基于 BPF 任务迭代器实现零侵入性能分析工具 xstack

1

$sudo apt install make gcc pkg-config libbpf-dev libbpf-tools clang llvm libbfd-dev libelf1 libelf-dev zlib1g-dev rustc cargo

1
2
3
4
5
6

$ git clone https://github.com/tanelpoder/0xtools && cd 0xtools/xstack
# Clone libbpf and blazesym submodules
$ git submodule update --init --recursive

$ make
$./xstack --help

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

$ ./xstack --help

USAGE: xstack -a | -p PID | -t TID [-F HZ] [-i NUM]

EXAMPLES:
  xstack -a           # Sample all tasks continuously
  xstack -p 1234      # Sample process 1234 and its threads
  xstack -t 5678      # Sample only thread 5678
  xstack -a -F 10     # Sample all tasks at 10 Hz
  xstack -a -i 100    # Sample all tasks for 100 iterations
  xstack -p $$ -F 5 -i 25  # Sample shell at 5 Hz for 5 seconds

  -a, --all                  Sample all tasks/threads
  -F, --freq=HZ              Sampling frequency in Hz (default: 1)
  -i, --iterations=NUM       Number of sampling iterations (default: infinite)
  -p, --pid=PID              Filter by process ID (TGID)
  -q, --quiet                Suppress CSV header output
  -r, --reverse-stack        Reverse stack trace order (innermost first)
  -t, --tid=TID              Filter by thread ID (PID)
  -?, --help                 Give this help list
      --usage                Give a short usage message
  -V, --version              Print program version

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98

/* Sleepable task iterator is needed for reading userspace memory of other tasks */
SEC("iter.s/task")
int dump_task(struct bpf_iter__task *ctx)
{
    struct task_struct *task = ctx->task;
    
    // 步骤1：判断过滤模式，检查进程是否符合采集 filter_mode == 0 表示采集所有任务
    __u32 key = 0;
    struct filter_config *cfg = bpf_map_lookup_elem(&config_map, &key);
    __u32 pid = task->pid;
    __u32 tgid = task->tgid;
    
    if (cfg->filter_mode == 1) {  // Filter by TGID (process)
        if (tgid != cfg->target_tgid)
            return 0;
    } else if (cfg->filter_mode == 2) {  // Filter by PID (thread)
        if (pid != cfg->target_pid)
            return 0;
    }

    __u32 state = task->__state;    

    // do not emit IDLE kernel threads
    if ((task->flags & PF_KTHREAD) && (state & TASK_IDLE))
        return 0;
    
    // 步骤2：分配 ringbuf 事件对象，填充进程 tgid、pid、state 和 comm 信息
    struct stack_event *event = bpf_ringbuf_reserve(&events, sizeof(*event), 0);
    
    event->pid = pid;
    event->tgid = tgid;
    event->state = state;

    bpf_probe_read_kernel_str(&event->comm, sizeof(event->comm), task->comm);
    
    // 步骤3：使用 bpf_get_task_stack 辅助函数获取内核空间堆栈
    event->kstack_sz = bpf_get_task_stack(task, event->kstack, 
                                          sizeof(event->kstack), 0);
    if (event->kstack_sz < 0)
        event->kstack_sz = 0;
    else
        event->kstack_sz /= sizeof(__u64);  // Convert bytes to number of entries
    
    // Get userspace stack - need manual unwinding when reading it from other task contexts
    // bpf_get_task_stack with BPF_F_USER_STACK only works for current task in a TP context
    event->ustack_sz = 0;
    
    // 步骤4：获取用户空间进程堆栈，基于 x86_64 或 arm64 实现遍历，主要依赖 bpf_copy_from_user_task 辅助函数
    // Don't try to manually unwind kernel threads as we have a BPF helper for that
    if (!(task->flags & PF_KTHREAD)) {
        // Get the current stack pointer from task's pt_regs
        struct pt_regs *regs = (struct pt_regs *)bpf_task_pt_regs(task);
        if (regs) {
            // Architecture-specific frame pointer unwinding
            #if defined(__TARGET_ARCH_x86)
                // x86_64 stack frame layout:
                // struct stack_frame {
                //     void *rbp;  // next frame pointer
                //     void *rip;  // return address
                // };
                __u64 fp = BPF_CORE_READ(regs, bp);  // Frame pointer (RBP)
                __u64 sp = BPF_CORE_READ(regs, sp);  // Stack pointer (RSP)
                
                for (int i = 0; i < MAX_STACK_DEPTH; i++) {
                    if (!fp || fp < sp || fp > sp + 0x100000) {
                        // Basic sanity check: fp should be above sp and within reasonable range
                        break;
                    }
                    
                    // Read the stack frame
                    __u64 next_fp, ret_addr;
                    if (bpf_copy_from_user_task(&next_fp, sizeof(next_fp), 
                                                (void *)fp, task, 0) < 0) {
                        break;
                    }
                    if (bpf_copy_from_user_task(&ret_addr, sizeof(ret_addr), 
                                                (void *)(fp + 8), task, 0) < 0) {
                        break;
                    }
                    
                    // Store the return address using loop index (verifier-safe)
                    if (i < MAX_STACK_DEPTH) {
                        event->ustack[i] = ret_addr;
                        event->ustack_sz = i + 1;
                    }
                    
                    // Move to next frame
                    fp = next_fp;
                }
            #elif defined(__TARGET_ARCH_arm64)
          			/* ARM64 架构省略 */ 
            #endif
        }
    }
    
    bpf_ringbuf_submit(event, 0);
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

  struct ring_buffer *rb = ring_buffer__new(bpf_map__fd(skel->maps.events),
                           handle_event, NULL, NULL); /*回调函数 handle_event() */

	while (running) {
        if (args.iterations > 0 && iteration >= args.iterations) {
            break;
        }

        struct timespec start_time;
        clock_gettime(CLOCK_MONOTONIC, &start_time);

        int iter_fd = bpf_iter_create(link_fd);
        int ret = read(iter_fd, buf, 1);

        while (ring_buffer__poll(rb, 0) > 0) {
            // Keep processing until no more events
        }

        close(iter_fd);

        // Calculate time spent and adjust sleep
        struct timespec end_time;
        clock_gettime(CLOCK_MONOTONIC, &end_time);

        long elapsed_ns = (end_time.tv_sec - start_time.tv_sec) * 1000000000L +
                         (end_time.tv_nsec - start_time.tv_nsec);

        long sleep_ns = interval_ns - elapsed_ns;
        if (sleep_ns > 0) {
            struct timespec sleep_time = {
                .tv_sec = sleep_ns / 1000000000L,
                .tv_nsec = sleep_ns % 1000000000L,
            };
            nanosleep(&sleep_time, NULL);
        }

        iteration++;
    }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

// Ring buffer callback
static int handle_event(void *ctx, void *data, size_t data_sz)
{
    struct stack_event *e = data;
    struct timespec ts;
  
    clock_gettime(CLOCK_REALTIME, &ts);
    char timestamp[64];
    strftime(timestamp, sizeof(timestamp), "%Y-%m-%d %H:%M:%S", localtime(&ts.tv_sec));
    snprintf(timestamp + strlen(timestamp), sizeof(timestamp) - strlen(timestamp),
             ".%06ld", ts.tv_nsec / 1000);

    // 调用 symbolize_stack 函数对地址符号化处理
    char *ksyms = symbolize_stack(e->kstack, e->kstack_sz, e->pid, true);
    char *usyms = symbolize_stack(e->ustack, e->ustack_sz, e->pid, false);

    // Print CSV values: timestamp,tid,tgid,comm,state,ustack,kstack
    printf("%s|%u|%u|%s|%s|%s|%s\n",
           timestamp,
           e->pid,
           e->tgid,
           e->comm,
           state_to_str(e->state),
           usyms ? usyms : "[no_ustack]",
           ksyms ? ksyms : "[no_kstack]"
        );

    if (ksyms) free(ksyms);
    if (usyms) free(usyms);

    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

static char *symbolize_stack(__u64 *addrs, int count, pid_t pid, bool is_kernel)
{
#ifdef USE_BLAZESYM
    if (!symbolizer || count <= 0)
        return strdup(is_kernel ? "" : "[no_ustack]");

    static char symbuf[65536];  // Large buffer for symbols
    symbuf[0] = '\0';

    const struct blaze_syms *syms = NULL;

    if (is_kernel) {
        struct blaze_symbolize_src_kernel src = {
            .type_size = sizeof(src),
        };
        syms = blaze_symbolize_kernel_abs_addrs(symbolizer, &src,
                                                (const uintptr_t *)addrs, count);
    } else {
        struct blaze_symbolize_src_process src = {
            .type_size = sizeof(src),
            .pid = pid,
        };
        syms = blaze_symbolize_process_abs_addrs(symbolizer, &src,
                                                 (const uintptr_t *)addrs, count);
    }

    if (!syms || syms->cnt == 0) {
        if (syms) blaze_syms_free(syms);
        return strdup(is_kernel ? "[no_ksymbols]" : "[no_usymbols]");
    }

    char *ptr = symbuf;
    size_t remaining = sizeof(symbuf) - 1;

    // Iterate in reverse order if requested
    if (reverse_stack) {
        for (int i = count - 1; i >= 0; i--) {
            if (i < count - 1) {
                if (remaining > 1) {
                    *ptr++ = ';';
                    remaining--;
                }
            }

            if (i < syms->cnt) {
                const struct blaze_sym *sym = &syms->syms[i];
                if (sym->name && sym->name[0]) {
                    int written = snprintf(ptr, remaining, "%s+0x%lx",
                                         sym->name, sym->offset);
                    if (written > 0 && written < remaining) {
                        ptr += written;
                        remaining -= written;
                    }
                } else {
                    int written = snprintf(ptr, remaining, "0x%llx", addrs[i]);
                    if (written > 0 && written < remaining) {
                        ptr += written;
                        remaining -= written;
                    }
                }
            } else {
                int written = snprintf(ptr, remaining, "0x%llx", addrs[i]);
                if (written > 0 && written < remaining) {
                    ptr += written;
                    remaining -= written;
                }
            }
        }
    } else { 
      /*正序*/
    }

    *ptr = '\0';
    blaze_syms_free(syms);
    return strdup(symbuf);
}