跟踪epoll 唤醒回调fd打印socket 地址和事件

zengxiaobai

已于 2022-10-18 10:39:24 修改

阅读量209

点赞数

分类专栏：内核-ebpf 文章标签： systemtap

于 2022-10-17 19:27:47 首次发布

本文链接：https://blog.csdn.net/qq_39015563/article/details/127373312

版权

内核-ebpf 专栏收录该内容

5 篇文章 0 订阅

订阅专栏

%{
#include <net/inet_connection_sock.h>
#include <net/inet_sock.h>
%}

%{
#ifndef NIPQUAD
#define NIPQUAD(addr) \
    ((unsigned char *)&addr)[0], \
    ((unsigned char *)&addr)[1], \
    ((unsigned char *)&addr)[2], \
    ((unsigned char *)&addr)[3]
#endif
#ifndef NIPQUAD_FMT
#define NIPQUAD_FMT "%u.%u.%u.%u"
#endif
%}


function verify_socket(socket_param : long) %{
    struct socket *sock = (typeof(sock))STAP_ARG_socket_param;
    struct sock *sk = sock->sk;
    struct inet_sock *isk = inet_sk(sk);
    u16 dport = isk->inet_dport;
    dport = (dport >> 8)|((dport << 8) & 0x00FF00);

    _stp_printf("\nsocket: local IP: " NIPQUAD_FMT ", local port:%u, dst IP:  " NIPQUAD_FMT ", dst port:%u\n", NIPQUAD(isk->inet_rcv_saddr), isk->inet_num, NIPQUAD(isk->inet_daddr), dport);

%}

probe kernel.statement("ep_poll_callback@fs/eventpoll.c:1183") {
    if(execname() == "XXX") {
        base_epitem = @container_of($wait, "struct eppoll_entry", wait)->base;
        file = base_epitem->ffd->file
        if(file->f_op == &@var("socket_file_ops@net/socket.c")) {
             //printf("%s %d %d %u %u\n",execname(), pid(),tid(), base_epitem->ffd->fd, base_epitem->event->events)

             private_data = file->private_data
             if(private_data != 0) {
                socket_sk = @cast(private_data, "struct socket")->sk
                sk_common_family = @cast(socket_sk, "struct sock")->__sk_common->skc_family

                if(sk_common_family == 2) {
                    verify_socket(private_data)
          qu          printf("%s %d %d %u %u\n",execname(), pid(),tid(), base_epitem->ffd->fd, base_epitem->event->events)
                    if(base_epitem->event->events & 0x00000001) {
                        printf("%s %d %d %u %u epoll:EPOLL_IN %ul\n",execname(), pid(),tid(), base_epitem->ffd->fd, base_epitem->event->events, $key)
                    } else {
                    if(base_epitem->event->events & 0x00000004) {
                        printf("%s %d %d %u %u epoll:EPOLL_OUT %ul\n",execname(), pid(),tid(), base_epitem->ffd->fd, base_epitem->event->events, $key)
                    }
                    }
                }
             }

        }
    }


}

全局变量： @var(“socket_file_ops@net/socket.c”))
stap -l ‘kernel.statement(“ep_poll_callback@fs/eventpoll.c:.*”)’
stap -L ‘kernel.statement(“ep_poll_callback@fs/eventpoll.c:.**”)’
根据fd 打印socket 地址：https://blog.csdn.net/justlinux2010/article/details/17653601