Operating Systems 2020W: Tutorial 9 - Revision history

Soma at 14:18, 3 April 2020

2020-04-03T14:18:46Z

← Older revision		Revision as of 14:18, 3 April 2020
Line 14:		Line 14:

	To get started, we will first examine the source code for <tt>3000shellwatch.py</tt> and <tt>bpf_program.c</tt>,		To get started, we will first examine the source code for <tt>3000shellwatch.py</tt> and <tt>bpf_program.c</tt>,
	the userspace and kernelspace components of our BPF program respectively. You can download a ~~tarball~~ containing all the coded needed for this tutorial [https://homeostasis.scs.carleton.ca/~soma/os-2020w/code/tut9-code.zip here].		the userspace and kernelspace components of our BPF program respectively. You can download a zip file containing all the coded needed for this tutorial [https://homeostasis.scs.carleton.ca/~soma/os-2020w/code/tut9-code.zip here].

	==Getting Started==		==Getting Started==

Soma: /* Playing with 3000shellwatch */

2020-03-20T18:11:17Z

Playing with 3000shellwatch

← Older revision		Revision as of 18:11, 20 March 2020
Line 26:		Line 26:

	==Playing with 3000shellwatch==		==Playing with 3000shellwatch==
			# Run <tt>sudo apt install python3-bcc</tt> in your terminal on the class VM. This installs a necessary dependency. (If you are running elsewhere, make sure to add python3 support for BCC when installing from source.)
	# Open two terminals. In one terminal, run <tt>./3000shell</tt> (From [[Operating Systems 2020W: Tutorial 3\|Tutorial 3]]), and in another terminal run <tt>sudo ./3000shellwatch.py -p `pidof 3000shell`</tt>. Run a several commands in <tt>3000shell</tt> and observe the output of <tt>3000shellwatch.py</tt>. What system calls is <tt>3000shell</tt> generating according to <tt>3000shellwatch.py</tt>? Compare this output with that of <tt>strace</tt>.		# Open two terminals. In one terminal, run <tt>./3000shell</tt> (From [[Operating Systems 2020W: Tutorial 3\|Tutorial 3]]), and in another terminal run <tt>sudo ./3000shellwatch.py -p `pidof 3000shell`</tt>. Run a several commands in <tt>3000shell</tt> and observe the output of <tt>3000shellwatch.py</tt>. What system calls is <tt>3000shell</tt> generating according to <tt>3000shellwatch.py</tt>? Compare this output with that of <tt>strace</tt>.
	# Let's try to make <tt>3000shellwatch.py</tt> crash the kernel. Modify the tracepoint on lines 69-95 to do something dangerous like dereferencing a NULL pointer. Run your BPF program. What is all that output? Did you crash your kernel or did something else happen?		# Let's try to make <tt>3000shellwatch.py</tt> crash the kernel. Modify the tracepoint on lines 69-95 to do something dangerous like dereferencing a NULL pointer. Run your BPF program. What is all that output? Did you crash your kernel or did something else happen?

Soma at 17:49, 20 March 2020

2020-03-20T17:49:37Z

← Older revision		Revision as of 17:49, 20 March 2020
Line 12:		Line 12:
	Also, here's a dated, but still insightful introductory article on eBPF:		Also, here's a dated, but still insightful introductory article on eBPF:
	* [https://lwn.net/Articles/740157/ A thorough introduction to eBPF (2017)]		* [https://lwn.net/Articles/740157/ A thorough introduction to eBPF (2017)]


	To get started, we will first examine the source code for <tt>3000shellwatch.py</tt> and <tt>bpf_program.c</tt>,		To get started, we will first examine the source code for <tt>3000shellwatch.py</tt> and <tt>bpf_program.c</tt>,

Soma at 17:49, 20 March 2020

2020-03-20T17:49:11Z

← Older revision		Revision as of 17:49, 20 March 2020
Line 10:		Line 10:
	* [https://github.com/iovisor/bcc/blob/master/docs/tutorial_bcc_python_developer.md BCC Python Developer Tutorial]		* [https://github.com/iovisor/bcc/blob/master/docs/tutorial_bcc_python_developer.md BCC Python Developer Tutorial]
	* [https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md Reference Guide]		* [https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md Reference Guide]
			Also, here's a dated, but still insightful introductory article on eBPF:
			* [https://lwn.net/Articles/740157/ A thorough introduction to eBPF (2017)]


	To get started, we will first examine the source code for <tt>3000shellwatch.py</tt> and <tt>bpf_program.c</tt>,		To get started, we will first examine the source code for <tt>3000shellwatch.py</tt> and <tt>bpf_program.c</tt>,

Soma: /* Code */

2020-03-20T17:43:13Z

Code

← Older revision		Revision as of 17:43, 20 March 2020
Line 36:		Line 36:

	==Code==		==Code==

			[https://homeostasis.scs.carleton.ca/~soma/os-2020w/code/tut9-code.zip Tutorial 9 code]

	===3000shellwatch.c===		===3000shellwatch.c===

Soma at 17:42, 20 March 2020

2020-03-20T17:42:22Z

← Older revision		Revision as of 17:42, 20 March 2020
Line 5:		Line 5:
	at a high level how they work.		at a high level how they work.

	~~Throughout this tutorial, you~~ may wish to [https://github.com/iovisor/bcc/blob/master/docs/~~reference_guide~~.md ~~refer to the~~ bcc ~~documentation~~].		You may wish to look at the BPF Compiler Collection (BCC) documentation for further information:
			* [https://github.com/iovisor/bcc/blob/master/README.md Project README]
			* [https://github.com/iovisor/bcc/blob/master/docs/tutorial.md BCC Tutorial]
			* [https://github.com/iovisor/bcc/blob/master/docs/tutorial_bcc_python_developer.md BCC Python Developer Tutorial]
			* [https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md Reference Guide]

	To get started, we will first examine the source code for <tt>3000shellwatch.py</tt> and <tt>bpf_program.c</tt>,		To get started, we will first examine the source code for <tt>3000shellwatch.py</tt> and <tt>bpf_program.c</tt>,

Soma: /* Code */

2020-03-20T17:34:07Z

Code

@@ Line 94: / Line 94: @@
          print(file=sys.stderr)
          print('Goodbye BPF world!', file=sys.stderr)
 </source>

Soma at 17:32, 20 March 2020

2020-03-20T17:32:50Z

← Older revision		Revision as of 17:32, 20 March 2020
Line 8:		Line 8:

	To get started, we will first examine the source code for <tt>3000shellwatch.py</tt> and <tt>bpf_program.c</tt>,		To get started, we will first examine the source code for <tt>3000shellwatch.py</tt> and <tt>bpf_program.c</tt>,
	the userspace and kernelspace components of our BPF program respectively.		the userspace and kernelspace components of our BPF program respectively. You can download a tarball containing all the coded needed for this tutorial [https://homeostasis.scs.carleton.ca/~soma/os-2020w/code/tut9-code.zip here].

	==Getting Started==		==Getting Started==

Soma: /* Getting Started */

2020-03-20T17:27:37Z

Getting Started

← Older revision		Revision as of 17:27, 20 March 2020
Line 17:		Line 17:
	# BPF programs are supposed to be completely production-safe due to the BPF verifier. Do you think it is possible to cause a kernel panic from a BPF program? Make a guess now, you will have a chance to test your guess later.		# BPF programs are supposed to be completely production-safe due to the BPF verifier. Do you think it is possible to cause a kernel panic from a BPF program? Make a guess now, you will have a chance to test your guess later.
	# Run a familiar <tt>trace</tt> command of your choice from one of the previous tutorials, but append the <tt>-v</tt> flag to the end of the command. <tt>trace</tt> will now output the source code for the BPF program it generated. How does this output compare with the hand written BPF program in <tt>bpf_program.c</tt>? Do you think it would be possible to write one long <tt>trace</tt> command to do the same thing as <tt>3000shellwatch.py</tt>?		# Run a familiar <tt>trace</tt> command of your choice from one of the previous tutorials, but append the <tt>-v</tt> flag to the end of the command. <tt>trace</tt> will now output the source code for the BPF program it generated. How does this output compare with the hand written BPF program in <tt>bpf_program.c</tt>? Do you think it would be possible to write one long <tt>trace</tt> command to do the same thing as <tt>3000shellwatch.py</tt>?
			# Note that we never run a C compiler on <tt>bpf_program.c</tt> directly; instead, the python code compiles then loads the C program. Why not just compile the program in advance?

	==Playing with 3000shellwatch==		==Playing with 3000shellwatch==

Soma: /* Getting Started */

2020-03-20T17:25:19Z

Getting Started

← Older revision		Revision as of 17:25, 20 March 2020
Line 11:		Line 11:

	==Getting Started==		==Getting Started==
	# Open <tt>3000shellwatch.py</tt> and <tt>bpf_program.c</tt>. Try to get an idea of the following (if you are stuck, check the documentation linked above):		Open <tt>3000shellwatch.py</tt> and <tt>bpf_program.c</tt>. Try to get an idea of the following (if you are stuck, check the documentation linked above):
	#* What is a tracepoint? What is a kprobe? What is a uprobe? What are their similarities and differences? <tt>bpf_program.c</tt> contains examples of all three.		# What is a tracepoint? What is a kprobe? What is a uprobe? What are their similarities and differences? <tt>bpf_program.c</tt> contains examples of all three.
	#* How do we pass events from kernelspace to userspace?		# How do we pass events from kernelspace to userspace?
	#* Do you notice any big differences between BPF programs and kernel modules? What things have you seen in kernel modules that are missing in the BPF program?		# Do you notice any big differences between BPF programs and kernel modules? What things have you seen in kernel modules that are missing in the BPF program?
	#* BPF programs are supposed to be completely production-safe due to the BPF verifier. Do you think it is possible to cause a kernel panic from a BPF program? Make a guess now, you will have a chance to test your guess later.		# BPF programs are supposed to be completely production-safe due to the BPF verifier. Do you think it is possible to cause a kernel panic from a BPF program? Make a guess now, you will have a chance to test your guess later.
	#* Run a familiar <tt>trace</tt> command of your choice from one of the previous tutorials, but append the <tt>-v</tt> flag to the end of the command. <tt>trace</tt> will now output the source code for the BPF program it generated. How does this output compare with the hand written BPF program in <tt>bpf_program.c</tt>? Do you think it would be possible to write one long <tt>trace</tt> command to do the same thing as <tt>3000shellwatch.py</tt>?		# Run a familiar <tt>trace</tt> command of your choice from one of the previous tutorials, but append the <tt>-v</tt> flag to the end of the command. <tt>trace</tt> will now output the source code for the BPF program it generated. How does this output compare with the hand written BPF program in <tt>bpf_program.c</tt>? Do you think it would be possible to write one long <tt>trace</tt> command to do the same thing as <tt>3000shellwatch.py</tt>?

	==Playing with 3000shellwatch==		==Playing with 3000shellwatch==