An eBPF-based short process stack analysis method, device and equipment

Abstract

The application relates to the technical field of operating systems, and discloses a stack analysis method, device and equipment for a short process based on eBPF, which comprises the following steps: in response to eBPF running to a preset position, obtaining a plurality of stack addresses of a target process and a pointer of a task structure corresponding to the target process, the task structure storing information of the target process; based on the pointer, obtaining a memory linked list of the target process from the task structure; based on the memory linked list, analyzing file mapping information of each virtual memory region; based on the file mapping information of each virtual memory region, analyzing each stack address of the target process to obtain an analysis result of the target process. According to the application, information is collected and saved before a process exits, complete memory mapping information is captured, the user state uses the stack address and the information in the virtual memory region to perform real-time analysis on the process, the stack analysis method is suitable for not only ordinary processes but also short processes, and resource consumption is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of operating systems, and in particular to a stack parsing method, apparatus, and device for a short process based on eBPF. Background Art

[0002] During the operation of an operating system, numerous processes exist. Parsing the stacks of these processes allows the operating system to determine the current location of the process and the call path that led to it. This parsing process plays a vital role in program debugging, providing developers with key information to troubleshoot program errors and optimize program operation logic.

[0003] In the operating system's process hierarchy, there's a special class of processes whose entire lifecycle, from inception to termination, is extremely brief, perhaps lasting only milliseconds. These processes are defined as "short processes." During stack parsing using eBPF (Extended Berkeley Packet Filter) technology, the eBPF kernel state typically sends the stack address to user state, which then resolves the stack address. Because short processes run so quickly, they are likely to have already exited by the time the operating system performs this stack parsing. Once a process exits, the kernel state cannot obtain the process's file mapping information. Consequently, user state lacks critical file mapping data, preventing it from parsing the stack information, making stack parsing for short processes difficult. Therefore, implementing stack parsing for short processes has become a pressing issue. Summary of the Invention

[0004] In view of this, the present invention provides a stack parsing method, apparatus and device for a short process based on eBPF to solve the stack parsing problem of a short process.

[0005] In a first aspect, the present invention provides a stack parsing method for a short process based on eBPF, the method comprising:

[0006] In response to eBPF running to a preset position, for a target process in kernel state, multiple stack addresses of the target process and a pointer to a task structure corresponding to the target process are obtained, where the task structure stores information about the target process;

[0007] Based on the pointer, get the memory linked list of the target process from the task structure;

[0008] Parse the file mapping information of each virtual memory area based on the memory linked list;

[0009] Based on the file mapping information of each virtual memory area, each stack address of the target process is parsed to obtain the parsing result of the target process.

[0010] The present invention obtains the stack address and task structure pointer of the target process directly in the kernel state to obtain the relevant information of the process in real time, obtains the memory linked list based on the pointer, and extracts information from the virtual memory area based on the memory linked list. The information can be collected and saved before the process exits. Even if the process life cycle is very short, the complete memory mapping information can be captured before it exits. Then, in the user state, the target process is parsed in real time based on the file mapping information of the virtual memory area. This is not only applicable to ordinary processes, but also realizes stack parsing of short processes, while reducing resource consumption. It is applicable to all scenarios that use eBPF technology to parse the stack.

[0011] In an optional embodiment, parsing the file mapping information of each virtual memory area based on the memory linked list includes:

[0012] For each virtual memory area, determine whether there is a file mapping in the virtual memory area;

[0013] For each virtual memory area with a file mapping, extract the memory start address, memory end address, inode value of the dynamic library file path and mapping file offset of the virtual memory area;

[0014] The memory start address, memory end address, inode value of the dynamic library file path and mapping file offset of the virtual memory area are used as the file mapping information of the virtual memory area.

[0015] By parsing the file mapping information of the virtual memory area, the present invention can more clearly understand the specific situation of each virtual memory area, including whether it is associated with the file mapping, as well as the relevant address range and file offset, etc., which is helpful for stack parsing.

[0016] In an optional embodiment, for each virtual memory area where a file mapping exists, extracting the inode value of the dynamic library file path of the virtual memory area includes:

[0017] Get the current directory entry and its file path in the virtual memory area, and traverse the parent directory upwards based on the current directory entry to get the next directory entry and its file path;

[0018] Determine whether the next directory entry is equal to the current directory entry;

[0019] When the next directory entry is not equal to the current directory entry, the next directory entry is used as the new current directory entry, and the process returns to the step of traversing the parent directory based on the current directory entry to obtain the next directory entry and its file path, until the next directory entry is the root directory, and the file paths of all directory entries are integrated into the total file path;

[0020] Get the dynamic library file path based on the current mount point and the total file path of all directory entries;

[0021] Determine the inode value corresponding to the dynamic library file path.

[0022] The present invention avoids directly transmitting a character string of the file path by extracting a group of inode values ​​of the dynamic file path, reduces information usage, and helps to realize stack parsing.

[0023] In an optional embodiment, each stack address of the target process is parsed based on the file mapping information of each virtual memory area to obtain a parsing result of the target process, including:

[0024] For the current stack address, based on the file mapping information of each virtual memory area, find the target virtual memory area corresponding to the current stack address;

[0025] Based on the inode value of the dynamic library file path, determine whether the dynamic library file in the target virtual memory area exists in the user state;

[0026] When a dynamic library file of the target virtual memory area exists in the user state, the current stack address is parsed based on the file mapping information of the target virtual memory area to obtain a parsing result corresponding to the current stack address;

[0027] The next stack address of the current stack address is used as the new current stack address, and the process returns to the step of searching for the target virtual memory area corresponding to the current stack address based on the file mapping information of each virtual memory area, until the parsing of multiple stack addresses is completed, and the parsing results corresponding to the multiple stack addresses are used as the parsing results of the target process.

[0028] The present invention searches for the target virtual memory area of ​​the current stack address and searches for its corresponding dynamic library file in the user state cache. If it already exists, there is no need to recreate it, thereby performing parsing based on file mapping information until the parsing of all stack addresses is completed, making the entire parsing process more efficient and reducing the consumption of system resources. In particular, for short processes, the stack address parsing can be completed in real time and quickly within their life cycle.

[0029] In an optional embodiment, for the current stack address, based on the file mapping information of each virtual memory area, searching for the target virtual memory area corresponding to the current stack address includes:

[0030] For the first virtual memory area in the memory linked list, a memory start address and a memory end address of the first virtual memory area are obtained based on the file mapping information of the first virtual memory area;

[0031] determine whether the current stack address is located between the memory start address and the memory end address of the first virtual memory region;

[0032] When the current stack address is not located between the memory start address and the memory end address of the first virtual memory region, continue to parse the next virtual memory region according to the memory chain table until the current stack address is located between the memory start address and the memory end address of any virtual memory region, and determine the virtual memory region as the target virtual memory region.

[0033] The application determines the virtual memory region in which the current stack address is located by the current stack address, the memory start address and the end address of the virtual memory region, thereby performing targeted stack parsing, and improving the parsing efficiency and accuracy.

[0034] In an optional implementation, after determining whether the dynamic library file of the target virtual memory region exists in the user mode, the method further comprises:

[0035] When the dynamic library file of the target virtual memory region does not exist in the user mode, establish a cache of the dynamic library file in the user mode.

[0036] The application establishes the cache when the cache of the dynamic library file does not exist in the user mode by considering that most processes use the same dynamic library file, thereby effectively reducing the resource occupation compared with establishing the corresponding cache for each process in the related art.

[0037] In an optional implementation, when the dynamic library file of the target virtual memory region exists in the user mode, parse the current stack address based on the file mapping information of the target virtual memory region to obtain a parsing result corresponding to the current stack address, comprising:

[0038] When the dynamic library file of the target virtual memory region exists in the user mode, determine the sum of the memory start address and the mapping file offset of the target virtual memory region;

[0039] Determine the difference between the current stack address and the sum;

[0040] Determine the function name corresponding to the difference from the dynamic library file in the user mode;

[0041] Take the difference and the function name corresponding to the current stack address as the parsing result of the current stack address.

[0042] The present invention calculates the sum of the memory starting address and the mapping file offset, and calculates the difference between the current stack address and the sum, so as to accurately locate the offset of the current stack address relative to the dynamic library file, thereby searching for the function name corresponding to the current stack address according to the difference, and can clearly indicate the specific function pointed to by the stack address. The difference and function name corresponding to the current stack address are used as the parsing result, which can clarify the function and location information corresponding to each stack address, and facilitate further analysis and processing.

[0043] In a second aspect, the present invention provides a stack parsing device for a short process based on eBPF, the device comprising:

[0044] A first acquisition module is configured to, in response to eBPF running to a preset position, acquire, for a target process in kernel state, multiple stack addresses of the target process and a pointer to a task structure corresponding to the target process, where the task structure stores information about the target process;

[0045] The second acquisition module is used to obtain the memory linked list of the target process from the task structure based on the pointer;

[0046] An extraction module, used for parsing file mapping information of each virtual memory area based on a memory linked list;

[0047] The parsing module is used to parse each stack address of the target process based on the file mapping information of each virtual memory area to obtain the parsing result of the target process.

[0048] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to execute the stack parsing method for a short process based on eBPF according to the first aspect or any corresponding embodiment thereof.

[0049] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the stack parsing method for short processes based on eBPF according to the first aspect or any corresponding embodiment thereof.

[0050] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, which are used to enable a computer to execute the stack parsing method of a short process based on eBPF according to the above-mentioned first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0052] Figure 1 is a flowchart of a stack parsing method for a short process based on eBPF according to an embodiment of the present invention;

[0053] Figure 2 1 is a structural block diagram of a stack parsing device for a short process based on eBPF according to an embodiment of the present invention;

[0054] Figure 3 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0055] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present invention.

[0056] Since short processes have extremely short runtimes, they are likely to have already exited by the time the operating system performs stack parsing on them. Once a process exits, the kernel state cannot obtain the process's file mapping information, causing the user state to be unable to complete the stack information parsing due to the lack of critical file mapping data, making it difficult to implement stack parsing for short processes. By acquiring and parsing the virtual memory area, the present invention can collect and save information before the process exits. Even if the process lifecycle is very short, complete memory mapping information can be captured before it exits. The user state can then use the stack address and information in the virtual memory area to perform real-time parsing of the target process. This approach is not only applicable to ordinary processes, but also implements stack parsing for short processes.

[0057] According to an embodiment of the present invention, an embodiment of a stack parsing method for a short process based on eBPF is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0058] In this embodiment, a short process stack parsing method based on eBPF is provided, which can be used in an operating system. Figure 1 is a flowchart of a stack parsing method for a short process based on eBPF according to an embodiment of the present invention, such as Figure 1 As shown, the process includes the following steps:

[0059] Step S101, in response to eBPF running to a preset position, for the target process in kernel mode, multiple stack addresses of the target process and a pointer to the task structure corresponding to the target process are obtained, and the task structure stores information about the target process. Specifically, when the eBPF program runs to a preset kernel-mode plug-in position or a function call occurs, the bpf_get_stack function is called to obtain multiple stack addresses of the target process. These stack addresses are presented in the form of an array, which is the memory address identifier of the function call in the stack when the process is running. At the same time, the bpf_get_current_task function is called to obtain the task structure pointer current corresponding to the target process. current points to the struct task_struct task structure, which stores information about the target process, such as process status, resource usage, memory management, and other information. By obtaining the stack address and the task structure pointer, preparation is made for the subsequent parsing of the stack address.

[0060] In step S102, based on the pointer, the memory linked list of the target process is obtained from the task structure. Specifically, the mm member (mm is a structure pointer describing the memory information of the target process) is accessed through the current pointer, and the virtual memory area (VMA) is obtained through mm->mmap. Each VMA contains key information about the target process's memory mapping. mm->mmap points to a VMA linked list. Each VMA in the linked list represents an area in virtual memory. Each VMA has a next member that points to the next VMA. By continuously accessing the next member, the entire VMA list can be traversed, thereby fully obtaining multiple VMAs and fully preparing for the subsequent extraction of file mapping information.

[0061] Step S103: parsing the file mapping information of each virtual memory area based on the memory linked list. Specifically, according to the order in the memory linked list, for each VMA in the linked list, extracting the file mapping information therein.

[0062] In step S104, each stack address of the target process is parsed based on the file mapping information of each virtual memory area to obtain a parsing result for the target process. Specifically, the user state parses each stack address based on the multiple stack addresses of the target process and the file mapping information of each VMA to implement stack parsing of the target process. This helps the user understand the function call status of the target process during execution, which is of great significance for program debugging and performance optimization.

[0063] The present invention obtains the stack address and task structure pointer of the target process directly in the kernel state to obtain the relevant information of the process in real time, obtains the memory linked list based on the pointer, and extracts information from the virtual memory area based on the memory linked list. The information can be collected and saved before the process exits. Even if the process life cycle is very short, the complete memory mapping information can be captured before it exits. Then, in the user state, the target process is parsed in real time based on the file mapping information of the virtual memory area. This is not only applicable to ordinary processes, but also realizes stack parsing of short processes, while reducing resource consumption. It is applicable to all scenarios that use eBPF technology to parse the stack.

[0064] In this embodiment, a short process stack parsing method based on eBPF is provided, which can be used in the above-mentioned operating system. The method specifically includes the following steps:

[0065] Step S201: In response to eBPF running to a preset position, for a target process in kernel mode, multiple stack addresses of the target process and a pointer to a task structure corresponding to the target process are obtained. The task structure stores information about the target process. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0066] Step S202: Based on the pointer, obtain the target process's memory linked list from the task structure. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0067] Step S203: parsing the file mapping information of each virtual memory area based on the memory linked list.

[0068] Specifically, the above step S203 includes:

[0069] Step S2031: For each virtual memory area, determine whether a file mapping exists in the virtual memory area. Specifically, if vm_file is NULL for a particular VMA, indicating that the VMA is a pure memory area (e.g., heap memory allocated via malloc), the VMA is skipped. If vm_file is not NULL, indicating that the VMA is mapped to a file, the file mapping information for the VMA is obtained.

[0070] Step S2032: For each virtual memory area with a file mapping, extract the memory start address, memory end address, inode value of the dynamic library file path, and mapping file offset of the virtual memory area.

[0071] In some optional implementations, step S2032 extracts the inode value of the dynamic library file path of each virtual memory area where a file mapping exists, including:

[0072] Step a1: Obtain the current directory entry and its file path in the virtual memory area. Based on the current directory entry, traverse the parent directory upward to obtain the next directory entry and its file path. Specifically, obtain the current directory entry (dentry) and record its file path. Then, traverse upward to the parent directory of the current directory entry (dentry->d_parent), and use that parent directory as the next directory entry.

[0073] Step a2, judging whether the next directory entry is equal to the current directory entry. Specifically, judging whether the traversal is completed is done by judging whether the next directory entry is equal to the current directory entry.

[0074] In step a3, if the next directory entry is not equal to the current directory entry, the next directory entry is used as the new current directory entry, and the process returns to the step of traversing the parent directory based on the current directory entry upward to obtain the next directory entry and its file path, until the next directory entry is the root directory, and the file paths of all directory entries are integrated into the total file path. Specifically, if the next directory entry is not equal to the current directory entry, the process returns to step a1 and continues traversing. If the next directory entry is equal to the current directory entry, it indicates that the traversal has reached the root directory, and all the obtained file paths are integrated to obtain the total file path.

[0075] Step a4: Based on the current mount point and the total file path of all directory entries, a dynamic library file path is obtained. Specifically, the current mount point and the file paths of all directory entries are integrated to obtain the dynamic library file.

[0076] Step a5, determines the inode value corresponding to the dynamic library file path. Specifically, if the dynamic library file path collected in the above steps is directly passed to the user state to participate in stack parsing, since the sending string path occupies a large amount of information, and it is very difficult to process the string in eBPF, it leads to difficulty in transmission and poor feasibility. Therefore, the embodiment of the present invention uniquely represents each string in the dynamic library file path with an inode value. The inode is the physical identifier of the file, which does not change with the file name or path. It is used to accurately associate files during subsequent stack parsing, thereby reducing the amount of information occupied and facilitating processing. The dynamic library file includes the mount point and the file path of all directory entries, that is, determining the inode value corresponding to the current mount point and the inode value of the directory entries traversed in sequence, as a set of inode values ​​for the dynamic library file.

[0077] Step S2033 uses the virtual memory area's memory start address, memory end address, inode value of the dynamic library file path, and mapped file offset as the file mapping information for the virtual memory area. Specifically, the memory start address (vm_start) and memory end address (vm_end) identify the starting and ending addresses of the file mapping in the process memory; the mapped file offset (vm_pgoff) indicates where the file mapping begins. This information, along with the aforementioned inode value, is passed to user mode as file mapping information and forms the basis for subsequent stack parsing in user mode.

[0078] Step S204 , parsing each stack address of the target process based on the file mapping information of each virtual memory area to obtain a parsing result of the target process.

[0079] Specifically, the above step S204 includes:

[0080] Step S2041 : for the current stack address, based on the file mapping information of each virtual memory area, searching for the target virtual memory area corresponding to the current stack address.

[0081] In some optional implementations, the above step S2041 includes:

[0082] Step b1: For the first virtual memory area in the memory linked list, obtain the memory start address and memory end address of the first virtual memory area based on the file mapping information of the first virtual memory area. Specifically, the memory linked list indicates multiple virtual memory access points (VMAs), and the determination is performed sequentially according to the order of these VMAs. For the first VMA, obtain the memory start address and memory end address from the file mapping information of the VMA.

[0083] Step b2, determining whether the current stack address is between the memory start address and the memory end address of the first virtual memory area. Specifically, based on the above two addresses, determining whether the current stack address is between the two addresses to determine whether the current stack address is in the VMA.

[0084] In step b3, if the current stack address is not between the memory start address and memory end address of the first virtual memory area, the next virtual memory area is parsed according to the memory linked list until the current stack address is between the memory start address and memory end address of any virtual memory area, and the virtual memory area is determined as the target virtual memory area. Specifically, if the current stack address and a certain VMA satisfy the relationship: the memory start address of the VMA ≤ the current stack address ≤ the memory end address of the VMA, then the current stack address is located in the VMA, and the VMA is determined as the target virtual memory area. If the current stack address does not meet the above address relationship, the process returns to step b1 and continues to determine the next VMA. For example, if the vm_start of a certain VMA is 7efc41600000 and the vm_end is 7efc41609000, and the current stack address is 7efc41601000, then the stack address is within the address range, and the VMA is the target virtual memory area.

[0085] Step S2042, based on the inode value of the dynamic library file path, judges whether there is the dynamic library file in the target virtual memory area in the user state. Specifically, symbolic information, such as function name and function address, is stored in the dynamic library file. In the related art, all can set up the cache corresponding to its dynamic library file in the user state for each process, but the dynamic library file that most processes use is consistent, and repeatedly setting up cache can cause waste of resources. Therefore, the embodiment of the present invention first judges whether there is the cache of the corresponding dynamic library file in the user state according to the inode value of the dynamic library file path, if there is, just do not need to repeat cache.

[0086] Step S2043 , when there is a dynamic library file in the target virtual memory area in the user state, the current stack address is parsed based on the file mapping information of the target virtual memory area to obtain a parsing result corresponding to the current stack address.

[0087] In some optional implementations, the above step S2043 includes:

[0088] Step c1, when a dynamic library file of the target virtual memory area exists in the user state, determines the sum of the memory start address and the mapping file offset of the target virtual memory area. Specifically, the sum obtained by adding the memory start address and the mapping file offset represents the actual starting address of the dynamic library file in the memory.

[0089] Step c2, determine the difference between the current stack address and the sum value. Specifically, by calculating the difference between the current stack address and the sum value, the offset of the current stack address relative to the starting address of the dynamic library file can be obtained. Assuming that the memory starting address is 0x1000, the current stack address is 0x1020, and the mapping file offset is 0x10, the difference is 0x1020-(0x1000+0x10)=0x10.

[0090] Step c3, determining the function name corresponding to the difference from the dynamic library file in the user state. Specifically, searching the corresponding symbol table in the dynamic library file in the user state, finding the function name corresponding to the difference, and thus knowing which function the current program has executed.

[0091] In step c4, the difference value and function name corresponding to the current stack address are used as the parsing result of the current stack address. Specifically, the difference value and function name combined can provide detailed information about the current stack address. The function name indicates which function the current program has executed, and the difference value further describes the relative position within the function. In scenarios such as program debugging and performance analysis, if the program crashes, the parsing result of the stack address can be used to quickly locate the function and position where the crash occurred; during performance analysis, the function and code segment where the performance bottleneck is located can be found based on the frequency and offset of function calls.

[0092] Step S2044, taking the next stack address of the current stack address as the new current stack address, returns to the step of searching for the target virtual memory area corresponding to the current stack address based on the file mapping information of each virtual memory area for the current stack address, until the parsing of multiple stack addresses is completed, and the parsing results corresponding to the multiple stack addresses are used as the parsing results of the target process. Specifically, the multiple stack addresses are parsed in sequence according to the order of function calls, and their corresponding function names and differences are parsed respectively. The stack addresses are arranged in sequence according to the order of function calls in the stack space. The address at the top of the stack corresponds to the function call currently being executed, and the address at the bottom of the stack corresponds to the previous function call. Therefore, by integrating the function names and differences in the order of the stack addresses, the function call sequence of the target process from the beginning to the current moment can be restored, providing comprehensive and accurate information for in-depth analysis of the operation of the target process.

[0093] Step S2045: When the dynamic library file in the target virtual memory area does not exist in the user state, a cache of the dynamic library file is established in the user state. Specifically, if the cache corresponding to the dynamic library file does not exist in the user state, a cache is established in the user state in the form of a key-value pair using the dynamic library file as a key and the symbol information in the dynamic library file as a value. Compared with the related art in which a corresponding cache is established for each process, resource usage is effectively reduced.

[0094] The present invention obtains the stack address and task structure pointer of the target process directly in the kernel state to obtain the relevant information of the process in real time, obtains the memory linked list based on the pointer, and extracts information from the virtual memory area based on the memory linked list. The information can be collected and saved before the process exits. Even if the process life cycle is very short, the complete memory mapping information can be captured before it exits. Then, in the user state, the target process is parsed based on the file mapping information of the virtual memory area. This is not only applicable to ordinary processes, but also realizes stack parsing of short processes, while reducing resource consumption. It is suitable for all scenarios that use eBPF technology to parse the stack.

[0095] In this embodiment, a stack parsing device for a short process based on eBPF is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the details that have been described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and conceivable.

[0096] This embodiment provides a stack parsing device for a short process based on eBPF, such as Figure 2 Shown, including:

[0097] The first acquisition module 201 is used to obtain multiple stack addresses of the target process and a pointer to a task structure corresponding to the target process in the kernel state in response to eBPF running to a preset position. The task structure stores information about the target process.

[0098] The second acquisition module 202 is used to acquire the memory linked list of the target process from the task structure based on the pointer.

[0099] The extraction module 203 is configured to parse the file mapping information of each virtual memory area based on the memory linked list.

[0100] The parsing module 204 is configured to parse each stack address of the target process based on the file mapping information of each virtual memory area to obtain a parsing result of the target process.

[0101] In some optional implementations, the extraction module 203 includes:

[0102] The first determining unit is configured to determine, for each virtual memory area, whether a file mapping exists in the virtual memory area.

[0103] The extraction unit is used to extract the memory start address, memory end address, inode value of the dynamic library file path and mapping file offset of each virtual memory area with file mapping.

[0104] The first determining unit is configured to use the memory start address, the memory end address, the inode value of the dynamic library file path, and the mapping file offset of the virtual memory area as file mapping information of the virtual memory area.

[0105] In some optional embodiments, the extraction unit includes:

[0106] The acquisition subunit is used to obtain the current directory entry and its file path in the virtual memory area, and traverse the parent directory upward based on the current directory entry to obtain the next directory entry and its file path.

[0107] The first judging subunit is used to judge whether the next directory entry is equal to the current directory entry.

[0108] The first traversal sub-unit is used to use the next directory entry as the new current directory entry when the next directory entry is not equal to the current directory entry, return to the step of traversing the parent directory upward based on the current directory entry to obtain the next directory entry and its file path, until the next directory entry is the root directory, and integrate the file paths of all directory entries into the total file path.

[0109] The first determining subunit is used to obtain the dynamic library file path based on the current mount point and the total file path of all directory entries.

[0110] The second determining subunit is used to determine the inode value corresponding to the dynamic library file path.

[0111] In some optional implementations, the parsing module 204 includes:

[0112] The search unit is configured to search for a target virtual memory area corresponding to the current stack address based on the file mapping information of each virtual memory area.

[0113] The second judgment unit is used to judge whether there is a dynamic library file in the target virtual memory area in the user state based on the inode value of the dynamic library file path.

[0114] The first parsing unit is used to parse the current stack address based on the file mapping information of the target virtual memory area when the dynamic library file of the target virtual memory area exists in the user state, and obtain the parsing result corresponding to the current stack address.

[0115] The second parsing unit is used to use the next stack address of the current stack address as the new current stack address, return to the step of searching for the target virtual memory area corresponding to the current stack address based on the file mapping information of each virtual memory area for the current stack address, until the parsing of multiple stack addresses is completed, and the parsing results corresponding to the multiple stack addresses are used as the parsing results of the target process.

[0116] In some optional implementations, the search unit includes:

[0117] The third determining subunit is configured to obtain, for a first virtual memory area in the memory linked list, a memory start address and a memory end address of the first virtual memory area based on file mapping information of the first virtual memory area.

[0118] The second judging subunit is used to judge whether the current stack address is located between the memory start address and the memory end address of the first virtual memory area.

[0119] The fourth determination sub-unit is used to continue parsing the next virtual memory area according to the memory linked list when the current stack address is not between the memory start address and the memory end address of the first virtual memory area, until the current stack address is between the memory start address and the memory end address of any virtual memory area, and determine the virtual memory area as the target virtual memory area.

[0120] In some optional implementations, after the second determination unit, the device further includes:

[0121] A module is established to establish a cache of dynamic library files in the user state when the dynamic library files in the target virtual memory area do not exist in the user state.

[0122] In some optional implementations, the first parsing unit includes:

[0123] The fifth determining subunit is configured to determine the sum of the memory start address and the mapping file offset of the target virtual memory area when the dynamic library file of the target virtual memory area exists in the user state.

[0124] The sixth determining subunit is used to determine the difference between the current stack address and the sum value.

[0125] The seventh determining subunit determines the function name corresponding to the difference from the dynamic library file in the user state.

[0126] The eighth determining subunit is configured to use the difference value and the function name corresponding to the current stack address as the parsing result of the current stack address.

[0127] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0128] The stack parsing device for short processes based on eBPF in this embodiment is presented in the form of functional units, where the units refer to ASIC (Application Specific Integrated Circuit) circuits, processors and memories that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0129] The embodiment of the present invention also provides a computer device having the above Figure 2 The stack parsing device of a short process based on eBPF is shown.

[0130] See also Figure 3 , Figure 3 is a structural diagram of a computer device provided by an optional embodiment of the present invention, such as Figure 3 As shown, the computer device includes: one or more processors 10, memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components utilize different buses to communicate with each other and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in the memory or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Equally, multiple computer devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 3 A processor 10 is taken as an example.

[0131] The processor 10 may be a central processing unit, a network processor, or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic, or any combination thereof.

[0132] The memory 20 stores instructions that can be executed by at least one processor 10, so as to enable at least one processor 10 to execute the method shown in the above embodiment.

[0133] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0134] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0135] The computer device further includes a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0136] The embodiment of the present invention also provides a computer-readable storage medium. The above-mentioned method according to the embodiment of the present invention can be implemented in hardware, firmware, or implemented as a computer code that can be recorded in a storage medium, or implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method shown in the above embodiment is implemented.

[0137] A portion of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the form in which the computer program instruction exists in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc. Accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium that can be accessed by the computer.

[0138] Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A stack parsing method for short processes based on eBPF, characterized in that: The method comprises: In response to eBPF running to a preset position, for a target process in kernel state, obtaining multiple stack addresses of the target process and a pointer to a task structure corresponding to the target process, the task structure storing information of the target process; Based on the pointer, obtaining the memory linked list of the target process from the task structure; Parsing file mapping information of each virtual memory area based on the memory linked list, wherein the file mapping information includes an inode value of a dynamic library file path; Parsing each stack address of the target process based on the file mapping information of each virtual memory area to obtain a parsing result of the target process; The step of parsing each stack address of the target process based on the file mapping information of each virtual memory area to obtain the parsing result of the target process includes: For the current stack address, based on the file mapping information of each virtual memory area, find the target virtual memory area corresponding to the current stack address; Based on the inode value of the dynamic library file path, determine whether there is a dynamic library file in the target virtual memory area in the user state; When a dynamic library file of the target virtual memory area exists in the user state, parsing the current stack address based on file mapping information of the target virtual memory area to obtain a parsing result corresponding to the current stack address; Using the next stack address of the current stack address as the new current stack address, returning to the step of searching for the target virtual memory area corresponding to the current stack address based on the file mapping information of each virtual memory area, until the parsing of the multiple stack addresses is completed, and using the parsing results corresponding to the multiple stack addresses as the parsing results of the target process; When the dynamic library file of the target virtual memory area does not exist in the user state, establishing a cache of the dynamic library file in the user state; The step of searching for a target virtual memory area corresponding to the current stack address based on file mapping information of each virtual memory area includes: For the first virtual memory area in the memory linked list, obtaining a memory start address and a memory end address of the first virtual memory area based on file mapping information of the first virtual memory area; Determine whether the current stack address is between the memory start address and memory end address of the first virtual memory area; When the current stack address is not between the memory start address and the memory end address of the first virtual memory area, continue to parse the next virtual memory area according to the memory linked list until the current stack address is between the memory start address and the memory end address of any virtual memory area, and determine the virtual memory area as the target virtual memory area; When the dynamic library file of the target virtual memory area exists in the user state, the current stack address is parsed based on the file mapping information of the target virtual memory area to obtain a parsing result corresponding to the current stack address, including: When a dynamic library file of the target virtual memory area exists in the user state, determining a sum of a memory start address and a mapping file offset of the target virtual memory area; Determine the difference between the current stack address and the sum; Determine the function name corresponding to the difference from the user-state dynamic library file; The difference value and function name corresponding to the current stack address are used as the parsing result of the current stack address.

2. The method according to claim 1, characterized in that The parsing of file mapping information of each virtual memory area based on the memory linked list includes: For each virtual memory area, determining whether there is a file mapping in the virtual memory area; For each virtual memory area with a file mapping, extract the memory start address, memory end address, inode value of the dynamic library file path and mapping file offset of the virtual memory area; The memory start address, memory end address, inode value of the dynamic library file path and mapping file offset of the virtual memory area are used as file mapping information of the virtual memory area.

3. The method according to claim 2, characterized in that For each virtual memory area where a file mapping exists, extracting the inode value of the dynamic library file path of the virtual memory area includes: Obtaining a current directory entry and a file path of the virtual memory area, and traversing the parent directory upward based on the current directory entry to obtain a next directory entry and a file path thereof; Determine whether the next directory entry is equal to the current directory entry; When the next directory entry is not equal to the current directory entry, the next directory entry is used as the new current directory entry, and the process returns to the step of traversing the parent directory based on the current directory entry to obtain the next directory entry and its file path, until the next directory entry is the root directory, and the file paths of all directory entries are integrated into the total file path; Obtain the dynamic library file path based on the current mount point and the total file path of all directory entries; Determine the inode value corresponding to the dynamic library file path.

4. A short process stack parsing device based on eBPF, characterized in that: The device comprises: A first acquisition module is configured to, in response to eBPF running to a preset position, acquire, for a target process in kernel state, multiple stack addresses of the target process and a pointer to a task structure corresponding to the target process, wherein the task structure stores information about the target process; A second acquisition module is used to acquire a memory linked list of the target process from the task structure based on the pointer; An extraction module is used to parse file mapping information of each virtual memory area based on the memory linked list, wherein the file mapping information includes an inode value of a dynamic library file path; a parsing module, configured to parse each stack address of the target process based on file mapping information of each virtual memory area to obtain a parsing result of the target process; The analysis module is specifically used for: For the current stack address, based on the file mapping information of each virtual memory area, find the target virtual memory area corresponding to the current stack address; Based on the inode value of the dynamic library file path, determine whether there is a dynamic library file in the target virtual memory area in the user state; When a dynamic library file of the target virtual memory area exists in the user state, parsing the current stack address based on file mapping information of the target virtual memory area to obtain a parsing result corresponding to the current stack address; Using the next stack address of the current stack address as the new current stack address, returning to the step of searching for the target virtual memory area corresponding to the current stack address based on the file mapping information of each virtual memory area, until the parsing of the multiple stack addresses is completed, and using the parsing results corresponding to the multiple stack addresses as the parsing results of the target process; When the dynamic library file of the target virtual memory area does not exist in the user state, establishing a cache of the dynamic library file in the user state; The step of searching for a target virtual memory area corresponding to the current stack address based on file mapping information of each virtual memory area includes: For the first virtual memory area in the memory linked list, obtaining a memory start address and a memory end address of the first virtual memory area based on file mapping information of the first virtual memory area; Determine whether the current stack address is between the memory start address and memory end address of the first virtual memory area; When the current stack address is not between the memory start address and the memory end address of the first virtual memory area, continue to parse the next virtual memory area according to the memory linked list until the current stack address is between the memory start address and the memory end address of any virtual memory area, and determine the virtual memory area as the target virtual memory area; When the dynamic library file of the target virtual memory area exists in the user state, the current stack address is parsed based on the file mapping information of the target virtual memory area to obtain a parsing result corresponding to the current stack address, including: When a dynamic library file of the target virtual memory area exists in the user state, determining a sum of a memory start address and a mapping file offset of the target virtual memory area; Determine the difference between the current stack address and the sum; Determine the function name corresponding to the difference from the user-state dynamic library file; The difference value and function name corresponding to the current stack address are used as the parsing result of the current stack address.

5. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the stack parsing method for a short process based on eBPF according to any one of claims 1 to 3 by executing the computer instructions.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the stack parsing method for a short process based on eBPF according to any one of claims 1 to 3.

Images