sys_exit(args,&rb,e);
+    }else{
+        return 0;
+    }
+
+}

eBPF_Supermarket/kvm_watcher/src/kvm_watcher.c

@@ -329,6 +329,7 @@ static struct env {
     bool execute_timer;
     bool verbose;
     bool show;
+    bool execute_container_syscall;
     int monitoring_time;
     pid_t vm_pid;
     enum EventType event_type;
@@ -349,6 +350,7 @@ static struct env {
     .monitoring_time = 0,
     .vm_pid = -1,
     .show = false,
+    .execute_container_syscall = false,
     .event_type = NONE_TYPE,
 };
 
@@ -359,6 +361,7 @@ int option_selected = 0;  // 功能标志变量,确保激活子功能
 // 具体解释命令行参数
 static const struct argp_option opts[] = {
     {"vcpu_wakeup", 'w', NULL, 0, "Monitoring the wakeup of vcpu."},
+    {"container_syscall", 'a', NULL, 0, "Monitoring the syscall of container."},
     {"vcpu_load", 'o', NULL, 0, "Monitoring the load of vcpu."},
     {"vm_exit", 'e', NULL, 0,
      "Monitoring the event of vm exit(including exiting to KVM and user "
@@ -392,6 +395,9 @@ static error_t parse_arg(int key, char *arg, struct argp_state *state) {
         case 's':
             env.show = true;
             break;
+        case 'a':
+            SET_OPTION_AND_CHECK_USAGE(option_selected, env.execute_container_syscall);
+            break;
         case 'H':
             argp_state_help(state, stderr, ARGP_HELP_STD_HELP);
             break;
@@ -516,6 +522,8 @@ static int determineEventType(struct env *env) {
         env->event_type = VCPU_LOAD;
     } else if (env->execute_timer) {
         env->event_type = TIMER;
+    }else if(env->execute_container_syscall){
+        env->event_type = CONTAINER_SYSCALL;
     } else {
         env->event_type = NONE_TYPE;  // 或者根据需要设置一个默认的事件类型
     }
@@ -544,6 +552,11 @@ static int handle_event(void *ctx, void *data, size_t data_sz) {
         case VCPU_LOAD: {
             break;
         }
+        case CONTAINER_SYSCALL:{
+            printf("%-15u %-15lld %-15lld \n",
+            e->syscall_data.pid,e->syscall_data.delay,e->syscall_data.syscall_id);
+            break;
+        }
         case HALT_POLL: {
             // 使用 e->halt_poll_data 访问 HALT_POLL 特有成员
             printf("%-18.6f %-15s %-6d/%-8d %-10s %-7d %-7d --> %d \n",
@@ -754,6 +767,10 @@ static int print_event_head(struct env *env) {
                    "DUR_HALT(ms)", "COMM", "PID/TID", "VCPU_ID", "WAIT/POLL",
                    "VAILD?");
             break;
+        case CONTAINER_SYSCALL:
+            printf("%-8s %-18s %6s %15s\n", "PID",
+                   "DELAY(ns)", "SyscallID", "COMM");
+            break;
         case EXIT:
             //可视化调整输出格式
             // printf("Waiting vm_exit ... \n");
@@ -862,7 +879,10 @@ static void set_disable_load(struct kvm_watcher_bpf *skel) {
     if (env.execute_hypercall) {
         SET_KP_OR_FENTRY_LOAD(kvm_emulate_hypercall, kvm);
     }
-
+    bpf_program__set_autoload(skel->progs.tp_container_sys_entry,
+                              env.execute_container_syscall ? true : false);
+    bpf_program__set_autoload(skel->progs.tracepoint__syscalls__sys_exit,
+                              env.execute_container_syscall ? true : false);                         
     bpf_program__set_autoload(skel->progs.tp_vcpu_wakeup,
                               env.execute_vcpu_wakeup ? true : false);
     bpf_program__set_autoload(skel->progs.tp_exit,