EBPF network performance monitoring and diagnosing method based on SW platform

Abstract

The invention belongs to the technical field of network environment diagnosis, and particularly relates to an eBPF network performance monitoring and diagnosing method based on a SW platform. Comprising the following steps: analyzing a network performance monitoring demand of the SW platform to determine a performance index and a diagnosis target of a network monitoring tool; by developing an eBPF tool based on an SW operating system kernel, related data in a network transmission process are captured in real time, and the related data are displayed and stored; performing deep analysis and anomaly detection on the network performance monitoring data by combining the characteristics of the SW platform so as to generate a data analysis result; and checking and positioning potential network problems according to the data analysis result. The invention aims to solve the problem of network performance monitoring under the SW platform, provides a method for capturing and analyzing the network abnormity in real time, and improves the network monitoring performance and the abnormity diagnosis efficiency under the SW platform.

Description

Technical Field

[0001] This invention belongs to the field of network environment diagnosis technology, and specifically relates to a method for monitoring and diagnosing eBPF network performance based on the Shenwei platform. Background Technology

[0002] In the context of the domestic operating system based on the Shenwei architecture, traditional network performance monitoring tools are limited by the differences in instruction sets and kernel compatibility of the Shenwei platform. They can only provide basic network performance monitoring data, such as bandwidth utilization and number of connections. They cannot deeply collect key performance data of the protocol stack kernel mode, such as interrupt distribution characteristics and the performance characteristics of network card send and receive function calls. This makes it difficult for developers to quickly locate network performance problems and reduces the efficiency of troubleshooting.

[0003] Current network performance monitoring tools suffer from significant shortcomings in data acquisition accuracy and real-time response capabilities, making it difficult to achieve accurate and real-time perception of network status changes. On one hand, existing tools mostly employ polling-based data collection, failing to capture instantaneous network events at the microsecond level. On the other hand, traditional monitoring tools, unable to be directly embedded in the kernel for data collection, must frequently switch between user mode and kernel mode for data aggregation and processing. This process incurs significant performance overhead, resulting in monitoring latency generally exceeding 50 milliseconds, making them unsuitable for applications with stringent real-time requirements.

[0004] In addition, existing solutions are insufficient in terms of network performance diagnostic capabilities, making it difficult to identify network performance bottlenecks and potential optimization points in a timely and accurate manner; at the same time, in terms of system compatibility, due to the differences between kernel versions of the Shenwei platform, current tools are unable to achieve comprehensive cross-version compatibility support. Summary of the Invention

[0005] The purpose of this invention is to provide a method for monitoring and diagnosing eBPF network performance based on the Shenwei platform. This invention aims to solve the network performance monitoring problem under the Shenwei platform, provide a method for real-time capture and analysis of network anomalies, and improve the network monitoring performance and anomaly diagnosis efficiency under the Shenwei platform.

[0006] To address the aforementioned technical problems, this invention provides a method for monitoring and diagnosing eBPF network performance based on the Shenwei platform, comprising: By analyzing the network performance monitoring requirements of the Shenwei platform, the performance indicators and diagnostic objectives of the network monitoring tools can be clarified. By developing an eBPF tool based on the Shenwei operating system kernel, we can capture relevant data in real time during network transmission, and then display and save the relevant data. By combining the features of the Shenwei platform, in-depth analysis and anomaly detection are performed on network performance monitoring data to generate data analysis results; Based on the data analysis results, potential network problems can be identified and located.

[0007] Preferably, the network performance monitoring requirements of the Shenwei platform include: instruction set compatibility requirements supporting the domestic Shenwei processor architecture, real-time requirements for network performance monitoring, data accuracy requirements for network performance monitoring, data analysis and anomaly detection requirements, and special adaptation requirements for domestic operating systems. The network monitoring tool's performance metrics include: packet processing throughput, packet loss rate, interruption distribution characteristics, and network card transmit / receive function call performance characteristics; its diagnostic objectives include: system resource allocation optimization analysis and performance bottleneck analysis.

[0008] Preferably, the development of eBPF tools based on the Shenwei operating system kernel includes: Adapt the eBPF tool accordingly; The adaptation includes: instruction set adaptation, kernel interface adaptation, and memory access adaptation; the instruction set adaptation is used to replace the instruction set with the Shenwei architecture instruction set, and the instruction set replacement includes: register mapping and atomic operation instruction replacement; the kernel interface adaptation is used to rewrite the interaction layer between BPF system calls and the Shenwei kernel to ensure compatibility with domestic security subsystems; the memory access adaptation is used to adjust the memory access mode of eBPF to conform to the cache coherence protocol of the Shenwei processor; The eBPF tool was tested; The tests include: functional testing, stability testing, and system compatibility testing. The functional testing confirms that the eBPF tool can accurately capture network events and correctly calculate core metrics such as throughput and latency. The stability testing evaluates whether the eBPF tool will cause kernel oops or memory leaks under 72 hours of full load operation, requiring CPU utilization fluctuations to not exceed 5%. The system compatibility testing verifies the stability of the eBPF tool across different kernel versions of Shenwei. The eBPF tool was verified; The verification process includes: environment setup, test implementation, and test result analysis. The environment setup is used to build the Shenwei architecture test platform, deploy the Shenwei Linux kernel, and load the network card driver module. The test implementation is used to execute test cases and record the test results. The test result analysis is used to confirm the deviation rate between the actual output data and the expected indicators, detect test cases that do not meet expectations, and fix them.

[0009] Preferably, the relevant data during the network transmission process includes: Packet processing throughput is used to measure the packet forwarding rate between different protocol layers; Packet loss rate is used to reflect the reliability and performance bottlenecks of network transmission; Interrupt distribution characteristics are used to monitor the CPU resource scheduling balance of packet processing tasks in real time; including: interrupt latency, interrupt trigger frequency, and interrupt distribution among CPU cores; the interrupt latency reflects the real-time response of the CPU to network packets, the interrupt trigger frequency reflects the network load intensity, and the interrupt distribution among CPU cores reflects the CPU load balance status. The performance characteristics of network interface card (NIC) transmit and receive function calls are used to evaluate network data processing efficiency and system load status; including: call frequency, execution latency, and CPU cycle utilization; the call frequency reflects the network I / O throughput level, the execution latency characterizes the real-time performance of data processing, and the CPU cycle utilization reflects the protocol stack processing overhead.

[0010] Preferably, the Shenwei platform features include: high-efficiency, low-power computing capabilities and wide applicability. The in-depth analysis of network performance monitoring data includes: The network performance monitoring data is preprocessed, including: data cleaning and normalization of the raw network performance monitoring data; the data cleaning is used to remove abnormal data points, verify the validity of the data, and repair missing data; the normalization is used to convert indicators of different units into standard scores and to perform timestamp synchronization processing on data streams with different sampling frequencies. The network performance monitoring data is analyzed for system resource allocation optimization, including: monitoring and analyzing the correlation curve between memory usage and packet loss rate, DMA buffer utilization statistics, and the ratio of system call frequency to CPU cycle usage; and analyzing memory allocation strategy optimization, dynamic adjustment of DMA buffer size, and system call path optimization methods through multi-dimensional resource usage characteristics. The network performance monitoring data is used to perform performance bottleneck analysis, including: monitoring and analyzing the waiting queue length of key functions, comparing the throughput at each stage, and the distribution of system call blocking time; by establishing a correlation model, the performance bottleneck level is accurately located, providing a quantitative basis for lock optimization, scheduling strategy adjustment, and batch processing improvement; Anomaly detection of network performance monitoring data includes: comprehensive analysis of multi-dimensional indicators such as packet throughput, packet loss rate, interruption distribution characteristics, and network card transmit / receive function performance; identification of abnormal features from multiple dimensions such as hardware layer, driver layer, and system call layer through a layered detection strategy, and generation of alarm information based on the comprehensive analysis results.

[0011] Preferably, the hierarchical detection strategy includes: Multi-dimensional metrics are collected in real time, and hardware layer interrupt latency distribution characteristics are dynamically captured through the eBPF program. The interrupt latency distribution characteristics include: interrupt response time, processing time, and inter-core distribution balance. By monitoring the frequency and time of network card transceiver function calls in the driver layer, the success rate of DMA operations and buffer utilization are statistically analyzed. The execution path latency of key APIs in the system call layer is tracked. Multi-dimensional metrics are constructed from the hardware layer, driver layer, and system call layer to establish a layered anomaly detection mechanism, so as to realize the anomaly detection of network performance monitoring data. Based on the detection results of the hierarchical anomaly detection mechanism, the cause of the fault is located and alarm information is generated.

[0012] Preferably, the hierarchical anomaly detection mechanism includes: Hardware-level anomaly detection includes: detecting interrupt latency, setting a threshold of 200μs as a real-time judgment standard, and any latency exceeding this threshold is considered abnormal; analyzing multi-core interrupt load balancing, statistically analyzing the number of interrupts processed and the total processing time of each CPU core per unit time, calculating the relative difference in interrupt processing volume between cores, and determining that the distribution is unbalanced when the difference between cores continuously exceeds 20%. Anomaly detection at the driver layer includes: analyzing network card driver performance, tracking the time consumption of network card send and receive functions, and considering it as an anomaly when the time consumption of a single send and receive operation suddenly increases by more than 100μs; analyzing interrupt handling latency, and judging performance degradation if high latency occurs three times in a row; and monitoring DMA buffer reuse rate, and if the reuse rate is consistently less than 60%, there is a memory leak or inefficient allocation strategy. Anomaly detection at the system call layer includes: monitoring the execution time and context switching overhead of key APIs at the system call layer, and considering a single call as abnormal if its time exceeds 30% of the baseline value; detecting system resource leaks through eBPF memory allocation tracing, including file descriptor leaks, memory leaks, and thread leaks.

[0013] Preferably, based on the data analysis results, potential network problems are investigated and located, including: Based on the anomaly detection results of the layered detection strategy, the system accurately identifies the anomaly characteristics of the hardware layer, driver layer, and protocol stack layer, deeply analyzes the specific problems existing in the anomaly layer, generates targeted optimization suggestions based on the diagnostic results, and provides effect prediction and risk assessment. The optimization suggestions include: for high latency issues, it is recommended to adjust the TCP window size or enable ECN explicit congestion notification; for unbalanced load situations, it is recommended to dynamically adjust the load balancing algorithm weights; when resource bottlenecks are found, it is recommended to propose CPU affinity settings or memory allocation optimization schemes. The effect prediction includes: quantitatively estimating the performance improvement after optimization, predicting the potential improvement in system throughput, and assessing the ripple effects of optimization measures on surrounding system components. The risk assessment includes: identifying stability issues caused by optimization measures, assessing the potential impact of configuration changes on existing business traffic, and conducting a graded assessment of the difficulty of rollback and contingency plans.

[0014] This invention also provides an eBPF network performance monitoring and diagnosis system based on the Shenwei platform, which executes the eBPF network performance monitoring and diagnosis method based on the Shenwei platform as described above, including: Client; On the server side, the client initiates a network request to the server and interacts with the data through the data transmission service module; The data transmission service module, acting as a data exchange hub, is responsible for forwarding data between the client and the server. The data transmission service module is configured with eBPF service to capture the network performance status in real time to monitor abnormal network behavior. The eBPF service captures network performance monitoring data during network transmission through the data capture service module and forwards the data to the data analysis service module for in-depth analysis of the network performance monitoring data. The data analysis service module assesses the current network status, quickly locates current network problems, predicts potential risks, and stores the analyzed data in the data storage service module. The data storage service module supports large-scale data storage, management, and display services to ensure data security and durability. The anomaly detection service module is used to monitor the abnormal state of the network performance monitoring data. It analyzes and detects the abnormal state of the system from multiple dimensions, including the hardware layer, driver layer, and system call layer, in order to ensure the security of the network operation process. The troubleshooting and location service module, based on the anomaly detection results of the anomaly detection service module, accurately identifies the anomaly characteristics of the hardware layer, driver layer, and protocol stack layer, deeply analyzes the specific problems existing in the anomaly layer, generates targeted optimization suggestions based on the diagnostic results, and provides effect prediction and risk assessment.

[0015] This invention also provides an eBPF network performance monitoring and diagnostic device based on the Shenwei platform, which executes the eBPF network performance monitoring and diagnostic method based on the Shenwei platform as described above, including: The network card connects to the motherboard via a high-speed PCIe interface and accesses the network via a network cable to capture and transmit raw traffic. The memory, as the data hub of the entire system, establishes an efficient path through DMA, enabling the network data packets captured by the network card to bypass the CPU and be directly written to the pre-allocated monitoring memory area. At the same time, it achieves lock-free data exchange with the eBPF program through a memory-mapped ring buffer to reduce transmission latency. The Shenwei processor, as the core computing unit of the entire system, achieves efficient collaboration between data processing and visualization output. The Shenwei processor can process network traffic data received from the network card in real time and directly transmit this data to the terminal display for real-time data display. The Shenwei processor dynamically loads the eBPF program into the programmable logic unit of the network card to achieve hardware-level traffic filtering and statistics. The network card, through interrupt affinity settings, binds different traffic queues to designated CPU cores, improving the performance of protocol parsing and indicator calculation, thus controlling the end-to-end latency from data acquisition to analysis and processing to the microsecond level, meeting the real-time monitoring requirements of high-performance networks. The terminal display, as the visualization terminal of the entire system, works in conjunction with the Shenwei processor through the memory to display monitoring data on the terminal.

[0016] Compared with the prior art, the present invention has the following beneficial effects: This invention provides a method for monitoring and diagnosing eBPF network performance based on the Shenwei platform. The method includes: analyzing the network performance monitoring requirements of the Shenwei platform, clarifying the performance indicators and diagnostic objectives of the network monitoring tool; developing an eBPF tool based on the Shenwei operating system kernel to capture relevant data during network transmission in real time, displaying and saving the data; performing in-depth analysis and anomaly detection on the network performance monitoring data based on the characteristics of the Shenwei platform; and investigating and locating potential network problems based on the data analysis results. This invention's eBPF network performance monitoring tool based on the Shenwei platform can capture the network performance status and abnormal behavior under the Shenwei platform architecture in real time, providing monitoring and analysis methods, improving the efficiency of diagnosing complex network problems, and assisting in the performance optimization and upgrade of the Shenwei platform. Attached Figure Description

[0017] Figure 1 This is a flowchart of an eBPF network performance monitoring and diagnosis method based on the Shenwei platform provided by the present invention.

[0018] Figure 2 This is a structural diagram of an eBPF network performance monitoring and diagnosis system based on the Shenwei platform provided by the present invention.

[0019] Figure 3 This is a structural diagram of an eBPF network performance monitoring and diagnostic device based on the Shenwei platform provided by the present invention. Detailed Implementation

[0020] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. The advantages and features of the present invention will become clearer from the following description. It should be noted that the drawings are all in a very simplified form and use non-precise proportions, and are only used to facilitate and clarify the illustration of the embodiments of the present invention.

[0021] like Figure 1 As shown, this embodiment of the invention provides a method for monitoring and diagnosing eBPF network performance based on the Shenwei platform, including the following steps: Step S10: Analyze the network performance monitoring requirements of the Shenwei platform and clarify the performance indicators and diagnostic objectives of the network monitoring tools.

[0022] Specifically, the network performance monitoring requirements of the Shenwei platform include: instruction set compatibility with the domestic Shenwei processor architecture, real-time network performance monitoring, data accuracy, data analysis and anomaly detection, and special adaptation for domestic operating systems. The network performance monitoring requirements of the Shenwei platform include the following aspects: Instruction set compatibility with the domestic Shenwei processor architecture: The compilation of the network performance monitoring tool needs to be adapted to the Shenwei platform's instruction set and compatible with different Shenwei platform kernel versions. Real-time network performance monitoring: The network performance monitoring tool needs to collect and display data in real time, achieving the collection of key indicator timestamps to reflect changes in network performance. Data accuracy requirements: The network performance monitoring tool needs to ensure the accuracy of the collected network performance data, reduce measurement errors, and achieve cross-validation between monitoring data and kernel counters. Data analysis and anomaly detection requirements: The network performance monitoring tool needs to support multi-dimensional joint analysis functions, perform anomaly detection on the collected data, and promptly identify and locate key problems and performance bottlenecks. Special adaptation requirements for domestic operating systems: Network performance monitoring tools need to be compatible with domestic operating systems such as Kylin and UnionTech, and adapt to network monitoring when domestic containers are running.

[0023] The performance metrics of the network monitoring tool include: Packet processing throughput: measuring the packet forwarding rate between different protocol layers. Packet loss rate: reflecting the reliability and performance bottlenecks of network transmission. Interrupt distribution characteristics: including interrupt latency, trigger frequency, and distribution among CPU cores, used to monitor the CPU resource scheduling balance of packet processing tasks in real time. Specifically, interrupt latency reflects the real-time performance of CPU response to network packets, interrupt trigger frequency reflects network load intensity, and the distribution of interrupts among computing cores reflects the CPU load balance. Performance characteristics of NIC transmit / receive function calls: including call frequency, execution latency, and resource usage, used to evaluate network data processing efficiency and system load status. Specifically, transmit / receive function call frequency reflects network I / O throughput, function execution latency characterizes data processing real-time performance, and CPU cycle utilization reflects protocol stack processing overhead.

[0024] The diagnostic objectives of the network monitoring tool include: system resource allocation optimization diagnosis and performance bottleneck diagnosis. System resource allocation optimization diagnosis involves monitoring and analyzing the correlation curves between memory usage and packet loss rate, DMA buffer utilization statistics, and the ratio of system call frequency to CPU utilization. Through multi-dimensional resource usage characteristics, it analyzes methods for optimizing memory allocation strategies, dynamically adjusting DMA buffer size, and optimizing system call paths. Performance bottleneck diagnosis involves monitoring and analyzing the waiting queue length of key functions, throughput comparisons at each stage, and system call blocking time distribution at the hardware, driver, and system call layers. It establishes correlation models to accurately locate performance bottleneck levels, providing quantitative evidence for lock optimization, scheduling strategy adjustment, and batch processing improvement.

[0025] Step S20: Develop an eBPF tool based on the Shenwei operating system kernel to capture relevant data during network transmission in real time, display the data, and save it.

[0026] Specifically, the development of the eBPF tool is based on the Shenwei operating system kernel. The specific steps include adapting, testing, and verifying the eBPF tool on the Shenwei platform. The role of the eBPF program: eBPF monitors network performance by securely and efficiently running custom programs at the kernel layer. It can capture and analyze network traffic in real time, providing fine-grained statistical metrics while maintaining extremely low overhead, avoiding the performance bottlenecks of traditional packet capture tools. This allows development teams to proactively discover and optimize network performance issues, making it one of the core technologies for observability in modern distributed systems.

[0027] The adaptation includes instruction set adaptation, kernel interface adaptation, and memory access adaptation. Instruction set adaptation: This replaces the instruction set with the Shenwei architecture instruction set, including register mapping and atomic operation instruction replacement. Kernel interface adaptation: This rewrites the interaction layer between the BPF system calls and the Shenwei kernel to ensure compatibility with domestic security subsystems. Memory access adaptation: This adjusts the eBPF memory access mode to conform to the Shenwei processor's cache coherence protocol.

[0028] The tests include functional testing, stability testing, and system compatibility testing. Functional testing confirms that the tool can accurately capture network events and correctly calculate core metrics such as throughput and latency. Stability testing evaluates whether the tool will cause kernel OOPs or memory leaks under 72 hours of full load operation, requiring CPU utilization fluctuations to not exceed 5%. System compatibility testing verifies the tool's stability across different Shenwei kernel versions.

[0029] The verification steps include environment setup, test execution, and test result analysis. Environment setup: Set up the Shenwei architecture test platform, deploy the Shenwei Linux kernel, and load the network card driver module. Test execution: Execute test cases and record the test results. Test result analysis: Confirm the deviation rate between the actual output data and the expected indicators, detect test cases that do not meet expectations, and fix them.

[0030] The data captured during network transmission includes: packet processing throughput, packet loss rate, interrupt distribution characteristics, and performance characteristics of network interface card (NIC) transceiver function calls. Packet processing throughput measures the packet forwarding rate between different protocol layers. Packet loss rate reflects network transmission reliability and performance bottlenecks. Interrupt distribution characteristics include interrupt latency, trigger frequency, and distribution across CPU cores, used to monitor the CPU resource scheduling balance of packet processing tasks in real time. Specifically, interrupt latency reflects the real-time performance of CPU response to network packets, interrupt trigger frequency reflects network load intensity, and interrupt distribution across computing cores reflects CPU load balance. NIC transceiver function call performance characteristics include call frequency, execution latency, and resource usage, used to evaluate network data processing efficiency and system load status. Specifically, transceiver function call frequency reflects network I / O throughput, function execution latency characterizes data processing real-time performance, and CPU cycle utilization reflects protocol stack processing overhead.

[0031] Step S30: Based on the characteristics of the Shenwei platform, conduct in-depth analysis and anomaly detection of network performance monitoring data.

[0032] Specifically, the Shenwei platform is characterized by: high-efficiency, low-power computing capabilities and broad application adaptability. High-efficiency, low-power computing capabilities: The Shenwei processor utilizes multi-core parallel computing and dynamic voltage / frequency adjustment optimization technologies to provide powerful computing capabilities while maintaining excellent energy efficiency. Broad application adaptability: The Shenwei platform covers the needs of all scenarios, from embedded devices to supercomputers. In the information and communication field, it supports real-time control systems and achieves high-performance network processing; in artificial intelligence scenarios, it optimizes heterogeneous computing, achieving efficient collaboration and scheduling of computing resources. Its software and hardware ecosystem is compatible with domestic operating systems, middleware, and industry software, forming a complete solution.

[0033] The in-depth analysis of network performance monitoring data includes preprocessing, system resource allocation optimization analysis, and performance bottleneck analysis. These analytical steps constitute a complete closed loop for network performance optimization: preprocessing ensures data quality, resource allocation optimization improves hardware utilization, and performance bottleneck analysis directly addresses system weaknesses. Through this multi-dimensional in-depth analysis, not only can current network problems be quickly located, but potential risks can also be predicted, providing data support for continuous optimization of the network architecture, ultimately achieving intelligent management of network performance and efficient resource allocation.

[0034] The preprocessing includes: data cleaning and normalization of the raw network monitoring data. Data cleaning: removing outlier data points, verifying data validity, and repairing missing data. Normalization: converting indicators of different units into standard scores and performing timestamp synchronization on data streams with different sampling frequencies.

[0035] The system resource allocation optimization analysis includes: monitoring and analyzing the correlation curve between memory usage and packet loss rate, DMA buffer utilization statistics, and the ratio of system call frequency to CPU utilization. Through multi-dimensional resource usage characteristics, the analysis includes memory allocation strategy optimization, dynamic adjustment of DMA buffer size, and system call path optimization methods.

[0036] The performance bottleneck analysis includes: monitoring and analyzing the waiting queue length of key functions, comparing the throughput of each stage, and the distribution of system call blocking time; establishing a correlation model; accurately locating the performance bottleneck level; and providing quantitative basis for lock optimization, scheduling strategy adjustment, and batch processing improvement.

[0037] The anomaly detection of network performance monitoring data specifically includes: comprehensively analyzing multi-dimensional indicators such as packet throughput, packet loss rate, interruption distribution characteristics, and network card transmit / receive function performance; identifying abnormal features from multiple dimensions such as hardware layer, driver layer, and system call layer through a layered detection strategy; and generating alarm information based on the comprehensive analysis results.

[0038] The layered detection strategy specifically includes: real-time acquisition of multi-dimensional indicators, a layered anomaly detection mechanism, fault location, and alarm information generation. Real-time acquisition of multi-dimensional indicators: Dynamically captures hardware layer interrupt latency distribution characteristics through the eBPF program, including interrupt response time, processing time, and inter-core distribution balance; monitors the frequency and duration of network card send / receive function calls in the driver layer, and statistically analyzes DMA operation success rate and buffer utilization; tracks the execution path latency of key APIs in the system call layer (including socket(), send(), and epoll(), etc.). Layered anomaly detection mechanism: Constructs multi-dimensional indicators from the hardware layer, driver layer, and system call layer to implement a layered anomaly detection mechanism, enabling anomaly detection of network performance monitoring data. Fault location and alarm information generation: Based on the results of the layered anomaly detection mechanism, locates the fault cause and generates alarm information.

[0039] The layered anomaly detection mechanism specifically includes: Hardware layer anomaly detection: detecting interrupt latency anomalies, setting a 200μs threshold as a real-time performance criterion; latency exceeding this threshold is considered anomaly; analyzing multi-core interrupt load balancing, statistically analyzing the number of interrupts processed and total processing time for each CPU core per unit time, calculating the relative difference in interrupt processing volume between cores, and determining imbalanced allocation when the difference between cores consistently exceeds 20%. Driver layer anomaly detection: analyzing network card driver performance, tracking the time consumption of network card send / receive functions; a sudden increase in the time consumption of a single send / receive operation exceeding 100μs is considered anomaly; analyzing interrupt processing latency; three consecutive instances of high latency are considered performance degradation; monitoring DMA buffer reuse rate; if the reuse rate consistently falls below 60%, there may be memory leaks or inefficient allocation strategies. System call layer anomaly detection: monitoring the execution time and context switching overhead of key APIs in the system call layer; if the time consumption of a single call exceeds 30% of the baseline value, it is considered anomaly; detecting system resource leaks, including file descriptor leaks, memory leaks, and thread leaks, through eBPF memory allocation tracing.

[0040] Step S40: Based on the data analysis results, investigate and locate potential network problems.

[0041] Specifically, the investigation and localization of potential network problems includes: accurately identifying abnormal features of the hardware layer, driver layer and protocol stack layer based on the anomaly detection results of the layered detection strategy, deeply analyzing the specific problems existing in the anomaly layer, generating targeted optimization suggestions based on the diagnostic results, and providing effect prediction and risk assessment.

[0042] The generated optimization suggestions include: for high latency issues, adjusting the TCP window size or enabling ECN explicit congestion notification; for unbalanced load situations, dynamically adjusting the load balancing algorithm weights; and when resource bottlenecks are identified, proposing CPU affinity settings or memory allocation optimization schemes. The effect prediction includes: quantitatively estimating the performance improvement after optimization, predicting the potential increase in system throughput, and assessing the cascading impact of optimization measures on surrounding system components. The risk assessment includes: identifying potential stability issues caused by optimization measures, assessing the potential impact of configuration changes on existing business traffic, and conducting a graded assessment of rollback difficulty and contingency plans. This technology significantly improves the network fault diagnosis efficiency of domestically developed platforms, and is particularly suitable for critical infrastructure fields with stringent network performance requirements. The entire solution achieves closed-loop processing from anomaly detection and root cause analysis to optimization suggestions, providing a systematic solution for network performance optimization of the Shenwei platform.

[0043] like Figure 2 As shown in the figure, this embodiment of the invention also provides an eBPF network performance monitoring and diagnosis system based on the Shenwei platform. Through the collaborative work of multiple services, it realizes real-time and efficient network performance status and abnormal behavior capture functions, thereby improving the efficiency of diagnosing complex network problems.

[0044] The client initiates a network request to the server, exchanging data through the data transmission service module. This module acts as a data exchange hub, forwarding data between the client and server. The eBPF service, attached to the data transmission service module, captures network performance status in real time and monitors abnormal network behavior. The eBPF service uses the data capture service module to capture network performance data during transmission and forwards it to the data analysis service module for in-depth analysis of the network performance monitoring data. The data analysis service module assesses the current network status, quickly identifies current network problems, and predicts potential risks. The analyzed data is then stored in the data storage service module. It supports large-scale data storage, management, and display services, ensuring data security and persistence. The data analysis service module is also connected to the anomaly detection service module and the troubleshooting and location service module. The anomaly detection service module monitors abnormal states in network performance data, analyzes and detects abnormal states of the system from multiple dimensions such as the hardware layer, driver layer, and system call layer, and ensures the security of network operation. Based on the anomaly detection results of the anomaly detection service module, the troubleshooting and location service module accurately identifies the abnormal characteristics of the hardware layer, driver layer, and protocol stack layer, deeply analyzes the specific problems existing in the anomaly layer, generates targeted optimization suggestions based on the diagnostic results, and provides effect prediction and risk assessment.

[0045] like Figure 3As shown, this embodiment of the invention also provides an eBPF network performance monitoring and diagnostic device based on the Shenwei platform, comprising: The network interface card (NIC), as the core hardware for network data acquisition, connects to the motherboard via a high-speed PCIe interface and accesses the network via a network cable to capture and transmit raw traffic. At the data interaction level, the NIC and memory establish an efficient path through DMA, enabling the captured network packets to bypass the CPU and be directly written to a pre-allocated monitoring memory area. Simultaneously, a memory-mapped circular buffer facilitates lock-free data exchange with the eBPF program, significantly reducing transmission latency. The Shenwei processor dynamically loads the eBPF program into the NIC's programmable logic unit, achieving hardware-level traffic filtering and statistics. The NIC uses interrupt affinity settings to bind different traffic queues to designated CPU cores, improving protocol parsing and metric calculation performance. This ensures end-to-end latency from data acquisition to analysis is controlled at the microsecond level, meeting the real-time monitoring requirements of high-performance networks.

[0046] The memory, serving as the data hub of the entire system, establishes an efficient path via DMA to write the raw network monitoring data captured by the network card into the memory area. Real-time data preprocessing is completed during the data writing phase, and the data is directly transmitted to the terminal display for visualization, achieving end-to-end processing from raw traffic acquisition to dynamic screen display, providing maintenance personnel with real-time network performance insights.

[0047] The Shenwei processor, as the core computing unit of the entire system, achieves efficient collaboration between data processing and visualization output. The Shenwei processor can process network traffic data incoming from the network card in real time and transmit the data directly to the terminal display for real-time data presentation.

[0048] The terminal display, as the visualization terminal of the entire system, works in conjunction with the Shenwei processor through the memory to display monitoring data on the terminal.

[0049] In summary, this invention aims to improve the performance of the Shenwei network system in application scenarios and during debugging. By capturing the network performance status and abnormal behavior under the Shenwei platform architecture in real time, it provides monitoring and analysis methods, improves the efficiency of diagnosing complex network problems, and helps optimize and upgrade the performance of the Shenwei platform.

[0050] The above description is merely a description of preferred embodiments of the present invention and is not intended to limit the scope of the present invention in any way. Any changes or modifications made by those skilled in the art based on the above disclosure shall fall within the protection scope of the claims.

Claims

1. A method for eBPF network performance monitoring and diagnosis based on Sunway platform, characterized in that, The application relates to a network performance monitoring method for a Shenwei platform. The method comprises the following steps: analyzing network performance monitoring requirements of the Shenwei platform to determine performance indexes and diagnosis targets of a network monitoring tool; developing an eBPF tool based on a Shenwei operating system kernel to capture relevant data in a network transmission process in real time, and displaying and saving the relevant data; performing deep analysis and abnormality detection on the network performance monitoring data by combining characteristics of the Shenwei platform to generate data analysis results; 2. The eBPF network performance monitoring and diagnosis method based on the Sunway platform according to claim 1, wherein, and locating potential network problems according to the data analysis results. The network performance monitoring requirements of the Shenwei platform include instruction set compatibility requirements of a domestic Shenwei processor architecture, real-time requirements of network performance monitoring, data accuracy requirements of network performance monitoring, data analysis and abnormality detection requirements, and special adaptation requirements suitable for a domestic operating system.

3. The eBPF network performance monitoring and diagnosis method based on Sunway platform according to claim 1, wherein, In the network monitoring tool, the performance indexes include data packet processing throughput, packet loss rate, interrupt distribution characteristics and performance characteristics of network card transceiver function calls; and the diagnosis targets include system resource allocation optimization analysis and performance bottleneck analysis. The eBPF tool based on the Shenwei operating system kernel is developed by: adapting the eBPF tool; wherein the adaptation includes instruction set adaptation, kernel interface adaptation and memory access adaptation; the instruction set adaptation is used for replacing an instruction set with a Shenwei architecture instruction set, the instruction set replacement includes register mapping and atomic operation instruction replacement; the kernel interface adaptation is used for rewriting an interaction layer of a BPF system call and a Shenwei kernel to ensure compatibility with a domestic security subsystem; and the memory access adaptation is used for adjusting a memory access mode of the eBPF to conform to a cache coherence protocol of the Shenwei processor; testing the eBPF tool; wherein the testing includes function testing, stability testing and system compatibility testing; the function testing is used for confirming that the eBPF tool can accurately capture network events and correctly calculate throughput and time delay core indexes; the stability testing is used for evaluating whether the eBPF tool can cause no kernel oops or memory leakage under a 72-hour full load running state, and the requirement is that the CPU occupancy fluctuation range is not more than 5%; and the system compatibility testing is used for verifying the stability of the eBPF tool between different kernel versions of the Shenwei; verifying the eBPF tool; 4. The eBPF network performance monitoring and diagnosis method based on Sunway platform according to claim 1, wherein, wherein the verification includes environment building, test implementation and analysis of test results; the environment building is used for building a Shenwei architecture test platform, deploying a Shenwei Linux kernel and loading a network card driver module; the test implementation is used for executing test cases and recording test results; and the analysis of test results is used for confirming a deviation rate of actual output data from expected indexes, detecting test cases that do not meet the expectation and repairing the test cases. The relevant data in the network transmission process include: data packet processing throughput for measuring packet forwarding rates between different protocol layers; packet loss rate for reflecting reliability and performance bottlenecks of network transmission; and Interrupt distribution characteristics for real-time monitoring of CPU resource scheduling balance of data packet processing tasks; including: interrupt delay, interrupt trigger frequency and interrupt distribution among CPU cores; the interrupt delay reflects the real-time response of the CPU to network data packets, the interrupt trigger frequency reflects the network load intensity, and the interrupt distribution among CPU cores reflects the CPU load balancing state; Performance characteristics of network card transceiver function calls for evaluating network data processing efficiency and system load state; including: call frequency, execution delay and CPU cycle occupancy; the call frequency reflects the network I / O throughput level, the execution delay represents the data processing real-time performance, and the CPU cycle occupancy reflects the protocol stack processing overhead.

5. The eBPF network performance monitoring and diagnosis method based on Sunway platform according to claim 1, wherein, The characteristics of the Sunway platform include: high-performance and low-power computing capability and wide application field adaptation; The deep analysis of the network performance monitoring data includes: Pretreatment of the network performance monitoring data, including: data cleaning and normalization processing of the original network performance monitoring data; the data cleaning is used to remove abnormal data points, check data validity, and repair missing data; the normalization processing is used to convert indicators of different units into standard scores, and to synchronize time stamps of data streams with different sampling frequencies; System resource allocation optimization analysis of the network performance monitoring data, including: monitoring and analyzing the correlation curve of memory usage and packet loss rate, DMA buffer utilization statistics and the ratio of system call frequency to CPU cycle occupancy; through multi-dimensional resource usage characteristics, analyzing memory allocation strategy optimization, dynamically adjusting DMA buffer size and system call path optimization method; Performance bottleneck analysis of the network performance monitoring data, including: monitoring and analyzing the length of the key function waiting queue, the throughput comparison of each stage and the distribution of system call blocking time; through the establishment of an association model, accurately locating the performance bottleneck level, providing quantitative basis for lock optimization, scheduling strategy adjustment and batch processing improvement; Abnormality detection of network performance monitoring data includes: comprehensive analysis of multi-dimensional indicators such as packet throughput, packet loss rate, interrupt distribution characteristics and network card transceiver function performance; through hierarchical detection strategy, identifying abnormal characteristics from multiple dimensions of hardware layer, driver layer and system call layer, and generating alarm information according to the comprehensive analysis results.

6. The eBPF network performance monitoring and diagnosis method based on Sunway platform according to claim 5, characterized in that, The hierarchical detection strategy includes: Multi-dimensional index real-time collection, dynamically capturing interrupt delay distribution characteristics in the hardware layer through eBPF program; the interrupt delay distribution characteristics include: interrupt response time, processing time and inter-core distribution balance; by monitoring the call frequency and time consumption of the network card transceiver function in the driver layer, statistics the DMA operation success rate and buffer utilization; by tracking the system call layer key API execution path delay; Building multi-dimensional indicators from hardware layer, driver layer and system call layer, establishing a hierarchical anomaly detection mechanism to realize abnormality detection of network performance monitoring data; According to the detection results of the hierarchical anomaly detection mechanism, locating the fault cause and generating alarm information.

7. The eBPF network performance monitoring and diagnosis method based on Sunway platform according to claim 6, characterized in that, The hierarchical anomaly detection mechanism includes: The exception detection of the hardware layer includes: detecting interrupt exception delay, setting a threshold of 200us as a real-time judgment standard, and regarding the delay exceeding the threshold as an exception; analyzing multi-core interrupt load balancing, counting the number of interrupts processed by each CPU core in a unit of time and the total processing time, calculating the relative difference of interrupt processing amount between cores, and determining that the distribution is uneven when the difference between cores continues to exceed 20%; The exception detection of the driver layer includes: analyzing the performance of the network card driver, tracking the time consumption of the network card transceiving function, and regarding a sudden increase in the time consumption of a single transceiving operation exceeding 100us as an exception; analyzing interrupt processing delay, and determining performance degradation when high delay occurs for three consecutive times; monitoring the reuse rate of the DMA buffer, and regarding a reuse rate less than 60% as a memory leak or inefficient allocation strategy problem; The exception detection of the system call layer includes: monitoring the execution time of key APIs in the system call layer and the context switching overhead, and regarding a single call time consumption exceeding 30% of the baseline value as an exception; detecting system resource leakage problems through eBPF memory allocation tracking, including file descriptor leakage, memory leakage, and thread leakage.

8. The eBPF network performance monitoring and diagnosis method based on Sunway platform according to claim 6, characterized in that, According to the data analysis result, potential network problems are investigated and located, including: Based on the exception detection results of the hierarchical detection strategy, the abnormal characteristics of the hardware layer, the driver layer, and the protocol stack layer are accurately identified, the specific problems existing in the abnormal layer are deeply analyzed, targeted optimization suggestions are generated according to the diagnosis results, and effect prediction and risk assessment are provided; The optimization suggestions include: for high delay problems, adjusting the TCP window size or enabling ECN explicit congestion notification; for load imbalance, recommending dynamic adjustment of the load balancing algorithm weight; for resource bottlenecks, proposing CPU affinity settings or memory allocation optimization schemes; The effect prediction includes: quantitatively estimating the performance improvement after optimization, predicting the space for improving system throughput, and evaluating the collateral impact of optimization measures on surrounding system components; The risk assessment includes: identifying stability problems caused by optimization measures, evaluating the potential impact of configuration changes on existing business traffic, and classifying the rollback difficulty and emergency plan.

9. A ShenWei platform-based eBPF network performance monitoring and diagnosis system, executing a ShenWei platform-based eBPF network performance monitoring and diagnosis method according to any one of claims 1-8. It includes: A client; A server, the client initiates a network request to the server, and data is exchanged through a data transmission service module; A data transmission service module serves as a data exchange hub and is responsible for forwarding data between the client and the server; an eBPF service is configured on the data transmission service module to capture the status of network performance in real time to monitor network abnormal behavior; A data capture service module, the eBPF service captures network performance monitoring data in the network transmission process through the data capture service module and forwards the data to the data analysis service module for deep analysis of network performance monitoring data; A data analysis service module evaluates the current network status, quickly locates the current network problem, and predicts potential risks; the analyzed data is stored on a data storage service module. A data storage service module supports large-scale data storage, management and display services to ensure data security and persistence. An anomaly detection service module is used to monitor abnormal states of the network performance monitoring data, analyze and detect system abnormal states from multiple dimensions of hardware layer, driver layer and system call layer to ensure network security during operation. An investigation and positioning service module accurately identifies abnormal characteristics of hardware layer, driver layer and protocol stack layer based on the anomaly detection results of the anomaly detection service module, deeply analyzes specific problems existing in the abnormal layer, generates targeted optimization suggestions according to the diagnosis results, and provides effect prediction and risk assessment.

10. A ShenWei platform-based eBPF network performance monitoring and diagnosis device, executing a ShenWei platform-based eBPF network performance monitoring and diagnosis method according to any one of claims 1-8. It comprises: a network card connected with a mainboard through a high-speed PCIe interface and connected with a network through a network cable to realize capture and transmission of raw traffic; a memory serving as a data hub of the entire system, which establishes an efficient channel through DMA, can bypass the CPU to write the network data packets captured by the network card into a pre-allocated monitoring memory area, and realizes lock-free data exchange with eBPF programs through a memory-mapped ring buffer to reduce transmission delay; a Sunway processor serving as the core computing unit of the entire system, which realizes efficient cooperation of data processing and visual output; the Sunway processor can process the network traffic data transmitted by the network card in real time and directly transmit the data to a terminal display for real-time data display; the Sunway processor loads eBPF programs into the programmable logic unit of the network card to realize hardware-level traffic filtering and statistics, and the network card binds different traffic queues to specified CPU cores through interrupt affinity setting to improve the performance of protocol analysis and index calculation, so that the end-to-end delay from data collection to analysis and processing is controlled within microseconds, meeting the real-time monitoring requirements of high-performance networks; a terminal display serving as the visualization terminal of the entire system, which cooperates with the memory and the Sunway processor to realize display of monitoring data on the terminal.

Images